last executing test programs: 693.250617ms ago: executing program 4 (id=5): setuid(0xffffffffffffffff) r0 = socket(0x18, 0x2, 0x0) setsockopt(r0, 0x1000000029, 0x23, 0x0, 0x0) sysctl$net_inet_ip(&(0x7f0000000080)={0x4, 0x2, 0x0, 0x11}, 0x4, 0x0, 0x0, 0x0, 0x0) setuid(0xffffffffffffffff) (async) socket(0x18, 0x2, 0x0) (async) setsockopt(r0, 0x1000000029, 0x23, 0x0, 0x0) (async) sysctl$net_inet_ip(&(0x7f0000000080)={0x4, 0x2, 0x0, 0x11}, 0x4, 0x0, 0x0, 0x0, 0x0) (async) 661.38223ms ago: executing program 7 (id=8): chroot(&(0x7f0000000740)='.\x00') mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = socket(0x18, 0x8002, 0x0) r1 = fcntl$dupfd(r0, 0x2, 0xffffffffffffffff) closefrom(r1) open(&(0x7f0000000000)='./file0\x00', 0x80, 0x150) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r3, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="28000000ffff000001"], 0x28}, 0x0) recvmsg(r2, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=""/66, 0x42}, 0x3800) munmap(&(0x7f0000001000/0x2000)=nil, 0x2000) sysctl$net_inet6_icmp6(&(0x7f0000000000)={0x4, 0x18, 0x3a, 0x3}, 0x4, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r5, &(0x7f00000018c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000000c0)="87c27e33bb7a86bf70b1d91d8cc5937d", 0x10}, {&(0x7f0000000240)="0f8ede06d4e0679dc1074f1aa9e637013d896881b2050782dca39bb40e21ffc552d591267babdbdca0d62113e59e99150370061bfd1f5c9e52b0ae96ca84e3210a909ad5fde2e67bebfe4d6eb44760dbb4f7d44d1baceafa676fbffa5cc5129a46a9b9581ceef4c48e7b6eaefbc683e99b40c77f6d99617d7062c68ad4c0e5eb131cdebc68f955f17507f3cd3ec2d94af5f539f0d1df7f19f6a24ba38431abaf3dab372c0b94a446a1453fc0fcb7edd95906646dcd5f88f01ce3dea9da311237227b01f77e9aa2ec47ef62e66ea6ef49e91ca86c66ea14cc69", 0xd9}, {&(0x7f0000000140)="bbdd94dc1f38354e99d294535289e772a51306fdae308a5792dfa81bd56b57797a6a4ec9bfe1787ed5643f243927d9d9dfb3e37221e6243b6a8a30c4b8f02eabaf039db6948785da82905c3cc528ae9a7b3b4ce64d130f9179bc5d9f4ae8296b2d3c246d16289c25", 0x68}, {&(0x7f0000000100)="51219ab7eb0182220f1323ad917cc590a2c6a7c81a45a7b4fd6fecf97a78718e", 0x20}], 0x4, 0x0, 0x10}, 0xc) recvmmsg(r4, &(0x7f0000002b00)={{0x0, 0x0, &(0x7f0000002940)=[{&(0x7f0000000a80)=""/44, 0x2c}, {&(0x7f0000000ac0)=""/86, 0x56}, {&(0x7f0000000040)=""/21, 0x15}, {&(0x7f0000000b80)=""/226, 0xe2}], 0x4, 0x0}, 0x7}, 0x38, 0x0, 0x0) sysctl$net_inet_ip(&(0x7f0000000000)={0x4, 0x2, 0x0, 0x1c}, 0x4, 0x0, 0x0, &(0x7f0000001100), 0x4) 445.093376ms ago: executing program 4 (id=9): r0 = syz_open_pts() r1 = openat$wskbd(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) ioctl$WSKBDIO_SETENCODING(r1, 0x80045710, &(0x7f0000000180)=0x401) fcntl$lock(r0, 0x8, &(0x7f0000000080)={0x0, 0x0, 0x300, 0x100000001}) fcntl$lock(r0, 0x9, &(0x7f0000000180)={0x2ff, 0x2ff, 0x2000000000010, 0x2}) syz_open_pts() (async) openat$wskbd(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) (async) ioctl$WSKBDIO_SETENCODING(r1, 0x80045710, &(0x7f0000000180)=0x401) (async) fcntl$lock(r0, 0x8, &(0x7f0000000080)={0x0, 0x0, 0x300, 0x100000001}) (async) fcntl$lock(r0, 0x9, &(0x7f0000000180)={0x2ff, 0x2ff, 0x2000000000010, 0x2}) (async) 439.500886ms ago: executing program 7 (id=10): r0 = socket(0x2, 0x4001, 0x0) setsockopt(r0, 0x2, 0x6, &(0x7f0000000000)='\v\x00\x00\x00', 0x4) setrlimit(0x8, &(0x7f0000000000)={0x41, 0x5f}) r1 = syz_open_pts() kevent(0xffffffffffffffff, &(0x7f00000013c0)=[{{}, 0xfffffffffffffffc, 0x95, 0x10, 0xcc, 0x2}], 0x8, 0x0, 0x15, 0x0) sysctl$ddb(&(0x7f0000000000)={0x9, 0x5}, 0x2, 0x0, 0x0, &(0x7f0000001080), 0x4) close(r1) r2 = syz_open_pts() ioctl$TIOCSETAW(r2, 0x802c7415, &(0x7f0000000100)={0x77ffffff, 0x8, 0x7fffffff, 0xffff7df8, "ec7600b72802100006faef0a00", 0x80000002, 0x6}) writev(r1, &(0x7f0000000280)=[{&(0x7f00000002c0)="5c2790", 0x3}], 0x1) setsockopt$sock_int(r0, 0xffff, 0x100, &(0x7f0000000040)=0xf6, 0x4) socket(0x16, 0x2, 0x0) 377.142035ms ago: executing program 0 (id=1): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0xffff, 0x1022, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$sock_cred(r2, 0xffff, 0x1022, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) setresgid(r3, r3, 0x0) setgid(r3) setresgid(0xffffffffffffffff, 0x0, r1) setregid(r1, r1) syz_emit_ethernet(0x46, &(0x7f0000000200)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "5f6ad9", 0x10, 0x3a, 0x9, @remote={0xfe, 0x80, '\x00', 0x0}, @local={0xfe, 0x80, '\x00', 0x0}, {[], @icmpv6=@ni={0x7, 0x0, 0x0, 0xfffc, 0x1, 0x833}}}}}}) 374.328338ms ago: executing program 1 (id=2): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) r1 = setsid() (async) mknod(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x4287e) (async) r2 = open(&(0x7f0000000300)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7815) setuid(0xffffffffffffffff) (async) mknod$loop(0x0, 0x2000, 0x1) (async) fcntl$lock(0xffffffffffffffff, 0x8, &(0x7f0000000040)={0x6, 0x2000003, 0x0, 0x3}) (async) fcntl$lock(0xffffffffffffffff, 0x9, 0x0) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) ioctl$FIONREAD(r2, 0x800474c4, &(0x7f0000000080)) (async) r3 = socket$inet(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x10, 0x2, 0x3}, 0x10) (async) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="89000000ffff000001"], 0x9}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg(r4, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x2) (async) r5 = socket$inet(0x2, 0x1, 0x93) bind$inet(r5, &(0x7f00000001c0)={0x10, 0x2, 0x3, 0xe0000000}, 0x10) (async) write(r2, &(0x7f0000000040)="5fd4eda2e6fcd4cf310d884a41", 0xd) sysctl$net_inet_ip(&(0x7f0000001ac0)={0x4, 0x2, 0x0, 0x19}, 0x4, 0x0, 0x0, &(0x7f0000001c40)="61c6", 0x2) setpgid(r1, 0x0) (async) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000080)={0x1, &(0x7f00000001c0)=[{0x5, 0x7, 0x17, 0x63b}]}) 373.914674ms ago: executing program 2 (id=3): syz_emit_ethernet(0x2a, &(0x7f0000000040)={@random="db516acbbd85", @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x2000, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0x0}, @broadcast}, @udp={{0x1, 0x2, 0x8}}}}}}) r0 = kqueue1(0x0) r1 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x0) r2 = openat$wsmouse(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) r3 = socket$inet6(0x18, 0x2, 0x0) setsockopt$sock_int(r3, 0xffff, 0x1000, &(0x7f0000000140)=0x5, 0x4) bind$inet6(r3, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x4, "00000000010000000600", 0x62a4}, 0x1c) connect$inet6(r3, &(0x7f00000001c0)={0x1c, 0x18, 0x2, 0x8, "fa0000000000000000004000", 0x4001d7}, 0x1c) sendmsg(r3, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="10"], 0x10}, 0x835d1917a3f570d6) kevent(r0, &(0x7f0000000080)=[{{r1}, 0xfffffffffffffff8, 0x0, 0xf0000000, 0x54a, 0xfffffffffffffffa}], 0x8, &(0x7f0000000100)=[{{r2}, 0xfffffffffffffffc, 0x44, 0x4, 0x0, 0x9}, {{r3}, 0xfffffffffffffffc, 0x2, 0x4, 0x9, 0x10000}], 0x8, &(0x7f0000000140)={0xd, 0xffffffffffffff28}) syz_emit_ethernet(0x23, &(0x7f0000000000)={@random="b905f0ffffff", @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x15, 0x0, 0x1, 0x0, 0x0, 0x0, @remote={0xac, 0x14, 0x0}, @broadcast}, @generic='4'}}}}) 373.532332ms ago: executing program 3 (id=4): r0 = socket$inet(0x2, 0x3, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) setsockopt$inet_opts(r0, 0x0, 0x200000000000a, &(0x7f0000000040)='\x00', 0x1) setsockopt$inet_opts(r0, 0x0, 0x200000000000b, &(0x7f0000000100)="f3", 0x1) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TIOCSETA(r1, 0xcd604406, &(0x7f0000000040)={0x1, 0x0, 0x6, 0x0, "d6a24900b178926c79486b47c1dd00", 0x8, 0x8}) socket(0x2, 0x8002, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2100, 0x5f00) r2 = open(&(0x7f0000000140)='./file0\x00', 0x80, 0x120) ioctl$DIOCMAP(r2, 0xc0106477, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x2}) socket(0x2, 0x1, 0x0) r3 = openat$pf(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) r4 = openat$pf(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETA(r4, 0xcd604406, &(0x7f0000000040)={0x3, 0x0, 0x6, 0x0, "d6a24900b178926c79486b47c1dd00", 0x4, 0x8}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$TIOCSETA(r3, 0xcd604407, &(0x7f0000000040)={0xa, 0x2000000, 0x2, 0x800005, "2c0d000000024000a400000300", 0x4, 0x8}) socket$inet(0x2, 0x1, 0x0) 368.613176ms ago: executing program 5 (id=6): r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$DIOCXBEGIN(r1, 0xc0104451, &(0x7f0000000040)={0x4, 0x408, &(0x7f00000024c0)=[{0x0, './file2\x00', 0x5}, {0x0, './file3\x00', 0x6}, {0x0, './file1\x00', 0xfffff502}, {0x0, './file1/file0\x00', 0x1800}]}) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) ioctl$DIOCXCOMMIT(r0, 0xc0104452, &(0x7f0000000040)={0x0, 0x40000005, 0x0}) (async) setresuid(0x0, 0xee00, 0xffffffffffffffff) 357.226701ms ago: executing program 6 (id=7): ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r0 = socket(0x18, 0x3, 0x0) r1 = socket(0x18, 0x3, 0x0) ioctl$FIONREAD(r1, 0xc0106924, &(0x7f00000001c0)) ioctl$FIONREAD(r0, 0x80206913, &(0x7f0000000100)) select(0x40, &(0x7f0000000180)={0xfffffffffffffffb, 0x44809e9d, 0x1, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x7fd, 0x2000000000000004}, 0x0, 0x0, 0x0) r2 = kqueue() kevent(r2, &(0x7f0000000240), 0x8, &(0x7f0000000240)=[{{r1}, 0x2, 0x8, 0x40000000, 0x5, 0x1000}], 0x15, 0x0) mknod(&(0x7f00000000c0)='./file1\x00', 0x2000, 0x637d) r3 = open(&(0x7f0000000800)='./file1\x00', 0x8, 0x2) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) select(0x40, &(0x7f0000000040)={0x4, 0x9, 0x9, 0x8, 0x667, 0x7, 0x0, 0x809}, &(0x7f0000000100)={0x4c4, 0xffffffffffffffff, 0x100000000, 0xffff, 0x5, 0x3ff, 0x2, 0x3}, &(0x7f00000001c0)={0x3, 0x8000000000000001, 0x3, 0x8, 0x19, 0x80000001, 0x8000, 0x4001ff}, &(0x7f0000000200)={0x6, 0xd079}) r4 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0xe0) ioctl$WSDISPLAYIO_USEFONT(0xffffffffffffffff, 0x80585750, &(0x7f0000000140)={'./file0\x00', 0xde, 0xadfd, 0xffffef9, 0x0, 0x80000002, 0xffffffff, 0x6, 0x0, 0x0, 0xfffffffffffffffc, 0x80000000}) ioctl$FIONBIO(r4, 0x82907003, &(0x7f0000000140)=0x2) closefrom(r3) 353.710367ms ago: executing program 7 (id=11): sysctl$kern(&(0x7f0000000000)={0x1, 0x4d}, 0x2, 0x0, 0x0, &(0x7f0000001440)="02000000", 0x4) r0 = open(&(0x7f0000000480)='./file0\x00', 0x800, 0x4ebfac6bbaf7900) ioctl$DIOCGETRULE(r0, 0xcd604407, &(0x7f0000000940)={0x5, 0x2, 0x3, './file0\x00', './file0\x00', 0x0, "39ef16c114f43693474a1bb1159e5527fe0095904d47ffd3dc362db51c3862712104bd1151231fec6f94e5d5956f1abc0b43870025b218a8c1b5b14c45d80912ff6a958f2bb0354bf21f73d6146a70b35119210c26aa23273edea7fbf8930a0c0c0411fa03dee881bb174a6bd7a14e12562d5cc129cafc0c5c73321a0927310000591c4039af91755f71a613c2dad5b30a801d1d50b850231ee6fb48e0c2c84f4587d770fe88254159e7aa645ddabf19ce5ed87bb1d567cbc7c23190ec0cc91d8d7c6f0f9890d0fedfd15ab9cf3e659696b624311b7f3b880126a5725176511f2cfaf26eeea2fc75c5f46ccb8b343701721f081469e70d256bcdb36e182debf38fa95bf14a5c0f89c6c9a0124b77d77020999a5a3346e3dae637a42d35eff5077ad3d2e117ce657d4524a08ff71c6c9af594c03133a601d3a7ec054de2ae10c6fefdc5b128ef1ec8919ecaff033579ee058ac5494900bea19608de73bfc578660d2f819cca075d13fa93971b04718155bfc85b87494f9f09947f18bb26e9de9e36758d9b66379c97ce5fbc2c080bfd460d3161980faea8927b3ef0deb07b5187ee19be524b68d71dba8bc08a59a9337167fe9b8ffff27c81f6e5aceedf0772f28c10ea687142b6ac6264e95a0bc4a138211ec7bc681923d0c1b38b421af8ec49d3990c8f2d3a1e3deba284623feaaf9642519cb85d76cd1920e04e9e96709c2440680d73273f1fc24dbd4c8b59fd983f8b0a54cb44314c6f99a2394efb88d3f099ab1effbe9bc24a5884bb0bd2a8482bb67fcd0170b517399bedd7f1b4879c6078ce8f27044f1de75b75186f989ef9a4a50db550131938b6ad8b5c3a3fd305b3dd1c4cd93d7f9405ebb1baf31114ec7666a3c0cee3c9db39492749b45466e2a2597cdaacaa693c0e9e7955ad2b40a5e9e2be76b24d7edf5d4d80ab0204111efcb1a3c08d4944fa9ab2ef140449202ea3a10f25e4fd6f8f15fb6286b91d63b5407579f89f6de8743799415184902e19c81fe8d214336d4f1320957ef2823cc5a1923e5f006cfa8f834168c74e1defacf7caf1b75d477d5d3d24e7eb64240739f41d19c19a4083b72601ca45ac79568a6a8318e3bf488f0be6847e4e3898231b25bbfb19ec5c15302b40f45b098c601f69a7bddd397ffa23c371fef60c8223c87525a9edbca46d2adc2d07b86326eb890f7f81e3f90f117588b50fe3319d8391894d01ff00ac23a2fe804e9da7b21644254c78768020215a7b3c90def0e2071c66493984d79d4947205de9b640d0c001d8361aae0d52ac3de4faa4c7375b3c06a4e7a76f9ea16b4671fc1780af387e00238776ec0a8d07e590a39063d4c9c1873cd322abefec5a8289a9937d8a2b9fb97509d00142ee0cf208b6b1fc776d6ecd503dad84384bcf051e72ddc187fd7f83d2d3f4d66eaf148d0bc1314777c96f779a10884302c51e9b18c8e471450d5879a0f2b9a8c08dbd05ad0cadb925b3eb48167a6e815401fe3c6d4b6dd959fd3a5b3d4483b8820680e5f2dfcb37760279aaf303b34c0a749e370f66f56036f631b90ac6c1614b3271864bbd7ca64fd4c210c9778df40b382fd4c246019b3d2f35c21d93a2cc4331f9923ca0b99c98308507ddd16a78341be26cb2fff79cb1982b32d3e6173bf48db482e20e35db6ac76c217aa7c542b25d6f94995912135fd555e0acb29cf883b7da21f4fc5852c0823d31de3fd3502a8a220dd1415d8474e9b637eddf93f18fb9c893ccb0f247d1f10d4113f1e37cabac2b1a90820b5f28b81358af0eb460d1b62b2c529e1edfc5991b7c3576948120b2a9ae3ffbd6369098f71218a9356d41715434977a4e9e8fa8c399ee1aeb5816a901f49fee5d324a54cdb368ff4c82b4c250115c02ca605c95c3dbee7ba483247c9603275aa6195465ae7074"}) ioctl$BIOCSETWF(r0, 0x80104277, &(0x7f0000000080)={0x7, &(0x7f0000000040)=[{0x2, 0x2, 0x8, 0x6f}, {0x0, 0x3, 0x1, 0x8}, {0x2, 0x7f, 0x8, 0x6}, {0x7fff, 0x5, 0x8, 0x7f}, {0xf, 0xfe, 0xc}, {0x4, 0x2b, 0x33, 0xe92}, {0x1, 0x8, 0x5, 0x9}]}) 4.210492ms ago: executing program 0 (id=12): munmap(&(0x7f0000001000/0x2000)=nil, 0x2000) r0 = shmget$private(0x0, 0x2000, 0x3b4, &(0x7f0000001000/0x2000)=nil) shmat(r0, &(0x7f0000001000/0x3000)=nil, 0x0) ioctl$DIOCRCLRTABLES(0xffffffffffffffff, 0xc450443c, &(0x7f0000001240)={{'./file0\x00', './file0\x00', 0x36, 0x7}, 0x0, 0x0, 0x0, 0xfffffffa, 0x8009, 0xbd, 0xd16, 0x32, 0x2}) setitimer(0x0, &(0x7f0000000100)={{0x7, 0x3}, {0x0, 0x5}}, 0x0) setitimer(0x0, &(0x7f0000000040)={{0x2, 0x81}, {0x0, 0x3}}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) msync(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4) 2.548162ms ago: executing program 3 (id=13): mknod(&(0x7f0000000040)='./bus\x00', 0x2000, 0x205318) r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$inet_opts(r0, 0x0, 0x200000000000a, &(0x7f00000000c0)='\x00', 0x1) setsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000240)="ea000001", 0x4) munmap(&(0x7f0000001000/0x2000)=nil, 0x2000) sysctl$net_inet_ip(&(0x7f0000000040)={0x4, 0x2, 0x0, 0x1d}, 0x4, &(0x7f0000001500), &(0x7f0000000000)=0x2, 0x0, 0x20) ktrace(&(0x7f0000000000)='./bus\x00', 0x1, 0x4, 0x0) 0s ago: executing program 7 (id=14): mknod(&(0x7f0000000040)='./bus\x00', 0x2000, 0x1700) r0 = open(&(0x7f0000000300)='./bus\x00', 0x200, 0xa0) r1 = socket$inet(0x18, 0x3, 0x102) kevent(0xffffffffffffffff, &(0x7f0000000000)=[{{}, 0xfffffffffffffff9, 0x5, 0x13, 0x1}], 0x0, 0x0, 0x7, 0x0) r2 = socket(0x18, 0x2, 0x0) setsockopt(r2, 0x1000000000029, 0xc, &(0x7f0000000000), 0x14) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) r3 = socket(0x18, 0x1, 0x4) setsockopt(r3, 0x1000000000029, 0xc, &(0x7f0000000000), 0x14) closefrom(r1) r4 = kqueue() kevent(r4, &(0x7f00000000c0), 0x100, &(0x7f0000000180)=[{{r0}, 0xffffffffffffffff, 0x13, 0x2}, {{r0}, 0xffffffffffffffff, 0x62}], 0x6, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.188' (ED25519) to the list of known hosts. WuAvRNmI_fNaG:ul St(PL 0NxfOTff fLOf2WE00RE7De1 ObNb 9Sa0Y,S C0Ax0L,L 09,7 21)4 -E>X IeT 0f acta lStopped at savectx+0xae: movl $0,%gs:0x688 TID PID UID PRFLAGS PFLAGS CPU COMMAND * 4512 95962 0 0 0x4000000 1 syz-executor 189307 998 0 0 0x4000000 0 syz-executor savectx() at savectx+0xae end of kernel end trace frame: 0xc743ee18d60, count: 14 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu0: uvm_fault(0xfffff2007e1bb9a0, 0x0, 0, 1) -> e ddb{1}> show kasan No such command ddb{1}> trace savectx() at savectx+0xae end of kernel end trace frame: 0xc743ee18d60, count: -1 ddb{1}> show registers rdi 0 rsi 0 rbp 0xffff800032fa2470 rbx 0 rdx 0xffff80000160d040 rcx 0xffff80002a2602b8 rax 0x33 r8 0xffff800032fa23a0 r9 0 r10 0x36fd24e9a89cbd1a r11 0xf358a89752fe7bb1 r12 0 r13 0 r14 0xffff80002a2602b8 r15 0 rip 0xffffffff8274e3ee savectx+0xae cs 0x8 rflags 0x46 rsp 0xffff800032fa23f0 ss 0x10 savectx+0xae: movl $0,%gs:0x688 ddb{1}> show proc PROC (syz-executor) tid=4512 pid=95962 tcnt=3 stat=onproc flags process=0 proc=4000000 runpri=50, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a260a80,0xffff80002a21b780 process=0xffff800045fed378 user=0xffff800032f9d000, vmspace=0xfffff2007e1bb3e8 estcpu=21, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 83313 85376 52168 0 2 0 0 syz-executor 83313 132909 52168 0 3 0 0x4000080 fsleep syz-executor 52418 317176 76765 0 2 0x100002 0 sh 47226 458679 35032 0 2 0 0 syz-executor 47226 438288 35032 0 3 0 0x4000080 fsleep syz-executor 74064 257245 62175 0 2 0 0 syz-executor 74064 448359 62175 0 3 0 0x4000080 fsleep syz-executor 95962 385975 93495 0 2 0 0 syz-executor *95962 4512 93495 0 7 0 0x4000000 syz-executor 95962 150344 93495 0 2 0 0x4000000 syz-executor 998 331902 77335 0 2 0 0 syz-executor 998 189307 77335 0 7 0 0x4000000 syz-executor 998 17238 77335 0 2 0 0x4000000 syz-executor 80849 465826 68672 0 2 0x2 0 syz-executor 76765 371867 68672 0 2 0x10000002 0 syz-executor 93495 477822 68672 0 3 0x2 0x80 nanoslp syz-executor 52168 271029 68672 0 3 0x2 0x80 nanoslp syz-executor 62175 119248 68672 0 3 0x2 0x80 nanoslp syz-executor 35032 272433 68672 0 3 0x2 0x80 nanoslp syz-executor 24623 468068 68672 0 3 0x2 0x80 nanoslp syz-executor 77335 81823 68672 0 3 0x2 0x80 nanoslp syz-executor 68672 379407 89260 0 3 0x2 0x80 kqread syz-executor 89260 34361 43523 0 3 0x100002 0x88 sigsusp ksh 43523 152294 75918 0 3 0x10 0x88 kqread sshd-session 75918 342655 44156 0 3 0x12 0x80 kqread sshd-session 44248 32077 1 0 3 0x100003 0x80 ttyin getty 44156 277039 1 0 3 0 0x88 kqread sshd 75270 352511 8994 74 3 0x1100012 0x80 bpf pflogd 8994 406376 1 0 3 0 0x80 sbwait pflogd 94044 191119 65972 73 3 0x1100010 0x80 kqread syslogd 65972 397273 1 0 3 0x100002 0x80 sbwait syslogd 51659 357386 1 0 3 0x100000 0x80 kqread resolvd 62422 192451 43616 77 3 0x100012 0x80 kqread dhcpleased 87060 311530 43616 77 3 0x100012 0x80 kqread dhcpleased 43616 112141 1 0 3 0 0x80 kqread dhcpleased 54804 123390 0 0 3 0x14000 0x200 bored smr 85139 295760 0 0 2 0x14000 0x200 zerothread 18470 270682 0 0 3 0x14000 0x200 aiodoned aiodoned 15762 196348 0 0 3 0x14000 0x200 syncer update 39225 32038 0 0 3 0x14000 0x200 cleaner cleaner 64696 72384 0 0 3 0x14000 0x200 reaper reaper 80156 155774 0 0 3 0x14000 0x200 pgdaemon pagedaemon 72306 312689 0 0 3 0x14000 0x200 bored viomb 49360 35694 0 0 3 0x14000 0x40000200 acpi0 acpi0 60084 390443 0 0 3 0x14000 0x40000200 idle1 64734 29286 0 0 3 0x14000 0x200 bored softnet1 85829 509339 0 0 3 0x14000 0x200 bored softnet0 67516 90955 0 0 3 0x14000 0x200 bored systqmp 44468 46328 0 0 3 0x14000 0x200 bored systq 22355 200020 0 0 3 0x14000 0x200 tmoslp softclockmp 61825 92920 0 0 3 0x14000 0x40000200 tmoslp softclock 30720 469723 0 0 3 0x14000 0x40000200 idle0 1 284035 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{1}> show all locks CPU 1: exclusive mutex &sched_lock r = 0 (0xffffffff83b3b490) #0 witness_lock+0x5f1 #1 mtx_enter+0x4b4 #2 yield+0x35 #3 pool_get+0x27e #4 soalloc+0x69 #5 socreate+0xee #6 sys_socket+0x124 #7 syscall+0xbd4 #8 Xsyscall+0x128 Process 52418 (sh) thread 0xffff80002a21b4d8 (317176) exclusive rwlock vmmaplk r = 0 (0xfffff2000b1f7a88) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 vm_map_lock_ln+0x12e #3 uvmspace_fork+0x44 #4 process_new+0x583 #5 fork1+0x3f9 #6 syscall+0xb17 #7 Xsyscall+0x128 Process 47226 (syz-executor) thread 0xffff80002a21a2b0 (458679) exclusive rrwlock inode r = 0 (0xfffff2006e12c678) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 rrw_enter+0xc6 #3 VOP_LOCK+0xbd #4 vn_lock+0xa4 #5 uvn_io+0x411 #6 uvn_get+0x31d #7 uvm_fault_lower_io+0x2ce #8 uvm_fault_lower+0x28d #9 uvm_fault+0x274 #10 upageflttrap+0xa9 #11 usertrap+0x430 #12 recall_trap+0x8 Process 998 (syz-executor) thread 0xffff80002a21afa8 (189307) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83a5b8c0) #0 witness_lock+0x5f1 #1 __mp_acquire_count+0x58 #2 malloc+0xe3 #3 sys_shmat+0x9c #4 syscall+0xb17 #5 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11052 12084K 12095K 166960K 12158 0 pcb 17 12K 12K 166960K 21 0 rtable 193 5K 7K 166960K 355 0 pf 35 17K 24K 166960K 68 0 ifaddr 37 6K 7K 166960K 51 0 ifgroup 56 2K 2K 166960K 68 0 sysctl 1 1K 9K 166960K 5 0 counters 70 37K 37K 166960K 78 0 ioctlops 0 0K 4K 166960K 1484 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1292 81K 81K 166960K 1381 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 3 5K 5K 166960K 3 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 18 65K 85K 166960K 159 0 proc 70 115K 163K 166960K 566 0 subproc 72 4K 4K 166960K 90 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 2 0 in_multi 77 5K 6K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 1 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 37 175K 175K 166960K 37 0 exec 0 0K 1K 166960K 402 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 228 168K 175K 166960K 3331 0 UVM aobj 4 2K 2K 166960K 4 0 pinsyscall 43 86K 98K 166960K 1378 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 1 0 NDP 24 1K 2K 166960K 32 0 temp 34 9118K 9124K 166960K 3735 0 kqueue 13 20K 24K 166960K 32 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 35 0 32 1 0 1 1 0 8 0 rtentry 176 111 0 23 5 0 5 5 0 8 0 unpcb 144 61 0 44 1 0 1 1 0 8 0 syncache 336 7 0 7 1 1 0 1 0 8 0 tcpcb 736 15 0 10 1 0 1 1 0 8 0 arp 136 18 0 4 1 0 1 1 0 8 0 inpcb 328 84 0 74 2 0 2 2 0 8 0 nd6 152 24 0 6 1 0 1 1 0 8 0 kcovpl 48 10 0 2 1 0 1 1 0 8 0 ppxss 1192 2 0 2 1 0 1 1 0 8 1 pffrag 232 1 0 1 1 0 1 1 0 482 1 pffrnode 88 1 0 1 1 0 1 1 0 8 1 pffrent 40 2 0 2 1 0 1 1 0 8 1 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfanchor 1288 4 0 0 1 0 1 1 0 8 0 pfstitem 24 33 0 0 1 0 1 1 0 8 0 pfstkey 128 33 0 0 2 0 2 2 0 8 0 pfstate 448 33 0 0 4 0 4 4 0 8 0 pfrule 1360 21 0 15 2 0 2 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 452 0 88 29 0 29 29 0 8 2 art_table 40 453 0 88 5 0 5 5 0 8 0 art_node 32 111 0 31 1 0 1 1 0 8 0 shmpl 120 1 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1582 0 110 93 0 93 93 0 8 0 ffsino 296 1582 0 110 114 0 114 114 0 8 0 nchpl 144 1788 0 83 64 0 64 64 0 8 0 vnodes 216 1689 0 0 94 0 94 94 0 8 0 namei 1024 6437 0 6437 3 2 1 2 0 8 1 percpumem 16 55 0 4 1 0 1 1 0 8 0 kstatmem 264 35 0 8 2 0 2 2 0 8 0 scxspl 216 6208 0 6208 4 3 1 3 1 8 1 plimitpl 152 32 0 15 1 0 1 1 0 8 0 sigapl 424 485 0 437 6 0 6 6 0 8 0 knotepl 120 56 0 0 2 0 2 2 0 8 0 kqueuepl 224 30 0 21 1 0 1 1 0 8 0 pipepl 344 137 0 110 3 0 3 3 0 8 0 fdescpl 528 469 0 437 3 0 3 3 0 8 0 filepl 160 1751 0 1540 11 1 10 10 0 8 0 lockfpl 104 14 0 12 1 0 1 1 0 8 0 lockfspl 48 6 0 4 1 0 1 1 0 8 0 sessionpl 144 30 0 19 1 0 1 1 0 8 0 pgrppl 48 40 0 22 1 0 1 1 0 8 0 ucredpl 104 110 0 96 1 0 1 1 0 8 0 zombiepl 144 445 0 444 2 1 1 1 0 8 0 processpl 1240 485 0 437 5 1 4 5 0 8 0 procpl 664 514 0 459 5 0 5 5 0 8 0 sockpl 752 180 0 150 5 1 4 4 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 132 0 0 17 0 17 17 0 8 0 mcl2k 2048 16 0 0 2 0 2 2 0 8 0 mextrefs 64 13 0 0 1 0 1 1 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 157 0 0 10 0 10 10 0 8 0 bufpl 272 2296 0 105 147 0 147 147 0 8 0 anonpl 32 3712 0 0 30 0 30 30 0 247 0 amapchunkpl 152 8774 0 8320 18 0 18 18 0 158 0 amappl16 200 1376 0 1360 5 4 1 5 0 8 0 amappl15 192 7 0 7 1 1 0 1 0 8 0 amappl14 184 443 0 440 1 0 1 1 0 8 0 amappl13 176 137 0 125 1 0 1 1 0 8 0 amappl12 168 771 0 741 2 0 2 2 0 8 0 amappl11 160 2 0 2 1 1 0 1 0 8 0 amappl10 152 66 0 52 1 0 1 1 0 8 0 amappl9 144 278 0 278 1 1 0 1 0 8 0 amappl8 136 117 0 116 1 0 1 1 0 8 0 amappl7 128 157 0 143 1 0 1 1 0 8 0 amappl6 120 196 0 194 1 0 1 1 0 8 0 amappl5 112 125 0 115 1 0 1 1 0 8 0 amappl4 104 316 0 298 1 0 1 1 0 8 0 amappl3 96 1556 0 1466 4 1 3 3 0 8 0 amappl2 88 628 0 555 2 0 2 2 0 8 0 amappl1 80 13597 0 12995 16 2 14 16 0 8 1 amappl 88 2545 0 2390 4 0 4 4 0 92 0 uvmvnodes 80 100 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 3 0 0 1 0 1 1 0 8 0 uaddrrnd 24 468 0 437 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 468 0 437 1 0 1 1 0 8 0 vmmpekpl 168 6616 0 6567 3 0 3 3 0 8 0 vmmpepl 168 43844 0 41982 82 1 81 81 0 357 0 vmsppl 488 468 0 437 5 1 4 5 0 8 0 rwobjpl 80 17333 0 16328 23 1 22 23 0 8 0 pdppl 4096 943 0 874 107 36 71 81 0 8 2 pvpl 32 8660 0 0 71 1 70 71 0 265 0 pmappl 256 468 0 437 3 1 2 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 428 0 42 12 0 12 12 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff838f7ff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x37 comcnputc(800,20) at comcnputc+0xd0 cnputc(20) at cnputc+0x67 kputchar(20,5,0) at kputchar+0x2ed kprintf() at kprintf+0x223 printf(ffffffff8357b726) at printf+0x8b trap_print(ffff80003c3a88d0,6) at trap_print+0x70 kerntrap(ffff80003c3a88d0) at kerntrap+0x2e6 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b sys_shmat(ffff80002a21afa8,ffff80003c3a8af0,ffff80003c3a8a40) at sys_shmat+0x39d syscall(ffff80003c3a8af0) at syscall+0xb17 end trace frame: 0xffff80003c3a8b70, count: 0 ddb{0}> trace x86_ipi_db(ffffffff838f7ff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 x86_bus_space_io_read_1(3f8,5) at x86_bus_space_io_read_1+0x37 comcnputc(800,20) at comcnputc+0xd0 cnputc(20) at cnputc+0x67 kputchar(20,5,0) at kputchar+0x2ed kprintf() at kprintf+0x223 printf(ffffffff8357b726) at printf+0x8b trap_print(ffff80003c3a88d0,6) at trap_print+0x70 kerntrap(ffff80003c3a88d0) at kerntrap+0x2e6 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b sys_shmat(ffff80002a21afa8,ffff80003c3a8af0,ffff80003c3a8a40) at sys_shmat+0x39d syscall(ffff80003c3a8af0) at syscall+0xb17 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x92ee76a4d20, count: -15 ddb{0}> machine ddbcpu 1 Stopped at savectx+0xae: movl $0,%gs:0x688 savectx() at savectx+0xae end of kernel end trace frame: 0xc743ee18d60, count: 14 ddb{1}> trace savectx() at savectx+0xae end of kernel end trace frame: 0xc743ee18d60, count: -1