kern.securelevel: 0 -> 1
creating runtime link editor directory cache.
preserving editor files.
starting network daemons: sshd.
starting local daemons:.
Mon Dec  3 19:57:25 PST 2018

OpenBSD/amd64 (worker.syzkaller) (tty00)

Warning: Permanently added '10.128.10.63' (ECDSA) to the list of known hosts.
2018/12/03 19:58:05 parsed 1 programs
2018/12/03 19:58:09 executed programs: 0
login: kernel: protection fault trap, code=0

Stopped at      m_tag_delete_chain+0x25:        movq    0(%r15),%rax

ddb> 

ddb> set $lines = 0

ddb> show panic

the kernel did not panic

ddb> trace

m_tag_delete_chain(f488a45fdbe2d62d) at m_tag_delete_chain+0x25

m_free(ffffff0072af1a00) at m_free+0xfd

m_freem(16) at m_freem+0x2d

soreceive(0,ffffff006e701c08,ffff800021154820,14b,ffff8000211548b0,ffff8000211547c0) at soreceive+0x1131

recvit(ffff8000211548e0,ffff8000211549e8,ffff8000211549d0,ffff8000ffffce18,0) at recvit+0x28c

sys_recvmsg(ffff800021154a70,ffff8000ffffce18,ffff8000210a5fd8) at sys_recvmsg+0x120

syscall(0) at syscall+0x3e4

Xsyscall(6,0,ffffffffffffffbf,0,3,ec4720af010) at Xsyscall+0x128

end of kernel

end trace frame: 0xec6f7b2c5b0, count: -8

ddb> show registers

rdi               0xffffff0072af1a00

rsi                             0x42

rbp               0xffff8000211546b0

rbx                                0

rdx               0xffffffffffffbead

rcx               0xffffffff81e8e3b0    mbstat_boot_boot_cpumem

rax                                0

r8                                 0

r9                0xffff8000ffffce18

r10               0xf488a45fdbe2d62d

r11               0xffffffff816a34a0    pool_lock_mtx_leave

r12                           0xdeaf    __ALIGN_SIZE+0xceaf

r13               0xffffff006e701c08

r14               0xffffff0072af1a00

r15               0xdeafbeaddeafbead

rip               0xffffffff817c0a25    m_tag_delete_chain+0x25

cs                               0x8

rflags                       0x10282    __ALIGN_SIZE+0xf282

rsp               0xffff8000211546a0

ss                              0x10

m_tag_delete_chain+0x25:        movq    0(%r15),%rax

ddb>