kernel: protection fault trap, code=0 Stopped at pfi_ifhead_RB_REMOVE+0x58: movq 0x10(%r15),%rbx ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic the kernel did not panic ddb> trace pfi_ifhead_RB_REMOVE(ffffffff822d4620,ffff800000a1f100) at pfi_ifhead_RB_REMOVE+0x58 sys/net/pf_if.c:80 pfi_detach_ifnet(ffff8000009f7000) at pfi_detach_ifnet+0x11e pfi_kif_unref sys/net/pf_if.c:199 [inline] pfi_detach_ifnet(ffff8000009f7000) at pfi_detach_ifnet+0x11e sys/net/pf_if.c:257 if_detach(ffff8000009f7000) at if_detach+0x15d sys/net/if.c:1120 tun_clone_destroy(ffff8000009f7000) at tun_clone_destroy+0x1c6 sys/net/if_tun.c:278 spec_close(ffff8000159f6938) at spec_close+0x3b0 sys/kern/spec_vnops.c:553 VOP_CLOSE(fffffd80308a73d0,2,fffffd803f7c6b40,ffff80001491fc68) at VOP_CLOSE+0x64 sys/kern/vfs_vops.c:174 vn_closefile(fffffd803615b788,ffff80001491fc68) at vn_closefile+0x14b vn_close sys/kern/vfs_vnops.c:289 [inline] vn_closefile(fffffd803615b788,ffff80001491fc68) at vn_closefile+0x14b sys/kern/vfs_vnops.c:575 fdrop(fffffd803615b788,ffff80001491fc68) at fdrop+0xc9 sys/kern/kern_descrip.c:1260 closef(fffffd803615b788,ffff80001491fc68) at closef+0x118 sys/kern/kern_descrip.c:1244 fdfree(ffff80001491fc68) at fdfree+0xf7 sys/kern/kern_descrip.c:1176 exit1(ffff80001491fc68,0,1) at exit1+0x32f sys/kern/kern_exit.c:196 sys_exit(ffff80001491fc68,ffff8000159f6bd0,ffff8000159f6c40) at sys_exit+0x17 sys/kern/kern_exit.c:94 syscall(ffff8000159f6ca0) at syscall+0x508 Xsyscall(6,1,0,1,0,7f7ffffd6074) at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffd6040, count: -14 ddb> show registers rdi 0xffffffff822d4620 pfi_ifs rsi 0xffff800000a1f100 rbp 0xffff8000159f67c0 rbx 0xdeaf4152deaf4152 rdx 0x28 rcx 0x5a5e93d1cf743d0a rax 0xffff800000a1f110 r8 0x101010101010101 r9 0x5 r10 0xbf613fafe6dfcf82 r11 0x669241b2b903e6ba r12 0xffffffff822d4620 pfi_ifs r13 0 r14 0xffff800000a1f100 r15 0xdeaf4152deaf4152 rip 0xffffffff81f06808 pfi_ifhead_RB_REMOVE+0x58 cs 0x8 rflags 0x10282 __ALIGN_SIZE+0xf282 rsp 0xffff8000159f6760 ss 0x10 pfi_ifhead_RB_REMOVE+0x58: movq 0x10(%r15),%rbx ddb> show proc PROC (syz-executor.0) pid=44125 stat=onproc flags process=1008 proc=2000 pri=50, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff800014920148,0xffffffff822b7b60 process=0xffff800014956368 user=0xffff8000159f1000, vmspace=0xfffffd803f014550 estcpu=36, cpticks=2, pctcpu=0.0 user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 28590 274425 5890 0 3 0x2 biowait syz-executor.1 29015 368725 5890 0 3 0x82 nanosleep syz-executor.0 6854 474849 1 0 3 0x100083 ttyin getty 20726 272917 0 0 3 0x14200 bored sosplice 5890 94513 27135 0 3 0x82 kqread syz-fuzzer 5890 338435 27135 0 3 0x4000082 nanosleep syz-fuzzer 5890 210098 27135 0 3 0x4000082 thrsleep syz-fuzzer 5890 488071 27135 0 3 0x4000082 thrsleep syz-fuzzer 5890 144290 27135 0 3 0x4000082 thrsleep syz-fuzzer 5890 379371 27135 0 3 0x4000082 thrsleep syz-fuzzer 5890 372674 27135 0 3 0x4000082 thrsleep syz-fuzzer 27135 266086 53139 0 3 0x10008a pause ksh 53139 435053 33833 0 3 0x92 select sshd 33833 96787 1 0 3 0x80 select sshd 59063 151218 49241 73 3 0x100010 ffs_fsync syslogd 49241 493173 1 0 3 0x100082 netio syslogd 98931 151238 1 77 3 0x100090 poll dhclient 98690 45556 1 0 3 0x80 poll dhclient 50543 292788 0 0 2 0x14200 zerothread 27701 370343 0 0 3 0x14200 aiodoned aiodoned 85471 440521 0 0 3 0x14200 syncer update 30038 400374 0 0 3 0x14200 cleaner cleaner 59345 158093 0 0 3 0x14200 reaper reaper 47595 383767 0 0 3 0x14200 pgdaemon pagedaemon 36122 220571 0 0 3 0x14200 bored crynlk 70808 162567 0 0 3 0x14200 bored crypto 38713 471257 0 0 3 0x40014200 acpi0 acpi0 18886 406004 0 0 2 0x14200 softnet 32381 220534 0 0 3 0x14200 bored systqmp 75342 37849 0 0 3 0x14200 bored systq 65913 486809 0 0 3 0x40014200 bored softclock 23642 257478 0 0 3 0x40014200 idle0 30431 23906 0 0 3 0x14200 bored smr 1 332372 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9514 6366K 7136K 78643K 27460 0 0 pcb 23 9K 11K 78643K 2888 0 0 rtable 112 4K 4K 78643K 1672 0 0 ifaddr 58 16K 18K 78643K 679 0 0 counters 19 16K 16K 78643K 19 0 0 ioctlops 0 0K 2K 78643K 299 0 0 iov 0 0K 28K 78643K 737 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 1202 76K 76K 78643K 7369 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 5K 78643K 86 0 0 VM map 2 0K 0K 78643K 2 0 0 sem 12 0K 0K 78643K 573 0 0 dirhash 12 2K 2K 78643K 12 0 0 ACPI 1793 195K 288K 78643K 12645 0 0 file desc 5 13K 25K 78643K 6391 0 0 sigio 0 0K 0K 78643K 80 0 0 proc 42 30K 54K 78643K 1371 0 0 subproc 32 2K 2K 78643K 199 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 ip_moptions 0 0K 0K 78643K 613 0 0 in_multi 33 2K 2K 78643K 337 0 0 ether_multi 1 0K 0K 78643K 37 0 0 mrt 0 0K 0K 78643K 10 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 114 503K 503K 78643K 114 0 0 exec 0 0K 1K 78643K 858 0 0 pfkey data 0 0K 4K 78643K 2 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 83 20K 30K 78643K 16076 0 0 UVM aobj 130 4K 4K 78643K 145 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 ip6_options 0 0K 1K 78643K 189 0 0 NDP 12 0K 0K 78643K 192 0 0 temp 168 2719K 3359K 78643K 23706 0 0 kqueue 0 0K 0K 78643K 36 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 24 0 18 1 0 1 1 0 8 0 inpcbpl 280 2485 0 2478 1 0 1 1 0 8 0 rtentry 112 148 0 104 2 0 2 2 0 8 0 syncache 264 4 0 4 1 1 0 1 0 8 0 tcpqe 32 47 0 47 1 1 0 1 0 8 0 tcpcb 544 960 0 956 1 0 1 1 0 8 0 nd6 48 33 0 27 1 0 1 1 0 8 0 swfcl 56 1 0 0 1 0 1 1 0 8 0 ppxss 1128 126 0 126 24 23 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 615 0 424 12 0 12 12 0 8 0 art_table 32 616 0 424 2 0 2 2 0 8 0 art_node 16 143 0 103 1 0 1 1 0 8 0 sysvmsgpl 40 18 0 8 1 0 1 1 0 8 0 semapl 112 571 0 561 1 0 1 1 0 8 0 shmpl 112 143 0 15 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 11748 0 10256 50 1 49 49 0 8 0 ffsino 240 11748 0 10256 88 0 88 88 0 8 0 nchpl 144 20746 0 19122 61 0 61 61 0 8 0 uvmvnodes 72 6812 0 0 124 0 124 124 0 8 0 vnodes 200 6812 0 0 359 0 359 359 0 8 0 namei 1024 66866 0 66866 7 6 1 1 0 8 1 scsiplug 64 6 0 6 4 4 0 1 0 8 0 scxspl 192 75913 0 75911 40 39 1 6 0 8 0 plimitpl 152 239 0 232 1 0 1 1 0 8 0 sigapl 432 6542 0 6529 2 0 2 2 0 8 0 futexpl 56 102937 0 102937 8 7 1 1 0 8 1 knotepl 112 1231 0 1212 1 0 1 1 0 8 0 kqueuepl 104 1452 0 1450 1 0 1 1 0 8 0 pipepl 112 3628 0 3609 7 6 1 2 0 8 0 fdescpl 424 6543 0 6529 2 0 2 2 0 8 0 filepl 120 39472 0 39376 10 6 4 5 0 8 1 lockfpl 104 2099 0 2099 11 10 1 1 0 8 1 lockfspl 48 738 0 738 11 10 1 1 0 8 1 sessionpl 112 33 0 23 1 0 1 1 0 8 0 pgrppl 48 95 0 85 1 0 1 1 0 8 0 ucredpl 96 9037 0 9030 1 0 1 1 0 8 0 zombiepl 144 6530 0 6529 2 1 1 1 0 8 0 processpl 848 6558 0 6529 4 0 4 4 0 8 0 procpl 624 14726 0 14691 8 4 4 4 0 8 0 sosppl 128 69 0 69 18 18 0 1 0 8 0 sockpl 384 5041 0 5024 15 12 3 4 0 8 1 mcl64k 65536 2186 0 2186 231 230 1 64 0 8 1 mcl16k 16384 18 0 18 15 15 0 1 0 8 0 mcl12k 12288 100 0 100 26 26 0 1 0 8 0 mcl9k 9216 112 0 112 18 17 1 1 0 8 1 mcl8k 8192 81 0 81 24 24 0 1 0 8 0 mcl4k 4096 305 0 305 15 14 1 1 0 8 1 mcl2k2 2112 31 0 31 16 16 0 1 0 8 0 mcl2k 2048 62117 0 62072 30 23 7 12 0 8 1 mtagpl 80 8 0 8 3 3 0 1 0 8 0 mbufpl 256 130969 0 130892 115 107 8 37 0 8 0 bufpl 256 22103 0 15272 428 0 428 428 0 8 0 anonpl 16 608171 0 598921 240 178 62 64 0 62 10 amapchunkpl 152 30163 0 30060 114 99 15 15 0 158 9 amappl16 192 35220 0 34613 230 198 32 45 0 8 1 amappl15 184 63 0 63 4 4 0 1 0 8 0 amappl14 176 1001 0 999 2 1 1 1 0 8 0 amappl13 168 671 0 671 5 4 1 1 0 8 1 amappl12 160 1529 0 1525 1 0 1 1 0 8 0 amappl11 152 2227 0 2211 1 0 1 1 0 8 0 amappl10 144 99 0 99 10 9 1 1 0 8 1 amappl9 136 1557 0 1554 1 0 1 1 0 8 0 amappl8 128 1141 0 1120 1 0 1 1 0 8 0 amappl7 120 71 0 65 1 0 1 1 0 8 0 amappl6 112 2211 0 2202 1 0 1 1 0 8 0 amappl5 104 1808 0 1797 1 0 1 1 0 8 0 amappl4 96 6686 0 6664 1 0 1 1 0 8 0 amappl3 88 1293 0 1283 1 0 1 1 0 8 0 amappl2 80 51704 0 51639 4 2 2 3 0 8 0 amappl1 72 122363 0 121961 27 18 9 19 0 8 0 amappl 80 15164 0 15129 1 0 1 1 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma64 64 259 0 259 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 17 0 17 1 1 0 1 0 8 0 aobjpl 64 144 0 15 3 0 3 3 0 8 0 uaddrrnd 24 6543 0 6529 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 6543 0 6529 1 0 1 1 0 8 0 vmmpekpl 168 42486 0 42460 2 0 2 2 0 8 0 vmmpepl 168 763092 0 761475 307 211 96 103 0 357 19 vmsppl 272 6542 0 6529 6 4 2 2 0 8 1 pdppl 4096 13092 0 13058 7 2 5 6 0 8 0 pvpl 32 2123109 0 2110727 742 503 239 261 0 265 118 pmappl 200 6542 0 6529 1 0 1 1 0 8 0 extentpl 40 41 0 26 1 0 1 1 0 8 0 phpool 112 993 0 431 22 4 18 19 0 8 0