panic: pool_do_put: mbufpl: double pool_put: 0xfffffd80345d0000 Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic() at panic+0x15c sys/kern/subr_prf.c:207 pool_do_put(ffffffff8256d040,fffffd80345d0000) at pool_do_put+0x31f pr_find_pagehead sys/kern/subr_pool.c:311 [inline] pool_do_put(ffffffff8256d040,fffffd80345d0000) at pool_do_put+0x31f sys/kern/subr_pool.c:839 pool_put(ffffffff8256d040,fffffd80345d0000) at pool_put+0x4b sys/kern/subr_pool.c:802 m_free(fffffd80345d0000) at m_free+0x119 sys/kern/uipc_mbuf.c:459 ml_purge(ffff800014946178) at ml_purge+0x50 m_freem sys/kern/uipc_mbuf.c:538 [inline] ml_purge(ffff800014946178) at ml_purge+0x50 sys/kern/uipc_mbuf.c:1628 ifq_purge(ffff800000a69a88) at ifq_purge+0x97 sys/net/ifq.c:423 tapclose(5d00,7,2000,ffff8000ffff8290) at tapclose+0xed tun_dev_close sys/net/if_tun.c:454 [inline] tapclose(5d00,7,2000,ffff8000ffff8290) at tapclose+0xed sys/net/if_tun.c:433 spec_close(ffff800014946290) at spec_close+0x311 sys/kern/spec_vnops.c:555 VOP_CLOSE(fffffd803a689680,7,fffffd803f7c69c0,ffff8000ffff8290) at VOP_CLOSE+0xc0 sys/kern/vfs_vops.c:175 vn_closefile(fffffd802d5fd448,ffff8000ffff8290) at vn_closefile+0xd3 vn_close sys/kern/vfs_vnops.c:298 [inline] vn_closefile(fffffd802d5fd448,ffff8000ffff8290) at vn_closefile+0xd3 sys/kern/vfs_vnops.c:610 fdrop(fffffd802d5fd448,ffff8000ffff8290) at fdrop+0xc2 sys/kern/kern_descrip.c:1273 closef(fffffd802d5fd448,ffff8000ffff8290) at closef+0x118 sys/kern/kern_descrip.c:1257 fdfree(ffff8000ffff8290) at fdfree+0x100 sys/kern/kern_descrip.c:1189 end trace frame: 0xffff8000149464e0, count: 0 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic pool_do_put: mbufpl: double pool_put: 0xfffffd80345d0000 ddb> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic() at panic+0x15c sys/kern/subr_prf.c:207 pool_do_put(ffffffff8256d040,fffffd80345d0000) at pool_do_put+0x31f pr_find_pagehead sys/kern/subr_pool.c:311 [inline] pool_do_put(ffffffff8256d040,fffffd80345d0000) at pool_do_put+0x31f sys/kern/subr_pool.c:839 pool_put(ffffffff8256d040,fffffd80345d0000) at pool_put+0x4b sys/kern/subr_pool.c:802 m_free(fffffd80345d0000) at m_free+0x119 sys/kern/uipc_mbuf.c:459 ml_purge(ffff800014946178) at ml_purge+0x50 m_freem sys/kern/uipc_mbuf.c:538 [inline] ml_purge(ffff800014946178) at ml_purge+0x50 sys/kern/uipc_mbuf.c:1628 ifq_purge(ffff800000a69a88) at ifq_purge+0x97 sys/net/ifq.c:423 tapclose(5d00,7,2000,ffff8000ffff8290) at tapclose+0xed tun_dev_close sys/net/if_tun.c:454 [inline] tapclose(5d00,7,2000,ffff8000ffff8290) at tapclose+0xed sys/net/if_tun.c:433 spec_close(ffff800014946290) at spec_close+0x311 sys/kern/spec_vnops.c:555 VOP_CLOSE(fffffd803a689680,7,fffffd803f7c69c0,ffff8000ffff8290) at VOP_CLOSE+0xc0 sys/kern/vfs_vops.c:175 vn_closefile(fffffd802d5fd448,ffff8000ffff8290) at vn_closefile+0xd3 vn_close sys/kern/vfs_vnops.c:298 [inline] vn_closefile(fffffd802d5fd448,ffff8000ffff8290) at vn_closefile+0xd3 sys/kern/vfs_vnops.c:610 fdrop(fffffd802d5fd448,ffff8000ffff8290) at fdrop+0xc2 sys/kern/kern_descrip.c:1273 closef(fffffd802d5fd448,ffff8000ffff8290) at closef+0x118 sys/kern/kern_descrip.c:1257 fdfree(ffff8000ffff8290) at fdfree+0x100 sys/kern/kern_descrip.c:1189 exit1(ffff8000ffff8290,19,1) at exit1+0x32f sys/kern/kern_exit.c:196 postsig(ffff8000ffff8290,19) at postsig+0x4a6 sigexit sys/kern/kern_sig.c:1499 [inline] postsig(ffff8000ffff8290,19) at postsig+0x4a6 sys/kern/kern_sig.c:1431 userret(ffff8000ffff8290) at userret+0x159 sys/kern/kern_sig.c:1889 syscall(ffff800014946710) at syscall+0x42e mi_syscall_return sys/sys/syscall_mi.h:115 [inline] syscall(ffff800014946710) at syscall+0x42e sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffbd9e0, count: -19 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff800014945f20 rbx 0xffff800014945fd0 rdx 0x2 rcx 0 rax 0 r8 0xffff800014945ee0 r9 0x1 r10 0 r11 0xd28a1a68e3274691 r12 0x3000000008 r13 0xffff800014945f30 r14 0x100 r15 0x1 rip 0xffffffff81790a28 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff800014945f10 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb> show proc PROC (syz-executor.0) pid=489386 stat=onproc flags process=a proc=2000 pri=17, usrpri=78, nice=20 forw=0xffffffffffffffff, list=0xffff8000ffff8518,0xffff8000ffff27c0 process=0xffff8000148a2700 user=0xffff800014941000, vmspace=0xfffffd803f012330 estcpu=28, cpticks=1, pctcpu=0.0 user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 78478 414392 41470 0 3 0x80 nanosleep syz-executor.1 78478 508081 41470 0 3 0x4000080 fsleep syz-executor.1 78478 366830 41470 0 3 0x4000080 fsleep syz-executor.1 10637 470337 1 0 3 0x100083 ttyin getty 71666 500376 0 0 3 0x14200 bored sosplice 41470 158961 22075 0 3 0x82 nanosleep syz-executor.1 22075 212949 81425 0 3 0x82 thrsleep syz-fuzzer 22075 462058 81425 0 3 0x4000082 thrsleep syz-fuzzer 22075 441704 81425 0 2 0x4000082 syz-fuzzer 22075 357477 81425 0 3 0x4000082 thrsleep syz-fuzzer 22075 187977 81425 0 3 0x4000082 thrsleep syz-fuzzer 22075 501216 81425 0 3 0x4000082 thrsleep syz-fuzzer 22075 393413 81425 0 3 0x4000082 thrsleep syz-fuzzer 22075 188188 81425 0 3 0x4000082 thrsleep syz-fuzzer 81425 341975 77219 0 3 0x10008a pause ksh 77219 58173 96014 0 3 0x92 select sshd 96014 33192 1 0 3 0x80 select sshd 40435 317789 7219 73 2 0x100010 syslogd 7219 52671 1 0 3 0x100082 netio syslogd 97337 398796 1 77 3 0x100090 poll dhclient 97687 7141 1 0 3 0x80 poll dhclient 76172 58598 0 0 2 0x14200 zerothread 48822 231007 0 0 3 0x14200 aiodoned aiodoned 65015 371373 0 0 3 0x14200 syncer update 85779 259849 0 0 3 0x14200 cleaner cleaner 60135 462362 0 0 3 0x14200 reaper reaper 71757 497725 0 0 3 0x14200 pgdaemon pagedaemon 73111 432427 0 0 3 0x14200 bored crynlk 32804 498961 0 0 3 0x14200 bored crypto 32800 369254 0 0 3 0x40014200 acpi0 acpi0 43162 81439 0 0 2 0x14200 softnet 46138 444186 0 0 3 0x14200 bored systqmp 29222 268218 0 0 3 0x14200 bored systq 38573 154740 0 0 3 0x40014200 bored softclock 18570 66551 0 0 3 0x40014200 idle0 20855 344836 0 0 3 0x14200 bored smr 1 54485 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 9507 6349K 6792K 78643K 11218 0 pcb 13 8K 8K 78643K 74 0 rtable 86 3K 4K 78643K 307 0 ifaddr 71 14K 16K 78643K 126 0 counters 19 16K 16K 78643K 19 0 ioctlops 0 0K 2K 78643K 25 0 iov 0 0K 16K 78643K 58 0 mount 1 1K 1K 78643K 1 0 vnodes 1242 78K 78K 78643K 1485 0 UFS quota 1 32K 32K 78643K 1 0 UFS mount 5 36K 36K 78643K 5 0 shm 2 1K 9K 78643K 39 0 VM map 8 2K 2K 78643K 8 0 sem 12 0K 0K 78643K 93 0 dirhash 12 2K 2K 78643K 12 0 ACPI 1794 195K 288K 78643K 12646 0 file desc 5 13K 25K 78643K 389 0 sigio 0 0K 0K 78643K 12 0 proc 49 38K 54K 78643K 402 0 subproc 23 1K 2K 78643K 50 0 NFS srvsock 1 0K 0K 78643K 1 0 NFS daemon 1 16K 16K 78643K 1 0 ip_moptions 0 0K 0K 78643K 53 0 in_multi 68 3K 3K 78643K 101 0 ether_multi 1 0K 0K 78643K 3 0 ISOFS mount 1 32K 32K 78643K 1 0 MSDOSFS mount 1 16K 16K 78643K 1 0 ttys 60 265K 265K 78643K 60 0 exec 0 0K 1K 78643K 229 0 pagedep 1 8K 8K 78643K 1 0 inodedep 1 32K 32K 78643K 1 0 newblk 1 0K 0K 78643K 1 0 VM swap 7 26K 26K 78643K 7 0 UVM amap 118 70K 72K 78643K 1795 0 UVM aobj 112 3K 3K 78643K 120 0 memdesc 1 4K 4K 78643K 1 0 crypto data 1 1K 1K 78643K 1 0 ip6_options 0 0K 0K 78643K 54 0 NDP 12 0K 0K 78643K 27 0 temp 133 3558K 3627K 78643K 5900 0 kqueue 0 0K 0K 78643K 1 0 SYN cache 2 16K 16K 78643K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 7 0 4 1 0 1 1 0 8 0 rtpcb 96 43 0 41 1 0 1 1 0 8 0 rtentry 112 60 0 27 2 0 2 2 0 8 0 unpcb 120 197 0 189 1 0 1 1 0 8 0 syncache 280 6 0 6 3 3 0 1 0 8 0 tcpqe 32 265 0 265 2 2 0 1 0 8 0 tcpcb 640 115 0 111 3 1 2 2 0 8 1 ipq 40 8 0 8 1 1 0 1 0 8 0 ipqe 40 106 0 106 1 1 0 1 0 8 0 inpcb 280 417 0 410 4 2 2 3 0 8 1 nd6 48 7 0 5 1 0 1 1 0 8 0 pkpcb 40 2 0 2 1 1 0 1 0 8 0 ppxss 1128 4 0 4 2 2 0 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 291 0 118 16 2 14 15 0 8 1 art_table 32 292 0 118 2 0 2 2 0 8 0 art_node 16 59 0 29 1 0 1 1 0 8 0 sysvmsgpl 40 37 0 24 1 0 1 1 0 8 0 semupl 112 3 0 3 1 1 0 1 0 8 0 semapl 112 89 0 79 1 0 1 1 0 8 0 shmpl 112 118 0 8 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 1968 0 569 46 0 46 46 0 8 0 ffsino 240 1968 0 569 83 0 83 83 0 8 0 nchpl 144 2855 0 1234 61 0 61 61 0 8 0 uvmvnodes 72 2188 0 0 40 0 40 40 0 8 0 vnodes 208 2188 0 0 116 0 116 116 0 8 0 namei 1024 8470 0 8470 1 0 1 1 0 8 1 vcpupl 1984 6 0 0 1 0 1 1 0 8 0 vmpool 520 6 0 0 1 0 1 1 0 8 0 scsiplug 64 1 0 1 1 1 0 1 0 8 0 scxspl 208 7332 0 7332 8 7 1 7 0 8 1 plimitpl 152 154 0 147 1 0 1 1 0 8 0 sigapl 432 561 0 548 2 0 2 2 0 8 0 futexpl 56 10545 0 10543 1 0 1 1 0 8 0 knotepl 112 240 0 221 1 0 1 1 0 8 0 kqueuepl 104 256 0 254 1 0 1 1 0 8 0 pipepl 128 660 0 642 3 2 1 2 0 8 0 fdescpl 424 562 0 548 2 0 2 2 0 8 0 filepl 120 4913 0 4828 7 3 4 6 0 8 0 lockfpl 104 88 0 87 1 0 1 1 0 8 0 lockfspl 48 33 0 32 1 0 1 1 0 8 0 sessionpl 128 19 0 9 1 0 1 1 0 8 0 pgrppl 48 19 0 9 1 0 1 1 0 8 0 ucredpl 96 908 0 901 1 0 1 1 0 8 0 zombiepl 144 549 0 548 1 0 1 1 0 8 0 processpl 896 577 0 548 4 0 4 4 0 8 0 procpl 648 1067 0 1029 4 0 4 4 0 8 0 sosppl 144 2 0 2 1 1 0 1 0 8 0 sockpl 384 668 0 651 7 4 3 6 0 8 1 mcl64k 65536 44 0 44 4 4 0 3 0 8 0 mcl16k 16384 8 0 8 2 1 1 1 0 8 1 mcl12k 12288 13 0 13 3 2 1 1 0 8 1 mcl9k 9216 8 0 8 2 2 0 1 0 8 0 mcl8k 8192 22 0 22 2 1 1 1 0 8 1 mcl4k 4096 49 0 49 2 1 1 1 0 8 1 mcl2k2 2112 2 0 2 1 1 0 1 0 8 0 mcl2k 2048 69809 0 69779 18 13 5 15 0 8 0 mtagpl 80 16 0 15 2 1 1 1 0 8 0 mbufpl 256 113879 0 113830 26 14 12 22 0 8 4 pool(mbufpl): free list modified: page 0xfffffd80345d0000; item ordinal 9; addr 0xfffffd80345d0000 (p 0xfffffd803a271000); offset 0xc=0xdea4beef bufpl 280 7465 0 2301 370 0 370 370 0 8 0 anonpl 16 80243 0 59767 103 5 98 98 0 62 14 amapchunkpl 152 2921 0 2773 13 3 10 11 0 158 1 amappl16 192 3345 0 2193 68 3 65 68 0 8 7 amappl15 184 166 0 164 1 0 1 1 0 8 0 amappl14 176 235 0 230 1 0 1 1 0 8 0 amappl13 168 1 0 0 1 0 1 1 0 8 0 amappl12 160 9 0 6 1 0 1 1 0 8 0 amappl11 152 48 0 36 1 0 1 1 0 8 0 amappl10 144 7 0 7 1 1 0 1 0 8 0 amappl9 136 558 0 555 1 0 1 1 0 8 0 amappl8 128 162 0 134 2 0 2 2 0 8 0 amappl7 120 42 0 38 1 0 1 1 0 8 0 amappl6 112 60 0 49 1 0 1 1 0 8 0 amappl5 104 142 0 129 1 0 1 1 0 8 0 amappl4 96 792 0 765 1 0 1 1 0 8 0 amappl3 88 125 0 120 1 0 1 1 0 8 0 amappl2 80 3902 0 3834 3 1 2 3 0 8 0 amappl1 72 19343 0 18931 26 16 10 20 0 8 0 amappl 80 1307 0 1261 2 0 2 2 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 64 119 0 8 2 0 2 2 0 8 0 uaddrrnd 24 568 0 548 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 568 0 548 1 0 1 1 0 8 0 vmmpekpl 168 8390 0 8364 2 0 2 2 0 8 0 vmmpepl 168 73213 0 70984 182 39 143 175 0 357 43 vmsppl 272 561 0 548 2 1 1 2 0 8 0 pdppl 4096 1142 0 1102 7 1 6 6 0 8 0 pvpl 32 223894 0 200349 231 4 227 227 0 265 37 pmappl 200 567 0 548 2 0 2 2 0 8 0 extentpl 40 46 0 29 1 0 1 1 0 8 0 phpool 112 169 0 40 5 0 5 5 0 8 0