panic: pool_do_put: mbufpl: double pool_put: 0xffffff006dae8100 Stopped at db_enter+0xa: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND *154826 41599 0 0 0x4000000 0 syz-executor0 db_enter() at db_enter+0xa panic() at panic+0x147 pool_do_put(ffffff006dae8100,ffffffff81ecbc58) at pool_do_put+0x2e2 pool_put(d61d2a85c5e8e65f,ffffff006dae8100) at pool_put+0x37 m_free(ffffff006dae8100) at m_free+0x12c m_freem(16) at m_freem+0x2d soreceive(0,ffffff006e70fc08,0,27,ffff800021164028,ffff800021163f30) at soreceive+0x1131 recvit(ffff8000ffffce18,ffff8000211640c0,0,ffff8000211640d8,78e4dcb3178) at recvit+0x28c sys_recvfrom(ffff800021164160,ffff8000ffffce18,ffff8000210a6628) at sys_recvfrom+0xbc syscall(0) at syscall+0x3e4 Xsyscall(6,0,ffffffffffffffbe,0,6,78b504a0010) at Xsyscall+0x128 end of kernel end trace frame: 0x78e4dcb3200, count: 4 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> show panic pool_do_put: mbufpl: double pool_put: 0xffffff006dae8100 ddb> trace db_enter() at db_enter+0xa panic() at panic+0x147 pool_do_put(ffffff006dae8100,ffffffff81ecbc58) at pool_do_put+0x2e2 pool_put(d61d2a85c5e8e65f,ffffff006dae8100) at pool_put+0x37 m_free(ffffff006dae8100) at m_free+0x12c m_freem(16) at m_freem+0x2d soreceive(0,ffffff006e70fc08,0,27,ffff800021164028,ffff800021163f30) at soreceive+0x1131 recvit(ffff8000ffffce18,ffff8000211640c0,0,ffff8000211640d8,78e4dcb3178) at recvit+0x28c sys_recvfrom(ffff800021164160,ffff8000ffffce18,ffff8000210a6628) at sys_recvfrom+0xbc syscall(0) at syscall+0x3e4 Xsyscall(6,0,ffffffffffffffbe,0,6,78b504a0010) at Xsyscall+0x128 end of kernel end trace frame: 0x78e4dcb3200, count: -11 ddb> show registers rdi 0xffffffff81e10dd8 kprintf_mutex rsi 0xffffffff81679b89 db_enter+0x9 rbp 0xffff800021163cb0 rbx 0xffff800021163d50 rdx 0xffff800001afc000 rcx 0x1fc6 __ALIGN_SIZE+0xfc6 rax 0xffff800001afc000 r8 0xffff800021163c80 r9 0x8080808080808080 r10 0xd61d2a85c5e8e65f r11 0xffffffff8174f9a0 x86_bus_space_io_read_1 r12 0x3000000008 r13 0xffff800021163cc0 r14 0x100 r15 0xffffffff81c3c06c cy_pio_rec+0x4090 rip 0xffffffff81679b8a db_enter+0xa cs 0x8 rflags 0x206 rsp 0xffff800021163cb0 ss 0x10 db_enter+0xa: popq %rbp ddb> show proc PROC (syz-executor0) pid=154826 stat=onproc flags process=0 proc=4000000 pri=82, usrpri=82, nice=20 forw=0xffffffffffffffff, list=0xffff8000ffffc260,0xffffffff81eafaa0 process=0xffff8000210a6628 user=0xffff80002115f000, vmspace=0xffffff007f12b210 estcpu=36, cpticks=0, pctcpu=0.0 user=0, sys=0, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 41599 186988 99245 0 2 0 syz-executor0 *41599 154826 99245 0 7 0x4000000 syz-executor0 99245 104860 26763 0 3 0x82 nanosleep syz-executor0 65949 131645 26763 0 3 0x2 biowait syz-executor1 79264 416532 1 0 3 0x100083 ttyin getty 95969 210338 0 0 3 0x14200 bored sosplice 26763 463236 51902 0 3 0x82 thrsleep syz-fuzzer 26763 55193 51902 0 3 0x4000082 nanosleep syz-fuzzer 26763 41894 51902 0 3 0x4000082 kqread syz-fuzzer 26763 379881 51902 0 3 0x4000082 thrsleep syz-fuzzer 26763 162667 51902 0 3 0x4000082 thrsleep syz-fuzzer 26763 201646 51902 0 3 0x4000082 thrsleep syz-fuzzer 26763 54961 51902 0 3 0x4000082 thrsleep syz-fuzzer 51902 364442 14961 0 3 0x10008a pause ksh 14961 348285 70246 0 3 0x92 select sshd 70246 23085 1 0 3 0x80 select sshd 86242 506574 37721 73 3 0x100090 kqread syslogd 37721 73578 1 0 3 0x100082 netio syslogd 26416 71683 1 77 3 0x100090 poll dhclient 23124 203418 1 0 3 0x80 poll dhclient 6276 43143 0 0 2 0x14200 zerothread 61114 422662 0 0 3 0x14200 aiodoned aiodoned 68971 430836 0 0 3 0x14200 syncer update 51145 82128 0 0 3 0x14200 cleaner cleaner 62074 47961 0 0 3 0x14200 reaper reaper 36721 88834 0 0 3 0x14200 pgdaemon pagedaemon 8183 434772 0 0 3 0x14200 bored crynlk 91012 50872 0 0 3 0x14200 bored crypto 35431 8176 0 0 3 0x40014200 acpi0 acpi0 16394 15244 0 0 3 0x14200 bored softnet 27281 65009 0 0 3 0x14200 bored systqmp 83853 524074 0 0 3 0x14200 bored systq 18542 193869 0 0 3 0x40014200 bored softclock 58779 284502 0 0 3 0x40014200 idle0 1 500305 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper