login: panic: pool_do_get: mcl2k free list modified: page 0xffffff000603c000; item addr 0xffffff000603d000; offset 0x0=0x162b011e00000000 != 0x162b011efda526bf Stopped at db_enter+0xa: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND *137956 914 0 0 0 0 syz-executor1 db_enter() at db_enter+0xa panic() at panic+0x147 pool_do_get(2,ffffffff81e95aa0,ffffffff81e95aa0) at pool_do_get+0x3ae pool_get(ffffff0069841c00,2) at pool_get+0x77 m_clget(7,ffff800000171000,1) at m_clget+0x1e0 vio_populate_rx_mbufs(ffff800000171050) at vio_populate_rx_mbufs+0xd4 vio_rx_intr(ffffffff) at vio_rx_intr+0x4d virtio_check_vqs(ffff80000001c300) at virtio_check_vqs+0x166 intr_handler(0,ffff80000024b980) at intr_handler+0x3f Xintr_ioapic_edge19_untramp(0,0,0,0,0,0) at Xintr_ioapic_edge19_untramp+0x19f alltraps(6,ffffffff3ff9f015,1015,4,5ba72fb1008,0) at alltraps+0x128 end of kernel end trace frame: 0x7f7fffff39b0, count: 4 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> show panic pool_do_get: mcl2k free list modified: page 0xffffff000603c000; item addr 0xffffff000603d000; offset 0x0=0x162b011e00000000 != 0x162b011efda526bf ddb> trace db_enter() at db_enter+0xa panic() at panic+0x147 pool_do_get(2,ffffffff81e95aa0,ffffffff81e95aa0) at pool_do_get+0x3ae pool_get(ffffff0069841c00,2) at pool_get+0x77 m_clget(7,ffff800000171000,1) at m_clget+0x1e0 vio_populate_rx_mbufs(ffff800000171050) at vio_populate_rx_mbufs+0xd4 vio_rx_intr(ffffffff) at vio_rx_intr+0x4d virtio_check_vqs(ffff80000001c300) at virtio_check_vqs+0x166 intr_handler(0,ffff80000024b980) at intr_handler+0x3f Xintr_ioapic_edge19_untramp(0,0,0,0,0,0) at Xintr_ioapic_edge19_untramp+0x19f alltraps(6,ffffffff3ff9f015,1015,4,5ba72fb1008,0) at alltraps+0x128 end of kernel end trace frame: 0x7f7fffff39b0, count: -11 ddb> show registers rdi 0xffffffff81e02af0 kprintf_mutex rsi 0x5 rbp 0xffff80002118b110 rbx 0xffff80002118b1b0 rdx 0x3fd rcx 0 rax 0x1 r8 0xffff80002118b0e0 r9 0x8080808080808080 r10 0x162b011e00000000 r11 0xffffffff810d5f70 x86_bus_space_io_read_1 r12 0x3000000008 r13 0xffff80002118b120 r14 0x100 r15 0xffffffff81c44b62 cy_pio_rec+0xd378 rip 0xffffffff8175717a db_enter+0xa cs 0x8 rflags 0x202 rsp 0xffff80002118b110 ss 0 db_enter+0xa: popq %rbp ddb> show proc PROC (syz-executor1) pid=137956 stat=onproc flags process=0 proc=0 pri=80, usrpri=80, nice=20 forw=0xffffffffffffffff, list=0xffff800021175c58,0xffff800021175308 process=0xffff8000210602f8 user=0xffff800021186000, vmspace=0xffffff007f12c108 estcpu=36, cpticks=2, pctcpu=0.0 user=0, sys=0, intr=1 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND * 914 137956 84522 0 7 0 syz-executor1 914 23909 84522 0 3 0x4000080 fsleep syz-executor1 68603 308754 1 0 3 0x80 nanosleep init 46834 208077 0 0 3 0x14200 bored sosplice 62187 499803 71423 0 3 0x2 biowait syz-executor0 84522 500459 71423 0 3 0x82 nanosleep syz-executor1 71423 36618 49446 0 3 0x82 thrsleep syz-fuzzer 71423 119050 49446 0 3 0x4000082 nanosleep syz-fuzzer 71423 477628 49446 0 3 0x4000082 kqread syz-fuzzer 71423 306509 49446 0 3 0x4000082 thrsleep syz-fuzzer 71423 129459 49446 0 3 0x4000082 thrsleep syz-fuzzer 71423 368458 49446 0 3 0x4000082 thrsleep syz-fuzzer 71423 466556 49446 0 3 0x4000082 thrsleep syz-fuzzer 49446 259501 92701 0 3 0x10008a pause ksh 92701 445518 70199 0 3 0x92 select sshd 70199 425204 1 0 3 0x80 select sshd 68667 187052 16078 73 3 0x100090 kqread syslogd 16078 518266 1 0 3 0x100082 netio syslogd 54084 25382 1 77 3 0x100090 poll dhclient 51242 240190 1 0 3 0x80 poll dhclient 77454 293345 0 0 2 0x14200 zerothread 54354 82464 0 0 3 0x14200 aiodoned aiodoned 84324 340675 0 0 3 0x14200 syncer update 38323 221591 0 0 3 0x14200 cleaner cleaner 44434 255412 0 0 3 0x14200 reaper reaper 22791 148825 0 0 3 0x14200 pgdaemon pagedaemon 70145 192265 0 0 3 0x14200 bored crynlk 13063 512061 0 0 3 0x14200 bored crypto 45855 244488 0 0 3 0x40014200 acpi0 acpi0 52062 216282 0 0 2 0x14200 softnet 41782 517456 0 0 3 0x14200 bored systqmp 86297 347375 0 0 3 0x14200 bored systq 37821 213265 0 0 3 0x40014200 bored softclock 62501 195893 0 0 3 0x40014200 idle0 1 419419 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper