kernel: protection fault trap, code=0 Stopped at pfi_ifhead_RB_REMOVE+0x58: movq 0x10(%r15),%rbx ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic the kernel did not panic ddb> trace pfi_ifhead_RB_REMOVE(ffffffff82282740,ffff8000009fc700) at pfi_ifhead_RB_REMOVE+0x58 sys/net/pf_if.c:80 pfi_detach_ifnet(ffff8000009e3000) at pfi_detach_ifnet+0x11e pfi_kif_unref sys/net/pf_if.c:199 [inline] pfi_detach_ifnet(ffff8000009e3000) at pfi_detach_ifnet+0x11e sys/net/pf_if.c:257 if_detach(ffff8000009e3000) at if_detach+0x15d sys/net/if.c:1118 tun_clone_destroy(ffff8000009e3000) at tun_clone_destroy+0x1c6 sys/net/if_tun.c:278 spec_close(ffff8000159dbdb8) at spec_close+0x3b0 sys/kern/spec_vnops.c:553 VOP_CLOSE(fffffd8029cb90a8,82,fffffd803f7c6840,ffff800014920140) at VOP_CLOSE+0x64 sys/kern/vfs_vops.c:174 vn_closefile(fffffd803a76b4c8,ffff800014920140) at vn_closefile+0x14b vn_close sys/kern/vfs_vnops.c:289 [inline] vn_closefile(fffffd803a76b4c8,ffff800014920140) at vn_closefile+0x14b sys/kern/vfs_vnops.c:575 fdrop(fffffd803a76b4c8,ffff800014920140) at fdrop+0xc9 sys/kern/kern_descrip.c:1260 closef(fffffd803a76b4c8,ffff800014920140) at closef+0x118 sys/kern/kern_descrip.c:1244 fdfree(ffff800014920140) at fdfree+0xf7 sys/kern/kern_descrip.c:1176 exit1(ffff800014920140,0,1) at exit1+0x32f sys/kern/kern_exit.c:196 sys_exit(ffff800014920140,ffff8000159dc050,ffff8000159dc0c0) at sys_exit+0x17 sys/kern/kern_exit.c:94 syscall(ffff8000159dc120) at syscall+0x508 Xsyscall(6,1,0,1,0,7f7ffffc8924) at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffc88f0, count: -14 ddb> show registers rdi 0xffffffff82282740 pfi_ifs rsi 0xffff8000009fc700 rbp 0xffff8000159dbc40 rbx 0xdeadbeefdeadbeef rdx 0x28 rcx 0x207ed19f261ebdf5 rax 0xffff8000009fc710 r8 0x101010101010101 r9 0x5 r10 0x2a5101ff15e89dd5 r11 0x5c844029fb3eb666 r12 0xffffffff82282740 pfi_ifs r13 0 r14 0xffff8000009fc700 r15 0xdeadbeefdeadbeef rip 0xffffffff8126ca98 pfi_ifhead_RB_REMOVE+0x58 cs 0x8 rflags 0x10282 __ALIGN_SIZE+0xf282 rsp 0xffff8000159dbbe0 ss 0x10 pfi_ifhead_RB_REMOVE+0x58: movq 0x10(%r15),%rbx ddb> show proc PROC (syz-executor.1) pid=330751 stat=onproc flags process=1008 proc=2000 pri=50, usrpri=81, nice=20 forw=0xffffffffffffffff, list=0xffff800014920d70,0xffffffff822ccfb8 process=0xffff8000ffffb078 user=0xffff8000159d7000, vmspace=0xfffffd803f014440 estcpu=31, cpticks=3, pctcpu=0.6 user=0, sys=0, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 81253 427266 1 0 3 0x100083 ttyin getty 44457 459774 88994 0 3 0x82 nanosleep syz-executor.1 88945 428544 0 0 3 0x14200 bored sosplice 30993 113827 88994 0 3 0x82 nanosleep syz-executor.0 88994 426682 36293 0 3 0x82 thrsleep syz-fuzzer 88994 37417 36293 0 3 0x4000082 thrsleep syz-fuzzer 88994 45689 36293 0 3 0x4000082 kqread syz-fuzzer 88994 194926 36293 0 3 0x4000082 thrsleep syz-fuzzer 88994 478894 36293 0 3 0x4000082 thrsleep syz-fuzzer 88994 377715 36293 0 3 0x4000082 thrsleep syz-fuzzer 88994 138557 36293 0 3 0x4000082 thrsleep syz-fuzzer 88994 229434 36293 0 3 0x4000082 thrsleep syz-fuzzer 36293 26537 13650 0 3 0x10008a pause ksh 13650 308853 20187 0 3 0x92 select sshd 20187 268434 1 0 3 0x80 select sshd 20116 223027 84916 73 3 0x100090 kqread syslogd 84916 399815 1 0 3 0x100082 netio syslogd 34796 305445 1 77 3 0x100090 poll dhclient 54031 53113 1 0 3 0x80 poll dhclient 59459 416562 0 0 2 0x14200 zerothread 92884 77738 0 0 3 0x14200 aiodoned aiodoned 79627 489169 0 0 3 0x14200 syncer update 74373 254421 0 0 3 0x14200 cleaner cleaner 84472 365426 0 0 3 0x14200 reaper reaper 17931 73496 0 0 3 0x14200 pgdaemon pagedaemon 77436 175274 0 0 3 0x14200 bored crynlk 57611 27013 0 0 3 0x14200 bored crypto 64191 63520 0 0 3 0x40014200 acpi0 acpi0 50501 31503 0 0 2 0x14200 softnet 78536 182782 0 0 3 0x14200 bored systqmp 53807 124739 0 0 3 0x14200 bored systq 21723 250854 0 0 3 0x40014200 bored softclock 28726 58332 0 0 3 0x40014200 idle0 93911 274392 0 0 3 0x14200 bored smr 1 98730 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9527 6359K 14550K 78643K 26058 0 0 pcb 23 9K 11K 78643K 2847 0 0 rtable 148 5K 6K 78643K 1378 0 0 ifaddr 64 17K 19K 78643K 643 0 0 counters 19 16K 16K 78643K 19 0 0 ioctlops 0 0K 2K 78643K 352 0 0 iov 0 0K 28K 78643K 714 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 1199 75K 76K 78643K 7096 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 5K 78643K 87 0 0 VM map 2 0K 0K 78643K 2 0 0 sem 12 0K 0K 78643K 529 0 0 dirhash 12 2K 2K 78643K 12 0 0 ACPI 1793 195K 288K 78643K 12645 0 0 file desc 5 13K 25K 78643K 6538 0 0 sigio 1 0K 0K 78643K 79 0 0 proc 42 30K 54K 78643K 982 0 0 subproc 32 2K 2K 78643K 51 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 ip_moptions 0 0K 0K 78643K 638 0 0 in_multi 33 2K 2K 78643K 243 0 0 ether_multi 1 0K 0K 78643K 31 0 0 mrt 0 0K 0K 78643K 18 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 108 477K 477K 78643K 108 0 0 exec 0 0K 1K 78643K 682 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 90 21K 39K 78643K 16358 0 0 UVM aobj 130 4K 4K 78643K 150 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 ip6_options 0 0K 1K 78643K 277 0 0 NDP 14 0K 0K 78643K 170 0 0 temp 183 2715K 3355K 78643K 22904 0 0 kqueue 0 0K 0K 78643K 43 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 8 0 2 1 0 1 1 0 8 0 inpcbpl 280 2634 0 2627 2 1 1 2 0 8 0 rtentry 112 76 0 18 2 0 2 2 0 8 0 syncache 264 4 0 4 1 1 0 1 0 8 0 tcpqe 32 90 0 90 1 1 0 1 0 8 0 tcpcb 544 964 0 960 1 0 1 1 0 8 0 ipq 40 2 0 2 1 1 0 1 0 8 0 ipqe 40 4 0 4 1 1 0 1 0 8 0 nd6 48 9 0 3 1 0 1 1 0 8 0 ppxss 1128 134 0 134 18 17 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 236 0 44 12 0 12 12 0 8 0 art_table 32 237 0 44 2 0 2 2 0 8 0 art_node 16 69 0 29 1 0 1 1 0 8 0 sysvmsgpl 40 17 0 9 1 0 1 1 0 8 0 semapl 112 527 0 517 1 0 1 1 0 8 0 shmpl 112 148 0 20 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 12207 0 10718 49 0 49 49 0 8 0 ffsino 240 12207 0 10718 88 0 88 88 0 8 0 nchpl 144 21433 0 19820 61 0 61 61 0 8 0 uvmvnodes 72 5926 0 0 108 0 108 108 0 8 0 vnodes 200 5926 0 0 312 0 312 312 0 8 0 namei 1024 67280 0 67280 3 2 1 1 0 8 1 scsiplug 64 9 0 9 7 6 1 1 0 8 1 scxspl 192 68334 0 68334 33 32 1 6 0 8 1 plimitpl 152 213 0 206 1 0 1 1 0 8 0 sigapl 432 6710 0 6697 2 0 2 2 0 8 0 futexpl 56 104321 0 104321 2 1 1 1 0 8 1 knotepl 112 1201 0 1182 1 0 1 1 0 8 0 kqueuepl 104 1574 0 1571 1 0 1 1 0 8 0 pipepl 112 3780 0 3757 12 10 2 2 0 8 0 fdescpl 424 6711 0 6697 2 0 2 2 0 8 0 filepl 120 40070 0 39970 10 6 4 5 0 8 0 lockfpl 104 2329 0 2329 6 5 1 1 0 8 1 lockfspl 48 785 0 785 6 5 1 1 0 8 1 sessionpl 112 22 0 12 1 0 1 1 0 8 0 pgrppl 48 77 0 67 1 0 1 1 0 8 0 ucredpl 96 8994 0 8987 1 0 1 1 0 8 0 zombiepl 144 6698 0 6696 2 1 1 1 0 8 0 processpl 840 6726 0 6696 4 0 4 4 0 8 0 procpl 624 15201 0 15164 7 3 4 4 0 8 0 sosppl 128 70 0 70 13 13 0 1 0 8 0 sockpl 384 5105 0 5088 8 5 3 4 0 8 1 mcl64k 65536 2131 0 2131 206 206 0 33 0 8 0 mcl16k 16384 16 0 16 13 12 1 1 0 8 1 mcl12k 12288 120 0 120 18 18 0 1 0 8 0 mcl9k 9216 92 0 92 22 22 0 1 0 8 0 mcl8k 8192 86 0 86 23 23 0 1 0 8 0 mcl4k 4096 290 0 290 11 10 1 1 0 8 1 mcl2k2 2112 35 0 35 22 22 0 1 0 8 0 mcl2k 2048 61265 0 61216 15 8 7 13 0 8 0 mtagpl 80 8 0 6 4 3 1 1 0 8 0 mbufpl 256 129545 0 129478 106 100 6 21 0 8 0 bufpl 256 22095 0 16417 356 0 356 356 0 8 0 anonpl 16 596972 0 586168 242 186 56 77 0 62 7 amapchunkpl 152 28007 0 27902 77 72 5 15 0 158 0 amappl16 192 36809 0 36222 227 193 34 53 0 8 4 amappl15 184 1 0 0 1 0 1 1 0 8 0 amappl14 176 41 0 40 2 1 1 1 0 8 0 amappl13 168 17 0 15 1 0 1 1 0 8 0 amappl12 160 382 0 378 1 0 1 1 0 8 0 amappl11 152 54 0 40 1 0 1 1 0 8 0 amappl10 144 75 0 73 2 1 1 1 0 8 0 amappl9 136 6693 0 6687 1 0 1 1 0 8 0 amappl8 128 6263 0 6242 1 0 1 1 0 8 0 amappl7 120 40 0 34 1 0 1 1 0 8 0 amappl6 112 60 0 53 1 0 1 1 0 8 0 amappl5 104 549 0 539 1 0 1 1 0 8 0 amappl4 96 6906 0 6886 1 0 1 1 0 8 0 amappl3 88 505 0 495 1 0 1 1 0 8 0 amappl2 80 53696 0 53629 4 2 2 3 0 8 0 amappl1 72 121000 0 120577 24 14 10 19 0 8 0 amappl 80 15532 0 15496 1 0 1 1 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma64 64 259 0 259 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 17 0 17 1 1 0 1 0 8 0 aobjpl 64 149 0 20 3 0 3 3 0 8 0 uaddrrnd 24 6711 0 6697 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 6711 0 6697 1 0 1 1 0 8 0 vmmpekpl 168 42551 0 42520 2 0 2 2 0 8 0 vmmpepl 168 783207 0 781577 224 146 78 96 0 357 3 vmsppl 272 6710 0 6697 2 1 1 2 0 8 0 pdppl 4096 13428 0 13394 6 1 5 6 0 8 0 pvpl 32 1736407 0 1721957 534 365 169 205 0 265 50 pmappl 200 6710 0 6697 1 0 1 1 0 8 0 extentpl 40 41 0 26 1 0 1 1 0 8 0 phpool 112 855 0 368 18 2 16 16 0 8 0