panic: uvm_fault_unwire_locked: address not in map Stopped at db_enter+0x1c: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *490232 8119 32767 0x10 0x4000000 0 syz-executor.3 327341 90705 32767 0x10 0 1 syz-executor.2 db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff8285d741) at panic+0x17b sys/kern/subr_prf.c:198 uvm_fault_unwire_locked(fffffd8066cc7020,20002000,20003000) at uvm_fault_unwire_locked+0x321 sys/uvm/uvm_fault.c:1663 uvm_fault_unwire(fffffd8066cc7020,20002000,20003000) at uvm_fault_unwire+0x43 sys/uvm/uvm_fault.c:1623 sys_sysctl(ffff8000212c77f0,ffff80002e479240,ffff80002e479290) at sys_sysctl+0x239 sys/kern/kern_sysctl.c:259 syscall(ffff80002e479310) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] syscall(ffff80002e479310) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x48f8118a0a0, count: 8 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: uvm_fault_unwire_locked: address not in map ddb{0}> trace db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff8285d741) at panic+0x17b sys/kern/subr_prf.c:198 uvm_fault_unwire_locked(fffffd8066cc7020,20002000,20003000) at uvm_fault_unwire_locked+0x321 sys/uvm/uvm_fault.c:1663 uvm_fault_unwire(fffffd8066cc7020,20002000,20003000) at uvm_fault_unwire+0x43 sys/uvm/uvm_fault.c:1623 sys_sysctl(ffff8000212c77f0,ffff80002e479240,ffff80002e479290) at sys_sysctl+0x239 sys/kern/kern_sysctl.c:259 syscall(ffff80002e479310) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] syscall(ffff80002e479310) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x48f8118a0a0, count: -7 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80002e479010 rbx 0xffffffff82bdbba7 cpu_info_full_primary+0x2ba7 rdx 0 rcx 0xffff8000212c77f0 rax 0xffffffff82bdaff0 cpu_info_full_primary+0x1ff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x6a06b0aa0651bb8f r11 0xdafef94f8785a9de r12 0xffffffff82bdb9a8 cpu_info_full_primary+0x29a8 r13 0 r14 0 r15 0x1 rip 0xffffffff821bd5ec db_enter+0x1c cs 0x8 rflags 0x246 rsp 0xffff80002e479000 ss 0 db_enter+0x1c: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor.3) tid=490232 pid=8119 tcnt=4 stat=onproc flags process=10 proc=4000000 runpri=36, usrpri=80, slppri=36, nice=20 wchan=0x0, wmesg=, ps_single=0x0 forw=0xffffffffffffffff, list=0xffff8000212c7d40,0xffff8000212c62c0 process=0xffff800021266198 user=0xffff80002e474000, vmspace=0xfffffd8066cc7020 estcpu=30, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 10960 300910 14450 32767 2 0x10 syz-executor.6 10960 214311 14450 32767 2 0x4000010 syz-executor.6 10960 85842 14450 32767 2 0x4000010 syz-executor.6 36628 331802 84664 32767 2 0x10 syz-executor.0 36628 39435 84664 32767 3 0x4000090 fsleep syz-executor.0 26264 118197 18491 32767 2 0x10 syz-executor.5 26264 451129 18491 32767 2 0x4000010 syz-executor.5 8119 465926 55866 32767 2 0x10 syz-executor.3 8119 337706 55866 32767 3 0x4000090 fsleep syz-executor.3 * 8119 490232 55866 32767 7 0x4000010 syz-executor.3 8119 441340 55866 32767 2 0x4000010 syz-executor.3 49167 210775 76905 32767 2 0x10 syz-executor.1 49167 346005 76905 32767 3 0x4000090 fsleep syz-executor.1 74100 457614 92914 32767 2 0x10 syz-executor.7 74100 264095 92914 32767 2 0x4000010 syz-executor.7 6858 402729 70411 32767 2 0x10 syz-executor.4 6858 104523 70411 32767 3 0x4000090 fsleep syz-executor.4 6858 183501 70411 32767 3 0x4000090 fsleep syz-executor.4 90705 327341 8608 32767 7 0x10 syz-executor.2 90705 66348 8608 32767 2 0x4000010 syz-executor.2 76905 273912 50799 32767 3 0x90 nanoslp syz-executor.1 50799 34742 31316 0 3 0x82 wait syz-executor.1 92914 235950 3174 32767 3 0x90 nanoslp syz-executor.7 3174 295603 31316 0 3 0x82 wait syz-executor.7 18491 367105 54347 32767 3 0x90 nanoslp syz-executor.5 54347 499158 31316 0 3 0x82 wait syz-executor.5 84664 347953 46667 32767 3 0x90 nanoslp syz-executor.0 46667 374156 31316 0 3 0x82 wait syz-executor.0 70411 128200 26415 32767 3 0x90 nanoslp syz-executor.4 26415 250130 31316 0 3 0x82 wait syz-executor.4 28036 150701 0 0 3 0x14200 bored sosplice 14450 123607 35649 32767 3 0x90 nanoslp syz-executor.6 35649 10083 31316 0 3 0x82 wait syz-executor.6 8608 483497 98505 32767 3 0x90 nanoslp syz-executor.2 55866 94959 61103 32767 3 0x90 nanoslp syz-executor.3 98505 62919 31316 0 3 0x82 wait syz-executor.2 61103 58647 31316 0 3 0x82 wait syz-executor.3 31316 282889 11777 0 3 0x2000082 wait syz-fuzzer 31316 250837 11777 0 3 0x6000082 thrsleep syz-fuzzer 31316 440377 11777 0 3 0x6000082 wait syz-fuzzer 31316 102100 11777 0 3 0x6000082 thrsleep syz-fuzzer 31316 45104 11777 0 3 0x6000082 wait syz-fuzzer 31316 145551 11777 0 3 0x6000082 wait syz-fuzzer 31316 255858 11777 0 3 0x6000082 thrsleep syz-fuzzer 31316 25573 11777 0 3 0x6000082 thrsleep syz-fuzzer 31316 47501 11777 0 3 0x6000082 thrsleep syz-fuzzer 31316 143496 11777 0 3 0x6000082 thrsleep syz-fuzzer 31316 128328 11777 0 3 0x6000082 kqread syz-fuzzer 31316 275572 11777 0 3 0x6000082 wait syz-fuzzer 31316 445276 11777 0 3 0x6000082 wait syz-fuzzer 31316 38812 11777 0 3 0x6000082 thrsleep syz-fuzzer 31316 184577 11777 0 3 0x6000082 wait syz-fuzzer 31316 423155 11777 0 3 0x6000082 wait syz-fuzzer 11777 63900 81914 0 3 0x10008a sigsusp ksh 81914 451961 64236 0 3 0x9a kqread sshd 30273 424379 1 0 3 0x100083 ttyin getty 64236 16601 1 0 3 0x88 kqread sshd 27202 297532 46870 73 3 0x1100090 kqread syslogd 46870 471543 1 0 3 0x100082 netio syslogd 52407 352188 1 0 3 0x100080 kqread resolvd 11211 332598 75029 77 3 0x100092 kqread dhcpleased 3431 35139 75029 77 3 0x100092 kqread dhcpleased 75029 519343 1 0 3 0x80 kqread dhcpleased 43506 282664 0 0 3 0x14200 bored smr 9326 150322 0 0 2 0x14200 zerothread 22465 10251 0 0 3 0x14200 aiodoned aiodoned 50187 439195 0 0 3 0x14200 syncer update 9490 67605 0 0 3 0x14200 cleaner cleaner 34017 508888 0 0 3 0x14200 reaper reaper 7509 159371 0 0 3 0x14200 pgdaemon pagedaemon 42503 469565 0 0 3 0x14200 bored viomb 72902 453537 0 0 3 0x40014200 acpi0 acpi0 98929 270666 0 0 3 0x40014200 idle1 77003 111274 0 0 3 0x14200 bored softnet3 78232 456099 0 0 3 0x14200 bored softnet2 50299 172748 0 0 3 0x14200 bored softnet1 63561 322843 0 0 3 0x14200 bored softnet0 33488 201563 0 0 3 0x14200 bored systqmp 43002 458113 0 0 3 0x14200 bored systq 28178 516892 0 0 3 0x14200 tmoslp softclockmp 49361 351106 0 0 3 0x40014200 tmoslp softclock 51641 288780 0 0 3 0x40014200 idle0 1 34621 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 8119 (syz-executor.3) thread 0xffff8000212c7d40 (337706) exclusive rwlock amaplk r = 0 (0xfffffd8069b298d8) #0 witness_lock+0x447 #1 amap_unref+0x2f sys/uvm/uvm_amap.c:1363 #2 uvm_unmap_detach+0x7d sys/uvm/uvm_map.c:1366 #3 sys_munmap+0x22e sys/uvm/uvm_mmap.c:539 #4 syscall+0x606 mi_syscall sys/sys/syscall_mi.h:110 [inline] #4 syscall+0x606 sys/arch/amd64/amd64/trap.c:623 #5 Xsyscall+0x128 Process 8119 (syz-executor.3) thread 0xffff8000212c77f0 (490232) shared rwlock vmmaplk r = 0 (0xfffffd8066cc7118) #0 witness_lock+0x447 #1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309 #2 uvm_fault_unwire+0x35 sys/uvm/uvm_fault.c:1622 #3 sys_sysctl+0x239 sys/kern/kern_sysctl.c:259 #4 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] #4 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623 #5 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff82c97270) #0 witness_lock+0x447 #1 __mp_acquire_count+0x48 sys/kern/kern_lock.c:227 #2 mi_switch+0x46d sys/kern/sched_bsd.c:470 #3 sleep_finish+0x19b sys/kern/kern_synch.c:414 #4 rw_enter+0x341 sys/kern/kern_rwlock.c:285 #5 uvm_fault_unwire+0x35 sys/uvm/uvm_fault.c:1622 #6 sys_sysctl+0x239 sys/kern/kern_sysctl.c:259 #7 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] #7 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623 #8 Xsyscall+0x128 exclusive rwlock sysctllk r = 0 (0xffffffff82be78a0) #0 witness_lock+0x447 #1 rw_enter+0x3c8 sys/kern/kern_rwlock.c:309 #2 sys_sysctl+0x1c3 sys/kern/kern_sysctl.c:238 #3 syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] #3 syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623 #4 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10214 6413K 6420K 78643K 11339 0 pcb 13 10K 12K 78643K 15 0 rtable 246 7K 7K 78643K 1193 0 pf 29 8K 8K 78643K 59 0 ifaddr 44 15K 15K 78643K 108 0 ifgroup 50 2K 2K 78643K 110 0 sysctl 3 1K 1K 78643K 3 0 counters 60 35K 35K 78643K 90 0 ioctlops 0 0K 2K 78643K 62 0 iov 0 0K 24K 78643K 567 0 mount 1 1K 1K 78643K 1 0 log 0 0K 0K 78643K 4 0 vnodes 1279 80K 80K 78643K 2231 0 UFS quota 1 32K 32K 78643K 1 0 UFS mount 5 36K 36K 78643K 5 0 shm 2 1K 9K 78643K 76 0 VM map 2 1K 1K 78643K 2 0 sem 12 0K 0K 78643K 1955 0 dirhash 12 2K 2K 78643K 12 0 ACPI 1697 195K 286K 78643K 12548 0 file desc 26 97K 117K 78643K 5728 0 sigio 0 0K 0K 78643K 35 0 proc 56 78K 115K 78643K 1209 0 subproc 104 6K 6K 78643K 299 0 NFS srvsock 1 0K 0K 78643K 1 0 NFS daemon 1 16K 16K 78643K 1 0 ip_moptions 0 0K 0K 78643K 261 0 in_multi 99 7K 7K 78643K 312 0 ether_multi 1 0K 0K 78643K 8 0 ISOFS mount 1 32K 32K 78643K 1 0 MSDOSFS mount 1 16K 16K 78643K 1 0 ttys 223 996K 996K 78643K 223 0 exec 0 0K 1K 78643K 1288 0 tdb 3 0K 0K 78643K 3 0 pagedep 1 8K 8K 78643K 1 0 inodedep 1 32K 32K 78643K 1 0 newblk 1 0K 0K 78643K 1 0 VM swap 8 62K 64K 78643K 10 0 UVM amap 431 91K 104K 78643K 58565 0 UVM aobj 131 4K 4K 78643K 136 0 memdesc 1 4K 4K 78643K 1 0 crypto data 1 1K 1K 78643K 1 0 ip6_options 0 0K 0K 78643K 120 0 NDP 11 0K 2K 78643K 72 0 temp 74 5924K 6052K 78643K 18816 0 kqueue 12 18K 28K 78643K 448 0 SYN cache 2 16K 16K 78643K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 22 0 0 1 0 1 1 0 8 0 rtpcb 120 507 0 504 6 5 1 3 0 8 0 rtentry 112 298 0 182 4 0 4 4 0 8 0 unpcb 144 4692 0 4679 44 38 6 6 0 8 5 syncache 312 80 0 80 10 10 0 1 0 8 0 sackhl 24 1 0 1 1 1 0 1 0 8 0 tcpqe 32 235 0 235 11 11 0 1 0 8 0 tcpcb 808 1957 0 1932 50 45 5 10 0 8 1 arp 120 49 0 30 1 0 1 1 0 8 0 ipq 40 75 0 75 2 2 0 1 0 8 0 ipqe 40 294 0 294 2 2 0 1 0 8 0 inpcb 368 4283 0 4249 43 39 4 11 0 8 0 nd6 136 90 0 61 2 0 2 2 0 8 0 kcovpl 48 23 0 15 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 1227 0 747 34 3 31 31 0 8 0 art_table 32 1228 0 747 4 0 4 4 0 8 0 art_node 16 297 0 191 1 0 1 1 0 8 0 sysvmsgpl 40 15 0 8 1 0 1 1 0 8 0 semapl 112 1953 0 1943 1 0 1 1 0 8 0 shmpl 112 133 0 5 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 8463 0 7016 91 0 91 91 0 8 0 ffsino 272 8463 0 7016 97 0 97 97 0 8 0 nchpl 144 15848 0 14203 63 0 63 63 0 8 0 uvmvnodes 80 5926 0 0 121 0 121 121 0 8 0 vnodes 216 5926 0 0 330 0 330 330 0 8 0 namei 1024 56934 0 56934 2 1 1 2 0 8 1 percpumem 16 58 0 15 1 0 1 1 0 8 0 kstatmem 264 52 0 30 2 0 2 2 0 8 0 scxspl 216 45391 0 45391 17 16 1 8 1 8 1 plimitpl 152 706 0 682 7 6 1 2 0 8 0 sigapl 424 6001 0 5945 7 0 7 7 0 8 0 futexpl 64 49479 0 49474 1 0 1 1 0 8 0 knotepl 120 453 0 0 11 0 11 11 0 8 0 kqueuepl 216 1266 0 1258 24 23 1 8 0 8 0 pipepl 320 1748 0 1720 44 41 3 8 0 8 0 fdescpl 496 5982 0 5945 7 2 5 6 0 8 0 filepl 152 40449 0 40213 55 40 15 20 0 8 5 lockfpl 104 6916 0 6914 2 1 1 2 0 8 0 lockfspl 48 803 0 801 1 0 1 1 0 8 0 sessionpl 144 38 0 22 1 0 1 1 0 8 0 pgrppl 48 49 0 33 1 0 1 1 0 8 0 ucredpl 104 4560 0 4542 1 0 1 1 0 8 0 zombiepl 144 5945 0 5945 1 0 1 1 0 8 1 processpl 1072 6001 0 5945 5 1 4 5 0 8 0 procpl 680 16229 0 16146 12 4 8 8 0 8 1 sosppl 168 72 0 72 8 7 1 1 0 8 1 sockpl 488 11531 0 11486 144 129 15 23 0 8 8 mcl64k 65536 17 0 0 3 0 3 3 0 8 0 mcl16k 16384 11 0 0 2 0 2 2 0 8 0 mcl12k 12288 13 0 0 2 0 2 2 0 8 0 mcl9k 9216 21 0 0 2 0 2 2 0 8 0 mcl8k 8192 20 0 0 3 0 3 3 0 8 0 mcl4k 4096 33 0 0 4 1 3 3 0 8 0 mcl2k2 2112 8 0 0 1 0 1 1 0 8 0 mcl2k 2048 297 0 0 33 7 26 33 0 8 0 mtagpl 96 3 0 0 1 0 1 1 0 8 0 mbufpl 256 943 0 0 54 0 54 54 0 8 0 bufpl 288 11998 0 5677 452 0 452 452 0 8 0 anonpl 24 699396 0 687032 130 36 94 101 0 186 0 amapchunkpl 152 198431 0 197461 94 54 40 53 0 158 2 amappl16 200 16056 0 15724 96 76 20 31 0 8 0 amappl15 192 8 0 7 1 0 1 1 0 8 0 amappl14 184 195 0 185 2 1 1 2 0 8 0 amappl13 176 13 0 13 2 2 0 1 0 8 0 amappl12 168 6859 0 6817 4 2 2 3 0 8 0 amappl11 160 57 0 47 1 0 1 1 0 8 0 amappl10 152 49 0 38 1 0 1 1 0 8 0 amappl9 144 193 0 192 2 1 1 1 0 8 0 amappl8 136 478 0 369 4 0 4 4 0 8 0 amappl7 128 228 0 201 2 0 2 2 0 8 0 amappl6 120 541 0 527 1 0 1 1 0 8 0 amappl5 112 218 0 210 1 0 1 1 0 8 0 amappl4 104 653 0 620 2 1 1 2 0 8 0 amappl3 96 36141 0 36031 10 6 4 4 0 8 1 amappl2 88 6743 0 6663 3 1 2 3 0 8 0 amappl1 80 29971 0 29431 23 9 14 22 0 8 0 amappl 88 57699 0 57415 7 0 7 7 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 135 0 5 3 0 3 3 0 8 0 uaddrrnd 24 5982 0 5945 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 5982 0 5945 1 0 1 1 0 8 0 vmmpekpl 168 52004 0 51941 4 0 4 4 0 8 0 vmmpepl 168 368757 0 366186 188 74 114 123 0 357 1 vmsppl 464 5981 0 5945 6 1 5 6 0 8 0 rwobjpl 56 102110 0 94631 113 4 109 109 0 8 0 pdppl 4096 11972 0 11890 278 196 82 92 0 8 0 pvpl 32 1838864 0 1820084 366 195 171 350 0 265 0 pmappl 248 5981 0 5945 3 0 3 3 0 8 0 extentpl 40 56 0 38 1 0 1 1 0 8 0 phpool 112 1175 0 308 26 0 26 26 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x1c sys/arch/amd64/amd64/db_interface.c:437 panic(ffffffff8285d741) at panic+0x17b sys/kern/subr_prf.c:198 uvm_fault_unwire_locked(fffffd8066cc7020,20002000,20003000) at uvm_fault_unwire_locked+0x321 sys/uvm/uvm_fault.c:1663 uvm_fault_unwire(fffffd8066cc7020,20002000,20003000) at uvm_fault_unwire+0x43 sys/uvm/uvm_fault.c:1623 sys_sysctl(ffff8000212c77f0,ffff80002e479240,ffff80002e479290) at sys_sysctl+0x239 sys/kern/kern_sysctl.c:259 syscall(ffff80002e479310) at syscall+0x5e2 mi_syscall sys/sys/syscall_mi.h:110 [inline] syscall(ffff80002e479310) at syscall+0x5e2 sys/arch/amd64/amd64/trap.c:623 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x48f8118a0a0, count: -7 ddb{0}> machine ddbcpu 1