panic: pool_cache_item_magic_check: mbufpl cpu free list modified: item addr 0xfffffd806f203c00+16 0x0!=0xadf24bc5e22f3a1b Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 375382 47234 0 0x2 0x4000000 0 syz-execprog *150357 60200 0 0x12 0 1 sshd db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic(ffffffff821fdb10) at panic+0x15c sys/kern/subr_prf.c:207 pool_cache_get(ffffffff826b7ec0) at pool_cache_get+0x323 pool_cache_item_magic_check sys/kern/subr_pool.c:1781 [inline] pool_cache_get(ffffffff826b7ec0) at pool_cache_get+0x323 sys/kern/subr_pool.c:1884 pool_get(ffffffff826b7ec0,2) at pool_get+0x91 sys/kern/subr_pool.c:572 m_gethdr(2,2) at m_gethdr+0x4c sys/kern/uipc_mbuf.c:283 tcp_output(ffff800000a0b760) at tcp_output+0x14e6 tcp_usrreq(fffffd806eb33af8,9,fffffd806f203b00,0,0,ffff800020ed1ae0) at tcp_usrreq+0xa55 sosend(fffffd806eb33af8,0,ffff800020e8dbd8,0,0,80) at sosend+0x671 sys/kern/uipc_socket.c:549 dofilewritev(ffff800020ed1ae0,4,ffff800020e8dbd8,0,ffff800020e8dcc0) at dofilewritev+0x1b6 sys/kern/sys_generic.c:365 sys_write(ffff800020ed1ae0,ffff800020e8dc70,ffff800020e8dcc0) at sys_write+0x83 sys/kern/sys_generic.c:285 syscall(ffff800020e8dd40) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline] syscall(ffff800020e8dd40) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffe5710, count: 3 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}>