panic: pool_do_get: mbufpl free list modified: page 0xffffff00286fd000; item addr 0xffffff00286fde00; offset 0x0=0x90ec678006000100 != 0x90ec6780a54d74d9 Stopped at db_enter+0xa: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND *421414 91643 0 0x12 0 0 sshd db_enter() at db_enter+0xa panic() at panic+0x147 pool_do_get(2,ffffffff81ea46b8,0) at pool_do_get+0x3ae pool_get(ffffff00286fd400,6c) at pool_get+0x77 m_copym(ffffff00286fdd00,34,ffff800000ac9540,ffffff00286fd300) at m_copym+0x136 tcp_output(ffff800014a339d8) at tcp_output+0x108d tcp_usrreq(3fa0,ffffff0036321008,0,ffffff00286fd500,0,db01aba60efd950d) at tcp_usrreq+0x1c0 sosend(ffffff0036092350,ffff8000149f4228,fc,ffff8000149f42d0,0,db01aba60efd950d) at sosend+0x462 dofilewritev(ffff800014a339d8,ffff8000149f42d0,fc,ffff8000149f42e0,7f7ffffe0d28) at dofilewritev+0x13e sys_write(ffff8000149f4370,ffff800014a339d8,ffff800014a15988) at sys_write+0x6e syscall(0) at syscall+0x3e4 Xsyscall(6,4,249b58099b3,4,3,24c017c3980) at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffe0d40, count: 3 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> show panic pool_do_get: mbufpl free list modified: page 0xffffff00286fd000; item addr 0xffffff00286fde00; offset 0x0=0x90ec678006000100 != 0x90ec6780a54d74d9 ddb> trace db_enter() at db_enter+0xa panic() at panic+0x147 pool_do_get(2,ffffffff81ea46b8,0) at pool_do_get+0x3ae pool_get(ffffff00286fd400,6c) at pool_get+0x77 m_copym(ffffff00286fdd00,34,ffff800000ac9540,ffffff00286fd300) at m_copym+0x136tcp_output(ffff800014a339d8) at tcp_output+0x108d tcp_usrreq(3fa0,ffffff0036321008,0,ffffff00286fd500,0,db01aba60efd950d) at tcp_usrreq+0x1c0 sosend(ffffff0036092350,ffff8000149f4228,fc,ffff8000149f42d0,0,db01aba60efd950d) at sosend+0x462 dofilewritev(ffff800014a339d8,ffff8000149f42d0,fc,ffff8000149f42e0,7f7ffffe0d28) at dofilewritev+0x13e sys_write(ffff8000149f4370,ffff800014a339d8,ffff800014a15988) at sys_write+0x6esyscall(0) at syscall+0x3e4 Xsyscall(6,4,249b58099b3,4,3,24c017c3980) at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffe0d40, count: -12 ddb> show registers rdi 0xffffffff81e22360 kprintf_mutex rsi 0x5 rbp 0xffff8000149f3d20 rbx 0xffff8000149f3dc0 rdx 0x3fd rcx 0 rax 0 r8 0xffff8000149f3cf0 r9 0x8080808080808080 r10 0x90ec678006000100 r11 0xffffffff81550c30 x86_bus_space_io_read_1 r12 0x3000000008 r13 0xffff8000149f3d30 r14 0x100 r15 0xffffffff81c48ac4 cy_pio_rec+0x1206c rip 0xffffffff81425d5a db_enter+0xa cs 0x8 rflags 0x246 rsp 0xffff8000149f3d20 ss 0x10 db_enter+0xa: popq %rbp ddb> show proc PROC (sshd) pid=421414 stat=onproc flags process=12 proc=0 pri=50, usrpri=50, nice=20 forw=0xffffffffffffffff, list=0xffff800014a33c30,0xffff800014a33538 process=0xffff800014a15988 user=0xffff8000149ef000, vmspace=0xffffff003f12b948 estcpu=0, cpticks=1, pctcpu=0.0 user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 17361 150711 1305 0 2 0 syz-executor1 62115 489919 1 0 3 0x100083 ttyin getty 54313 508070 0 0 3 0x14200 bored sosplice 88515 461242 87418 0 2 0x2 syz-executor0 1305 141158 87418 0 3 0x82 nanosleep syz-executor1 87418 297868 10046 0 3 0x82 thrsleep syz-fuzzer 87418 252042 10046 0 3 0x4000082 nanosleep syz-fuzzer 87418 69649 10046 0 3 0x4000082 thrsleep syz-fuzzer 87418 160195 10046 0 3 0x4000082 thrsleep syz-fuzzer 87418 186122 10046 0 3 0x4000082 thrsleep syz-fuzzer 87418 427678 10046 0 3 0x4000082 thrsleep syz-fuzzer 87418 398672 10046 0 2 0x4000002 syz-fuzzer 10046 166708 91643 0 3 0x10008a pause ksh *91643 421414 25521 0 7 0x12 sshd 25521 181366 1 0 3 0x80 select sshd 84504 477388 78996 73 3 0x100090 kqread syslogd 78996 384922 1 0 3 0x100082 netio syslogd 4883 294630 1 77 3 0x100090 poll dhclient 54685 349597 1 0 3 0x80 poll dhclient 29484 458042 0 0 2 0x14200 zerothread 97471 262662 0 0 3 0x14200 aiodoned aiodoned 84339 288411 0 0 3 0x14200 syncer update 88709 166834 0 0 3 0x14200 cleaner cleaner 41404 58043 0 0 3 0x14200 reaper reaper 82448 111841 0 0 3 0x14200 pgdaemon pagedaemon 34863 24480 0 0 3 0x14200 bored crynlk 75398 370697 0 0 3 0x14200 bored crypto 56462 371804 0 0 3 0x40014200 acpi0 acpi0 12930 226003 0 0 3 0x14200 bored softnet 49145 165554 0 0 3 0x14200 bored systqmp 85717 233891 0 0 3 0x14200 bored systq 15665 472993 0 0 3 0x40014200 bored softclock 99116 109678 0 0 3 0x40014200 idle0 1 143122 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper