panic: pool_do_get: mbufpl free list modified: page 0xfffffd805358d000; item addr 0xfffffd805358d200; offset 0x0=0x8d0405daabc00000 != 0x8d0405daabc0466a
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
*   410  59106      0           0  0x4000000    0  syz-executor.0
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff82473739) at panic+0x15c sys/kern/subr_prf.c:207
pool_do_get(ffffffff82862e28,2,ffff80001e7a8ea8) at pool_do_get+0x42a sys/kern/subr_pool.c:738
pool_get(ffffffff82862e28,2) at pool_get+0xb5 sys/kern/subr_pool.c:581
m_get(2,3) at m_get+0x4c sys/kern/uipc_mbuf.c:250
sbappendaddr(fffffd806b695320,fffffd806b6953a8,ffffffff82524d2c,fffffd805358da00,0) at sbappendaddr+0x2a0 sys/kern/uipc_socket2.c:804
rtm_sendup(fffffd806b695320,fffffd805358d100,1) at rtm_sendup+0xef sys/net/rtsock.c:594
route_input(fffffd805358d100,0,0) at route_input+0x1ab sys/net/rtsock.c:560
if_attach(ffff800000b32800) at if_attach+0x50 sys/net/if.c:541
tun_create(ffffffff827125b0,a9,0) at tun_create+0x20c sys/net/if_tun.c:252
if_clone_create(ffff80001e7a91c0,0) at if_clone_create+0xa3 sys/net/if.c:1154
tun_dev_open(28a9,ffffffff827125b0,384,ffff80001d6d0c48) at tun_dev_open+0xb0 sys/net/if_tun.c:383
spec_open(ffff80001e7a92b8) at spec_open+0x3ea sys/kern/spec_vnops.c:157
VOP_OPEN(fffffd80577f1420,1,fffffd806c3bfae0,ffff80001d6d0c48) at VOP_OPEN+0x6a sys/kern/vfs_vops.c:153
end trace frame: 0xffff80001e7a9450, count: 0
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.