panic: pool_do_get: mbufpl free list modified: page 0xfffffd8068bf6000; item addr 0xfffffd8068bf6000; offset 0x0=0xa1f2920000000000 != 0xa1f292238596d7eb
Stopped at      db_enter+0x18:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 323858  67134      0         0x2  0x4000000    0K syz-fuzzer
*266145   2615      0        0x12          0    1  sshd
db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398
panic(ffffffff8249c628) at panic+0x164 sys/kern/subr_prf.c:218
pool_do_get(ffffffff828ce6d0,2,ffff800020e60798) at pool_do_get+0x439 sys/kern/subr_pool.c:738
pool_get(ffffffff828ce6d0,2) at pool_get+0xeb sys/kern/subr_pool.c:581
m_copym(fffffd807db12000,19b4,580,2) at m_copym+0x174 m_get sys/kern/uipc_mbuf.c:250 [inline]
m_copym(fffffd807db12000,19b4,580,2) at m_copym+0x174 sys/kern/uipc_mbuf.c:667
tcp_output(ffff800000ada6f0) at tcp_output+0x15ba sys/netinet/tcp_output.c:673
tcp_usrreq(fffffd806eaf7c88,9,fffffd8068bf5b00,0,0,ffff8000fffffb38) at tcp_usrreq+0xa55
sosend(fffffd806eaf7c88,0,ffff800020e60c78,0,0,80) at sosend+0x671 sys/kern/uipc_socket.c:555
dofilewritev(ffff8000fffffb38,4,ffff800020e60c78,0,ffff800020e60d60) at dofilewritev+0x1b6 sys/kern/sys_generic.c:365
sys_write(ffff8000fffffb38,ffff800020e60d10,ffff800020e60d60) at sys_write+0x83 sys/kern/sys_generic.c:285
syscall(ffff800020e60de0) at syscall+0x4a4 mi_syscall sys/sys/syscall_mi.h:102 [inline]
syscall(ffff800020e60de0) at syscall+0x4a4 sys/arch/amd64/amd64/trap.c:570
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x7f7ffffbffc0, count: 3
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.