uvm_fault(0xfffffd8069da55c8, 0x0, 0, 1) -> e fatal page fault in supervisor mode trap type 6 code 0 rip ffffffff81d2b590 cs 8 rflags 10207 cr2 0 cpl 0 rsp ffff80002a3622a0 gsbase 0xffff8000299ddff0 kgsbase 0x0 panic: trap type 6, code=0, pc=ffffffff81d2b590 Starting stack trace... panic(ffffffff833325a8) at panic+0x1d0 sys/kern/subr_prf.c:229 kerntrap(ffff80002a3621f0) at kerntrap+0x29b sys/arch/amd64/amd64/trap.c:327 alltraps_kern_meltdown() at alltraps_kern_meltdown+0x7b dt_ioctl_record_stop(ffff80000167b000) at dt_ioctl_record_stop+0xf0 sys/dev/dt/dt_dev.c:580 dtclose(31e5f,81,2000,ffff80003b007748) at dtclose+0x105 dt_pcb_purge sys/dev/dt/dt_dev.c:-1 [inline] dtclose(31e5f,81,2000,ffff80003b007748) at dtclose+0x105 sys/dev/dt/dt_dev.c:232 spec_close(ffff80002a3623a0) at spec_close+0x45f sys/kern/spec_vnops.c:-1 VOP_CLOSE(fffffd806f533b18,81,fffffd80097fb270,ffff80003b007748) at VOP_CLOSE+0x133 sys/kern/vfs_vops.c:156 vn_closefile(fffffd806c1e6850,ffff80003b007748) at vn_closefile+0x12b vn_close sys/kern/vfs_vnops.c:292 [inline] vn_closefile(fffffd806c1e6850,ffff80003b007748) at vn_closefile+0x12b sys/kern/vfs_vnops.c:615 fdrop(fffffd806c1e6850,ffff80003b007748) at fdrop+0x126 sys/kern/kern_descrip.c:1267 closef(fffffd806c1e6850,ffff80003b007748) at closef+0x192 sys/kern/kern_descrip.c:1251 fdfree(ffff80003b007748) at fdfree+0x116 sys/kern/kern_descrip.c:1182 exit1(ffff80003b007748,0,0,1) at exit1+0x58f sys/kern/kern_exit.c:214 sys_exit(ffff80003b007748,ffff80002a362710,ffff80002a362660) at sys_exit+0x1a sys/kern/kern_exit.c:-1 syscall(ffff80002a362710) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80002a362710) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:579 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7dea9a7225e0, count: 242 End of stack trace. WARNING: SPL NOT LOWERED ON SYSCALL 11 -1 EXIT 0 4 Stopped at savectx+0xae: movl $0,%gs:0x688 TID PID UID PRFLAGS PFLAGS CPU COMMAND 131766 60378 0 0 0 0 syz-executor *212498 90993 0 0x2 0 1 syz-executor savectx() at savectx+0xae end of kernel end trace frame: 0x7e88fefb3500, count: 14 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: uvm_fault(0xfffffd8069da55c8, 0x0, 0, 1) -> e ddb{1}> trace savectx() at savectx+0xae end of kernel end trace frame: 0x7e88fefb3500, count: -1 ddb{1}> show registers rdi 0 rsi 0 rbp 0xffff80002a33cba0 rbx 0 rdx 0 rcx 0xffff80002a291498 rax 0x33 r8 0xffff80002a33cad0 r9 0x1 r10 0xa9fd23a3ef2ffda6 r11 0x6cc43bc212636198 r12 0 r13 0 r14 0xffff80002a291498 r15 0 rip 0xffffffff81c733ee savectx+0xae cs 0x8 rflags 0x46 rsp 0xffff80002a33cb20 ss 0x10 savectx+0xae: movl $0,%gs:0x688 ddb{1}> show proc PROC (syz-executor) tid=212498 pid=90993 tcnt=1 stat=onproc flags process=2 proc=0 runpri=50, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a291208,0xffff8000ffffd208 process=0xffff8000ffff6f38 user=0xffff80002a337000, vmspace=0xfffffd800b026d20 estcpu=36, cpticks=1, pctcpu=0.29, user=3, sys=193, intr=3 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 60378 131766 62010 0 7 0 syz-executor 60378 226183 62010 0 3 0x4000080 kqsel syz-executor 73735 185116 23061 0 3 0x80 nanoslp syz-executor 73735 201764 23061 0 3 0x4000080 ttyout syz-executor 73735 331139 23061 0 3 0x4000080 fsleep syz-executor 98906 282780 80235 -1 3 0x90 nanoslp syz-executor 98906 508976 80235 -1 3 0x4000090 kqsel syz-executor 83880 269204 62914 0 3 0x82 wait syz-executor 39232 477872 1 0 3 0x100083 ttyin getty 59383 429629 62914 0 3 0x82 nanoslp syz-executor 24716 122169 0 0 3 0x14280 nfsidl nfsio 23226 130963 0 0 3 0x14280 nfsidl nfsio 11373 138613 0 0 3 0x14280 nfsidl nfsio 24734 247254 0 0 3 0x14280 nfsidl nfsio 96562 84001 0 0 3 0x14280 nfsidl nfsio 52489 337777 0 0 3 0x14280 nfsidl nfsio 59760 135935 0 0 3 0x14280 nfsidl nfsio 48469 244377 0 0 3 0x14280 nfsidl nfsio 37228 192552 0 0 3 0x14280 nfsidl nfsio 81525 446475 0 0 3 0x14280 nfsidl nfsio 10295 262916 0 0 3 0x14280 nfsidl nfsio 45295 258181 0 0 3 0x14280 nfsidl nfsio 66594 257202 0 0 3 0x14280 nfsidl nfsio 44769 26376 0 0 3 0x14280 nfsidl nfsio 90688 236769 0 0 3 0x14280 nfsidl nfsio 81058 418382 0 0 3 0x14280 nfsidl nfsio 25554 195902 0 0 3 0x14280 nfsidl nfsio 34761 131061 0 0 3 0x14280 nfsidl nfsio 23721 486458 0 0 3 0x14280 nfsidl nfsio 2133 392845 0 0 3 0x14280 nfsidl nfsio 23061 302329 62914 0 3 0x82 nanoslp syz-executor 63065 151652 62914 0 3 0x82 nanoslp syz-executor 92489 498184 0 0 3 0x14200 bored sosplice 18794 101543 62914 0 3 0x82 nanoslp syz-executor *90993 212498 62914 0 7 0x2 syz-executor 80235 7679 62914 0 3 0x82 nanoslp syz-executor 62010 53996 62914 0 3 0x82 nanoslp syz-executor 62914 213264 89985 0 3 0x82 kqread syz-executor 89985 89444 28938 0 3 0x10008a sigsusp ksh 28938 439982 40818 0 3 0x98 kqread sshd-session 40818 199965 13995 0 3 0x92 kqread sshd-session 13995 445319 1 0 3 0x88 kqread sshd 5528 170458 8303 74 3 0x1100092 bpf pflogd 8303 28596 1 0 3 0x80 sbwait pflogd 99124 265198 91049 73 3 0x1100090 kqread syslogd 91049 337437 1 0 3 0x100082 sbwait syslogd 98441 183059 1 0 3 0x100080 kqread resolvd 35001 39267 30544 77 3 0x100092 kqread dhcpleased 82443 142702 30544 77 3 0x100092 kqread dhcpleased 30544 285674 1 0 3 0x80 kqread dhcpleased 19727 266039 0 0 3 0x14200 bored smr 312 195508 0 0 3 0x14200 pgzero zerothread 50199 212618 0 0 3 0x14200 aiodoned aiodoned 88187 130577 0 0 3 0x14200 syncer update 19325 104539 0 0 3 0x14200 cleaner cleaner 60304 408893 0 0 3 0x14200 reaper reaper 39809 87375 0 0 3 0x14200 pgdaemon pagedaemon 62617 364324 0 0 3 0x14200 bored viomb 83021 455503 0 0 3 0x40014200 acpi0 acpi0 57897 219824 0 0 3 0x40014200 idle1 85300 21100 0 0 3 0x14200 bored softnet3 5183 56106 0 0 3 0x14200 bored softnet2 55385 39217 0 0 3 0x14200 bored softnet1 74368 364875 0 0 3 0x14200 netlock softnet0 99421 288600 0 0 2 0x40014200 systqmp 88860 69271 0 0 3 0x14200 bored systq 94023 490042 0 0 3 0x14200 tmoslp softclockmp 31757 130461 0 0 3 0x40014200 tmoslp softclock 47497 16644 0 0 3 0x40014200 idle0 1 521323 0 0 3 0x82 wait init 0 0 -1 0 3 0x10010200 scheduler swapper ddb{1}> show all locks ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10271 11132K 13015K 166960K 14494 0 pcb 18 15K 16K 166960K 381 0 rtable 226 12K 12K 166960K 790 0 pf 44 19K 22K 166960K 203 0 ifaddr 42 7K 8K 166960K 150 0 ifgroup 65 2K 2K 166960K 239 0 sysctl 4 1K 9K 166960K 17 0 counters 74 37K 38K 166960K 250 0 ioctlops 0 0K 4K 166960K 1785 0 iov 0 0K 24K 166960K 324 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1548 97K 97K 166960K 3409 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 9K 166960K 45 0 VM map 2 1K 1K 166960K 2 0 sem 25 16K 26K 166960K 59 0 dirhash 12 2K 2K 166960K 75 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 18 65K 236K 166960K 2420 0 sigio 0 0K 0K 166960K 36 0 proc 73 91K 128K 166960K 1004 0 subproc 72 4K 4K 166960K 135 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 460 0 in_multi 77 5K 7K 166960K 379 0 ether_multi 1 0K 0K 166960K 20 0 mrt 2 0K 0K 166960K 19 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 259 1155K 1155K 166960K 259 0 exec 0 0K 1K 166960K 1049 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 5 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 266 173K 188K 166960K 23602 0 UVM aobj 40 6K 6K 166960K 48 0 pinsyscall 43 86K 102K 166960K 3780 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 147 0 NDP 15 0K 2K 166960K 103 0 temp 79 8688K 8768K 166960K 80474 0 kqueue 14 22K 32K 166960K 440 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 176 0 173 1 0 1 1 0 8 0 rtentry 176 237 0 145 6 0 6 6 0 8 0 unpcb 144 1616 0 1595 10 9 1 4 0 8 0 syncache 336 19 0 19 4 3 1 1 0 8 1 tcpqe 32 5 0 5 2 2 0 1 0 8 0 tcpcb 808 933 0 928 15 13 2 8 0 8 0 arp 128 40 0 21 1 0 1 1 0 8 0 inpcb 384 2739 0 2727 15 11 4 9 0 8 1 nd6 144 53 0 28 1 0 1 1 0 8 0 pkpcb 40 32 0 32 2 1 1 1 0 8 1 kcovpl 48 15 0 7 1 0 1 1 0 8 0 mppekey 1024 3 0 3 2 2 0 1 0 8 0 ppxss 1192 66 0 65 2 1 1 1 0 8 0 pppxif 1504 11 0 11 2 2 0 1 0 8 0 pfstscr 40 1 0 1 1 1 0 1 0 8 0 pffrag 232 14 0 5 1 0 1 1 0 482 0 pffrnode 88 9 0 2 1 0 1 1 0 8 0 pffrent 40 27 0 18 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfrktable 1344 2 0 1 1 0 1 1 0 8 0 pfanchor 1288 2 0 0 1 0 1 1 0 8 0 pftag 88 2 0 1 2 1 1 1 0 8 0 pfstitem 24 148 0 71 1 0 1 1 0 8 0 pfstkey 128 155 0 78 4 0 4 4 0 8 0 pfstate 384 151 0 76 10 0 10 10 0 8 0 pfrule 1344 27 0 19 2 1 1 2 0 8 0 rttmr 136 2 0 2 2 2 0 1 0 8 0 art_heap8 4096 5 0 1 5 1 4 5 0 8 0 art_heap4 256 1060 0 658 35 9 26 29 0 8 0 art_table 32 1065 0 659 4 0 4 4 0 8 0 art_node 16 230 0 151 1 0 1 1 0 8 0 sysvmsgpl 40 5 0 2 1 0 1 1 0 8 0 semupl 112 3 0 3 2 2 0 1 0 8 0 semapl 112 48 0 25 1 0 1 1 0 8 0 shmpl 112 45 0 8 2 0 2 2 0 8 0 dirhash 1024 60 0 43 3 0 3 3 0 8 0 dino2pl 256 5679 0 4158 96 0 96 96 0 8 0 ffsino 288 5679 0 4158 109 0 109 109 0 8 0 nchpl 144 9054 0 8421 63 39 24 63 0 8 0 rtmask 32 12 0 12 4 4 0 1 0 8 0 uvmvnodes 80 5926 0 0 121 0 121 121 0 8 0 vnodes 216 5926 0 0 330 0 330 330 0 8 0 namei 1024 31571 0 31571 2 1 1 2 0 8 1 percpumem 16 140 0 88 1 0 1 1 0 8 0 kstatmem 264 148 0 112 4 1 3 3 0 8 0 acpiwqpl 32 1 0 1 1 0 1 1 1 8 1 scsiplug 72 9 0 9 4 4 0 1 0 8 0 scxspl 216 25612 0 25612 13 12 1 8 1 8 1 plimitpl 152 459 0 442 1 0 1 1 0 8 0 sigapl 424 2761 0 2690 11 2 9 9 0 8 0 knotepl 120 798 0 0 23 0 23 23 0 8 0 kqueuepl 224 926 0 914 8 7 1 5 0 8 0 pipepl 336 400 0 373 6 3 3 6 0 8 0 fdescpl 520 2699 0 2667 3 0 3 3 0 8 0 filepl 160 17613 0 17379 23 10 13 16 0 8 1 lockfpl 104 843 0 841 2 1 1 2 0 8 0 lockfspl 48 271 0 269 1 0 1 1 0 8 0 sessionpl 144 46 0 37 1 0 1 1 0 8 0 pgrppl 48 221 0 204 1 0 1 1 0 8 0 ucredpl 104 2877 0 2862 1 0 1 1 0 8 0 zombiepl 144 2695 0 2690 1 0 1 1 0 8 0 processpl 1208 2761 0 2690 7 1 6 6 0 8 0 procpl 656 6551 0 6476 9 1 8 8 0 8 0 srpgc 96 18 0 18 3 3 0 1 0 8 0 sosppl 168 15 0 15 3 3 0 1 0 8 0 sockpl 728 4644 0 4610 17 12 5 11 0 8 1 mcl64k 65536 7 0 0 1 0 1 1 0 8 0 mcl16k 16384 2 0 0 1 0 1 1 0 8 0 mcl9k 9216 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 126 0 0 16 0 16 16 0 8 0 mcl2k2 2112 1 0 0 1 0 1 1 0 8 0 mcl2k 2048 24 0 0 3 0 3 3 0 8 0 mtagpl 96 28 0 0 1 0 1 1 0 8 0 mbufpl 256 746 0 0 45 0 45 45 0 8 0 bufpl 280 6297 0 155 439 0 439 439 0 8 0 anonpl 32 9655 0 0 78 0 78 78 0 246 0 amapchunkpl 152 78985 0 78413 39 13 26 32 0 158 3 amappl16 200 5597 0 5559 49 37 12 15 0 8 8 amappl15 192 7 0 7 2 2 0 1 0 8 0 amappl14 184 160 0 148 1 0 1 1 0 8 0 amappl13 176 5 0 5 3 3 0 1 0 8 0 amappl12 168 3505 0 3473 4 2 2 3 0 8 0 amappl11 160 78 0 64 1 0 1 1 0 8 0 amappl10 152 10 0 9 1 0 1 1 0 8 0 amappl9 144 244 0 244 1 1 0 1 0 8 0 amappl8 136 24 0 20 1 0 1 1 0 8 0 amappl7 128 140 0 128 1 0 1 1 0 8 0 amappl6 120 263 0 259 1 0 1 1 0 8 0 amappl5 112 155 0 145 1 0 1 1 0 8 0 amappl4 104 418 0 397 1 0 1 1 0 8 0 amappl3 96 16333 0 16206 5 1 4 4 0 8 0 amappl2 88 875 0 811 2 0 2 2 0 8 0 amappl1 80 21571 0 20960 19 2 17 17 0 8 2 amappl 88 22291 0 22101 5 0 5 5 0 92 0 dma65536 65536 1 0 1 1 1 0 1 0 8 0 dma32768 32768 1 0 1 1 1 0 1 0 8 0 dma16384 16384 1 0 1 1 1 0 1 0 8 0 dma4096 4096 2 0 2 2 2 0 1 0 8 0 dma2048 2048 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 7 0 7 2 2 0 1 0 8 0 dma128 128 255 0 255 3 3 0 1 0 8 0 dma64 64 7 0 7 2 2 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 47 0 8 1 0 1 1 0 8 0 uaddrrnd 24 2699 0 2667 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 2699 0 2667 1 0 1 1 0 8 0 vmmpekpl 168 23577 0 23522 3 0 3 3 0 8 0 vmmpepl 168 172963 0 170855 115 11 104 104 0 357 3 vmsppl 480 2698 0 2667 6 1 5 5 0 8 0 rwobjpl 72 49475 0 42531 132 1 131 131 0 8 1 pdppl 4096 5406 0 5334 130 54 76 84 0 8 4 pvpl 32 16194 0 0 131 0 131 131 0 265 0 pmappl 256 2698 0 2667 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 486 0 94 12 0 12 12 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff837eeff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff8393c3f0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:128 [inline] __mp_lock(ffffffff8393c3f0) at __mp_lock+0x192 sys/kern/kern_lock.c:159 softintr_dispatch(2) at softintr_dispatch+0x12a sys/kern/kern_softintr.c:83 dosoftint(2) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:840 Xsofttty() at Xsofttty+0x27 __mp_lock(ffffffff8393c3f0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:128 [inline] __mp_lock(ffffffff8393c3f0) at __mp_lock+0x192 sys/kern/kern_lock.c:159 softintr_dispatch(0) at softintr_dispatch+0x12a sys/kern/kern_softintr.c:83 dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:840 Xsoftclock() at Xsoftclock+0x27 end of kernel end trace frame: 0x7af8903beac0, count: 4 ddb{0}> trace x86_ipi_db(ffffffff837eeff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff8393c3f0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:128 [inline] __mp_lock(ffffffff8393c3f0) at __mp_lock+0x192 sys/kern/kern_lock.c:159 softintr_dispatch(2) at softintr_dispatch+0x12a sys/kern/kern_softintr.c:83 dosoftint(2) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:840 Xsofttty() at Xsofttty+0x27 __mp_lock(ffffffff8393c3f0) at __mp_lock+0x192 __mp_lock_spin sys/kern/kern_lock.c:128 [inline] __mp_lock(ffffffff8393c3f0) at __mp_lock+0x192 sys/kern/kern_lock.c:159 softintr_dispatch(0) at softintr_dispatch+0x12a sys/kern/kern_softintr.c:83 dosoftint(0) at dosoftint+0x54 sys/arch/amd64/amd64/intr.c:840 Xsoftclock() at Xsoftclock+0x27 end of kernel end trace frame: 0x7af8903beac0, count: -11 ddb{0}> machine ddbcpu 1 Stopped at savectx+0xae: movl $0,%gs:0x688 savectx() at savectx+0xae end of kernel end trace frame: 0x7e88fefb3500, count: 14 ddb{1}> trace savectx() at savectx+0xae end of kernel end trace frame: 0x7e88fefb3500, count: -1