[ 3610.2679071] panic: vrelel: bad ref count [ 3610.2779504] cpu1: Begin traceback... [ 3610.2880027] vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:292 [ 3610.3482981] vnpanic() at netbsd:vnpanic+0xa9 sys/kern/vfs_vnode.c:298 [ 3610.4086056] vrelel() at netbsd:vrelel+0x12b8 sys/kern/vfs_vnode.c:1402 [ 3610.4488006] vrele() at netbsd:vrele+0x51 sys/kern/vfs_vnode.c:1022 [ 3610.4890055] union_rele() at netbsd:union_rele+0x174 sys/fs/union/union_subr.c:322 [ 3610.5291998] union_freevp() at netbsd:union_freevp+0xac sys/fs/union/union_subr.c:551 [ 3610.5593532] union_reclaim() at netbsd:union_reclaim+0xd8 sys/fs/union/union_vnops.c:1663 [ 3610.5995580] VOP_RECLAIM() at netbsd:VOP_RECLAIM+0xc7 sys/kern/vnode_if.c:1601 [ 3610.6397553] vcache_reclaim() at netbsd:vcache_reclaim+0x402 sys/kern/vfs_vnode.c:1884 [ 3610.6799604] vrelel() at netbsd:vrelel+0x682 sys/kern/vfs_vnode.c:971 [ 3610.7201366] vrele() at netbsd:vrele+0x51 sys/kern/vfs_vnode.c:1022 [ 3610.7603330] union_remove() at netbsd:union_remove+0x130 sys/fs/union/union_vnops.c:1232 [ 3610.8105852] VOP_REMOVE() at netbsd:VOP_REMOVE+0x19c sys/kern/vnode_if.c:1219 [ 3610.8608337] do_sys_unlinkat() at netbsd:do_sys_unlinkat+0x5b5 sys/kern/vfs_syscalls.c:2914 [ 3610.9110903] syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline] [ 3610.9110903] syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline] [ 3610.9110903] syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138 [ 3610.9211340] --- syscall (number 10) --- [ 3610.9412498] netbsd:syscall+0x25a: [ 3610.9412498] cpu1: End traceback... [ 3610.9412498] fatal breakpoint trap in supervisor mode [ 3610.9512842] trap type 1 code 0 rip 0xffffffff8023241d cs 0x8 rflags 0x286 cr2 0x7f5afc8b1000 ilevel 0 rsp 0xffffc182776b9590 [ 3610.9613611] curlwp 0xffffc180151ceac0 pid 5054.5054 lowest kstack 0xffffc182776b22c0 Stopped in pid 5054.5054 (syz-executor.5) at netbsd:breakpoint+0x5: leave ? breakpoint() at netbsd:breakpoint+0x5 db_panic() at netbsd:db_panic+0x105 sys/ddb/db_panic.c:69 vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:292 vnpanic() at netbsd:vnpanic+0xa9 sys/kern/vfs_vnode.c:298 vrelel() at netbsd:vrelel+0x12b8 sys/kern/vfs_vnode.c:1402 vrele() at netbsd:vrele+0x51 sys/kern/vfs_vnode.c:1022 union_rele() at netbsd:union_rele+0x174 sys/fs/union/union_subr.c:322 union_freevp() at netbsd:union_freevp+0xac sys/fs/union/union_subr.c:551 union_reclaim() at netbsd:union_reclaim+0xd8 sys/fs/union/union_vnops.c:1663 VOP_RECLAIM() at netbsd:VOP_RECLAIM+0xc7 sys/kern/vnode_if.c:1601 vcache_reclaim() at netbsd:vcache_reclaim+0x402 sys/kern/vfs_vnode.c:1884 vrelel() at netbsd:vrelel+0x682 sys/kern/vfs_vnode.c:971 vrele() at netbsd:vrele+0x51 sys/kern/vfs_vnode.c:1022 union_remove() at netbsd:union_remove+0x130 sys/fs/union/union_vnops.c:1232 VOP_REMOVE() at netbsd:VOP_REMOVE+0x19c sys/kern/vnode_if.c:1219 do_sys_unlinkat() at netbsd:do_sys_unlinkat+0x5b5 sys/kern/vfs_syscalls.c:2914 syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline] syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline] syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138 --- syscall (number 10) --- netbsd:syscall+0x25a: Panic string: vrelel: bad ref count PID LID S CPU FLAGS STRUCT LWP * NAME WAIT 15305 15305 2 1 0 ffffc180156e62c0 syz-executor.1 5054 >5054 7 1 40 ffffc180151ceac0 syz-executor.5 13291 13291 3 1 1c0 ffffc18015245b00 syz-executor.3 pipe_rd 26421 26421 3 1 180 ffffc180140a99c0 syz-executor.3 parked 14798 24374 3 1 1100000 ffffc18013e156c0 syz-executor.3 vfork 14798 14798 2 1 11000040 ffffc1801345b8c0 syz-executor.3 12974 12974 3 1 180 ffffc18012c0c640 syz-executor.3 parked 6087 25521 3 1 1100000 ffffc180157b3900 syz-executor.3 vfork 6087 6087 2 1 11000040 ffffc18013db5200 syz-executor.3 14282 14282 3 1 180 ffffc18012b76100 syz-executor.3 parked 2797 13261 3 1 1100000 ffffc180133a45c0 syz-executor.3 vfork 2797 2797 2 1 11000040 ffffc180156e0b00 syz-executor.3 15023 15023 3 0 180 ffffc18012d1a640 syz-executor.1 parked 4541 12146 3 0 11100000 ffffc18012dd8500 syz-executor.1 vfork 4541 4541 2 0 11000040 ffffc18012c572c0 syz-executor.1 5687 5687 3 1 180 ffffc1801518ea00 syz-executor.1 parked 26060 12428 2 0 1000040 ffffc18014ccf9c0 syz-executor.1 26060 10018 3 1 11100000 ffffc18012d95480 syz-executor.1 vfork 22926 22926 3 1 180 ffffc18012bf21c0 syz-executor.1 parked 12764 26084 3 1 11100000 ffffc180151901c0 syz-executor.1 vfork 12764 12764 2 1 11000040 ffffc18012acf0c0 syz-executor.1 7645 7645 3 1 1c0 ffffc18015274b80 syz-executor.0 pipe_rd 1131 2612 3 1 1100000 ffffc180133d7680 syz-executor.0 tstile 1131 1131 2 0 11000040 ffffc18014dc0640 syz-executor.0 2040 2040 3 0 1c0 ffffc180140a9580 syz-executor.2 pipe_rd 5323 753 3 1 1100000 ffffc18012d42b40 syz-executor.0 tstile 5323 5323 2 1 11000040 ffffc18015723300 syz-executor.0 10300 10300 3 1 180 ffffc180156e06c0 syz-executor.3 parked 6298 6298 3 0 0 ffffc180156e0280 syz-executor.3 vfork 17796 17796 3 1 0 ffffc180156d4ac0 syz-executor.3 vfork 6791 6791 3 1 0 ffffc180156d4680 syz-executor.3 vfork 27038 27038 3 0 0 ffffc180156d4240 syz-executor.3 vfork 6526 6526 3 0 0 ffffc180156caa80 syz-executor.3 vfork 14393 14393 3 0 0 ffffc180156ca640 syz-executor.3 vfork 6513 6513 3 0 0 ffffc180156ca200 syz-executor.3 vfork 6525 6525 3 1 0 ffffc180156c0a40 syz-executor.3 vfork 6521 6521 3 0 0 ffffc180156c0600 syz-executor.3 vfork 29020 29020 3 1 0 ffffc180156c01c0 syz-executor.3 vfork 27037 27037 3 1 0 ffffc180156b8a00 syz-executor.3 vfork 6295 6295 3 0 0 ffffc180156b85c0 syz-executor.3 vfork 6179 6179 3 0 0 ffffc180156b8180 syz-executor.3 vfork 25181 25181 3 0 0 ffffc180156ae9c0 syz-executor.3 vfork 9061 9061 3 0 0 ffffc180156ae580 syz-executor.3 vfork 7480 7480 3 1 0 ffffc180156ae140 syz-executor.3 vfork 16468 16468 3 1 0 ffffc180156a3980 syz-executor.3 vfork 7488 7488 3 1 0 ffffc180156a3540 syz-executor.3 vfork 27533 27533 3 1 0 ffffc180156a3100 syz-executor.3 vfork 6517 6517 3 0 0 ffffc1801554e900 syz-executor.3 vfork 28507 28507 3 0 0 ffffc1801554e4c0 syz-executor.3 vfork 7020 7020 3 0 0 ffffc1801554e080 syz-executor.3 vfork 6499 6499 3 0 0 ffffc18013471940 syz-executor.3 vfork 19543 19543 3 0 0 ffffc18013471500 syz-executor.3 vfork 28009 28009 3 0 0 ffffc180134710c0 syz-executor.3 vfork 29771 29771 3 1 0 ffffc18013443300 syz-executor.3 vfork 29032 29032 3 1 0 ffffc180140b7280 syz-executor.3 vfork 25156 25156 3 0 0 ffffc18014d815c0 syz-executor.3 vfork 2106 2106 3 0 0 ffffc18012cf25c0 syz-executor.3 vfork 6522 6522 3 0 0 ffffc18012dbe080 syz-executor.3 vfork 20312 20312 3 0 0 ffffc180151ce240 syz-executor.3 vfork 27999 27999 3 1 0 ffffc180140af1c0 syz-executor.3 vfork 21826 7507 2 1 1000040 ffffc18014dc1ac0 syz-executor.3 21826 7472 3 0 1100000 ffffc18013380140 syz-executor.3 vfork 7090 7090 3 0 180 ffffc18015274300 syz-executor.3 parked 27124 27354 2 1 1000040 ffffc18015274740 syz-executor.3 27124 28449 3 0 11100000 ffffc180133ec280 syz-executor.3 vfork 26511 26511 3 0 180 ffffc180140b5680 syz-executor.3 parked 27815 6004 3 0 11100000 ffffc18015190600 syz-executor.3 vfork 27815 27815 2 1 11000040 ffffc18012d54b80 syz-executor.3 26586 25840 3 1 1100000 ffffc18015428780 syz-executor.0 tstile 26586 26586 2 1 11000040 ffffc18013364980 syz-executor.0 27091 7112 3 0 1100000 ffffc18015428340 syz-executor.0 tstile 27091 27091 2 0 11000040 ffffc1801345b480 syz-executor.0 3562 24827 3 1 1100000 ffffc18013ef7780 syz-executor.0 tstile 3562 3562 2 0 11000040 ffffc18012cd8100 syz-executor.0 24987 6563 3 0 1100000 ffffc180140a8540 syz-executor.0 tstile 24987 24987 2 0 11000040 ffffc1801508a340 syz-executor.0 23177 22265 3 0 1100000 ffffc18012cf2a00 syz-executor.0 tstile 23177 23177 2 1 11000040 ffffc18013443740 syz-executor.0 23010 2783 3 0 1100000 ffffc18012c7a300 syz-executor.0 tstile 23010 23010 2 0 11000040 ffffc18014ea0b00 syz-executor.0 3455 5762 3 0 1100000 ffffc180140b2a80 syz-executor.0 tstile 3455 3455 2 1 11000040 ffffc18014cb1540 syz-executor.0 1360 1360 3 0 180 ffffc180133d7240 syz-executor.3 parked 22862 27727 3 0 11100000 ffffc1801345b040 syz-executor.3 vfork 22862 22862 2 1 11000040 ffffc180146af8c0 syz-executor.3 793 793 3 0 180 ffffc18015180140 syz-executor.3 parked 792 792 3 0 0 ffffc18015179980 syz-executor.3 vfork 791 791 3 0 0 ffffc18015179540 syz-executor.3 vfork 790 790 3 0 0 ffffc18015179100 syz-executor.3 vfork 789 789 3 0 0 ffffc1801516d940 syz-executor.3 vfork 788 788 3 0 0 ffffc1801516d500 syz-executor.3 vfork 787 787 3 0 0 ffffc1801516d0c0 syz-executor.3 vfork 786 786 3 0 0 ffffc18015163900 syz-executor.3 vfork 785 785 3 0 0 ffffc180151634c0 syz-executor.3 vfork 784 784 3 0 0 ffffc18015163080 syz-executor.3 vfork 783 783 3 0 0 ffffc180151588c0 syz-executor.3 vfork 782 782 3 0 0 ffffc18015158480 syz-executor.3 vfork 781 781 3 0 0 ffffc18015158040 syz-executor.3 vfork 780 780 3 0 0 ffffc1801514fbc0 syz-executor.3 vfork 779 779 3 0 0 ffffc1801514f780 syz-executor.3 vfork 778 778 3 0 0 ffffc1801514f340 syz-executor.3 vfork 777 777 3 0 0 ffffc18015146b80 syz-executor.3 vfork 776 776 3 0 0 ffffc18015146740 syz-executor.3 vfork 775 775 3 0 0 ffffc18015146300 syz-executor.3 vfork 774 774 3 0 0 ffffc1801513ab40 syz-executor.3 vfork 773 773 3 0 0 ffffc1801513a700 syz-executor.3 vfork 772 772 3 0 0 ffffc1801513a2c0 syz-executor.3 vfork 771 771 3 0 0 ffffc1801512eb00 syz-executor.3 vfork 770 770 3 0 0 ffffc1801512e6c0 syz-executor.3 vfork 769 769 3 0 0 ffffc1801512e280 syz-executor.3 vfork 768 768 3 0 0 ffffc18015126ac0 syz-executor.3 vfork 21