uvm_fault(0xffffffff83ae5038, 0xffff800026c72008, 0, 1) -> d kernel: page fault trap, code=0 Stopped at ffs2_balloc+0xa0a: movq 0(%rcx,%rax,8),%r14 TID PID UID PRFLAGS PFLAGS CPU COMMAND *450073 38428 0 0 0x4000000 0 syz-executor ffs2_balloc(fffff8806f55fb00,35949,1,fffff88007ffd820,3,ffff8000380d7448) at ffs2_balloc+0xa0a sys/ufs/ffs/ffs_balloc.c:614 ffs_write(ffff8000380d74d0) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345 VOP_WRITE(fffff8806d9a5888,ffff8000380d7688,7,fffff88007ffd820) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245 vn_write(fffff8806f89e9e0,ffff8000380d7688,0) at vn_write+0x1c2 sys/kern/vfs_vnops.c:414 dofilewritev(ffff80002a76bca0,4,ffff8000380d7688,0,ffff8000380d7730) at dofilewritev+0x2bd sys/kern/sys_generic.c:384 sys_write(ffff80002a76bca0,ffff8000380d77e0,ffff8000380d7730) at sys_write+0xa2 sys/kern/sys_generic.c:300 syscall(ffff8000380d77e0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff8000380d77e0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xe4f9cfbcc90, count: 7 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: uvm_fault(0xffffffff83ae5038, 0xffff800026c72008, 0, 1) -> d ddb> show kasan No such command ddb> trace ffs2_balloc(fffff8806f55fb00,35949,1,fffff88007ffd820,3,ffff8000380d7448) at ffs2_balloc+0xa0a sys/ufs/ffs/ffs_balloc.c:614 ffs_write(ffff8000380d74d0) at ffs_write+0x4f9 sys/ufs/ffs/ffs_vnops.c:345 VOP_WRITE(fffff8806d9a5888,ffff8000380d7688,7,fffff88007ffd820) at VOP_WRITE+0x101 sys/kern/vfs_vops.c:245 vn_write(fffff8806f89e9e0,ffff8000380d7688,0) at vn_write+0x1c2 sys/kern/vfs_vnops.c:414 dofilewritev(ffff80002a76bca0,4,ffff8000380d7688,0,ffff8000380d7730) at dofilewritev+0x2bd sys/kern/sys_generic.c:384 sys_write(ffff80002a76bca0,ffff8000380d77e0,ffff8000380d7730) at sys_write+0xa2 sys/kern/sys_generic.c:300 syscall(ffff8000380d77e0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff8000380d77e0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xe4f9cfbcc90, count: -8 ddb> show registers rdi 0 rsi 0x2 rbp 0xffff8000380d73f0 rbx 0xfffff8806f55fb00 rdx 0 rcx 0xffff800026c72000 rax 0x1 r8 0xffffffffffffffff r9 0xffff8000380d7448 r10 0 r11 0x43fce4d4c5d93da6 r12 0x1 r13 0xffff800000c48800 r14 0xffff8000380d7290 r15 0xfffff8806378c120 rip 0xffffffff8264102a ffs2_balloc+0xa0a cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff8000380d7280 ss 0x10 ffs2_balloc+0xa0a: movq 0(%rcx,%rax,8),%r14 ddb> show proc PROC (syz-executor) tid=450073 pid=38428 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a76b770,0xffff80002a778020 process=0xffff8000380d8918 user=0xffff8000380d2000, vmspace=0xfffff8807f229450 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb>