panic: mallocarray: overflow 18446744071562067968 * 8 Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *292052 94723 0 0 0x4000000 0 syz-executor1 db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399 panic() at panic+0x154 sys/kern/subr_prf.c:208 mallocarray(23ce4d59a2091730,7fffffff,80000000,82) at mallocarray+0xec wsmux_getmux(1011a0424e17e7fc) at wsmux_getmux+0x6f sys/dev/wscons/wsmux.c:135 wsmux_do_ioctl(f00ac3495c4bd998,80085761,fffffd802f4e3608,82,fffffd803f7c7ae0) a t wsmux_do_ioctl+0x268 VOP_IOCTL(c97283363b0b6998,80085761,fffffd80302c4b50,ffff800014a34728,fffffd802f4e3608,ffff800014a34728) at VOP_IOCTL+0x80 sys/kern/vfs_vops.c:290 vn_ioctl(db60ad9b09e87882,fffffd80302c4b50,ffff800014a34728,8) at vn_ioctl+0xc5 sys/kern/vfs_vnops.c:512 sys_ioctl(d1e55ca8673f6766,0,ffff800014a34728) at sys_ioctl+0x639 syscall(291d745eba10a5de) at syscall+0x528 Xsyscall(6,0,ffffffffffffff8a,0,3,974baac010) at Xsyscall+0x128 end of kernel end trace frame: 0x99ea22a6d0, count: 5 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> show panic mallocarray: overflow 18446744071562067968 * 8 ddb> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399 panic() at panic+0x154 sys/kern/subr_prf.c:208 mallocarray(23ce4d59a2091730,7fffffff,80000000,82) at mallocarray+0xec wsmux_getmux(1011a0424e17e7fc) at wsmux_getmux+0x6f sys/dev/wscons/wsmux.c:135 wsmux_do_ioctl(f00ac3495c4bd998,80085761,fffffd802f4e3608,82,fffffd803f7c7ae0) at wsmux_do_ioctl+0x268 wsmux_add_mux sys/dev/wscons/wsmux.c:563 [inline] wsmux_do_ioctl(f00ac3495c4bd998,80085761,fffffd802f4e3608,82,fffffd803f7c7ae0) at wsmux_do_ioctl+0x268 sys/dev/wscons/wsmux.c:424 VOP_IOCTL(c97283363b0b6998,80085761,fffffd80302c4b50,ffff800014a34728,fffffd802f4e3608,ffff800014a34728) at VOP_IOCTL+0x80 sys/kern/vfs_vops.c:290 vn_ioctl(db60ad9b09e87882,fffffd80302c4b50,ffff800014a34728,8) at vn_ioctl+0xc5 sys/kern/vfs_vnops.c:512sys_ioctl(d1e55ca8673f6766,0,ffff800014a34728) at sys_ioctl+0x639 syscall(291d745eba10a5de) at syscall+0x528 Xsyscall(6,0,ffffffffffffff8a,0,3,974baac010) at Xsyscall+0x128 end of kernel end trace frame: 0x99ea22a6d0, count: -10 ddb> show registers rdi 0xffffffff8111eb77 db_enter+0x17 rsi 0x1813 __ALIGN_SIZE+0x813 rbp 0xffff800014a168c0 rbx 0xffff800014a16960 rdx 0x1814 __ALIGN_SIZE+0x814 rcx 0xffff800001b3a000 rax 0xffff800001b3a000 r8 0xffffffff813e1344 kprintf+0x184 r9 0x1 r10 0x1bc291b96ad5a1a0 r11 0x93de8d51f34f3a7e r12 0x3000000008 r13 0xffff800014a168d0 r14 0x100 r15 0x1 rip 0xffffffff8111eb78 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff800014a168b0 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb> show proc PROC (syz-executor1) pid=292052 stat=onproc flags process=0 proc=4000000 pri=79, usrpri=79, nice=20 forw=0xffffffffffffffff, list=0xffff800014a359e8,0xffffffff82229718 process=0xffff8000149b8d40 user=0xffff800014a11000, vmspace=0xfffffd803f015d68 estcpu=36, cpticks=0, pctcpu=0.0 user=0, sys=0, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 94723 231470 34245 0 2 0 syz-executor1 *94723 292052 34245 0 7 0x4000000 syz-executor1 15039 76821 90556 0 2 0 syz-executor0 15039 244895 90556 0 3 0x4000080 netio syz-executor0 34245 22204 22910 0 3 0x82 nanosleep syz-executor1 90556 8267 22910 0 3 0x82 nanosleep syz-executor0 6067 150524 1 0 3 0x100083 ttyin getty 79481 409029 0 0 3 0x14200 bored sosplice 22910 224595 15747 0 3 0x82 thrsleep syz-fuzzer 22910 208193 15747 0 3 0x4000082 thrsleep syz-fuzzer 22910 243563 15747 0 3 0x4000082 thrsleep syz-fuzzer 22910 401571 15747 0 3 0x4000082 thrsleep syz-fuzzer 22910 268977 15747 0 3 0x4000082 thrsleep syz-fuzzer 22910 424376 15747 0 3 0x4000082 thrsleep syz-fuzzer 22910 47300 15747 0 3 0x4000082 thrsleep syz-fuzzer 22910 464024 15747 0 3 0x4000082 kqread syz-fuzzer 22910 132978 15747 0 3 0x4000082 thrsleep syz-fuzzer 15747 41908 24821 0 3 0x10008a pause ksh 24821 43503 52003 0 3 0x92 select sshd 52003 195562 1 0 3 0x80 select sshd 84807 201983 47464 73 3 0x100090 kqread syslogd 47464 501780 1 0 3 0x100082 netio syslogd 94337 493308 1 77 3 0x100090 poll dhclient 31061 55835 1 0 3 0x80 poll dhclient 27811 191534 0 0 2 0x14200 zerothread 39438 503250 0 0 3 0x14200 aiodoned aiodoned 10397 345920 0 0 3 0x14200 syncer update 83433 497308 0 0 3 0x14200 cleaner cleaner 69471 9322 0 0 3 0x14200 reaper reaper 60778 387324 0 0 3 0x14200 pgdaemon pagedaemon 80958 48510 0 0 3 0x14200 bored crynlk 94694 13106 0 0 3 0x14200 bored crypto 32683 107285 0 0 3 0x40014200 acpi0 acpi0 10178 58475 0 0 3 0x14200 bored softnet 37581 396177 0 0 3 0x14200 bored systqmp 69884 438574 0 0 3 0x14200 bored systq 7153 181485 0 0 3 0x40014200 bored softclock 52663 207194 0 0 3 0x40014200 idle0 1 167243 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9589 8945K 8946K 78643K 16777 0 0 pcb 26 9K 12K 78643K 13792 0 0 rtable 100 3K 3K 78643K 3182 0 0 ifaddr 78 22K 26K 78643K 1775 0 0 counters 19 16K 16K 78643K 19 0 0 ioctlops 0 0K 2K 78643K 217 0 0 iov 0 0K 34K 78643K 2904 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 1193 75K 76K 78643K 17980 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 9K 78643K 416 0 0 VM map 2 0K 0K 78643K 2 0 0 sem 12 0K 0K 78643K 2408 0 0 dirhash 12 2K 2K 78643K 12 0 0 ACPI 1777 193K 286K 78643K 12501 0 0 file desc 6 17K 25K 78643K 26912 0 0 sigio 0 0K 0K 78643K 426 0 0 proc 42 30K 54K 78643K 4552 0 0 subproc 64 65538K 67586K 78643K 522 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 ip_moptions 0 0K 0K 78643K 3596 0 0 in_multi 33 2K 2K 78643K 1219 0 0 ether_multi 1 0K 0K 78643K 156 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 156 689K 689K 78643K 156 0 0 exec 0 0K 1K 78643K 2315 0 0 pfkey data 0 0K 4K 78643K 18 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 149 24K 61K 78643K 66245 0 0 UVM aobj 130 4K 4K 78643K 161 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 ip6_options 0 0K 1K 78643K 702 0 0 NDP 18 0K 0K 78643K 508 0 0 temp 212 2348K 2428K 78643K 74113 0 0 kqueue 0 0K 0K 78643K 318 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 11 0 7 1 0 1 1 0 8 0 inpcbpl 280 11515 0 11508 1 0 1 1 0 8 0 plimitpl 152 348 0 341 1 0 1 1 0 8 0 rtentry 112 104 0 64 2 0 2 2 0 8 0 syncache 264 4 0 4 1 1 0 1 0 8 0 tcpcb 544 4216 0 4212 1 0 1 1 0 8 0 nd6 48 18 0 14 1 0 1 1 0 8 0 swfcl 56 5 0 0 1 0 1 1 0 8 0 ppxss 1128 317 0 317 110 109 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 499 0 310 12 0 12 12 0 8 0 art_table 32 500 0 310 2 0 2 2 0 8 0 art_node 16 103 0 69 1 0 1 1 0 8 0 sysvmsgpl 40 14 0 8 2 1 1 1 0 8 0 semupl 112 2 0 2 1 1 0 1 0 8 0 semapl 112 2406 0 2396 1 0 1 1 0 8 0 shmpl 112 159 0 31 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 53909 0 51875 66 0 66 66 0 8 0 ffsino 240 53909 0 51875 122 2 120 120 0 8 0 nchpl 144 92901 0 91316 60 1 59 60 0 8 0 uvmvnodes 72 6499 0 0 119 0 119 119 0 8 0 vnodes 200 6499 0 0 343 0 343 343 0 8 0 namei 1024 298114 0 298114 9 8 1 1 0 8 1 scsiplug 64 101 0 101 66 66 0 1 0 8 0 scxspl 192 295803 0 295803 119 118 1 6 0 8 1 sigapl 432 27060 0 27046 2 0 2 2 0 8 0 futexpl 56 433428 0 433428 9 8 1 1 0 8 1 knotepl 112 6987 0 6960 53 52 1 2 0 8 0 kqueuepl 104 9415 0 9413 1 0 1 1 0 8 0 pipepl 112 17972 0 17953 53 51 2 2 0 8 1 fdescpl 424 27061 0 27046 2 0 2 2 0 8 0 filepl 120 175055 0 174956 36 32 4 6 0 8 1 lockfpl 96 9181 0 9180 43 42 1 1 0 8 0 lockfspl 24 15621 0 15620 38 37 1 1 0 8 0 sessionpl 112 26 0 16 1 0 1 1 0 8 0 pgrppl 48 351 0 341 1 0 1 1 0 8 0 ucredpl 96 58956 0 58949 1 0 1 1 0 8 0 zombiepl 144 27046 0 27046 1 0 1 1 0 8 1 processpl 840 27075 0 27046 5 1 4 4 0 8 0 procpl 600 64487 0 64448 5 1 4 4 0 8 0 sosppl 128 505 0 505 106 106 0 1 0 8 0 sockpl 384 24692 0 24672 55 52 3 4 0 8 1 mcl64k 65536 15274 0 15274 1413 1385 28 65 0 8 28 mcl16k 16384 90 0 90 70 70 0 1 0 8 0 mcl12k 12288 512 0 512 129 128 1 1 0 8 1 mcl9k 9216 516 0 516 119 118 1 1 0 8 1 mcl8k 8192 554 0 554 132 131 1 1 0 8 1 mcl4k 4096 1347 0 1347 65 64 1 1 0 8 1 mcl2k2 2112 262 0 262 110 109 1 1 0 8 1 mcl2k 2048 81273 0 81246 29 24 5 7 0 8 0 mtagpl 80 4 0 4 2 2 0 1 0 8 0 mbufpl 256 270159 0 270118 759 745 14 36 0 8 8 bufpl 256 51643 0 45112 409 0 409 409 0 8 0 anonpl 16 2743646 0 2735809 945 897 48 65 0 62 11 amapchunkpl 152 135426 0 135344 607 535 72 189 0 158 67 amappl16 192 195830 0 195418 1359 1330 29 45 0 8 8 amappl15 184 1080 0 1079 1 0 1 1 0 8 0 amappl14 176 284 0 280 2 1 1 1 0 8 0 amappl13 168 914 0 910 1 0 1 1 0 8 0 amappl12 160 16 0 16 4 4 0 1 0 8 0 amappl11 152 415 0 406 1 0 1 1 0 8 0 amappl10 144 233 0 232 1 0 1 1 0 8 0 amappl9 136 523 0 522 1 0 1 1 0 8 0 amappl8 128 484 0 393 3 0 3 3 0 8 0 amappl7 120 926 0 917 1 0 1 1 0 8 0 amappl6 112 159 0 151 1 0 1 1 0 8 0 amappl5 104 1463 0 1452 1 0 1 1 0 8 0 amappl4 96 12708 0 12679 2 1 1 2 0 8 0 amappl3 88 14339 0 14331 1 0 1 1 0 8 0 amappl2 80 271111 0 271048 2 0 2 2 0 8 0 amappl1 72 487870 0 487428 25 15 10 19 0 8 0 amappl 72 65133 0 65100 1 0 1 1 0 75 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma64 64 259 0 259 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 17 0 17 1 1 0 1 0 8 0 aobjpl 64 160 0 31 3 0 3 3 0 8 0 uaddrrnd 24 27061 0 27046 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 27061 0 27046 1 0 1 1 0 8 0 vmmpekpl 168 208912 0 208887 2 0 2 2 0 8 0 vmmpepl 168 2802772 0 2801249 743 666 77 89 0 357 4 vmsppl 264 27060 0 27046 3 2 1 2 0 8 0 pdppl 4096 54128 0 54092 6 1 5 6 0 8 0 pvpl 32 7806214 0 7795163 1822 1695 127 232 0 265 32 pmappl 192 27060 0 27046 1 0 1 1 0 8 0 extentpl 40 39 0 25 1 0 1 1 0 8 0 phpool 112 3033 0 2432 21 2 19 19 0 8 0