panic: malformed IPv4 option passed to ip_optcopy Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND * 39145 61478 0 0 0x4000000 0 syz-executor1 db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399 panic() at panic+0x147 sys/kern/subr_prf.c:208 ip_fragment(1d6637a39ca297b1,ffffff00395f6f00,ffff800000171290) at ip_fragment+0x551 ip_output(ab7a148e5c5bdf16,ffffff0038173a00,ffffff00395f6f00,0,ffffff00370c88c0,ffffff00370c9a80) at ip_output+0xc06 sys/netinet/ip_output.c:501 udp_output(b7d960aa330f5802,1400,ffffff00370c9a80,0) at udp_output+0x444 sys/netinet/udp_usrreq.c:1004 sosend(b23822aacf510bef,ffffff0030bc0d30,ffff8000ffff8e18,1000,ffff8000ffff8e18,ffff8000ffff8e38) at sosend+0x472 sys/kern/uipc_socket.c:513 sendit(67ba688d1efec476,ffff800014a8e5d8,ffff800014a8e5c0,ffff8000ffff53d0,ffff8000ffff8e18) at sendit+0x430 sys/kern/uipc_syscalls.c:662 sys_sendto(c1e08afb2460c412,ffff800014a8e660,ffff8000ffff8e18) at sys_sendto+0x88 syscall(733c857d643b9a4a) at syscall+0x3f1 Xsyscall(6,0,ffffffffffffffd7,0,6,17a5b88e010) at Xsyscall+0x128 end of kernel end trace frame: 0x17d3599cab0, count: 5 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> show panic malformed IPv4 option passed to ip_optcopy ddb> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399 panic() at panic+0x147 sys/kern/subr_prf.c:208 ip_fragment(1d6637a39ca297b1,ffffff00395f6f00,ffff800000171290) at ip_fragment+0x551 ip_output(ab7a148e5c5bdf16,ffffff0038173a00,ffffff00395f6f00,0,ffffff00370c88c0,ffffff00370c9a80) at ip_output+0xc06 sys/netinet/ip_output.c:501 udp_output(b7d960aa330f5802,1400,ffffff00370c9a80,0) at udp_output+0x444 sys/netinet/udp_usrreq.c:1004 sosend(b23822aacf510bef,ffffff0030bc0d30,ffff8000ffff8e18,1000,ffff8000ffff8e18,ffff8000ffff8e38) at sosend+0x472 sys/kern/uipc_socket.c:513 sendit(67ba688d1efec476,ffff800014a8e5d8,ffff800014a8e5c0,ffff8000ffff53d0,ffff8000ffff8e18) at sendit+0x430 sys/kern/uipc_syscalls.c:662 sys_sendto(c1e08afb2460c412,ffff800014a8e660,ffff8000ffff8e18) at sys_sendto+0x88 syscall(733c857d643b9a4a) at syscall+0x3f1 Xsyscall(6,0,ffffffffffffffd7,0,6,17a5b88e010) at Xsyscall+0x128 end of kernel end trace frame: 0x17d3599cab0, count: -10 ddb> show registers rdi 0xffffffff81f1d5a8 kprintf_mutex rsi 0xffffffff81bcf0c7 db_enter+0x17 rbp 0xffff800014a8e0f0 rbx 0xffff800014a8e190 rdx 0xffff800000932000 rcx 0x1915 __ALIGN_SIZE+0x915 rax 0xffff800000932000 r8 0xffff800014a8e0c0 r9 0 r10 0xb08ae2970c3a292e r11 0x722eac48d88e69a r12 0x3000000008 r13 0xffff800014a8e100 r14 0x100 r15 0xffffffff81cbe76a substchar+0xfe5f rip 0xffffffff81bcf0c8 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff800014a8e0e0 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb> show proc PROC (syz-executor1) pid=39145 stat=onproc flags process=0 proc=4000000 pri=80, usrpri=80, nice=20 forw=0xffffffffffffffff, list=0xffff8000ffff9070,0xffffffff81fafe18 process=0xffff8000ffff53d0 user=0xffff800014a89000, vmspace=0xffffff003f12a840 estcpu=36, cpticks=0, pctcpu=0.0 user=0, sys=0, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 61478 12725 81975 0 2 0 syz-executor1 *61478 39145 81975 0 7 0x4000000 syz-executor1 97177 37398 1 0 3 0x100083 ttyin getty 84287 180107 0 0 3 0x14200 bored sosplice 35089 521054 57365 0 2 0x2 syz-executor0 81975 242042 57365 0 3 0x82 nanosleep syz-executor1 57365 108347 30469 0 3 0x82 thrsleep syz-fuzzer 57365 130270 30469 0 3 0x4000082 nanosleep syz-fuzzer 57365 36599 30469 0 3 0x4000082 thrsleep syz-fuzzer 57365 86101 30469 0 3 0x4000082 thrsleep syz-fuzzer 57365 230434 30469 0 3 0x4000082 kqread syz-fuzzer 57365 89901 30469 0 3 0x4000082 thrsleep syz-fuzzer 57365 438307 30469 0 3 0x4000082 thrsleep syz-fuzzer 30469 187774 49155 0 3 0x10008a pause ksh 49155 196019 61277 0 3 0x92 select sshd 61277 265768 1 0 3 0x80 select sshd 41979 159628 28982 73 3 0x100090 kqread syslogd 28982 277973 1 0 3 0x100082 netio syslogd 38180 441376 1 77 3 0x100090 poll dhclient 58176 372740 1 0 3 0x80 poll dhclient 27518 472418 0 0 2 0x14200 zerothread 64774 519403 0 0 3 0x14200 aiodoned aiodoned 21909 60800 0 0 3 0x14200 syncer update 98454 455380 0 0 3 0x14200 cleaner cleaner 32971 462321 0 0 3 0x14200 reaper reaper 48810 114412 0 0 3 0x14200 pgdaemon pagedaemon 96835 426412 0 0 3 0x14200 bored crynlk 80067 45681 0 0 3 0x14200 bored crypto 92274 473928 0 0 3 0x40014200 acpi0 acpi0 81310 416082 0 0 3 0x14200 bored softnet 38945 126929 0 0 3 0x14200 bored systqmp 81869 92704 0 0 3 0x14200 bored systq 54807 353371 0 0 3 0x40014200 bored softclock 49977 446103 0 0 3 0x40014200 idle0 1 281063 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper