panic: pool_do_get: shmpl free list modified: page 0xfffffd800f94f000; item addr 0xfffffd800f94f540; offset 0x40=0xf69ecd07
Stopped at      db_enter+0x25:  addq    $0x8,%rsp
    TID    PID    UID     PRFLAGS     PFLAGS  CPU  COMMAND
 204472  12040  60929        0x10          0    0  syz-executor
*432548  12040  60929        0x10  0x4000000    1K syz-executor
db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438
panic(ffffffff83448dfa) at panic+0x1e5 sys/kern/subr_prf.c:198
pool_do_get(ffffffff83a89ff8,2,ffff80003abca638) at pool_do_get+0x5df
pool_get(ffffffff83a89ff8,2) at pool_get+0x162 sys/kern/subr_pool.c:-1
shmget_allocate_segment(ffff80002a307cc0,ffff80003abca890,4,ffff80003abca7e0) at shmget_allocate_segment+0x1af sys/kern/sysv_shm.c:-1
sys_shmget(ffff80002a307cc0,ffff80003abca890,ffff80003abca7e0) at sys_shmget+0x195 sys/kern/sysv_shm.c:484
syscall(ffff80003abca890) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline]
syscall(ffff80003abca890) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0xc6429c1ad90, count: 7
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports.  Insufficient info makes it difficult to find and fix bugs.
ddb{1}>