login: panic: Data modified on freelist: word 5 of object 0xffff800000ce6000 size 0x100 previous type devbuf (0xd != 0xdead4110) Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *156834 5823 0 0 0x4000000 0 syz-executor.1 db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic() at panic+0x15c sys/kern/subr_prf.c:207 malloc(100,2,a) at malloc+0xa23 sys/kern/kern_malloc.c:331 bpfopen(51700,1,2000,ffff8000ffff53d0) at bpfopen+0xb5 sys/net/bpf.c:360 spec_open_clone(ffff800016980b98) at spec_open_clone+0x241 sys/kern/spec_vnops.c:737 spec_open(ffff800016980b98) at spec_open+0x40e VOP_OPEN(fffffd8036ce64e0,1,fffffd803f7c69c0,ffff8000ffff53d0) at VOP_OPEN+0x6a sys/kern/vfs_vops.c:154 vn_open(ffff800016980dd8,1,0) at vn_open+0x494 sys/kern/vfs_vnops.c:174 doopenat(ffff8000ffff53d0,ffffff9c,20000080,0,0,ffff800016980fd0) at doopenat+0x28e sys/kern/vfs_syscalls.c:1157 syscall(ffff800016981050) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555 Xsyscall(6,0,ffffffffffffffa2,0,4,fd1aad830e0) at Xsyscall+0x128 end of kernel end trace frame: 0xfd3f0172380, count: 4 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic Data modified on freelist: word 5 of object 0xffff800000ce6000 size 0x100 previous type devbuf (0xd != 0xdead4110) ddb> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:398 panic() at panic+0x15c sys/kern/subr_prf.c:207 malloc(100,2,a) at malloc+0xa23 sys/kern/kern_malloc.c:331 bpfopen(51700,1,2000,ffff8000ffff53d0) at bpfopen+0xb5 sys/net/bpf.c:360 spec_open_clone(ffff800016980b98) at spec_open_clone+0x241 sys/kern/spec_vnops.c:737 spec_open(ffff800016980b98) at spec_open+0x40e VOP_OPEN(fffffd8036ce64e0,1,fffffd803f7c69c0,ffff8000ffff53d0) at VOP_OPEN+0x6a sys/kern/vfs_vops.c:154 vn_open(ffff800016980dd8,1,0) at vn_open+0x494 sys/kern/vfs_vnops.c:174 doopenat(ffff8000ffff53d0,ffffff9c,20000080,0,0,ffff800016980fd0) at doopenat+0x28e sys/kern/vfs_syscalls.c:1157 syscall(ffff800016981050) at syscall+0x507 sys/arch/amd64/amd64/trap.c:555 Xsyscall(6,0,ffffffffffffffa2,0,4,fd1aad830e0) at Xsyscall+0x128 end of kernel end trace frame: 0xfd3f0172380, count: -11 ddb> show registers rdi 0xffffffff81d5c6a7 db_enter+0x17 rsi 0x40e8 __ALIGN_SIZE+0x30e8 rbp 0xffff8000169808a0 rbx 0xffff800016980950 rdx 0x40e9 __ALIGN_SIZE+0x30e9 rcx 0xffff8000179b8000 rax 0xffff8000179b8000 r8 0xffff800016980860 r9 0x1 r10 0xffff800000aa0c00 r11 0x9c8eb466a6457c43 r12 0x3000000008 r13 0xffff8000169808b0 r14 0x100 r15 0x1 rip 0xffffffff81d5c6a8 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff800016980890 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb> show proc PROC (syz-executor.1) pid=156834 stat=onproc flags process=0 proc=4000000 pri=86, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff8000ffff9150,0xffffffff825a4598 process=0xffff8000ffff6a30 user=0xffff80001697c000, vmspace=0xfffffd803f014990 estcpu=36, cpticks=1, pctcpu=0.0 user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 5823 76920 72455 0 2 0 syz-executor.1 5823 338711 72455 0 3 0x4000080 kqread syz-executor.1 * 5823 156834 72455 0 7 0x4000000 syz-executor.1 72455 275620 95985 0 3 0x82 nanosleep syz-executor.1 87938 435948 1 0 3 0x100083 ttyin getty 34364 190339 95985 0 3 0x2 biowait syz-executor.0 23991 55672 0 0 3 0x14200 acct acct 29559 157132 0 0 3 0x14200 bored sosplice 95985 146783 90569 0 3 0x82 thrsleep syz-fuzzer 95985 300613 90569 0 3 0x4000082 thrsleep syz-fuzzer 95985 233231 90569 0 3 0x4000082 thrsleep syz-fuzzer 95985 311440 90569 0 3 0x4000082 thrsleep syz-fuzzer 95985 417111 90569 0 3 0x4000082 kqread syz-fuzzer 95985 280012 90569 0 3 0x4000082 thrsleep syz-fuzzer 95985 229923 90569 0 3 0x4000082 thrsleep syz-fuzzer 90569 439644 29037 0 3 0x10008a pause ksh 29037 155187 74672 0 3 0x92 select sshd 74672 414875 1 0 3 0x80 select sshd 46949 475447 61117 73 3 0x100090 kqread syslogd 61117 462350 1 0 3 0x100082 netio syslogd 68738 43405 1 77 3 0x100090 poll dhclient 43638 13662 1 0 3 0x80 poll dhclient 785 114987 0 0 2 0x14200 zerothread 64628 125496 0 0 3 0x14200 aiodoned aiodoned 55145 518926 0 0 3 0x14200 syncer update 70596 452369 0 0 3 0x14200 cleaner cleaner 39437 205483 0 0 3 0x14200 reaper reaper 2744 97350 0 0 3 0x14200 pgdaemon pagedaemon 89135 142152 0 0 3 0x14200 bored crynlk 73342 99025 0 0 3 0x14200 bored crypto 54288 17880 0 0 3 0x40014200 acpi0 acpi0 35914 150219 0 0 3 0x14200 bored softnet 24273 72589 0 0 3 0x14200 bored systqmp 17418 352515 0 0 3 0x14200 bored systq 77122 382555 0 0 3 0x40014200 bored softclock 44977 497898 0 0 3 0x40014200 idle0 88579 383906 0 0 3 0x14200 bored smr 1 356366 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9563 7260K 15450K 78643K 14978 0 0 pcb 15 10K 12K 78643K 1135 0 0 rtable 97 7K 8K 78643K 908 0 0 ifaddr 73 14K 15K 78643K 253 0 0 counters 19 16K 16K 78643K 19 0 0 ioctlops 0 0K 2K 78643K 96 0 0 iov 0 0K 26K 78643K 340 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 1233 77K 78K 78643K 3122 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 5K 78643K 17 0 0 VM map 8 2K 2K 78643K 20 0 0 sem 12 0K 1K 78643K 539 0 0 dirhash 12 2K 2K 78643K 12 0 0 ACPI 1793 195K 288K 78643K 12645 0 0 file desc 5 13K 25K 78643K 1275 0 0 sigio 0 0K 0K 78643K 19 0 0 proc 48 38K 63K 78643K 799 0 0 subproc 32 2K 2K 78643K 153 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 ip_moptions 0 0K 0K 78643K 155 0 0 in_multi 22 1K 2K 78643K 172 0 0 ether_multi 1 0K 0K 78643K 10 0 0 mrt 0 0K 0K 78643K 10 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 78 344K 344K 78643K 78 0 0 exec 0 0K 1K 78643K 423 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 119 71K 72K 78643K 4596 0 0 UVM aobj 130 5K 5K 78643K 135 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 ip6_options 0 0K 0K 78643K 226 0 0 NDP 18 0K 0K 78643K 80 0 0 temp 214 3548K 4184K 78643K 102390 0 0 kqueue 0 0K 0K 78643K 11 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 34 0 30 1 0 1 1 0 8 0 rtpcb 80 122 0 120 1 0 1 1 0 8 0 rtentry 112 154 0 120 2 0 2 2 0 8 0 unpcb 120 786 0 777 2 1 1 2 0 8 0 syncache 264 7 0 7 4 3 1 1 0 8 1 tcpqe 32 4247 0 4247 2 2 0 1 0 8 0 tcpcb 544 454 0 450 3 2 1 2 0 8 0 ipq 40 19 0 19 6 5 1 1 0 8 1 ipqe 40 221 0 221 6 5 1 1 0 8 1 inpcb 280 2320 0 2311 18 16 2 13 0 8 1 rttmr 72 3 0 3 3 3 0 1 0 8 0 ip6q 72 2 0 2 1 1 0 1 0 8 0 ip6af 40 6 0 6 1 1 0 1 0 8 0 nd6 48 20 0 18 3 2 1 1 0 8 0 pkpcb 40 4 0 4 2 2 0 1 0 8 0 swfcl 56 4 0 0 1 0 1 1 0 8 0 ppxss 1128 16 0 16 8 7 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 668 0 494 27 13 14 15 0 8 2 art_table 32 669 0 494 2 0 2 2 0 8 0 art_node 16 153 0 122 1 0 1 1 0 8 0 sysvmsgpl 40 88 0 69 1 0 1 1 0 8 0 semupl 112 4 0 4 1 1 0 1 0 8 0 semapl 112 535 0 525 1 0 1 1 0 8 0 shmpl 112 133 0 5 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 3424 0 2032 46 0 46 46 0 8 0 ffsino 240 3424 0 2032 83 0 83 83 0 8 0 nchpl 144 5471 0 3876 60 0 60 60 0 8 0 uvmvnodes 72 5018 0 0 92 0 92 92 0 8 0 vnodes 208 5018 0 0 265 0 265 265 0 8 0 namei 1024 18537 0 18537 3 2 1 1 0 8 1 vcpupl 1984 6 0 0 1 0 1 1 0 8 0 vmpool 520 18 0 12 1 0 1 1 0 8 0 scsiplug 64 3 0 3 2 2 0 1 0 8 0 scxspl 192 20170 0 20169 20 17 3 7 0 8 2 plimitpl 152 126 0 119 1 0 1 1 0 8 0 sigapl 432 1428 0 1415 2 0 2 2 0 8 0 futexpl 56 39463 0 39463 1 0 1 1 0 8 1 knotepl 112 1025 0 1004 3 1 2 2 0 8 1 kqueuepl 104 1298 0 1294 1 0 1 1 0 8 0 pipepl 112 988 0 969 5 4 1 2 0 8 0 fdescpl 424 1429 0 1415 2 0 2 2 0 8 0 filepl 120 13190 0 13086 17 12 5 11 0 8 1 lockfpl 104 485 0 484 1 0 1 1 0 8 0 lockfspl 48 161 0 160 1 0 1 1 0 8 0 sessionpl 112 27 0 17 1 0 1 1 0 8 0 pgrppl 48 34 0 24 1 0 1 1 0 8 0 ucredpl 96 1612 0 1605 1 0 1 1 0 8 0 zombiepl 144 1415 0 1415 3 2 1 1 0 8 1 processpl 864 1445 0 1415 4 0 4 4 0 8 0 procpl 632 3514 0 3476 10 5 5 5 0 8 1 sosppl 128 13 0 13 5 5 0 1 0 8 0 sockpl 384 3270 0 3250 34 29 5 21 0 8 2 mcl64k 65536 674 0 674 39 38 1 33 0 8 1 mcl16k 16384 19 0 19 8 7 1 1 0 8 1 mcl12k 12288 53 0 53 7 6 1 1 0 8 1 mcl9k 9216 25 0 25 7 7 0 1 0 8 0 mcl8k 8192 65 0 65 7 6 1 1 0 8 1 mcl4k 4096 138 0 138 6 5 1 1 0 8 1 mcl2k2 2112 11 0 11 5 4 1 1 0 8 1 mcl2k 2048 63161 0 63118 21 14 7 14 0 8 0 mtagpl 80 43 0 41 3 2 1 1 0 8 0 mbufpl 256 113965 0 113886 56 46 10 26 0 8 0 bufpl 256 13446 0 7349 382 0 382 382 0 8 0 anonpl 16 188514 0 172009 128 59 69 83 0 62 0 amapchunkpl 152 8693 0 8581 39 33 6 19 0 158 0 amappl16 192 8353 0 7419 98 49 49 59 0 8 1 amappl14 176 186 0 181 2 1 1 1 0 8 0 amappl13 168 694 0 692 3 2 1 1 0 8 0 amappl12 160 124 0 122 1 0 1 1 0 8 0 amappl11 152 67 0 56 1 0 1 1 0 8 0 amappl10 144 26 0 25 1 0 1 1 0 8 0 amappl9 136 831 0 824 1 0 1 1 0 8 0 amappl8 128 455 0 423 3 1 2 2 0 8 0 amappl7 120 65 0 59 1 0 1 1 0 8 0 amappl6 112 72 0 62 1 0 1 1 0 8 0 amappl5 104 497 0 486 1 0 1 1 0 8 0 amappl4 96 2268 0 2241 1 0 1 1 0 8 0 amappl3 88 176 0 171 1 0 1 1 0 8 0 amappl2 80 10241 0 10175 4 2 2 3 0 8 0 amappl1 72 37662 0 37253 28 19 9 20 0 8 0 amappl 80 3857 0 3815 2 0 2 2 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 17 0 17 1 1 0 1 0 8 0 aobjpl 64 134 0 5 3 0 3 3 0 8 0 uaddrrnd 24 1447 0 1415 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 1447 0 1415 1 0 1 1 0 8 0 vmmpekpl 168 14504 0 14473 2 0 2 2 0 8 0 vmmpepl 168 183141 0 181148 241 119 122 127 0 357 27 vmsppl 272 1428 0 1415 4 3 1 2 0 8 0 pdppl 4096 2900 0 2860 8 2 6 6 0 8 0 pvpl 32 535612 0 516001 299 128 171 231 0 265 8 pmappl 200 1446 0 1427 4 2 2 2 0 8 0 extentpl 40 41 0 26 1 0 1 1 0 8 0 phpool 112 653 0 140 16 1 15 16 0 8 0