panic: pool_do_put: mbufpl: double pool_put: 0xffffff007de7cd00 Stopped at db_enter+0xa: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND *201525 13108 0 0 0x4000000 0 syz-executor0 db_enter() at db_enter+0xa panic() at panic+0x147 pool_do_put(ffffff007de7cd00,ffffffff81ecbc58) at pool_do_put+0x2e2 pool_put(3d74236743c520ae,ffffff007de7cd00) at pool_put+0x37 m_free(ffffff007de7cd00) at m_free+0x12c m_freem(16) at m_freem+0x2d soreceive(0,ffffff006f2ee900,ffff800021132330,2a3,ffff8000211323c0,ffff8000211322d0) at soreceive+0x1131 recvit(ffff8000211323f0,ffff8000211324f8,ffff8000211324e0,ffff8000ffffcbc0,0) at recvit+0x28c sys_recvmsg(ffff800021132580,ffff8000ffffcbc0,ffff8000210a5338) at sys_recvmsg+0x120 syscall(0) at syscall+0x3e4 Xsyscall(6,0,ffffffffffffffbf,0,3,f6774208010) at Xsyscall+0x128 end of kernel end trace frame: 0xf6a08ec9740, count: 4 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> show panic pool_do_put: mbufpl: double pool_put: 0xffffff007de7cd00 ddb> trace db_enter() at db_enter+0xa panic() at panic+0x147 pool_do_put(ffffff007de7cd00,ffffffff81ecbc58) at pool_do_put+0x2e2 pool_put(3d74236743c520ae,ffffff007de7cd00) at pool_put+0x37 m_free(ffffff007de7cd00) at m_free+0x12c m_freem(16) at m_freem+0x2d soreceive(0,ffffff006f2ee900,ffff800021132330,2a3,ffff8000211323c0,ffff8000211322d0) at soreceive+0x1131 recvit(ffff8000211323f0,ffff8000211324f8,ffff8000211324e0,ffff8000ffffcbc0,0) at recvit+0x28c sys_recvmsg(ffff800021132580,ffff8000ffffcbc0,ffff8000210a5338) at sys_recvmsg+0x120 syscall(0) at syscall+0x3e4 Xsyscall(6,0,ffffffffffffffbf,0,3,f6774208010) at Xsyscall+0x128 end of kernel end trace frame: 0xf6a08ec9740, count: -11 ddb> show registers rdi 0xffffffff81e10dd8 kprintf_mutex rsi 0xffffffff81679b89 db_enter+0x9 rbp 0xffff800021132050 rbx 0xffff8000211320f0 rdx 0xffff800002acd000 rcx 0x1d4a __ALIGN_SIZE+0xd4a rax 0xffff800002acd000 r8 0xffff800021132020 r9 0x8080808080808080 r10 0x3d74236743c520ae r11 0xffffffff8174f9a0 x86_bus_space_io_read_1 r12 0x3000000008 r13 0xffff800021132060 r14 0x100 r15 0xffffffff81c3c06c cy_pio_rec+0x4090 rip 0xffffffff81679b8a db_enter+0xa cs 0x8 rflags 0x202 rsp 0xffff800021132050 ss 0x10 db_enter+0xa: popq %rbp ddb> show proc PROC (syz-executor0) pid=201525 stat=onproc flags process=0 proc=4000000 pri=73, usrpri=73, nice=20 forw=0xffffffffffffffff, list=0xffff8000ffffce18,0xffffffff81eafaa0 process=0xffff8000210a5338 user=0xffff80002112d000, vmspace=0xffffff007f12b528 estcpu=36, cpticks=0, pctcpu=0.0 user=0, sys=0, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 13108 131092 48617 0 2 0 syz-executor0 *13108 201525 48617 0 7 0x4000000 syz-executor0 10249 75279 40100 0 2 0x2 syz-executor1 93994 256226 0 0 3 0x14200 bored sosplice 48617 317806 40100 0 3 0x82 nanosleep syz-executor0 40100 201344 25293 0 3 0x82 thrsleep syz-fuzzer 40100 93064 25293 0 3 0x4000082 nanosleep syz-fuzzer 40100 459744 25293 0 3 0x4000082 thrsleep syz-fuzzer 40100 380710 25293 0 3 0x4000082 thrsleep syz-fuzzer 40100 478134 25293 0 3 0x4000082 thrsleep syz-fuzzer 40100 224059 25293 0 3 0x4000082 thrsleep syz-fuzzer 40100 505068 25293 0 3 0x4000082 kqread syz-fuzzer 25293 522141 32038 0 3 0x10008a pause ksh 32038 274193 44700 0 3 0x92 select sshd 37809 194771 1 0 3 0x100083 ttyin getty 44700 237968 1 0 3 0x80 select sshd 38758 239791 47072 73 3 0x100090 kqread syslogd 47072 497606 1 0 3 0x100082 netio syslogd 47160 102938 1 77 3 0x100090 poll dhclient 92891 56719 1 0 3 0x80 poll dhclient 95642 9889 0 0 2 0x14200 zerothread 8142 125369 0 0 3 0x14200 aiodoned aiodoned 56367 513441 0 0 3 0x14200 syncer update 48375 286499 0 0 3 0x14200 cleaner cleaner 52067 417599 0 0 3 0x14200 reaper reaper 80502 212774 0 0 3 0x14200 pgdaemon pagedaemon 16958 418663 0 0 3 0x14200 bored crynlk 57841 190698 0 0 3 0x14200 bored crypto 69547 106830 0 0 3 0x40014200 acpi0 acpi0 4703 335260 0 0 3 0x14200 bored softnet 62357 317290 0 0 3 0x14200 bored systqmp 22730 25724 0 0 3 0x14200 bored systq 98129 452094 0 0 3 0x40014200 bored softclock 33103 63972 0 0 3 0x40014200 idle0 1 347989 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper