panic: pool_do_get: mbufpl free list modified: page 0xffffff0035326000; item addr 0xffffff0035326300; offset 0x0=0x3e25322106000100 != 0x3e2532217855ddee Stopped at db_enter+0xa: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND * 5026 71013 0 0 0x4000000 0 syz-executor1 db_enter() at db_enter+0xa panic() at panic+0x147 pool_do_get(2,ffffffff81ea46b8,ffffff0034f58c00) at pool_do_get+0x3ae pool_get(c,0) at pool_get+0x77 m_copyback(ffffff003a34102e,ffffff0034f58c00,40,100,100) at m_copyback+0x344 swofp_send_error(ffffff0034f58c00,ffff800000ad9000,ffff800000ad3900,0) at swofp_send_error+0xac swofp_input(ffff800000ad9000,ffff800014adc3c8) at swofp_input+0x126 switchwrite(ffffff003a4142a8,ffffff003a4142a8,ffff800014adc5a8) at switchwrite+0x30e spec_write(ffffffff81e1e918) at spec_write+0xa0 VOP_WRITE(1,ffffff003a4142a8,1,ffffff0037690438) at VOP_WRITE+0x65 vn_write(ffffff0037690438,ffff800014adc5a8,ffd4) at vn_write+0x161 dofilewritev(ffff800014adc6d0,1,ffff800014adc6e8,ffff8000ffffd070,0) at dofilewritev+0x13e sys_pwritev(ffff800014adc770,ffff8000ffffd070,ffff8000149cf008) at sys_pwritev+0xbf syscall(0) at syscall+0x3e4 end trace frame: 0xffff800014adc7f0, count: 0 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> show panic pool_do_get: mbufpl free list modified: page 0xffffff0035326000; item addr 0xffffff0035326300; offset 0x0=0x3e25322106000100 != 0x3e2532217855ddee ddb> trace db_enter() at db_enter+0xa panic() at panic+0x147 pool_do_get(2,ffffffff81ea46b8,ffffff0034f58c00) at pool_do_get+0x3ae pool_get(c,0) at pool_get+0x77 m_copyback(ffffff003a34102e,ffffff0034f58c00,40,100,100) at m_copyback+0x344 swofp_send_error(ffffff0034f58c00,ffff800000ad9000,ffff800000ad3900,0) at swofp_send_error+0xac swofp_input(ffff800000ad9000,ffff800014adc3c8) at swofp_input+0x126 switchwrite(ffffff003a4142a8,ffffff003a4142a8,ffff800014adc5a8) at switchwrite+0x30e spec_write(ffffffff81e1e918) at spec_write+0xa0 VOP_WRITE(1,ffffff003a4142a8,1,ffffff0037690438) at VOP_WRITE+0x65 vn_write(ffffff0037690438,ffff800014adc5a8,ffd4) at vn_write+0x161 dofilewritev(ffff800014adc6d0,1,ffff800014adc6e8,ffff8000ffffd070,0) at dofilewritev+0x13e sys_pwritev(ffff800014adc770,ffff8000ffffd070,ffff8000149cf008) at sys_pwritev+0xbf syscall(0) at syscall+0x3e4 Xsyscall(6,0,ffffffffffffffb8,0,4,2602601e010) at Xsyscall+0x128 end of kernel end trace frame: 0x262de7f8d40, count: -15 ddb>