panic: pool_do_put: mbufpl: double pool_put: 0xffffff0071454300 Stopped at db_enter+0xa: popq %rbp TID PID UID PRFLAGS PFLAGS CPU COMMAND *209936 85149 0 0 0x4000000 0 syz-executor1 db_enter() at db_enter+0xa panic() at panic+0x147 pool_do_put(ffffff0071454300,ffffffff81ecbc58) at pool_do_put+0x2e2 pool_put(b5879742ae4ca728,ffffff0071454300) at pool_put+0x37 m_free(ffffff0071454300) at m_free+0x12c m_freem(16) at m_freem+0x2d soreceive(0,ffffff006f2eba80,ffff800021138110,465,ffff8000211381a0,ffff8000211380b0) at soreceive+0x1131 recvit(ffff8000211381d0,ffff8000211382d8,ffff8000211382c0,ffff8000ffff72d8,0) at recvit+0x28c sys_recvmsg(ffff800021138360,ffff8000ffff72d8,ffff80002105f330) at sys_recvmsg+0x120 syscall(0) at syscall+0x3e4 Xsyscall(6,0,ffffffffffffffbf,0,3,4d569c8b010) at Xsyscall+0x128 end of kernel end trace frame: 0x4d7d25b1080, count: 4 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> show panic pool_do_put: mbufpl: double pool_put: 0xffffff0071454300 ddb> trace db_enter() at db_enter+0xa panic() at panic+0x147 pool_do_put(ffffff0071454300,ffffffff81ecbc58) at pool_do_put+0x2e2 pool_put(b5879742ae4ca728,ffffff0071454300) at pool_put+0x37 m_free(ffffff0071454300) at m_free+0x12c m_freem(16) at m_freem+0x2d soreceive(0,ffffff006f2eba80,ffff800021138110,465,ffff8000211381a0,ffff8000211380b0) at soreceive+0x1131 recvit(ffff8000211381d0,ffff8000211382d8,ffff8000211382c0,ffff8000ffff72d8,0) at recvit+0x28c sys_recvmsg(ffff800021138360,ffff8000ffff72d8,ffff80002105f330) at sys_recvmsg+0x120 syscall(0) at syscall+0x3e4 Xsyscall(6,0,ffffffffffffffbf,0,3,4d569c8b010) at Xsyscall+0x128 end of kernel end trace frame: 0x4d7d25b1080, count: -11 ddb> show registers rdi 0xffffffff81e10dd8 kprintf_mutex rsi 0xffffffff81679b89 db_enter+0x9 rbp 0xffff800021137e30 rbx 0xffff800021137ed0 rdx 0xffff800001ccf000 rcx 0x1d99 __ALIGN_SIZE+0xd99 rax 0xffff800001ccf000 r8 0xffff800021137e00 r9 0x8080808080808080 r10 0xb5879742ae4ca728 r11 0xffffffff8174f9a0 x86_bus_space_io_read_1 r12 0x3000000008 r13 0xffff800021137e40 r14 0x100 r15 0xffffffff81c3c06c cy_pio_rec+0x4090 rip 0xffffffff81679b8a db_enter+0xa cs 0x8 rflags 0x206 rsp 0xffff800021137e30 ss 0x10 db_enter+0xa: popq %rbp ddb> show proc PROC (syz-executor1) pid=209936 stat=onproc flags process=0 proc=4000000 pri=82, usrpri=82, nice=20 forw=0xffffffffffffffff, list=0xffff8000ffff7530,0xffffffff81eafaa0 process=0xffff80002105f330 user=0xffff800021133000, vmspace=0xffffff007f12ba50 estcpu=36, cpticks=0, pctcpu=0.0 user=0, sys=0, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 85149 381860 6110 0 2 0 syz-executor1 *85149 209936 6110 0 7 0x4000000 syz-executor1 50409 456716 73839 0 2 0 syz-executor0 50409 277522 73839 0 3 0x4000080 ttyout syz-executor0 50409 7149 73839 0 3 0x4000080 fsleep syz-executor0 68891 291675 1 0 3 0x100083 ttyin getty 70646 114759 0 0 3 0x14200 bored sosplice 73839 478944 40031 0 3 0x82 nanosleep syz-executor0 6110 395805 40031 0 3 0x82 nanosleep syz-executor1 40031 198781 49716 0 3 0x82 thrsleep syz-fuzzer 40031 329813 49716 0 3 0x4000082 thrsleep syz-fuzzer 40031 170632 49716 0 3 0x4000082 thrsleep syz-fuzzer 40031 98965 49716 0 3 0x4000082 thrsleep syz-fuzzer 40031 101748 49716 0 3 0x4000082 kqread syz-fuzzer 40031 212649 49716 0 3 0x4000082 thrsleep syz-fuzzer 40031 475432 49716 0 3 0x4000082 thrsleep syz-fuzzer 49716 350810 73936 0 3 0x10008a pause ksh 73936 278858 58343 0 3 0x92 select sshd 58343 429682 1 0 3 0x80 select sshd 32320 49679 13208 73 3 0x100090 kqread syslogd 13208 49599 1 0 3 0x100082 netio syslogd 56410 18858 1 77 3 0x100090 poll dhclient 87700 345552 1 0 3 0x80 poll dhclient 85141 23883 0 0 2 0x14200 zerothread 33277 209903 0 0 3 0x14200 aiodoned aiodoned 42922 15850 0 0 3 0x14200 syncer update 70097 385470 0 0 3 0x14200 cleaner cleaner 24820 464015 0 0 3 0x14200 reaper reaper 29558 221422 0 0 3 0x14200 pgdaemon pagedaemon 96048 16202 0 0 3 0x14200 bored crynlk 73491 480118 0 0 3 0x14200 bored crypto 24999 191370 0 0 3 0x40014200 acpi0 acpi0 35409 357770 0 0 3 0x14200 bored softnet 47509 492519 0 0 3 0x14200 bored systqmp 51323 300057 0 0 3 0x14200 bored systq 54697 215453 0 0 3 0x40014200 bored softclock 52412 416270 0 0 3 0x40014200 idle0 1 243624 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper