[ 864.6468604] panic: kernel diagnostic assertion "sn->sn_opencnt" failed: file "/syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/miscfs/specfs/spec_vnops.c", line 1665 
[ 864.6568834] cpu1: Begin traceback...
[ 864.6769861] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:293
[ 864.7372873] kern_assert() at netbsd:kern_assert+0x65 sys/arch/amd64/amd64/db_disasm.c:1074
[ 864.7875330] spec_close() at netbsd:spec_close+0x8a0 sys/miscfs/specfs/spec_vnops.c:1665
[ 864.8377843] VOP_CLOSE() at netbsd:VOP_CLOSE+0x132 sys/kern/vnode_if.c:605
[ 864.8779844] cnclose() at netbsd:cnclose+0x10a sys/dev/cons.c:159
[ 864.9181899] cdev_close() at netbsd:cdev_close+0x181 sys/kern/subr_devsw.c:1200
[ 864.9684343] spec_close() at netbsd:spec_close+0x5c1 sys/miscfs/specfs/spec_vnops.c:1710
[ 865.0086367] VOP_CLOSE() at netbsd:VOP_CLOSE+0x132 sys/kern/vnode_if.c:605
[ 865.0588834] vn_close() at netbsd:vn_close+0x4c sys/kern/vfs_vnops.c:480
[ 865.0990847] closef() at netbsd:closef+0x1cd sys/kern/kern_descrip.c:832
[ 865.1493320] fd_free() at netbsd:fd_free+0x4dc sys/kern/kern_descrip.c:1571
[ 865.1895335] exit1() at netbsd:exit1+0x3a7 sys/kern/kern_exit.c:301
[ 865.2297336] sys_exit() at netbsd:sys_exit+0xd4 sys/kern/kern_exit.c:180
[ 865.2799834] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 865.2799834] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 865.2799834] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 865.2900330] --- syscall (number 1) ---
[ 865.3101314] netbsd:syscall+0x2da:
[ 865.3101314] cpu1: End traceback...
[ 865.3101314] fatal breakpoint trap in supervisor mode
[ 865.3201814] trap type 1 code 0 rip 0xffffffff80221ab5 cs 0x8 rflags 0x246 cr2 0x40b66c ilevel 0 rsp 0xffffd480da072a30
[ 865.3302290] curlwp 0xfffff783beff95c0 pid 13233.13233 lowest kstack 0xffffd480da06e2c0
[ 865.3302290] Skipping crash dump on recursive panic
[ 865.3302290] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/dev/wsfb/genfb.c:988:28, member access within null pointer of type 'struct genfb_private'

[ 865.3302290] cpu1: Begin traceback...
[ 865.3302290] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:293
[ 865.3302290] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 865.3302290] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 865.3302290] genfb_enable_polling() at netbsd:genfb_enable_polling+0x17e sys/dev/wsfb/genfb.c:988
[ 865.3302290] x86_genfb_ddb_trap_callback() at netbsd:x86_genfb_ddb_trap_callback+0x39 sys/arch/x86/x86/genfb_machdep.c:97
[ 865.3302290] db_trap() at netbsd:db_trap+0x68 sys/ddb/db_trap.c:73
[ 865.3302290] kdb_trap() at netbsd:kdb_trap+0x1aa sys/arch/amd64/amd64/db_interface.c:251
[ 865.3302290] trap() at netbsd:trap+0x5b2 sys/arch/amd64/amd64/trap.c:315
[ 865.3302290] --- trap (number 1) ---
[ 865.3302290] breakpoint() at netbsd:breakpoint+0x5
[ 865.3302290] db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
[ 865.3302290] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:293
[ 865.3302290] kern_assert() at netbsd:kern_assert+0x65 sys/arch/amd64/amd64/db_disasm.c:1074
[ 865.3302290] spec_close() at netbsd:spec_close+0x8a0 sys/miscfs/specfs/spec_vnops.c:1665
[ 865.3302290] VOP_CLOSE() at netbsd:VOP_CLOSE+0x132 sys/kern/vnode_if.c:605
[ 865.3302290] cnclose() at netbsd:cnclose+0x10a sys/dev/cons.c:159
[ 865.3302290] cdev_close() at netbsd:cdev_close+0x181 sys/kern/subr_devsw.c:1200
[ 865.3302290] spec_close() at netbsd:spec_close+0x5c1 sys/miscfs/specfs/spec_vnops.c:1710
[ 865.3302290] VOP_CLOSE() at netbsd:VOP_CLOSE+0x132 sys/kern/vnode_if.c:605
[ 865.3302290] vn_close() at netbsd:vn_close+0x4c sys/kern/vfs_vnops.c:480
[ 865.3302290] closef() at netbsd:closef+0x1cd sys/kern/kern_descrip.c:832
[ 865.3302290] fd_free() at netbsd:fd_free+0x4dc sys/kern/kern_descrip.c:1571
[ 865.3302290] exit1() at netbsd:exit1+0x3a7 sys/kern/kern_exit.c:301
[ 865.3302290] sys_exit() at netbsd:sys_exit+0xd4 sys/kern/kern_exit.c:180
[ 865.3302290] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 865.3302290] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 865.3302290] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 865.3302290] --- syscall (number 1) ---
[ 865.3302290] netbsd:syscall+0x2da:
[ 865.3302290] cpu1: End traceback...
[ 865.3302290] fatal breakpoint trap in supervisor mode
[ 865.3302290] trap type 1 code 0 rip 0xffffffff80221ab5 cs 0x8 rflags 0x246 cr2 0x40b66c ilevel 0x8 rsp 0xffffd480da072100
[ 865.3302290] curlwp 0xfffff783beff95c0 pid 13233.13233 lowest kstack 0xffffd480da06e2c0
[ 865.3302290] uvm_fault(0xfffff7838a3ea9e8, 0x0, 1) -> e
[ 865.3302290] fatal page fault in supervisor mode
[ 865.3302290] trap type 6 code 0 rip 0xffffffff830b6b5b cs 0x8 rflags 0x10217 cr2 0x1e8 ilevel 0x8 rsp 0xffffd480da071d30
[ 865.3302290] curlwp 0xfffff783beff95c0 pid 13233.13233 lowest kstack 0xffffd480da06e2c0
kernel: page fault trap, code=0
[ 865.3302290] uvm_fault(0xfffff7838a3ea9e8, 0x0, 1) -> e
[ 865.3302290] fatal page fault in supervisor mode
[ 865.3302290] trap type 6 code 0 rip 0xffffffff830b6b5b cs 0x8 rflags 0x10217 cr2 0x1e8 ilevel 0x8 rsp 0xffffd480da071960
[ 865.3302290] curlwp 0xfffff783beff95c0 pid 13233.13233 lowest kstack 0xffffd480da06e2c0
kernel: page fault trap, code=0
[ 865.3302290] uvm_fault(0xfffff7838a3ea9e8, 0x0, 1) -> e
[ 865.3302290] fatal page fault in supervisor mode
[ 865.3302290] trap type 6 code 0 rip 0xffffffff830b6b5b cs 0x8 rflags 0x10217 cr2 0x1e8 ilevel 0x8 rsp 0xffffd480da071590
[ 865.3302290] curlwp 0xfffff783beff95c0 pid 13233.13233 lowest kstack 0xffffd480da06e2c0
kernel: page fault trap, code=0
[ 865.3302290] uvm_fault(0xfffff7838a3ea9e8, 0x0, 1) -> e
[ 865.3302290] fatal page fault in supervisor mode
[ 865.3302290] trap type 6 code 0 rip 0xffffffff830b6b5b cs 0x8 rflags 0x10217 cr2 0x1e8 ilevel 0x8 rsp 0xffffd480da0711c0
[ 865.3302290] curlwp 0xfffff783beff95c0 pid 13233.13233 lowest kstack 0xffffd480da06e2c0
kernel: page fault trap, code=0
[ 865.3302290] uvm_fault(0xfffff7838a3ea9e8, 0x0, 1) -> e
[ 865.3302290] fatal page fault in supervisor mode
[ 865.3302290] trap type 6 code 0 rip 0xffffffff830b6b5b cs 0x8 rflags 0x10217 cr2 0x1e8 ilevel 0x8 rsp 0xffffd480da070df0
[ 865.3302290] curlwp 0xfffff783beff95c0 pid 13233.13233 lowest kstack 0xffffd480da06e2c0
kernel: page fault trap, code=0
[ 865.3302290] uvm_fault(0xfffff7838a3ea9e8, 0x0, 1) -> e
[ 865.3302290] fatal page fault in supervisor mode
[ 865.3302290] trap type 6 code 0 rip 0xffffffff830b6b5b cs 0x8 rflags 0x10217 cr2 0x1e8 ilevel 0x8 rsp 0xffffd480da070a20
[ 865.3302290] curlwp 0xfffff783beff95c0 pid 13233.13233 lowest kstack 0xffffd480da06e2c0
kernel: page fault trap, code=0
[ 865.3302290] uvm_fault(0xfffff7838a3ea9e8, 0x0, 1) -> e