kernel: protection fault trap, code=0 Stopped at pfi_ifhead_RB_REMOVE+0x58: movq 0x10(%r15),%rbx ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic the kernel did not panic ddb> trace pfi_ifhead_RB_REMOVE(ffffffff822b0e00,ffff8000009a5400) at pfi_ifhead_RB_REMOVE+0x58 sys/net/pf_if.c:80 pfi_detach_ifnet(ffff8000009cf000) at pfi_detach_ifnet+0x11e pfi_kif_unref sys/net/pf_if.c:199 [inline] pfi_detach_ifnet(ffff8000009cf000) at pfi_detach_ifnet+0x11e sys/net/pf_if.c:257 if_detach(ffff8000009cf000) at if_detach+0x15d sys/net/if.c:1120 tun_clone_destroy(ffff8000009cf000) at tun_clone_destroy+0x1c6 sys/net/if_tun.c:278 spec_close(ffff8000149e2248) at spec_close+0x3b0 sys/kern/spec_vnops.c:553 VOP_CLOSE(fffffd8036b9d170,81,fffffd803f7c6a20,ffff800014970870) at VOP_CLOSE+0x64 sys/kern/vfs_vops.c:174 vn_closefile(fffffd802fc73088,ffff800014970870) at vn_closefile+0x14b vn_close sys/kern/vfs_vnops.c:289 [inline] vn_closefile(fffffd802fc73088,ffff800014970870) at vn_closefile+0x14b sys/kern/vfs_vnops.c:575 fdrop(fffffd802fc73088,ffff800014970870) at fdrop+0xc9 sys/kern/kern_descrip.c:1260 closef(fffffd802fc73088,ffff800014970870) at closef+0x118 sys/kern/kern_descrip.c:1244 fdfree(ffff800014970870) at fdfree+0xf7 sys/kern/kern_descrip.c:1176 exit1(ffff800014970870,0,1) at exit1+0x32f sys/kern/kern_exit.c:196 sys_exit(ffff800014970870,ffff8000149e24e0,ffff8000149e2550) at sys_exit+0x17 sys/kern/kern_exit.c:94 syscall(ffff8000149e25b0) at syscall+0x508 Xsyscall(6,1,0,1,0,7f7ffffdf9c4) at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffdf990, count: -14 ddb> show registers rdi 0xffffffff822b0e00 pfi_ifs rsi 0xffff8000009a5400 rbp 0xffff8000149e20d0 rbx 0xdeafbeaddeafbead rdx 0x28 rcx 0xd4532f4f256cb520 rax 0xffff8000009a5410 r8 0x101010101010101 r9 0x5 r10 0x5eb75b22b3b88c8b r11 0xbcff0b1aa661fb4 r12 0xffffffff822b0e00 pfi_ifs r13 0 r14 0xffff8000009a5400 r15 0xdeafbeaddeafbead rip 0xffffffff81abc7e8 pfi_ifhead_RB_REMOVE+0x58 cs 0x8 rflags 0x10282 __ALIGN_SIZE+0xf282 rsp 0xffff8000149e2070 ss 0x10 pfi_ifhead_RB_REMOVE+0x58: movq 0x10(%r15),%rbx ddb> show proc PROC (syz-executor.1) pid=266687 stat=onproc flags process=1008 proc=2000 pri=50, usrpri=86, nice=20 forw=0xffffffffffffffff, list=0xffff800014901ea8,0xffffffff8229b1b0 process=0xffff8000ffffa360 user=0xffff8000149dd000, vmspace=0xfffffd803f013990 estcpu=36, cpticks=2, pctcpu=0.0 user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 38470 228773 20401 0 3 0x2 biowait syz-executor.0 41462 292969 1 0 3 0x100083 ttyin getty 81409 519974 20401 0 3 0x82 nanosleep syz-executor.1 42257 406870 0 0 3 0x14200 bored sosplice 20401 212667 40742 0 3 0x82 thrsleep syz-fuzzer 20401 62684 40742 0 3 0x4000082 nanosleep syz-fuzzer 20401 251455 40742 0 3 0x4000082 thrsleep syz-fuzzer 20401 21147 40742 0 3 0x4000082 thrsleep syz-fuzzer 20401 211501 40742 0 3 0x4000082 thrsleep syz-fuzzer 20401 4772 40742 0 3 0x4000082 kqread syz-fuzzer 20401 521991 40742 0 3 0x4000082 thrsleep syz-fuzzer 20401 310239 40742 0 3 0x4000082 thrsleep syz-fuzzer 40742 483040 13514 0 3 0x10008a pause ksh 13514 480016 93571 0 3 0x92 select sshd 93571 152584 1 0 3 0x80 select sshd 92371 216931 51860 73 3 0x100090 kqread syslogd 51860 131760 1 0 3 0x100082 netio syslogd 13545 347274 0 0 2 0x14200 zerothread 42874 209450 0 0 3 0x14200 aiodoned aiodoned 66870 367458 0 0 3 0x14200 syncer update 78877 476919 0 0 3 0x14200 cleaner cleaner 33547 408917 0 0 3 0x14200 reaper reaper 79510 449037 0 0 3 0x14200 pgdaemon pagedaemon 76399 220792 0 0 3 0x14200 bored crynlk 91477 235784 0 0 3 0x14200 bored crypto 65577 330344 0 0 3 0x40014200 acpi0 acpi0 42556 362191 0 0 2 0x14200 softnet 96661 144498 0 0 3 0x14200 bored systqmp 10262 75228 0 0 3 0x14200 bored systq 28112 160558 0 0 3 0x40014200 bored softclock 3664 134610 0 0 3 0x40014200 idle0 78811 387347 0 0 3 0x14200 bored smr 1 371730 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim Kern Lim devbuf 9558 6320K 14638K 78643K 50027 0 0 pcb 19 8K 11K 78643K 6654 0 0 rtable 118 4K 5K 78643K 688 0 0 ifaddr 77 22K 26K 78643K 1352 0 0 counters 19 16K 16K 78643K 19 0 0 ioctlops 0 0K 2K 78643K 699 0 0 iov 0 0K 36K 78643K 1837 0 0 mount 1 1K 1K 78643K 1 0 0 vnodes 1192 75K 76K 78643K 15743 0 0 UFS quota 1 32K 32K 78643K 1 0 0 UFS mount 5 36K 36K 78643K 5 0 0 shm 2 1K 5K 78643K 161 0 0 VM map 2 0K 0K 78643K 2 0 0 sem 12 0K 1K 78643K 1220 0 0 dirhash 12 2K 2K 78643K 12 0 0 ACPI 1793 195K 288K 78643K 12645 0 0 file desc 5 13K 25K 78643K 15094 0 0 sigio 0 0K 0K 78643K 196 0 0 proc 43 30K 54K 78643K 2100 0 0 subproc 32 2K 2K 78643K 97 0 0 NFS srvsock 1 0K 0K 78643K 1 0 0 NFS daemon 1 16K 16K 78643K 1 0 0 ip_moptions 0 0K 0K 78643K 1387 0 0 in_multi 33 2K 2K 78643K 518 0 0 ether_multi 1 0K 0K 78643K 57 0 0 mrt 0 0K 0K 78643K 40 0 0 ISOFS mount 1 32K 32K 78643K 1 0 0 MSDOSFS mount 1 16K 16K 78643K 1 0 0 ttys 114 503K 503K 78643K 114 0 0 exec 0 0K 1K 78643K 1499 0 0 pfkey data 0 0K 4K 78643K 10 0 0 pagedep 1 8K 8K 78643K 1 0 0 inodedep 1 32K 32K 78643K 1 0 0 newblk 1 0K 0K 78643K 1 0 0 VM swap 7 26K 26K 78643K 7 0 0 UVM amap 90 21K 39K 78643K 36179 0 0 UVM aobj 130 4K 4K 78643K 136 0 0 memdesc 1 4K 4K 78643K 1 0 0 crypto data 1 1K 1K 78643K 1 0 0 ip6_options 0 0K 1K 78643K 653 0 0 NDP 18 0K 0K 78643K 366 0 0 temp 210 2716K 3356K 78643K 49822 0 0 kqueue 0 0K 0K 78643K 153 0 0 SYN cache 2 16K 16K 78643K 2 0 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 12 0 6 1 0 1 1 0 8 0 inpcbpl 280 5977 0 5973 1 0 1 1 0 8 0 rtentry 112 90 0 45 2 0 2 2 0 8 0 syncache 264 4 0 4 1 1 0 1 0 8 0 sackhl 24 1 0 1 1 1 0 1 0 8 0 tcpqe 32 20 0 20 1 1 0 1 0 8 0 tcpcb 544 2165 0 2161 1 0 1 1 0 8 0 ipq 40 4 0 4 2 2 0 1 0 8 0 ipqe 40 8 0 8 2 2 0 1 0 8 0 nd6 48 15 0 9 1 0 1 1 0 8 0 swfcl 56 5 0 0 1 0 1 1 0 8 0 ppxss 1128 262 0 262 43 42 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 332 0 135 14 1 13 13 0 8 0 art_table 32 333 0 135 2 0 2 2 0 8 0 art_node 16 78 0 38 1 0 1 1 0 8 0 sysvmsgpl 40 16 0 8 2 1 1 1 0 8 0 semupl 112 1 0 1 1 1 0 1 0 8 0 semapl 112 1218 0 1208 1 0 1 1 0 8 0 shmpl 112 134 0 6 4 0 4 4 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 26346 0 24732 53 0 53 53 0 8 0 ffsino 240 26346 0 24732 96 0 96 96 0 8 0 nchpl 144 47717 0 46097 61 0 61 61 0 8 0 uvmvnodes 72 6814 0 0 124 0 124 124 0 8 0 vnodes 200 6814 0 0 359 0 359 359 0 8 0 namei 1024 155664 0 155663 7 6 1 1 0 8 0 scsiplug 64 14 0 14 14 14 0 1 0 8 0 scxspl 192 150251 0 150250 68 65 3 6 0 8 2 plimitpl 152 523 0 517 1 0 1 1 0 8 0 sigapl 432 15271 0 15260 2 0 2 2 0 8 0 futexpl 56 246139 0 246139 7 6 1 1 0 8 1 knotepl 112 2762 0 2743 2 1 1 2 0 8 0 kqueuepl 104 3439 0 3437 1 0 1 1 0 8 0 pipepl 112 8270 0 8251 18 16 2 2 0 8 1 fdescpl 424 15272 0 15260 2 0 2 2 0 8 0 filepl 120 92265 0 92180 43 39 4 5 0 8 1 lockfpl 104 5433 0 5433 9 8 1 1 0 8 1 lockfspl 48 1866 0 1866 9 8 1 1 0 8 1 sessionpl 112 35 0 27 1 0 1 1 0 8 0 pgrppl 48 177 0 169 1 0 1 1 0 8 0 ucredpl 96 21393 0 21387 1 0 1 1 0 8 0 zombiepl 144 15261 0 15260 3 2 1 1 0 8 0 processpl 848 15287 0 15260 4 0 4 4 0 8 0 procpl 624 34659 0 34625 30 26 4 4 0 8 1 sosppl 128 188 0 188 42 41 1 1 0 8 1 sockpl 384 11787 0 11777 24 22 2 3 0 8 0 mcl64k 65536 2035 0 2035 197 196 1 64 0 8 1 mcl16k 16384 46 0 46 28 28 0 1 0 8 0 mcl12k 12288 241 0 241 33 32 1 1 0 8 1 mcl9k 9216 245 0 245 39 38 1 1 0 8 1 mcl8k 8192 216 0 216 44 43 1 1 0 8 1 mcl4k 4096 635 0 635 12 11 1 1 0 8 1 mcl2k2 2112 68 0 68 31 31 0 1 0 8 0 mcl2k 2048 75427 0 75392 39 33 6 10 0 8 1 mtagpl 80 27 0 27 10 10 0 1 0 8 0 mbufpl 256 182534 0 182487 83 77 6 35 0 8 0 bufpl 256 46658 0 39815 428 0 428 428 0 8 0 anonpl 16 1256189 0 1245540 415 362 53 77 0 62 5 amapchunkpl 152 62011 0 61917 141 135 6 18 0 158 0 amappl16 192 76929 0 76329 401 368 33 43 0 8 1 amappl15 184 2298 0 2297 1 0 1 1 0 8 0 amappl14 176 2347 0 2346 2 1 1 1 0 8 0 amappl13 168 1425 0 1423 1 0 1 1 0 8 0 amappl12 160 42 0 38 1 0 1 1 0 8 0 amappl11 152 61 0 53 1 0 1 1 0 8 0 amappl10 144 11382 0 11379 2 1 1 1 0 8 0 amappl9 136 588 0 585 1 0 1 1 0 8 0 amappl8 128 183 0 162 1 0 1 1 0 8 0 amappl7 120 11331 0 11326 1 0 1 1 0 8 0 amappl6 112 68 0 61 1 0 1 1 0 8 0 amappl5 104 241 0 234 1 0 1 1 0 8 0 amappl4 96 13280 0 13261 1 0 1 1 0 8 0 amappl3 88 5302 0 5292 1 0 1 1 0 8 0 amappl2 80 122852 0 122789 4 2 2 3 0 8 0 amappl1 72 269789 0 269410 24 15 9 19 0 8 0 amappl 80 35084 0 35054 1 0 1 1 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma64 64 259 0 259 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 17 0 17 1 1 0 1 0 8 0 aobjpl 64 135 0 6 3 0 3 3 0 8 0 uaddrrnd 24 15272 0 15260 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 15272 0 15260 1 0 1 1 0 8 0 vmmpekpl 168 98501 0 98473 2 0 2 2 0 8 0 vmmpepl 168 1764817 0 1763261 379 304 75 94 0 357 2 vmsppl 272 15271 0 15260 2 1 1 2 0 8 0 pdppl 4096 30550 0 30520 7 2 5 6 0 8 0 pvpl 32 3746625 0 3732942 915 770 145 254 0 265 27 pmappl 200 15271 0 15260 1 0 1 1 0 8 0 extentpl 40 41 0 26 1 0 1 1 0 8 0 phpool 112 994 0 426 20 2 18 19 0 8 0