uvm_fault(0xffffffff8389d910, 0xffff80000162a04a, 0, 1) -> e kernel: page fault trap, code=0 Stopped at arp_rtrequest+0x65e: movzwl 0xc(%r15,%rbx,1),%ecx TID PID UID PRFLAGS PFLAGS CPU COMMAND *180344 74574 0 0 0x4000000 0 syz-executor arp_rtrequest(ffff800000039058,1,fffffd8067a9fc58) at arp_rtrequest+0x65e arprequest sys/netinet/if_ether.c:279 [inline] arp_rtrequest(ffff800000039058,1,fffffd8067a9fc58) at arp_rtrequest+0x65e sys/netinet/if_ether.c:182 rtrequest(1,ffff80003c94f148,0,ffff80003c94f0c0,16) at rtrequest+0xd4c sys/net/route.c:1114 rtm_output(ffff80000149f200,ffff80003c94f1f0,ffff80003c94f148,0,16) at rtm_output+0x855 sys/net/rtsock.c:970 route_output(fffffd805f329200,ffff8000014a0450) at route_output+0x9ac sys/net/rtsock.c:875 route_send(ffff8000014a0450,fffffd805f329200,0,0) at route_send+0xd7 sys/net/rtsock.c:339 sosend(ffff8000014a0450,0,ffff80003c94f398,0,0,808) at sosend+0x824 sys/kern/uipc_socket.c:-1 sendit(ffff80003c98bc58,3,ffff80003c94f490,808,ffff80003c94f540) at sendit+0x721 sys/kern/uipc_syscalls.c:779 sys_sendto(ffff80003c98bc58,ffff80003c94f5f0,ffff80003c94f540) at sys_sendto+0x8d sys/kern/uipc_syscalls.c:557 syscall(ffff80003c94f5f0) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80003c94f5f0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:742 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x661acd1cb70, count: 5 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: uvm_fault(0xffffffff8389d910, 0xffff80000162a04a, 0, 1) -> e ddb> trace arp_rtrequest(ffff800000039058,1,fffffd8067a9fc58) at arp_rtrequest+0x65e arprequest sys/netinet/if_ether.c:279 [inline] arp_rtrequest(ffff800000039058,1,fffffd8067a9fc58) at arp_rtrequest+0x65e sys/netinet/if_ether.c:182 rtrequest(1,ffff80003c94f148,0,ffff80003c94f0c0,16) at rtrequest+0xd4c sys/net/route.c:1114 rtm_output(ffff80000149f200,ffff80003c94f1f0,ffff80003c94f148,0,16) at rtm_output+0x855 sys/net/rtsock.c:970 route_output(fffffd805f329200,ffff8000014a0450) at route_output+0x9ac sys/net/rtsock.c:875 route_send(ffff8000014a0450,fffffd805f329200,0,0) at route_send+0xd7 sys/net/rtsock.c:339 sosend(ffff8000014a0450,0,ffff80003c94f398,0,0,808) at sosend+0x824 sys/kern/uipc_socket.c:-1 sendit(ffff80003c98bc58,3,ffff80003c94f490,808,ffff80003c94f540) at sendit+0x721 sys/kern/uipc_syscalls.c:779 sys_sendto(ffff80003c98bc58,ffff80003c94f5f0,ffff80003c94f540) at sys_sendto+0x8d sys/kern/uipc_syscalls.c:557 syscall(ffff80003c94f5f0) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80003c94f5f0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:742 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x661acd1cb70, count: -10 ddb> show registers rdi 0x20 rsi 0x90 rbp 0xffff80003c94ef90 rbx 0xde rdx 0 rcx 0x100040600080100 rax 0xfffffd805f3291e0 r8 0x1000 __ALIGN_SIZE r9 0 r10 0xf9f658d6f03d1392 r11 0xdb4ef1133c91acd2 r12 0x36 r13 0xfffffd805f329100 r14 0xfffffd8067a9fc58 r15 0xffff800001629f60 rip 0xffffffff811e5a1e arp_rtrequest+0x65e cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff80003c94ef10 ss 0x10 arp_rtrequest+0x65e: movzwl 0xc(%r15,%rbx,1),%ecx ddb> show proc PROC (syz-executor) tid=180344 pid=74574 tcnt=2 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80003c98a548,0xffffffff83945ac0 process=0xffff80002a8e84a8 user=0xffff80003c94a000, vmspace=0xfffffd806c9a3880 estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 74574 356708 59075 0 2 0 syz-executor *74574 180344 59075 0 7 0x4000000 syz-executor 3189 219652 18749 -1 2 0x10 syz-executor 3189 433653 18749 -1 3 0x4000090 fsleep syz-executor 3189 39716 18749 -1 3 0x4000090 fsleep syz-executor 59891 520450 27374 0 3 0x80 nanoslp syz-executor 59891 162904 27374 0 3 0x4000080 bell syz-executor 59891 288782 27374 0 3 0x4000080 fsleep syz-executor 37678 282322 88583 0 3 0x80 nanoslp syz-executor 37678 175924 88583 0 3 0x4000080 lockf syz-executor 37678 415984 88583 0 3 0x4000080 fsleep syz-executor 95854 41539 74979 -1 3 0x90 nanoslp syz-executor 95854 213998 74979 -1 3 0x4000090 kqsel syz-executor 95854 143638 74979 -1 3 0x4000090 fsleep syz-executor 11125 3928 2319 0 3 0x90 nanoslp syz-executor 11125 54941 2319 0 3 0x4000090 wsevent_read syz-executor 11125 378988 2319 0 3 0x4000090 fsleep syz-executor 90172 431298 15525 60928 3 0x90 nanoslp syz-executor 90172 138218 15525 60928 3 0x4000090 kqsel syz-executor 90172 207135 15525 60928 3 0x4000090 fsleep syz-executor 74979 70125 77258 0 3 0x82 nanoslp syz-executor 15525 54596 77258 0 3 0x82 nanoslp syz-executor 26105 492882 0 0 3 0x14200 bored sosplice 88583 227569 77258 0 3 0x82 nanoslp syz-executor 18749 451799 77258 0 3 0x82 nanoslp syz-executor 2319 178720 77258 0 3 0x82 nanoslp syz-executor 59075 91061 77258 0 3 0x82 nanoslp syz-executor 85626 113842 77258 0 3 0x82 nanoslp syz-executor 27374 452281 77258 0 3 0x82 nanoslp syz-executor 77258 21508 23102 0 2 0x2 syz-executor 23102 234709 31710 0 3 0x10008a sigsusp ksh 31710 409490 47662 0 3 0x98 kqread sshd-session 47662 459465 42726 0 3 0x92 kqread sshd-session 27421 435207 1 0 3 0x100083 ttyopn getty 42726 61033 1 0 3 0x88 kqread sshd 27990 324308 88493 73 3 0x1100090 kqread syslogd 88493 390549 1 0 3 0x100082 sbwait syslogd 23579 478864 1 0 3 0x100080 kqread resolvd 46182 412253 3082 77 3 0x100092 kqread dhcpleased 24442 261534 3082 77 3 0x100092 kqread dhcpleased 3082 218574 1 0 3 0x80 kqread dhcpleased 81978 519593 0 0 3 0x14200 bored smr 15441 471404 0 0 2 0x14200 zerothread 22981 39592 0 0 3 0x14200 aiodoned aiodoned 23031 227775 0 0 3 0x14200 syncer update 8591 211671 0 0 3 0x14200 cleaner cleaner 18082 200414 0 0 3 0x14200 reaper reaper 37501 66586 0 0 3 0x14200 pgdaemon pagedaemon 2779 215706 0 0 3 0x14200 bored viomb 7331 38437 0 0 3 0x40014200 acpi0 acpi0 9374 414092 0 0 3 0x14200 bored softnet3 31789 135814 0 0 3 0x14200 bored softnet2 70543 298025 0 0 3 0x14200 bored softnet1 45918 251037 0 0 3 0x14200 bored softnet0 93630 331845 0 0 3 0x14200 bored systqmp 60590 264616 0 0 3 0x14200 bored systq 9443 58625 0 0 3 0x40014200 tmoslp softclock 80286 398285 0 0 3 0x40014200 idle0 1 402419 0 0 3 0x82 wait init 0 0 -1 0 3 0x10010200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10181 11048K 13275K 166960K 14187 0 pcb 18 16K 18K 166960K 248 0 rtable 260 9K 9K 166960K 591 0 pf 32 13K 16K 166960K 104 0 ifaddr 42 7K 8K 166960K 83 0 ifgroup 50 2K 2K 166960K 128 0 sysctl 4 1K 9K 166960K 12 0 counters 32 17K 18K 166960K 68 0 ioctlops 0 0K 4K 166960K 260 0 iov 0 0K 28K 166960K 115 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1573 99K 99K 166960K 2854 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 13K 166960K 21 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 37 0 dirhash 12 2K 2K 166960K 27 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 18 65K 236K 166960K 993 0 sigio 0 0K 0K 166960K 32 0 proc 60 59K 108K 166960K 660 0 subproc 72 4K 4K 166960K 90 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 207 0 in_multi 96 7K 7K 166960K 153 0 ether_multi 1 0K 0K 166960K 8 0 mrt 0 0K 0K 166960K 8 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 91 413K 413K 166960K 91 0 exec 0 0K 1K 166960K 529 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 239 143K 152K 166960K 10104 0 UVM aobj 31 5K 5K 166960K 35 0 pinsyscall 39 78K 95K 166960K 2059 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 51 0 NDP 11 0K 2K 166960K 56 0 temp 52 8670K 8742K 166960K 34842 0 kqueue 13 20K 31K 166960K 165 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 221 0 217 3 0 3 3 0 8 2 rtentry 136 157 0 48 5 0 5 5 0 8 0 unpcb 144 661 0 644 4 0 4 4 0 8 3 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 488 0 483 10 1 9 10 0 8 8 arp 88 25 0 5 1 0 1 1 0 8 0 ipq 40 1 0 0 1 0 1 1 0 8 0 ipqe 40 1 0 0 1 0 1 1 0 8 0 inpcb 328 1144 0 1131 13 3 10 13 0 8 8 ip6q 72 3 0 1 1 0 1 1 0 8 0 ip6af 40 5 0 3 1 0 1 1 0 8 0 nd6 104 36 0 9 1 0 1 1 0 8 0 pkpcb 40 4 0 4 1 0 1 1 0 8 1 kcovpl 48 10 0 2 1 0 1 1 0 8 0 mppekey 1024 1 0 1 1 0 1 1 0 8 1 ppxss 1072 25 0 25 1 0 1 1 0 8 1 pppxif 1384 5 0 5 1 0 1 1 0 8 1 pfstscr 40 2 0 2 1 0 1 1 0 8 1 pfstitem 24 2 0 0 1 0 1 1 0 8 0 pfstkey 128 6 0 4 1 0 1 1 0 8 0 pfstate 384 3 0 2 1 0 1 1 0 8 0 pfrule 1344 3 0 3 1 0 1 1 0 8 1 rttmr 136 1 0 1 1 0 1 1 0 8 1 art_heap8 4096 3 0 0 3 0 3 3 0 8 0 art_heap4 256 586 0 161 30 0 30 30 0 8 1 art_table 40 589 0 161 5 0 5 5 0 8 0 art_node 32 155 0 57 1 0 1 1 0 8 0 sysvmsgpl 40 10 0 7 1 0 1 1 0 8 0 semapl 112 33 0 23 1 0 1 1 0 8 0 shmpl 112 32 0 4 1 0 1 1 0 8 0 dirhash 1024 27 0 10 3 0 3 3 0 8 0 dino2pl 256 3354 0 1858 95 0 95 95 0 8 0 ffsino 248 3354 0 1858 95 0 95 95 0 8 0 nchpl 144 4701 0 3011 64 0 64 64 0 8 1 rtmask 32 3 0 3 1 0 1 1 0 8 1 uvmvnodes 80 4388 0 0 90 0 90 90 0 8 0 vnodes 216 4388 0 0 244 0 244 244 0 8 0 namei 1024 16242 0 16242 2 0 2 2 0 8 2 kstatmem 264 68 0 46 3 0 3 3 0 8 1 scsiplug 72 6 0 6 1 0 1 1 0 8 1 scxspl 216 16073 0 16073 8 0 8 8 1 8 8 plimitpl 152 179 0 162 1 0 1 1 0 8 0 sigapl 424 1278 0 1231 8 0 8 8 0 8 1 knotepl 120 45465 0 45418 20 7 13 17 0 8 11 kqueuepl 184 367 0 356 3 0 3 3 0 8 2 pipepl 296 273 0 246 5 0 5 5 0 8 2 fdescpl 440 1238 0 1208 5 0 5 5 0 8 1 filepl 120 8819 0 8595 15 0 15 15 0 8 5 lockfpl 104 715 0 708 2 0 2 2 0 8 1 lockfspl 48 342 0 337 1 0 1 1 0 8 0 sessionpl 144 24 0 16 1 0 1 1 0 8 0 pgrppl 48 55 0 39 1 0 1 1 0 8 0 ucredpl 104 1817 0 1802 1 0 1 1 0 8 0 zombiepl 144 1232 0 1231 1 0 1 1 0 8 0 processpl 1160 1278 0 1231 5 0 5 5 0 8 0 procpl 656 2525 0 2465 8 0 8 8 0 8 2 sosppl 168 6 0 6 1 0 1 1 0 8 1 sockpl 528 2061 0 2027 12 1 11 12 0 8 8 mcl64k 65536 111 0 111 1 0 1 1 0 8 1 mcl16k 16384 4 0 4 1 0 1 1 0 8 1 mcl12k 12288 3 0 3 1 0 1 1 0 8 1 mcl9k 9216 1 0 1 1 0 1 1 0 8 1 mcl8k 8192 14 0 14 1 0 1 1 0 8 1 mcl4k 4096 3568 0 3517 14 0 14 14 0 8 7 mcl2k 2048 1413 0 1406 7 0 7 7 0 8 5 mtagpl 96 155 0 8 4 0 4 4 0 8 0 mbufpl 256 15529 0 15204 23 1 22 22 0 8 0 bufpl 280 5046 0 124 352 0 352 352 0 8 0 anonpl 24 205095 0 201776 46 0 46 46 0 187 14 amapchunkpl 152 33286 0 32759 28 0 28 28 0 158 7 amappl16 200 4252 0 4219 23 11 12 15 0 8 8 amappl15 192 2 0 2 1 0 1 1 0 8 1 amappl14 184 109 0 99 1 0 1 1 0 8 0 amappl13 176 4 0 4 1 0 1 1 0 8 1 amappl12 168 1876 0 1846 3 0 3 3 0 8 1 amappl11 160 48 0 38 1 0 1 1 0 8 0 amappl10 152 9 0 9 1 0 1 1 0 8 1 amappl9 144 236 0 236 1 0 1 1 0 8 1 amappl8 136 38 0 37 1 0 1 1 0 8 0 amappl7 128 109 0 99 1 0 1 1 0 8 0 amappl6 120 195 0 189 1 0 1 1 0 8 0 amappl5 112 121 0 114 1 0 1 1 0 8 0 amappl4 104 291 0 275 1 0 1 1 0 8 0 amappl3 96 6613 0 6493 4 0 4 4 0 8 0 amappl2 88 649 0 593 2 0 2 2 0 8 0 amappl1 80 11475 0 10928 14 0 14 14 0 8 1 amappl 88 9264 0 9087 5 0 5 5 0 92 0 dma4096 4096 1 0 1 1 0 1 1 0 8 1 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 0 1 1 0 8 1 dma128 128 258 0 258 1 0 1 1 0 8 1 dma64 64 6 0 6 1 0 1 1 0 8 1 dma32 32 7 0 7 1 0 1 1 0 8 1 dma16 16 20 0 19 1 0 1 1 0 8 0 aobjpl 72 34 0 4 1 0 1 1 0 8 0 uaddrrnd 24 1238 0 1208 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 1238 0 1208 1 0 1 1 0 8 0 vmmpekpl 168 10899 0 10856 3 0 3 3 0 8 0 vmmpepl 168 81948 0 80022 95 0 95 95 0 357 7 vmsppl 360 1237 0 1208 4 0 4 4 0 8 1 rwobjpl 32 27218 0 21929 43 0 43 43 0 8 0 pdppl 4096 2483 0 2416 105 38 67 83 0 8 0 pvpl 32 547416 0 538515 127 0 127 127 0 265 42 pmappl 216 1237 0 1208 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 300 0 40 8 0 8 8 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace arp_rtrequest(ffff800000039058,1,fffffd8067a9fc58) at arp_rtrequest+0x65e arprequest sys/netinet/if_ether.c:279 [inline] arp_rtrequest(ffff800000039058,1,fffffd8067a9fc58) at arp_rtrequest+0x65e sys/netinet/if_ether.c:182 rtrequest(1,ffff80003c94f148,0,ffff80003c94f0c0,16) at rtrequest+0xd4c sys/net/route.c:1114 rtm_output(ffff80000149f200,ffff80003c94f1f0,ffff80003c94f148,0,16) at rtm_output+0x855 sys/net/rtsock.c:970 route_output(fffffd805f329200,ffff8000014a0450) at route_output+0x9ac sys/net/rtsock.c:875 route_send(ffff8000014a0450,fffffd805f329200,0,0) at route_send+0xd7 sys/net/rtsock.c:339 sosend(ffff8000014a0450,0,ffff80003c94f398,0,0,808) at sosend+0x824 sys/kern/uipc_socket.c:-1 sendit(ffff80003c98bc58,3,ffff80003c94f490,808,ffff80003c94f540) at sendit+0x721 sys/kern/uipc_syscalls.c:779 sys_sendto(ffff80003c98bc58,ffff80003c94f5f0,ffff80003c94f540) at sys_sendto+0x8d sys/kern/uipc_syscalls.c:557 syscall(ffff80003c94f5f0) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80003c94f5f0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:742 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x661acd1cb70, count: -10 ddb> machine ddbcpu 1 No such command ddb> trace arp_rtrequest(ffff800000039058,1,fffffd8067a9fc58) at arp_rtrequest+0x65e arprequest sys/netinet/if_ether.c:279 [inline] arp_rtrequest(ffff800000039058,1,fffffd8067a9fc58) at arp_rtrequest+0x65e sys/netinet/if_ether.c:182 rtrequest(1,ffff80003c94f148,0,ffff80003c94f0c0,16) at rtrequest+0xd4c sys/net/route.c:1114 rtm_output(ffff80000149f200,ffff80003c94f1f0,ffff80003c94f148,0,16) at rtm_output+0x855 sys/net/rtsock.c:970 route_output(fffffd805f329200,ffff8000014a0450) at route_output+0x9ac sys/net/rtsock.c:875 route_send(ffff8000014a0450,fffffd805f329200,0,0) at route_send+0xd7 sys/net/rtsock.c:339 sosend(ffff8000014a0450,0,ffff80003c94f398,0,0,808) at sosend+0x824 sys/kern/uipc_socket.c:-1 sendit(ffff80003c98bc58,3,ffff80003c94f490,808,ffff80003c94f540) at sendit+0x721 sys/kern/uipc_syscalls.c:779 sys_sendto(ffff80003c98bc58,ffff80003c94f5f0,ffff80003c94f540) at sys_sendto+0x8d sys/kern/uipc_syscalls.c:557 syscall(ffff80003c94f5f0) at syscall+0x97e mi_syscall sys/sys/syscall_mi.h:-1 [inline] syscall(ffff80003c94f5f0) at syscall+0x97e sys/arch/amd64/amd64/trap.c:742 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x661acd1cb70, count: -10