panic: malformed IPv4 option passed to ip_optcopy Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *523520 64447 32767 0x10 0x4000000 0 syz-executor1 245444 44284 0 0x2 0x4000080 1 syz-fuzzer db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399 panic() at panic+0x147 sys/kern/subr_prf.c:208 ip_fragment(2208ec92071ba4ba,ffffff006fe05cb0,ffff800000173290) at ip_fragment+0x625 ip_output(6b33503ffc170449,ffffff006f4b4348,ffffff006a38a600,0,ffffff006a38a600,ffffff007a86d600) at ip_output+0xc8d sys/netinet/ip_output.c:501 udp_output(3409a4d08e10083b,1254,ffffff007a86d600,0) at udp_output+0x45a sys/netinet/udp_usrreq.c:1004 sosend(53237d34f396d8ff,ffffff006828cda8,ffff80002113adc8,11ac,ffff80002113af00,0) at sosend+0x47a sys/kern/uipc_socket.c:513 dofilewritev(7afefa19a38a5ac5,0,3,ffff800021063788,ffff80002113af00) at dofilewritev+0x14b sys/kern/sys_generic.c:364 sys_writev(519c998a0a371e79,790,ffff800021063788) at sys_writev+0xdb sys/kern/sys_generic.c:310 syscall(526b2c03eef1c590) at syscall+0x496 mi_syscall sys/sys/syscall_mi.h:99 [inline] syscall(526b2c03eef1c590) at syscall+0x496 sys/arch/amd64/amd64/trap.c:583 Xsyscall(6,0,d,0,3,9da85d67010) at Xsyscall+0x128 end of kernel end trace frame: 0x9dd42313a20, count: 5 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> show panic malformed IPv4 option passed to ip_optcopy ddb{0}> trace db_enter() at db_enter+0x18 sys/arch/amd64/amd64/db_interface.c:399 panic() at panic+0x147 sys/kern/subr_prf.c:208 ip_fragment(2208ec92071ba4ba,ffffff006fe05cb0,ffff800000173290) at ip_fragment+0x625 ip_output(6b33503ffc170449,ffffff006f4b4348,ffffff006a38a600,0,ffffff006a38a600,ffffff007a86d600) at ip_output+0xc8d sys/netinet/ip_output.c:501 udp_output(3409a4d08e10083b,1254,ffffff007a86d600,0) at udp_output+0x45a sys/netinet/udp_usrreq.c:1004 sosend(53237d34f396d8ff,ffffff006828cda8,ffff80002113adc8,11ac,ffff80002113af00,0) at sosend+0x47a sys/kern/uipc_socket.c:513 dofilewritev(7afefa19a38a5ac5,0,3,ffff800021063788,ffff80002113af00) at dofilewritev+0x14b sys/kern/sys_generic.c:364 sys_writev(519c998a0a371e79,790,ffff800021063788) at sys_writev+0xdb sys/kern/sys_generic.c:310 syscall(526b2c03eef1c590) at syscall+0x496 mi_syscall sys/sys/syscall_mi.h:99 [inline] syscall(526b2c03eef1c590) at syscall+0x496 sys/arch/amd64/amd64/trap.c:583 Xsyscall(6,0,d,0,3,9da85d67010) at Xsyscall+0x128 end of kernel end trace frame: 0x9dd42313a20, count: -10 ddb{0}> show registers rdi 0xffffffff81eee870 kprintf_mutex rsi 0xffffffff8158b247 db_enter+0x17 rbp 0xffff80002113a9f0 rbx 0xffff80002113aa90 rdx 0xffff80000213e000 rcx 0x1426 __ALIGN_SIZE+0x426 rax 0xffff80000213e000 r8 0xffff80002113a9c0 r9 0 r10 0x2d4246b0d3a9e204 r11 0x1d823e3937e6ef11 r12 0x3000000008 r13 0xffff80002113aa00 r14 0x100 r15 0xffffffff81cd2082 substchar+0xd438 rip 0xffffffff8158b248 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff80002113a9e0 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor1) pid=523520 stat=onproc flags process=10 proc=4000000 pri=59, usrpri=59, nice=20 forw=0xffffffffffffffff, list=0xffff800021063080,0xffffffff81faa2e0 process=0xffff8000210649e8 user=0xffff800021136000, vmspace=0xffffff007f123630 estcpu=18, cpticks=1, pctcpu=0.0 user=0, sys=1, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 64447 508489 7509 32767 2 0x10 syz-executor1 *64447 523520 7509 32767 7 0x4000010 syz-executor1 7509 291702 86154 32767 3 0x90 nanosleep syz-executor1 86154 223793 44284 0 3 0x82 wait syz-executor1 41482 325162 9571 32767 2 0x10 syz-executor0 9571 44757 44284 0 3 0x82 wait syz-executor0 73601 97131 0 0 3 0x14200 bored sosplice 44284 226449 62480 0 2 0x482 syz-fuzzer 44284 66118 62480 0 2 0x4000482 syz-fuzzer 44284 364099 62480 0 3 0x4000082 thrsleep syz-fuzzer 44284 83709 62480 0 3 0x4000082 thrsleep syz-fuzzer 44284 85333 62480 0 3 0x4000082 thrsleep syz-fuzzer 44284 243030 62480 0 3 0x4000082 thrsleep syz-fuzzer 44284 280580 62480 0 3 0x4000082 thrsleep syz-fuzzer 44284 245444 62480 0 7 0x4000082 syz-fuzzer 44284 267062 62480 0 3 0x4000082 thrsleep syz-fuzzer 44284 366677 62480 0 3 0x4000082 thrsleep syz-fuzzer 44284 164842 62480 0 3 0x4000082 thrsleep syz-fuzzer 62480 175385 21739 0 3 0x10008a pause ksh 21739 82369 73375 0 3 0x92 select sshd 92062 151048 1 0 3 0x100083 ttyin getty 73375 213614 1 0 3 0x80 select sshd 41000 225145 76085 73 3 0x100090 kqread syslogd 76085 24715 1 0 3 0x100082 netio syslogd 36053 9694 1 77 3 0x100090 poll dhclient 55463 219844 1 0 3 0x80 poll dhclient 36851 473888 0 0 3 0x14200 pgzero zerothread 93588 164212 0 0 3 0x14200 aiodoned aiodoned 65850 227220 0 0 3 0x14200 syncer update 41166 211367 0 0 3 0x14200 cleaner cleaner 93172 35854 0 0 3 0x14200 reaper reaper 77378 379895 0 0 3 0x14200 pgdaemon pagedaemon 62997 17222 0 0 3 0x14200 bored crynlk 18617 355387 0 0 3 0x14200 bored crypto 2469 43856 0 0 3 0x40014200 acpi0 acpi0 78132 106239 0 0 3 0x40014200 idle1 30330 362845 0 0 3 0x14200 bored softnet 21773 309447 0 0 3 0x14200 bored systqmp 74278 439099 0 0 3 0x14200 bored systq 76220 469514 0 0 3 0x40014200 bored softclock 48760 82720 0 0 3 0x40014200 idle0 1 267106 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper