kernel: protection fault trap, code=0 Stopped at in_delmulti+0x8d: movl 0xc(%r14),%r15d ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic the kernel did not panic ddb> trace in_delmulti(fffdffbffbffffff) at in_delmulti+0x8d sys/netinet/in.c:914 in_purgeaddr(ffff800000ae0a00) at in_purgeaddr+0x156 sys/netinet/in.c:760 in_ifdetach(ffff800000ac7800) at in_ifdetach+0x74 sys/netinet/in.c:971 if_detach(ffff800000ac7800) at if_detach+0x140 sys/net/if.c:1032 tun_clone_destroy(ffff800000ac7800) at tun_clone_destroy+0x1c7 sys/net/if_tun.c:326 tun_dev_close(5d00,7) at tun_dev_close+0x160 sys/net/if_tun.c:477 spec_close(ffff80001e7a7090) at spec_close+0x311 sys/kern/spec_vnops.c:560 VOP_CLOSE(fffffd805f76a9c0,7,fffffd806c3bfae0,ffff80001e802c78) at VOP_CLOSE+0xc0 sys/kern/vfs_vops.c:174 vn_closefile(fffffd805700fe28,ffff80001e802c78) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline] vn_closefile(fffffd805700fe28,ffff80001e802c78) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:614 fdrop(fffffd805700fe28,ffff80001e802c78) at fdrop+0xc2 sys/kern/kern_descrip.c:1279 closef(fffffd805700fe28,ffff80001e802c78) at closef+0x117 sys/kern/kern_descrip.c:1263 fdfree(ffff80001e802c78) at fdfree+0x100 sys/kern/kern_descrip.c:1195 exit1(ffff80001e802c78,0,0,1) at exit1+0x32c sys/kern/kern_exit.c:197 sys_exit(ffff80001e802c78,ffff80001e7a7320,ffff80001e7a7370) at sys_exit+0x16 sys/kern/kern_exit.c:95 syscall(ffff80001e7a73f0) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffc8650, count: -16 ddb> show registers rdi 0x2 rsi 0 rbp 0xffff80001e7a6e60 rbx 0 rdx 0 rcx 0x1 rax 0xffff80001e802c78 r8 0xffff800000ae0a00 r9 0xffffffff81256843 rt_ifa_purge+0x153 r10 0x5 r11 0xcb67ffdfe81a58f0 r12 0 r13 0x3 r14 0xfffdffbffbffffff r15 0x1 rip 0xffffffff817ba21d in_delmulti+0x8d cs 0x8 rflags 0x10246 __ALIGN_SIZE+0xf246 rsp 0xffff80001e7a6e00 ss 0 in_delmulti+0x8d: movl 0xc(%r14),%r15d ddb> show proc PROC (syz-executor.0) pid=75422 stat=onproc flags process=1018 proc=2000 pri=32, usrpri=74, nice=20 forw=0xffffffffffffffff, list=0xffff80001d703648,0xffff80001d6beef8 process=0xffff80001f9a2030 user=0xffff80001e7a2000, vmspace=0xfffffd80565fa668 estcpu=24, cpticks=0, pctcpu=0.1 user=0, sys=0, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 85039 128748 32087 0 2 0 syz-executor.1 85039 78157 32087 0 2 0x4000000 syz-executor.1 42876 114165 0 0 3 0x14200 bored sosplice 86947 110784 0 0 3 0x14200 acct acct 67508 238273 1 0 3 0x100083 ttyin getty 88891 506951 0 0 3 0x14280 nfsidl nfsio 64342 60993 0 0 3 0x14280 nfsidl nfsio 64258 29374 0 0 3 0x14280 nfsidl nfsio 12095 54042 0 0 3 0x14280 nfsidl nfsio 73610 209097 0 0 3 0x14280 nfsidl nfsio 52153 399771 0 0 3 0x14280 nfsidl nfsio 38983 8972 0 0 3 0x14280 nfsidl nfsio 10899 175706 0 0 3 0x14280 nfsidl nfsio 67114 17265 0 0 3 0x14280 nfsidl nfsio 93348 385211 0 0 3 0x14280 nfsidl nfsio 5715 220272 0 0 3 0x14280 nfsidl nfsio 60030 21458 0 0 3 0x14280 nfsidl nfsio 91214 317819 0 0 3 0x14280 nfsidl nfsio 48526 74487 0 0 3 0x14280 nfsidl nfsio 81280 41197 0 0 3 0x14280 nfsidl nfsio 28636 201843 0 0 3 0x14280 nfsidl nfsio 76614 414003 0 0 3 0x14280 nfsidl nfsio 9498 321096 0 0 3 0x14280 nfsidl nfsio 5084 313354 0 0 3 0x14280 nfsidl nfsio 90488 154925 0 0 3 0x14280 nfsidl nfsio 32087 357440 77216 0 3 0x82 nanosleep syz-executor.1 77216 168601 57481 0 3 0x82 thrsleep syz-fuzzer 77216 188862 57481 0 3 0x4000082 nanosleep syz-fuzzer 77216 339952 57481 0 3 0x4000082 thrsleep syz-fuzzer 77216 120870 57481 0 3 0x4000082 thrsleep syz-fuzzer 77216 221994 57481 0 3 0x4000082 thrsleep syz-fuzzer 77216 384041 57481 0 3 0x4000082 thrsleep syz-fuzzer 77216 208492 57481 0 2 0x4000002 syz-fuzzer 57481 191654 83363 0 3 0x10008a pause ksh 83363 202395 66695 0 3 0x92 select sshd 66695 243713 1 0 3 0x80 select sshd 58500 437056 72523 73 3 0x100090 kqread syslogd 72523 31570 1 0 3 0x100082 netio syslogd 91527 131601 1 77 2 0x100090 dhclient 80978 342403 1 0 3 0x80 poll dhclient 86138 154459 0 0 3 0x14200 bored smr 70227 126535 0 0 2 0x14200 zerothread 9793 376901 0 0 3 0x14200 aiodoned aiodoned 97807 227145 0 0 3 0x14200 syncer update 46626 289885 0 0 3 0x14200 cleaner cleaner 77692 150945 0 0 3 0x14200 reaper reaper 95279 70511 0 0 3 0x14200 pgdaemon pagedaemon 19352 432187 0 0 3 0x14200 bored crynlk 66726 464136 0 0 3 0x14200 bored crypto 57504 330274 0 0 3 0x40014200 acpi0 acpi0 68527 201083 0 0 3 0x14200 bored softnet 47422 125420 0 0 2 0x14200 systqmp 22846 518786 0 0 3 0x14200 bored systq 26884 92089 0 0 3 0x40014200 bored softclock 81779 99653 0 0 3 0x40014200 idle0 1 504247 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 9469 6332K 6843K 78643K 10970 0 pcb 13 8K 8K 78643K 71 0 rtable 109 5K 9K 78643K 469 0 ifaddr 61 13K 15K 78643K 162 0 sysctl 2 0K 0K 78643K 2 0 counters 21 16K 16K 78643K 28 0 ioctlops 0 0K 4K 78643K 79 0 iov 0 0K 12K 78643K 32 0 mount 1 1K 1K 78643K 1 0 vnodes 1219 77K 77K 78643K 1348 0 UFS quota 1 32K 32K 78643K 1 0 UFS mount 5 36K 36K 78643K 5 0 shm 2 1K 5K 78643K 11 0 VM map 2 0K 0K 78643K 2 0 sem 12 0K 1K 78643K 86 0 dirhash 9 1K 2K 78643K 12 0 ACPI 1809 195K 288K 78643K 12938 0 file desc 5 13K 25K 78643K 417 0 proc 49 38K 63K 78643K 391 0 subproc 23 1K 2K 78643K 34 0 NFS srvsock 1 0K 0K 78643K 1 0 NFS daemon 1 16K 16K 78643K 1 0 ip_moptions 0 0K 0K 78643K 23 0 in_multi 61 3K 3K 78643K 120 0 ether_multi 1 0K 0K 78643K 8 0 mrt 0 0K 0K 78643K 2 0 ISOFS mount 1 32K 32K 78643K 1 0 MSDOSFS mount 1 16K 16K 78643K 1 0 ttys 43 201K 201K 78643K 43 0 exec 0 0K 1K 78643K 212 0 pagedep 1 8K 8K 78643K 1 0 inodedep 1 32K 32K 78643K 1 0 newblk 1 0K 0K 78643K 1 0 VM swap 7 26K 26K 78643K 7 0 UVM amap 145 72K 72K 78643K 1815 0 UVM aobj 20 2K 2K 78643K 20 0 memdesc 1 4K 4K 78643K 1 0 crypto data 1 1K 1K 78643K 1 0 ip6_options 0 0K 0K 78643K 66 0 NDP 8 0K 0K 78643K 28 0 temp 98 3866K 3945K 78643K 5763 0 kqueue 3 4K 22K 78643K 32 0 SYN cache 2 16K 16K 78643K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 6 0 2 1 0 1 1 0 8 0 rtpcb 88 45 0 43 1 0 1 1 0 8 0 rtentry 112 62 0 21 2 0 2 2 0 8 0 unpcb 120 191 0 183 1 0 1 1 0 8 0 syncache 272 6 0 6 2 1 1 1 0 8 1 tcpqe 32 145 0 145 1 1 0 1 0 8 0 tcpcb 592 124 0 120 3 1 2 2 0 8 1 inpcb 296 390 0 383 2 0 2 2 0 8 1 nd6 48 14 0 8 1 0 1 1 0 8 0 ppxss 1136 3 0 3 2 1 1 1 0 8 1 pfrktable 1344 86 0 83 1 0 1 1 0 8 0 pftag 88 9 0 6 1 0 1 1 0 8 0 pfrule 1360 21 0 14 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 242 0 70 14 0 14 14 0 8 1 art_table 32 243 0 70 2 0 2 2 0 8 0 art_node 16 61 0 21 1 0 1 1 0 8 0 sysvmsgpl 40 5 0 0 1 0 1 1 0 8 0 semupl 112 3 0 3 1 1 0 1 0 8 0 semapl 112 74 0 64 1 0 1 1 0 8 0 shmpl 112 17 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 10 3 0 3 3 0 8 1 dino2pl 256 1983 0 591 88 0 88 88 0 8 0 ffsino 240 1983 0 591 83 0 83 83 0 8 0 nchpl 144 2981 0 1409 60 0 60 60 0 8 0 uvmvnodes 72 2115 0 0 39 0 39 39 0 8 0 vnodes 208 2115 0 0 112 0 112 112 0 8 0 namei 1024 7697 0 7697 1 0 1 1 0 8 1 vcpupl 1984 5 0 0 1 0 1 1 0 8 0 vmpool 528 5 0 0 1 0 1 1 0 8 0 pfiaddrpl 120 26 0 24 1 0 1 1 0 8 0 scxspl 200 8424 0 8424 1 0 1 1 0 8 1 plimitpl 152 41 0 34 1 0 1 1 0 8 0 sigapl 424 626 0 576 6 0 6 6 0 8 0 futexpl 56 8047 0 8047 1 0 1 1 0 8 1 knotepl 112 159 0 145 2 1 1 2 0 8 0 kqueuepl 152 126 0 124 1 0 1 1 0 8 0 pipepl 272 117 0 109 2 0 2 2 0 8 1 fdescpl 432 590 0 576 2 0 2 2 0 8 0 filepl 120 3568 0 3486 4 0 4 4 0 8 0 lockfpl 104 71 0 70 1 0 1 1 0 8 0 lockfspl 48 26 0 25 1 0 1 1 0 8 0 sessionpl 120 18 0 8 1 0 1 1 0 8 0 pgrppl 48 20 0 10 1 0 1 1 0 8 0 ucredpl 96 270 0 262 1 0 1 1 0 8 0 zombiepl 144 577 0 576 1 0 1 1 0 8 0 processpl 944 626 0 576 7 0 7 7 0 8 0 procpl 632 1106 0 1049 7 1 6 6 0 8 1 sockpl 400 630 0 613 3 0 3 3 0 8 1 mcl64k 65536 18 0 18 2 1 1 1 0 8 1 mcl12k 12288 17 0 17 1 0 1 1 0 8 1 mcl9k 9216 3 0 3 1 0 1 1 0 8 1 mcl8k 8192 10 0 10 1 0 1 1 0 8 1 mcl4k 4096 38 0 38 2 1 1 1 0 8 1 mcl2k2 2112 4 0 4 2 1 1 1 0 8 1 mcl2k 2048 95961 0 95918 20 13 7 16 0 8 0 mtagpl 96 38 0 20 2 1 1 1 0 8 0 mbufpl 256 153737 0 153599 20 2 18 18 0 8 0 bufpl 280 4291 0 118 299 0 299 299 0 8 0 anonpl 16 64010 0 46210 76 2 74 74 0 107 1 amapchunkpl 152 2367 0 2188 10 2 8 10 0 158 0 amappl16 192 2714 0 1772 49 0 49 49 0 8 0 amappl15 184 1 0 0 1 0 1 1 0 8 0 amappl14 176 3 0 0 1 0 1 1 0 8 0 amappl13 168 218 0 214 1 0 1 1 0 8 0 amappl12 160 219 0 212 1 0 1 1 0 8 0 amappl11 152 52 0 42 1 0 1 1 0 8 0 amappl10 144 20 0 17 1 0 1 1 0 8 0 amappl9 136 361 0 360 1 0 1 1 0 8 0 amappl8 128 326 0 282 2 0 2 2 0 8 0 amappl7 120 104 0 92 1 0 1 1 0 8 0 amappl6 112 30 0 25 1 0 1 1 0 8 0 amappl5 104 707 0 692 1 0 1 1 0 8 0 amappl4 96 612 0 586 1 0 1 1 0 8 0 amappl3 88 138 0 129 1 0 1 1 0 8 0 amappl2 80 3884 0 3812 2 0 2 2 0 8 0 amappl1 72 22142 0 21728 23 14 9 17 0 8 0 amappl 80 1318 0 1265 2 0 2 2 0 84 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 64 19 0 0 1 0 1 1 0 8 0 uaddrrnd 24 595 0 576 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 595 0 576 1 0 1 1 0 8 0 vmmpekpl 168 7535 0 7505 2 0 2 2 0 8 0 vmmpepl 168 78592 0 76504 124 23 101 120 0 357 10 vmsppl 272 594 0 576 2 0 2 2 0 8 0 pdppl 4096 1196 0 1157 7 1 6 6 0 8 1 pvpl 32 208684 0 187804 178 0 178 178 0 265 5 pmappl 200 594 0 576 2 0 2 2 0 8 0 extentpl 40 53 0 36 1 0 1 1 0 8 0 phpool 112 254 0 21 7 0 7 7 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace in_delmulti(fffdffbffbffffff) at in_delmulti+0x8d sys/netinet/in.c:914 in_purgeaddr(ffff800000ae0a00) at in_purgeaddr+0x156 sys/netinet/in.c:760 in_ifdetach(ffff800000ac7800) at in_ifdetach+0x74 sys/netinet/in.c:971 if_detach(ffff800000ac7800) at if_detach+0x140 sys/net/if.c:1032 tun_clone_destroy(ffff800000ac7800) at tun_clone_destroy+0x1c7 sys/net/if_tun.c:326 tun_dev_close(5d00,7) at tun_dev_close+0x160 sys/net/if_tun.c:477 spec_close(ffff80001e7a7090) at spec_close+0x311 sys/kern/spec_vnops.c:560 VOP_CLOSE(fffffd805f76a9c0,7,fffffd806c3bfae0,ffff80001e802c78) at VOP_CLOSE+0xc0 sys/kern/vfs_vops.c:174 vn_closefile(fffffd805700fe28,ffff80001e802c78) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline] vn_closefile(fffffd805700fe28,ffff80001e802c78) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:614 fdrop(fffffd805700fe28,ffff80001e802c78) at fdrop+0xc2 sys/kern/kern_descrip.c:1279 closef(fffffd805700fe28,ffff80001e802c78) at closef+0x117 sys/kern/kern_descrip.c:1263 fdfree(ffff80001e802c78) at fdfree+0x100 sys/kern/kern_descrip.c:1195 exit1(ffff80001e802c78,0,0,1) at exit1+0x32c sys/kern/kern_exit.c:197 sys_exit(ffff80001e802c78,ffff80001e7a7320,ffff80001e7a7370) at sys_exit+0x16 sys/kern/kern_exit.c:95 syscall(ffff80001e7a73f0) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffc8650, count: -16 ddb> machine ddbcpu 1 No such command ddb> trace in_delmulti(fffdffbffbffffff) at in_delmulti+0x8d sys/netinet/in.c:914 in_purgeaddr(ffff800000ae0a00) at in_purgeaddr+0x156 sys/netinet/in.c:760 in_ifdetach(ffff800000ac7800) at in_ifdetach+0x74 sys/netinet/in.c:971 if_detach(ffff800000ac7800) at if_detach+0x140 sys/net/if.c:1032 tun_clone_destroy(ffff800000ac7800) at tun_clone_destroy+0x1c7 sys/net/if_tun.c:326 tun_dev_close(5d00,7) at tun_dev_close+0x160 sys/net/if_tun.c:477 spec_close(ffff80001e7a7090) at spec_close+0x311 sys/kern/spec_vnops.c:560 VOP_CLOSE(fffffd805f76a9c0,7,fffffd806c3bfae0,ffff80001e802c78) at VOP_CLOSE+0xc0 sys/kern/vfs_vops.c:174 vn_closefile(fffffd805700fe28,ffff80001e802c78) at vn_closefile+0xd2 vn_close sys/kern/vfs_vnops.c:298 [inline] vn_closefile(fffffd805700fe28,ffff80001e802c78) at vn_closefile+0xd2 sys/kern/vfs_vnops.c:614 fdrop(fffffd805700fe28,ffff80001e802c78) at fdrop+0xc2 sys/kern/kern_descrip.c:1279 closef(fffffd805700fe28,ffff80001e802c78) at closef+0x117 sys/kern/kern_descrip.c:1263 fdfree(ffff80001e802c78) at fdfree+0x100 sys/kern/kern_descrip.c:1195 exit1(ffff80001e802c78,0,0,1) at exit1+0x32c sys/kern/kern_exit.c:197 sys_exit(ffff80001e802c78,ffff80001e7a7320,ffff80001e7a7370) at sys_exit+0x16 sys/kern/kern_exit.c:95 syscall(ffff80001e7a73f0) at syscall+0x507 sys/arch/amd64/amd64/trap.c:570 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffc8650, count: -16