panic: pool_do_get: shmpl free list modified: page 0xfffffd806bb6a000; item addr 0xfffffd806bb6ad20; offset 0x40=0x67b58892 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND * 54726 62071 32767 0x10 0x4000000 0K syz-executor 450557 43065 32767 0x10 0x4000000 1 syz-executor db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff833abad5) at panic+0x1e5 sys/kern/subr_prf.c:198 pool_do_get(ffffffff8397b360,1,ffff80003c50a598) at pool_do_get+0x5da pool_get(ffffffff8397b360,1) at pool_get+0x149 shmget_allocate_segment(ffff80002a33b9b8,ffff80003c50a7f0,29,ffff80003c50a740) at shmget_allocate_segment+0x1a7 sys_shmget(ffff80002a33b9b8,ffff80003c50a7f0,ffff80003c50a740) at sys_shmget+0x1b2 sys/kern/sysv_shm.c:482 syscall(ffff80003c50a7f0) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c50a7f0) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x4da76bb4e30, count: 7 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: pool_do_get: shmpl free list modified: page 0xfffffd806bb6a000; item addr 0xfffffd806bb6ad20; offset 0x40=0x67b58892 ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff833abad5) at panic+0x1e5 sys/kern/subr_prf.c:198 pool_do_get(ffffffff8397b360,1,ffff80003c50a598) at pool_do_get+0x5da pool_get(ffffffff8397b360,1) at pool_get+0x149 shmget_allocate_segment(ffff80002a33b9b8,ffff80003c50a7f0,29,ffff80003c50a740) at shmget_allocate_segment+0x1a7 sys_shmget(ffff80002a33b9b8,ffff80003c50a7f0,ffff80003c50a740) at sys_shmget+0x1b2 sys/kern/sysv_shm.c:482 syscall(ffff80003c50a7f0) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c50a7f0) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x4da76bb4e30, count: -8 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80003c50a3d0 rbx 0xffffffff837a4dc7 cpu_info_full_primary+0x2dc7 rdx 0 rcx 0xffff80002a33b9b8 rax 0xffffffff837a3ff0 cpu_info_full_primary+0x1ff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0xa5b3be1ab99e153 r11 0x5b874c581cbafe1 r12 0xffffffff837a4bc8 cpu_info_full_primary+0x2bc8 r13 0 r14 0 r15 0x1 rip 0xffffffff815cd015 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80003c50a3c0 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor) tid=54726 pid=62071 tcnt=3 stat=onproc flags process=10 proc=4000000 runpri=32, usrpri=67, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a33b728,0xffffffff83904ce8 process=0xffff8000ffff2e10 user=0xffff80003c505000, vmspace=0xfffffd806bedb750 estcpu=17, cpticks=2, pctcpu=0.0, user=0, sys=2, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 56797 1078 13954 32767 2 0x10 syz-executor 56797 279913 13954 32767 3 0x4000090 fsleep syz-executor 65315 436443 36057 32767 3 0x400090 nanoslp syz-executor 65315 143791 36057 32767 3 0x4400090 fsleep syz-executor 65315 115435 36057 32767 2 0x4400010 syz-executor 62071 259828 94662 32767 2 0x10 syz-executor 62071 1870 94662 32767 3 0x4000010 bqwait syz-executor *62071 54726 94662 32767 7 0x4000010 syz-executor 70512 39123 41773 32767 2 0x10 syz-executor 70512 64085 41773 32767 3 0x4000090 fsleep syz-executor 43065 97129 34228 32767 2 0x10 syz-executor 43065 450557 34228 32767 7 0x4000010 syz-executor 46784 259192 61760 32767 2 0x10 syz-executor 92345 464303 0 0 3 0x14200 bored sosplice 34228 353816 3785 32767 2 0x490 syz-executor 61760 485133 14470 32767 2 0x10 syz-executor 94662 63999 92420 32767 3 0x90 nanoslp syz-executor 84356 483251 80845 32767 2 0x10000490 syz-executor 80130 109954 58939 32767 2 0x10000010 syz-executor 36057 479599 47731 32767 3 0x90 nanoslp syz-executor 13954 113686 59793 32767 3 0x90 nanoslp syz-executor 41773 183235 16934 32767 3 0x90 nanoslp syz-executor 3785 522108 34410 0 3 0x82 wait syz-executor 14470 72919 34410 0 3 0x82 wait syz-executor 80845 46732 34410 0 3 0x82 wait syz-executor 92420 54075 34410 0 3 0x82 wait syz-executor 58939 271567 34410 0 3 0x82 wait syz-executor 16934 149447 34410 0 3 0x82 wait syz-executor 47731 396841 34410 0 3 0x82 wait syz-executor 59793 305348 34410 0 3 0x82 wait syz-executor 34410 504960 44390 0 3 0x82 kqread syz-executor 44390 442762 32613 0 3 0x10008a sigsusp ksh 32613 98470 19849 0 3 0x98 kqread sshd-session 19849 319787 88161 0 3 0x92 kqread sshd-session 29741 101001 1 0 3 0x100083 ttyin getty 88161 81366 1 0 3 0x88 kqread sshd 92303 461878 55718 73 3 0x1100090 kqread syslogd 55718 78936 1 0 3 0x100082 sbwait syslogd 24742 202943 1 0 3 0x100080 kqread resolvd 29104 467580 30978 77 3 0x100092 kqread dhcpleased 78282 189495 30978 77 3 0x100092 kqread dhcpleased 30978 385691 1 0 3 0x80 kqread dhcpleased 35140 121855 0 0 3 0x14200 bored smr 48318 30927 0 0 2 0x14200 zerothread 68967 141033 0 0 3 0x14200 aiodoned aiodoned 77089 16371 0 0 3 0x14200 syncer update 85281 35969 0 0 3 0x14200 cleaner cleaner 59795 368852 0 0 3 0x14200 reaper reaper 32538 29057 0 0 3 0x14200 pgdaemon pagedaemon 60112 213517 0 0 3 0x14200 bored viomb 99140 82111 0 0 3 0x40014200 acpi0 acpi0 53796 393516 0 0 3 0x40014200 idle1 41081 429329 0 0 3 0x14200 bored softnet3 29183 190635 0 0 3 0x14200 bored softnet2 38445 324830 0 0 3 0x14200 bored softnet1 30638 516124 0 0 2 0x14200 softnet0 34413 61576 0 0 3 0x14200 bored systqmp 87875 32950 0 0 3 0x14200 bored systq 89513 217715 0 0 3 0x14200 tmoslp softclockmp 38139 98716 0 0 3 0x40014200 tmoslp softclock 64447 133126 0 0 3 0x40014200 idle0 1 55919 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks CPU 0: exclusive mutex shmpl r = 0 (0xffffffff8397b378) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 mtx_enter_try+0x178 #2 mtx_enter+0x60 sys/kern/kern_lock.c:239 #3 pool_get+0x10b sys/kern/subr_pool.c:583 #4 shmget_allocate_segment+0x1a7 #5 sys_shmget+0x1b2 sys/kern/sysv_shm.c:482 #6 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0xb08 sys/arch/amd64/amd64/trap.c:577 #7 Xsyscall+0x128 Process 62071 (syz-executor) thread 0xffff8000fffee550 (1870) exclusive rrwlock inode r = 0 (0xfffffd806e5adef0) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 rw_do_enter_write+0x3ea sys/kern/kern_rwlock.c:316 #2 rrw_enter+0xc6 sys/kern/kern_rwlock.c:616 #3 VOP_LOCK+0xa6 sys/kern/vfs_vops.c:524 #4 vn_lock+0xa4 sys/kern/vfs_vnops.c:570 #5 vget+0x2bd sys/kern/vfs_subr.c:694 #6 ffs_sync_vnode+0x1aa sys/ufs/ffs/ffs_vfsops.c:1076 #7 vfs_mount_foreach_vnode+0x65 #8 ffs_sync+0x146 sys/ufs/ffs/ffs_vfsops.c:1131 #9 sys_sync+0x104 sys/kern/vfs_syscalls.c:537 #10 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] #10 syscall+0xb08 sys/arch/amd64/amd64/trap.c:577 #11 Xsyscall+0x128 shared rwlock vfslock r = 0 (0xffff800000b49860) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 rw_do_enter_read+0x3af sys/kern/kern_rwlock.c:405 #2 vfs_busy+0x94 sys/kern/vfs_subr.c:247 #3 sys_sync+0x5d sys/kern/vfs_syscalls.c:530 #4 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] #4 syscall+0xb08 sys/arch/amd64/amd64/trap.c:577 #5 Xsyscall+0x128 Process 62071 (syz-executor) thread 0xffff80002a33b9b8 (54726) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83917ac8) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 syscall+0xae6 mi_syscall sys/sys/syscall_mi.h:176 [inline] #1 syscall+0xae6 sys/arch/amd64/amd64/trap.c:577 #2 Xsyscall+0x128 exclusive mutex shmpl r = 0 (0xffffffff8397b378) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 mtx_enter_try+0x178 #2 mtx_enter+0x60 sys/kern/kern_lock.c:239 #3 pool_get+0x10b sys/kern/subr_pool.c:583 #4 shmget_allocate_segment+0x1a7 #5 sys_shmget+0x1b2 sys/kern/sysv_shm.c:482 #6 syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] #6 syscall+0xb08 sys/arch/amd64/amd64/trap.c:577 #7 Xsyscall+0x128 Process 43065 (syz-executor) thread 0xffff8000fffef220 (450557) shared rwlock vmmaplk r = 0 (0xfffffd806bedb688) #0 witness_lock+0x5bb stacktrace_save sys/sys/stacktrace.h:37 [inline] #0 witness_lock+0x5bb sys/kern/subr_witness.c:1155 #1 rw_do_enter_read+0x3af sys/kern/kern_rwlock.c:405 #2 uvmfault_lookup+0x122 sys/uvm/uvm_fault.c:1864 #3 uvm_fault_check+0x4b sys/uvm/uvm_fault.c:732 #4 uvm_fault+0x106 sys/uvm/uvm_fault.c:668 #5 kpageflttrap+0x2d0 sys/arch/amd64/amd64/trap.c:279 #6 kerntrap+0x14a sys/arch/amd64/amd64/trap.c:332 #7 alltraps_kern_meltdown+0x7b #8 copyout+0x57 #9 syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] #9 syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577 #10 Xsyscall+0x128 ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 10186 10954K 10966K 166960K 11265 0 pcb 17 12K 12K 166960K 17 0 rtable 236 6K 6K 166960K 346 0 pf 31 16K 16K 166960K 31 0 ifaddr 42 7K 7K 166960K 44 0 ifgroup 50 2K 2K 166960K 50 0 sysctl 1 1K 1K 166960K 1 0 counters 64 36K 36K 166960K 64 0 ioctlops 0 0K 2K 166960K 29 0 iov 0 0K 4K 166960K 4 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1332 84K 84K 166960K 1359 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 3 0 VM map 2 1K 1K 166960K 2 0 sem 4 0K 0K 166960K 4 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 24 89K 113K 166960K 188 0 proc 58 79K 115K 166960K 477 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 6 0 in_multi 99 7K 7K 166960K 99 0 ether_multi 1 0K 0K 166960K 1 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 61 281K 281K 166960K 61 0 exec 0 0K 1K 166960K 341 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 223 73K 75K 166960K 3046 0 UVM aobj 4 2K 2K 166960K 6 0 pinsyscall 45 90K 106K 166960K 1183 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 2 0K 0K 166960K 2 0 NDP 11 0K 2K 166960K 27 0 temp 37 8630K 8694K 166960K 3778 0 kqueue 18 28K 28K 166960K 45 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 24 0 0 1 0 1 1 0 8 0 rtpcb 120 39 0 36 1 0 1 1 0 8 0 rtentry 112 112 0 1 4 0 4 4 0 8 0 unpcb 144 71 0 53 1 0 1 1 0 8 0 syncache 336 3 0 3 1 0 1 1 0 8 1 tcpcb 808 27 0 20 1 0 1 1 0 8 0 arp 120 18 0 0 1 0 1 1 0 8 0 inpcb 376 96 0 84 2 0 2 2 0 8 0 nd6 136 25 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 453 0 0 29 0 29 29 0 8 0 art_table 32 454 0 0 4 0 4 4 0 8 0 art_node 16 111 0 10 1 0 1 1 0 8 0 sysvmsgpl 40 1 0 1 1 0 1 1 0 8 1 semapl 112 2 0 0 1 0 1 1 0 8 0 shmpl 112 3 0 2 1 0 1 1 0 8 0 pool(0xffffffff8397b360:shmpl): page inconsistency: page 0xfffffd806bb6a000; 33 on list, 1 missing, 35 items per page dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1609 0 107 95 0 95 95 0 8 0 ffsino 280 1609 0 107 108 0 108 108 0 8 0 nchpl 144 1865 0 190 63 0 63 63 0 8 0 uvmvnodes 80 1690 0 0 35 0 35 35 0 8 0 vnodes 216 1690 0 0 94 0 94 94 0 8 0 namei 1024 5504 0 5504 1 0 1 1 0 8 1 percpumem 16 46 0 0 1 0 1 1 0 8 0 kstatmem 264 22 0 0 2 0 2 2 0 8 0 scxspl 216 6162 0 6052 9 1 8 8 1 8 0 plimitpl 152 39 0 15 2 0 2 2 0 8 1 sigapl 424 460 0 403 7 0 7 7 0 8 0 futexpl 64 681 0 678 1 0 1 1 0 8 0 knotepl 120 107 0 0 4 0 4 4 0 8 0 kqueuepl 216 46 0 31 1 0 1 1 0 8 0 pipepl 328 103 0 76 3 0 3 3 0 8 0 fdescpl 504 441 0 405 7 1 6 6 0 8 0 filepl 152 1637 0 1418 9 0 9 9 0 8 0 lockfpl 104 16 0 14 1 0 1 1 0 8 0 lockfspl 48 9 0 7 1 0 1 1 0 8 0 sessionpl 144 21 0 5 1 0 1 1 0 8 0 pgrppl 48 29 0 5 1 0 1 1 0 8 0 ucredpl 104 174 0 155 1 0 1 1 0 8 0 zombiepl 144 405 0 403 1 0 1 1 0 8 0 processpl 1176 460 0 403 5 0 5 5 0 8 0 procpl 656 548 0 484 7 0 7 7 0 8 1 sosppl 168 1 0 1 1 0 1 1 0 8 1 sockpl 688 207 0 174 4 0 4 4 0 8 0 mcl8k 8192 5 0 0 1 0 1 1 0 8 0 mcl4k 4096 115 0 0 15 0 15 15 0 8 0 mcl2k 2048 17 0 0 3 0 3 3 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 190 0 0 12 0 12 12 0 8 0 bufpl 280 2348 0 123 159 0 159 159 0 8 0 anonpl 24 101290 0 96536 64 2 62 62 0 184 20 amapchunkpl 152 9438 0 8939 29 0 29 29 0 158 7 amappl16 200 1921 0 1796 19 1 18 18 0 8 8 amappl15 192 11 0 11 1 1 0 1 0 8 0 amappl14 184 98 0 88 1 0 1 1 0 8 0 amappl13 176 2 0 2 1 1 0 1 0 8 0 amappl12 168 1039 0 1004 2 0 2 2 0 8 0 amappl11 160 42 0 32 1 0 1 1 0 8 0 amappl10 152 45 0 44 1 0 1 1 0 8 0 amappl9 144 254 0 254 1 1 0 1 0 8 0 amappl8 136 19 0 18 1 0 1 1 0 8 0 amappl7 128 110 0 99 1 0 1 1 0 8 0 amappl6 120 171 0 168 1 0 1 1 0 8 0 amappl5 112 123 0 117 1 0 1 1 0 8 0 amappl4 104 264 0 250 1 0 1 1 0 8 0 amappl3 96 1480 0 1364 4 0 4 4 0 8 0 amappl2 88 602 0 547 2 0 2 2 0 8 0 amappl1 80 7492 0 6955 13 0 13 13 0 8 0 amappl 88 2719 0 2544 5 0 5 5 0 92 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 5 0 2 1 0 1 1 0 8 0 uaddrrnd 24 441 0 405 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 441 0 405 1 0 1 1 0 8 0 vmmpekpl 168 5120 0 5093 2 0 2 2 0 8 0 vmmpepl 168 33328 0 31311 98 0 98 98 0 357 2 vmsppl 456 440 0 405 7 1 6 6 0 8 0 rwobjpl 64 14061 0 11452 46 0 46 46 0 8 0 pdppl 4096 890 0 810 102 20 82 92 0 8 2 pvpl 32 17321 0 0 141 1 140 140 0 265 0 pmappl 248 440 0 405 4 1 3 3 0 8 0 extentpl 40 55 0 38 1 0 1 1 0 8 0 phpool 112 274 0 23 8 0 8 8 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff833abad5) at panic+0x1e5 sys/kern/subr_prf.c:198 pool_do_get(ffffffff8397b360,1,ffff80003c50a598) at pool_do_get+0x5da pool_get(ffffffff8397b360,1) at pool_get+0x149 shmget_allocate_segment(ffff80002a33b9b8,ffff80003c50a7f0,29,ffff80003c50a740) at shmget_allocate_segment+0x1a7 sys_shmget(ffff80002a33b9b8,ffff80003c50a7f0,ffff80003c50a740) at sys_shmget+0x1b2 sys/kern/sysv_shm.c:482 syscall(ffff80003c50a7f0) at syscall+0xb08 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c50a7f0) at syscall+0xb08 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x4da76bb4e30, count: -8 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff800029a9bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 copy_fault() at copy_fault syscall(ffff80003a4e6d10) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003a4e6d10) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x67930eaedb0, count: 9 ddb{1}> trace x86_ipi_db(ffff800029a9bff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 copy_fault() at copy_fault syscall(ffff80003a4e6d10) at syscall+0xbc6 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003a4e6d10) at syscall+0xbc6 sys/arch/amd64/amd64/trap.c:577 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x67930eaedb0, count: -6