panic: chgproccnt: procs < 0 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *344789 57766 60929 0x10 0x4000000 0K syz-executor db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834d65db) at panic+0x1e5 sys/kern/subr_prf.c:198 chgproccnt(ee00,ffffffff) at chgproccnt+0xcc sys_setuid(ffff8000fffeea78,ffff80003c403bc0,ffff80003c403b10) at sys_setuid+0x2d9 sys/kern/kern_prot.c:746 syscall(ffff80003c403bc0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c403bc0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x99ee632eef0, count: 9 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{0}> ddb{0}> set $lines = 0 ddb{0}> set $maxwidth = 0 ddb{0}> show panic *cpu0: chgproccnt: procs < 0 ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834d65db) at panic+0x1e5 sys/kern/subr_prf.c:198 chgproccnt(ee00,ffffffff) at chgproccnt+0xcc sys_setuid(ffff8000fffeea78,ffff80003c403bc0,ffff80003c403b10) at sys_setuid+0x2d9 sys/kern/kern_prot.c:746 syscall(ffff80003c403bc0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c403bc0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x99ee632eef0, count: -6 ddb{0}> show registers rdi 0 rsi 0x1 rbp 0xffff80003c403990 rbx 0xffffffff8391de07 cpu_info_full_primary+0x2e07 rdx 0 rcx 0xffff8000fffeea78 rax 0xffffffff8391cff0 cpu_info_full_primary+0x1ff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x50c3e0960e79cc9c r11 0x76f6c1fa0d2dff1d r12 0xffffffff8391dc08 cpu_info_full_primary+0x2c08 r13 0 r14 0 r15 0x1 rip 0xffffffff827a3b95 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80003c403980 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{0}> show proc PROC (syz-executor) tid=344789 pid=57766 tcnt=3 stat=onproc flags process=10 proc=4000000 runpri=50, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff8000fffef770,0xffff8000fffee028 process=0xffff80002a39c4e8 user=0xffff80003c3fe000, vmspace=0xfffffd800b0633d0 estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb{0}> ps PID TID PPID UID S FLAGS WAIT COMMAND 17086 427578 29286 0 2 0 syz-executor 17086 266736 29286 0 3 0x4000080 fsleep syz-executor 57766 373914 18099 60929 2 0x10 syz-executor *57766 344789 18099 60929 7 0x4000010 syz-executor 57766 505019 18099 60929 2 0x4000010 syz-executor 27617 332785 39042 0 2 0 syz-executor 27617 381978 39042 0 3 0x4000080 fsleep syz-executor 74960 165986 89574 0 2 0 syz-executor 74960 264738 89574 0 3 0x4000080 fsleep syz-executor 56525 163534 99394 0 2 0 syz-executor 56525 261030 99394 0 3 0x4000080 fsleep syz-executor 34314 48641 39065 60929 2 0x10 syz-executor 34314 193686 39065 60929 3 0x4000090 fsleep syz-executor 34314 120627 39065 60929 3 0x4000090 fsleep syz-executor 42703 320337 42129 0 3 0x80 nanoslp syz-executor 42703 3041 42129 0 3 0x4000080 msgwait syz-executor 42703 202178 42129 0 3 0x4000080 fsleep syz-executor 42703 495057 42129 0 3 0x4000080 fsleep syz-executor 77206 179171 0 0 3 0x14200 acct acct 66771 437871 16504 0 2 0x2 syz-executor 18099 378177 16504 0 3 0x82 nanoslp syz-executor 42129 284829 16504 0 3 0x82 nanoslp syz-executor 29286 1036 16504 0 3 0x82 nanoslp syz-executor 99394 429915 16504 0 3 0x82 nanoslp syz-executor 39042 159971 16504 0 3 0x82 nanoslp syz-executor 89574 141189 16504 0 3 0x82 nanoslp syz-executor 39065 379680 16504 0 3 0x82 nanoslp syz-executor 16504 95166 45588 0 3 0x82 kqread syz-executor 45588 498223 20407 0 3 0x10008a sigsusp ksh 20407 428061 39602 0 3 0x98 kqread sshd-session 39602 225979 52908 0 3 0x92 kqread sshd-session 20985 32111 1 0 3 0x100083 ttyin getty 52908 347158 1 0 3 0x88 kqread sshd 26664 387589 98851 74 3 0x1100092 bpf pflogd 98851 517197 1 0 3 0x80 sbwait pflogd 74653 463594 76747 73 3 0x1100090 kqread syslogd 76747 359859 1 0 3 0x100082 sbwait syslogd 90703 492408 1 0 3 0x100080 kqread resolvd 93437 450960 64318 77 3 0x100092 kqread dhcpleased 38631 364741 64318 77 3 0x100092 kqread dhcpleased 64318 452461 1 0 3 0x80 kqread dhcpleased 2213 62549 0 0 3 0x14200 bored smr 41344 481646 0 0 2 0x14200 zerothread 91995 110948 0 0 3 0x14200 aiodoned aiodoned 8878 5067 0 0 3 0x14200 syncer update 40962 407130 0 0 3 0x14200 cleaner cleaner 13661 217964 0 0 3 0x14200 reaper reaper 96056 126284 0 0 3 0x14200 pgdaemon pagedaemon 54213 92386 0 0 3 0x14200 bored viomb 28515 12232 0 0 3 0x40014200 acpi0 acpi0 39559 424268 0 0 7 0x40014200 idle1 48744 63425 0 0 3 0x14200 bored softnet1 41147 125523 0 0 3 0x14200 bored softnet0 55980 42368 0 0 3 0x14200 bored systqmp 88243 74977 0 0 3 0x14200 bored systq 65935 270956 0 0 3 0x14200 tmoslp softclockmp 70697 439715 0 0 3 0x40014200 tmoslp softclock 97913 339746 0 0 3 0x40014200 idle0 1 79223 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{0}> show all locks Process 57766 (syz-executor) thread 0xffff8000fffeea78 (344789) ddb{0}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11078 12167K 12352K 166960K 12701 0 pcb 18 12K 12K 166960K 131 0 rtable 210 7K 8K 166960K 838 0 pf 32 17K 19K 166960K 80 0 ifaddr 40 7K 7K 166960K 66 0 ifgroup 51 2K 2K 166960K 91 0 sysctl 4 1K 9K 166960K 14 0 counters 68 36K 37K 166960K 108 0 ioctlops 0 0K 4K 166960K 1619 0 iov 0 0K 16K 166960K 44 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1294 81K 82K 166960K 1747 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 12 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 27 0 dirhash 12 2K 2K 166960K 18 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 17 61K 85K 166960K 656 0 sigio 0 0K 0K 166960K 6 0 proc 72 115K 180K 166960K 636 0 subproc 72 4K 4K 166960K 81 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 72 0 in_multi 88 6K 7K 166960K 129 0 ether_multi 1 0K 0K 166960K 6 0 mrt 0 0K 0K 166960K 22 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 97 440K 440K 166960K 97 0 exec 0 0K 1K 166960K 533 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 245 165K 179K 166960K 8252 0 UVM aobj 53 12K 12K 166960K 54 0 pinsyscall 42 84K 100K 166960K 1899 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 1K 166960K 52 0 NDP 11 0K 1K 166960K 44 0 temp 65 9076K 9142K 166960K 26300 0 kqueue 14 22K 28K 166960K 120 0 SYN cache 2 16K 16K 166960K 2 0 ddb{0}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 97 0 94 2 1 1 2 0 8 0 rtentry 176 328 0 237 6 0 6 6 0 8 0 unpcb 144 465 0 442 2 0 2 2 0 8 1 syncache 336 7 0 7 3 2 1 1 0 8 1 tcpqe 32 1 0 1 1 0 1 1 0 8 1 tcpcb 736 278 0 273 12 5 7 7 0 8 6 arp 136 86 0 70 1 0 1 1 0 8 0 inpcb 328 917 0 906 17 10 7 7 0 8 5 nd6 152 27 0 6 1 0 1 1 0 8 0 pkpcb 40 1 0 1 1 1 0 1 0 8 0 kcovpl 48 9 0 1 1 0 1 1 0 8 0 ppxss 1192 17 0 17 2 1 1 1 0 8 1 pffrag 232 3 0 1 1 0 1 1 0 482 0 pffrnode 88 3 0 1 1 0 1 1 0 8 0 pffrent 40 4 0 2 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfqueue 320 1 0 1 1 1 0 1 0 8 0 pfstitem 24 43 0 18 1 0 1 1 0 8 0 pfstkey 128 43 0 18 2 0 2 2 0 8 0 pfstate 448 43 0 18 5 0 5 5 0 8 1 pfrule 1360 21 0 15 2 0 2 2 0 8 0 art_heap8 4096 3 0 0 3 0 3 3 0 8 0 art_heap4 256 810 0 407 45 19 26 45 0 8 0 art_table 40 813 0 407 8 2 6 8 0 8 0 art_node 32 328 0 247 3 1 2 3 0 8 0 sysvmsgpl 40 18 0 10 1 0 1 1 0 8 0 semupl 112 2 0 2 1 1 0 1 0 8 0 semapl 112 23 0 13 1 0 1 1 0 8 0 shmpl 112 46 0 1 2 0 2 2 0 8 0 dirhash 1024 21 0 4 3 0 3 3 0 8 0 dino2pl 256 2549 0 1084 93 0 93 93 0 8 0 ffsino 296 2549 0 1084 114 0 114 114 0 8 0 nchpl 144 3468 0 1761 64 0 64 64 0 8 0 rtmask 32 3 0 3 1 1 0 1 0 8 0 vnodes 216 2825 0 0 157 0 157 157 0 8 0 namei 1024 11456 0 11456 1 0 1 1 0 8 1 percpumem 16 69 0 20 1 0 1 1 0 8 0 vcpupl 3968 5 0 0 1 0 1 1 0 8 0 vmpool 848 5 0 0 1 0 1 1 0 8 0 kstatmem 264 54 0 30 3 1 2 3 0 8 0 acpiwqpl 32 1 0 1 1 0 1 1 1 8 1 scsiplug 72 4 0 4 2 1 1 1 0 8 1 scxspl 216 18403 0 18403 11 9 2 8 1 8 2 plimitpl 152 174 0 156 1 0 1 1 0 8 0 sigapl 424 987 0 939 6 0 6 6 0 8 0 knotepl 120 315 0 0 10 0 10 10 0 8 0 kqueuepl 224 180 0 169 1 0 1 1 0 8 0 pipepl 344 172 0 145 3 0 3 3 0 8 0 fdescpl 528 970 0 939 3 0 3 3 0 8 0 filepl 160 5417 0 5187 17 4 13 13 0 8 2 lockfpl 104 247 0 242 2 1 1 2 0 8 0 lockfspl 48 89 0 84 1 0 1 1 0 8 0 sessionpl 144 27 0 18 1 0 1 1 0 8 0 pgrppl 48 46 0 29 1 0 1 1 0 8 0 ucredpl 104 734 0 718 1 0 1 1 0 8 0 zombiepl 144 1298 0 1298 2 1 1 1 0 8 1 processpl 1232 988 0 939 5 1 4 5 0 8 0 procpl 664 1937 0 1877 6 0 6 6 0 8 0 sosppl 176 4 0 4 2 2 0 1 0 8 0 sockpl 752 1558 0 1521 22 10 12 12 0 8 7 mcl64k 65536 2 0 0 1 0 1 1 0 8 0 mcl16k 16384 2 0 0 1 0 1 1 0 8 0 mcl8k 8192 3 0 0 1 0 1 1 0 8 0 mcl4k 4096 105 0 0 14 0 14 14 0 8 0 mcl2k 2048 24 0 0 3 0 3 3 0 8 0 mtagpl 96 10 0 0 1 0 1 1 0 8 0 mbufpl 256 286 0 0 18 0 18 18 0 8 0 bufpl 280 6982 0 852 439 0 439 439 0 8 0 anonpl 32 10525 0 0 85 0 85 85 0 246 0 amapchunkpl 152 26080 0 25520 30 2 28 30 0 158 2 amappl16 200 3287 0 3217 25 9 16 21 0 8 8 amappl15 192 9 0 9 1 1 0 1 0 8 0 amappl14 184 453 0 452 1 0 1 1 0 8 0 amappl13 176 175 0 163 1 0 1 1 0 8 0 amappl12 168 1242 0 1212 2 0 2 2 0 8 0 amappl11 160 21 0 21 1 1 0 1 0 8 0 amappl10 152 66 0 52 1 0 1 1 0 8 0 amappl9 144 273 0 272 2 1 1 1 0 8 0 amappl8 136 111 0 108 1 0 1 1 0 8 0 amappl7 128 176 0 163 1 0 1 1 0 8 0 amappl6 120 170 0 167 1 0 1 1 0 8 0 amappl5 112 111 0 99 1 0 1 1 0 8 0 amappl4 104 317 0 297 1 0 1 1 0 8 0 amappl3 96 5108 0 5000 4 0 4 4 0 8 0 amappl2 88 607 0 545 2 0 2 2 0 8 0 amappl1 80 13636 0 13028 18 1 17 17 0 8 3 amappl 88 7364 0 7193 5 0 5 5 0 92 0 uvmvnodes 80 127 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 255 0 255 3 3 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 20 0 19 1 0 1 1 0 8 0 aobjpl 72 53 0 1 1 0 1 1 0 8 0 uaddrrnd 24 970 0 939 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 970 0 939 1 0 1 1 0 8 0 vmmpekpl 168 10327 0 10286 3 0 3 3 0 8 0 vmmpepl 168 71662 0 69687 109 2 107 107 0 357 10 vmsppl 488 969 0 939 5 0 5 5 0 8 1 rwobjpl 80 23037 0 21881 32 1 31 31 0 8 2 pdppl 4096 1957 0 1883 114 38 76 81 0 8 2 pvpl 32 20429 0 0 165 0 165 165 0 265 0 pmappl 256 974 0 939 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 325 0 66 8 0 8 8 0 8 0 ddb{0}> machine ddbcpu 0 Invalid cpu 0 ddb{0}> trace db_enter() at db_enter+0x25 sys/arch/amd64/amd64/db_interface.c:438 panic(ffffffff834d65db) at panic+0x1e5 sys/kern/subr_prf.c:198 chgproccnt(ee00,ffffffff) at chgproccnt+0xcc sys_setuid(ffff8000fffeea78,ffff80003c403bc0,ffff80003c403b10) at sys_setuid+0x2d9 sys/kern/kern_prot.c:746 syscall(ffff80003c403bc0) at syscall+0xb17 mi_syscall sys/sys/syscall_mi.h:176 [inline] syscall(ffff80003c403bc0) at syscall+0xb17 sys/arch/amd64/amd64/trap.c:783 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x99ee632eef0, count: -6 ddb{0}> machine ddbcpu 1 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffff8000299bdff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224 sched_idle(ffff8000299bdff0) at sched_idle+0x391 sys/kern/kern_sched.c:191 end trace frame: 0x0, count: 10 ddb{1}> trace x86_ipi_db(ffff8000299bdff0) at x86_ipi_db+0x27 sys/arch/amd64/amd64/db_interface.c:394 x86_ipi_handler() at x86_ipi_handler+0xd9 sys/arch/amd64/amd64/ipi.c:106 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 acpicpu_idle() at acpicpu_idle+0x457 sys/dev/acpi/acpicpu_x86.c:1224 sched_idle(ffff8000299bdff0) at sched_idle+0x391 sys/kern/kern_sched.c:191 end trace frame: 0x0, count: -5