Warning: Permanently added '10.128.1.40' (ED25519) to the list of known hosts. 2026/09/14 05:06:06 parsed 1 programs 2026/09/14 05:06:06 serving rpc on tcp://30139 2026/09/14 05:06:08 executed programs: 0 2026/09/14 05:06:13 executed programs: 125 2026/09/14 05:06:18 executed programs: 252 WpAanRNiINcG: :ke SrPneLl dNiaOT LOWERED ON TRAP EXIT c 0 Stopped at proc_trampoline+0xc7: movl $0,%gs:0x688 TID PID UID PRFLAGS PFLAGS CPU COMMAND *378316 91459 0 0 0 1 syz-executor 282149 91459 0 0 0x4000000 0 syz-executor proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x790c1eb99180, count: 14 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu0: kernel diagnostic assertion "next != NULL && next->start <= entry->end" failed: file "/syzkaller/jobs/openbsd/kernel/sys/uvm/uvm_fault.c", line 1764 ddb{1}> show kasan kasan: no report recorded this boot ddb{1}> trace proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x790c1eb99180, count: -1 ddb{1}> show registers rdi 0xffffffff854a24c0 panicstr rsi 0xffffffff84fdd2c0 __sancov_gen_cov_switch_values.22 rbp 0xffff800029a8e740 rbx 0 rdx 0 rcx 0xffff800028fe3ff0 rax 0x2a r8 0xffff800029a8e620 r9 0x1 r10 0x21 r11 0xffffffff811f01a0 x86_bus_space_io_read_1 r12 0 r13 0xffffffff82ed22a8 Xdoreti+0x18 r14 0 r15 0 rip 0xffffffff816a9427 proc_trampoline+0xc7 cs 0x8 rflags 0x246 rsp 0xffff800029a8e6c0 ss 0x10 proc_trampoline+0xc7: movl $0,%gs:0x688 ddb{1}> show proc PROC (syz-executor) tid=378316 pid=91459 tcnt=3 stat=onproc flags process=0 proc=0 runpri=86, usrpri=86, slppri=17, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff800029934560,0xffff800029934040 process=0xffff8000298a44d8 user=0xffff800029a83000, vmspace=0xffff800001aeb998 estcpu=36, cpticks=1, pctcpu=0.0, user=0, sys=0, intr=1 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND *91459 378316 87778 0 7 0 0 syz-executor 91459 282149 87778 0 7 0 0x4000000 syz-executor 91459 171544 87778 0 3 0 0x4000080 fsleep syz-executor 87778 344812 36582 0 3 0x2 0x80 nanoslp syz-executor 36582 493990 63641 0 3 0x2 0x80 kqread syz-executor 63641 38636 8767 0 3 0x2 0x80 thrsleep syz-execprog 63641 228829 8767 0 3 0x2 0x4000080 thrsleep syz-execprog 63641 233706 8767 0 3 0x2 0x4000080 thrsleep syz-execprog 63641 105438 8767 0 3 0x2 0x4000080 thrsleep syz-execprog 63641 270100 8767 0 3 0x2 0x4000080 kqread syz-execprog 63641 238825 8767 0 3 0x2 0x4000080 thrsleep syz-execprog 63641 153450 8767 0 3 0x2 0x4000080 thrsleep syz-execprog 63641 52327 8767 0 3 0x2 0x4000080 thrsleep syz-execprog 63641 73977 8767 0 3 0x2 0x4000080 thrsleep syz-execprog 63641 355427 8767 0 3 0x2 0x4000080 thrsleep syz-execprog 63641 68426 8767 0 3 0x2 0x4000080 thrsleep syz-execprog 63641 173579 8767 0 3 0x2 0x4000080 thrsleep syz-execprog 63641 420713 8767 0 3 0x2 0x4000080 thrsleep syz-execprog 8767 447833 55414 0 3 0x100002 0x88 sigsusp ksh 55414 374939 73318 0 3 0x10 0x88 kqread sshd-session 73318 8338 99050 0 3 0x12 0x80 kqread sshd-session 54268 291784 1 0 3 0x100003 0x80 ttyin getty 99050 166944 1 0 3 0 0x88 kqread sshd 3086 178661 68085 74 3 0x1100012 0x80 bpf pflogd 68085 240102 1 0 3 0 0x80 sbwait pflogd 22706 407518 46383 73 3 0x1100010 0x80 kqread syslogd 46383 50487 1 0 3 0x100002 0x80 sbwait syslogd 56396 42374 1 0 3 0x100000 0x80 kqread resolvd 70522 232139 47575 77 3 0x100012 0x80 kqread dhcpleased 62629 296111 47575 77 3 0x100012 0x80 kqread dhcpleased 47575 44697 1 0 3 0 0x80 kqread dhcpleased 64834 34599 0 0 3 0x14000 0x200 bored smr 10019 59794 0 0 3 0x14000 0x200 pgzero zerothread 55698 122291 0 0 3 0x14000 0x200 aiodoned aiodoned 55128 273774 0 0 3 0x14000 0x200 syncer update 64096 306989 0 0 3 0x14000 0x200 cleaner cleaner 78638 500213 0 0 3 0x14000 0x200 reaper reaper 74329 246356 0 0 3 0x14000 0x200 pgdaemon pagedaemon 62698 250618 0 0 3 0x14000 0x200 bored viomb 69163 209661 0 0 3 0x14000 0x40000200 acpi0 acpi0 60006 403042 0 0 3 0x14000 0x40000200 idle1 70823 87281 0 0 3 0x14000 0x200 bored softnet1 62687 219497 0 0 3 0x14000 0x200 bored softnet0 2428 509552 0 0 3 0x14000 0x200 bored systqmp 69302 236698 0 0 3 0x14000 0x200 bored systq 44484 243464 0 0 3 0x14000 0x200 tmoslp softclockmp 81244 286479 0 0 3 0x14000 0x40000200 tmoslp softclock 26243 406495 0 0 3 0x14000 0x40000200 idle0 1 268590 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{1}> show all locks CPU 1: exclusive mutex &sched_lock r = 0 (0xffffffff85497e70) #0 witness_lock+0x632 #1 mtx_enter+0x683 #2 sleep_setup+0x12e #3 sys_futex+0x62f #4 syscall+0x1089 #5 Xsyscall+0x128 Process 91459 (syz-executor) thread 0xffff800029934030 (282149) exclusive rwlock amaplk r = 0 (0xffff800001f48c00) #0 witness_lock+0x632 #1 rw_do_enter_write+0x53e #2 uvm_map_lock_entry+0x66 #3 uvm_fault_unwire_locked+0x37f #4 uvm_fault_wire+0x12d #5 uvm_vslock_device+0x187 #6 physio+0x4a7 #7 spec_read+0x29a #8 VOP_READ+0x1a8 #9 vn_read+0x1fc #10 dofilereadv+0x386 #11 sys_preadv+0x1b3 #12 syscall+0x1089 #13 Xsyscall+0x128 shared rwlock vmmaplk r = 0 (0xffff800001aeba98) #0 witness_lock+0x632 #1 rw_do_enter_read+0x55d #2 uvm_fault_wire+0x116 #3 uvm_vslock_device+0x187 #4 physio+0x4a7 #5 spec_read+0x29a #6 VOP_READ+0x1a8 #7 vn_read+0x1fc #8 dofilereadv+0x386 #9 sys_preadv+0x1b3 #10 syscall+0x1089 #11 Xsyscall+0x128 exclusive kernel_lock &kernel_lock r = 0 (0xffffffff85448300) #0 witness_lock+0x632 #1 __mp_acquire_count+0x48 #2 sleep_finish+0x423 #3 rw_do_enter_read+0x3bd #4 uvmfault_lookup+0x1a2 #5 uvm_fault_check+0x43 #6 uvm_fault+0x1e7 #7 uvm_fault_wire+0x73 #8 uvm_vslock_device+0x187 #9 physio+0x4a7 #10 spec_read+0x29a #11 VOP_READ+0x1a8 #12 vn_read+0x1fc #13 dofilereadv+0x386 #14 sys_preadv+0x1b3 #15 syscall+0x1089 #16 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11030 12234K 12234K 166960K 12431 0 pcb 17 24K 24K 166960K 17 0 rtable 83 4K 4K 166960K 231 0 pf 20 18K 20K 166960K 40 0 ifaddr 15 3K 3K 166960K 29 0 ifgroup 27 1K 1K 166960K 42 0 sysctl 1 1K 13K 166960K 5 0 counters 56 39K 39K 166960K 62 0 ioctlops 0 0K 4K 166960K 1479 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1227 79K 79K 166960K 1342 0 UFS quota 1 36K 36K 166960K 1 0 UFS mount 5 44K 44K 166960K 5 0 shm 2 2K 2K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 4 9K 13K 166960K 516 0 proc 70 128K 144K 166960K 440 0 subproc 0 0K 1K 166960K 53 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 20K 20K 166960K 1 0 in_multi 22 1K 1K 166960K 55 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 3 0 ISOFS mount 1 36K 36K 166960K 1 0 MSDOSFS mount 1 20K 20K 166960K 1 0 ttys 25 182K 182K 166960K 25 0 exec 0 0K 2K 166960K 436 0 fusefs mount 1 36K 36K 166960K 1 0 tdb 3 1K 1K 166960K 3 0 VM swap 14 124K 124K 166960K 15 0 UVM amap 219 175K 336K 166960K 8545 0 UVM aobj 3 4K 4K 166960K 3 0 pinsyscall 1055 1901K 1901K 166960K 1921 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 5 0K 0K 166960K 16 0 temp 1 9160K 9172K 166960K 7911 0 kqueue 14 44K 44K 166960K 66 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 25 0 22 1 0 1 1 0 8 0 rtentry 176 67 0 34 3 1 2 2 0 8 0 unpcb 144 105 0 88 1 0 1 1 0 8 0 syncache 336 17 0 17 2 2 0 1 0 8 0 tcpqe 32 1 0 1 1 1 0 1 0 8 0 tcpcb 736 28 0 21 1 0 1 1 0 8 0 arp 136 10 0 6 1 0 1 1 0 8 0 inpcb 328 69 0 59 1 0 1 1 0 8 0 nd6 152 12 0 9 2 1 1 1 0 8 0 kcovpl 48 7 0 7 2 2 0 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 30 0 10 1 0 1 1 0 8 0 pfstkey 128 30 0 10 1 0 1 1 0 8 0 pfstate 448 30 0 10 3 0 3 3 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 289 0 144 13 3 10 10 0 8 0 art_table 40 290 0 144 3 1 2 2 0 8 0 art_node 32 67 0 37 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1943 0 436 95 0 95 95 0 8 0 ffsino 296 1943 0 436 116 0 116 116 0 8 0 nchpl 144 2512 0 710 69 2 67 67 0 8 0 vnodes 216 2010 0 0 112 0 112 112 0 8 0 namei 1024 10026 0 10026 3 2 1 2 0 8 1 percpumem 16 47 0 3 1 0 1 1 0 8 0 kstatmem 264 19 0 6 1 0 1 1 0 8 0 scxspl 216 17565 0 17565 5 4 1 2 1 8 1 plimitpl 152 95 0 84 1 0 1 1 0 8 0 sigapl 424 843 0 808 8 4 4 6 0 8 0 knotepl 120 111 0 0 3 0 3 3 0 8 0 kqueuepl 224 62 0 52 1 0 1 1 0 8 0 pipepl 344 277 0 270 3 2 1 2 0 8 0 fdescpl 528 827 0 808 4 2 2 3 0 8 0 filepl 160 3467 0 3387 7 3 4 5 0 8 0 lockfpl 104 6 0 4 1 0 1 1 0 8 0 lockfspl 48 4 0 2 1 0 1 1 0 8 0 sessionpl 144 65 0 56 1 0 1 1 0 8 0 pgrppl 48 96 0 86 1 0 1 1 0 8 0 ucredpl 104 242 0 229 1 0 1 1 0 8 0 zombiepl 144 808 0 808 1 0 1 1 0 8 1 processpl 1232 843 0 808 5 2 3 4 0 8 0 procpl 664 1497 0 1448 7 2 5 5 0 8 0 sockpl 752 199 0 169 5 2 3 4 0 8 0 mcl64k 65536 3 0 0 1 0 1 1 0 8 0 mcl16k 16384 2 0 0 1 0 1 1 0 8 0 mcl12k 12288 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 3 0 0 1 0 1 1 0 8 0 mcl4k 4096 186 0 0 24 0 24 24 0 8 0 mcl2k 2048 17 0 0 3 0 3 3 0 8 0 mextrefs 64 8 0 0 1 0 1 1 0 8 0 mtagpl 96 3 0 0 1 0 1 1 0 8 0 mbufpl 256 191 0 0 12 0 12 12 0 8 0 bufpl 272 7998 0 839 478 0 478 478 0 8 0 anonpl 32 11124 0 0 91 1 90 90 0 222 0 amapchunkpl 152 28263 0 27737 49 23 26 33 0 158 3 amappl16 200 8397 0 8250 15 4 11 12 0 8 0 amappl15 192 27 0 27 3 3 0 1 0 8 0 amappl14 184 470 0 465 1 0 1 1 0 8 0 amappl13 176 272 0 257 3 2 1 2 0 8 0 amappl12 168 1154 0 1134 3 2 1 2 0 8 0 amappl11 160 42 0 42 2 2 0 1 0 8 0 amappl10 152 132 0 114 3 2 1 2 0 8 0 amappl9 144 3630 0 3630 3 3 0 1 0 8 0 amappl8 136 225 0 194 3 1 2 2 0 8 0 amappl7 128 299 0 277 4 2 2 3 0 8 0 amappl6 120 220 0 217 1 0 1 1 0 8 0 amappl5 112 462 0 452 1 0 1 1 0 8 0 amappl4 104 564 0 538 3 2 1 2 0 8 0 amappl3 96 3773 0 3718 4 2 2 3 0 8 0 amappl2 88 1582 0 1511 8 5 3 5 0 8 0 amappl1 80 26184 0 25617 36 20 16 24 0 8 1 amappl 88 7016 0 6890 8 4 4 5 0 92 0 uvmvnodes 80 90 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 2 0 0 1 0 1 1 0 8 0 uaddrrnd 24 827 0 808 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 827 0 808 1 0 1 1 0 8 0 vmmpekpl 168 16602 0 16582 2 0 2 2 0 8 0 vmmpepl 168 101988 0 100353 148 25 123 131 0 357 46 vmsppl 488 826 0 808 5 2 3 4 0 8 0 rwobjpl 80 42732 0 41638 62 35 27 42 0 8 1 pdppl 4096 1663 0 1616 111 64 47 69 0 8 0 pvpl 32 59563 0 0 482 1 481 481 0 265 0 pmappl 256 826 0 808 2 0 2 2 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 120 759 0 74 22 1 21 22 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x19: leave x86_ipi_db(ffffffff8502eff0) at x86_ipi_db+0x19 x86_ipi_handler() at x86_ipi_handler+0x112 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff85447b00) at __mp_lock+0x272 softintr_dispatch(0) at softintr_dispatch+0x215 dosoftint(0) at dosoftint+0x7b Xsoftclock() at Xsoftclock+0x27 cnputc(61) at cnputc+0xaf db_putchar(61) at db_putchar+0x29f kprintf() at kprintf+0x2aad db_printf(ffffffff847f7500) at db_printf+0x102 panic(ffffffff847f7460) at panic+0x17d __assert(ffffffff847f3360,ffffffff847f3380,6e4,ffffffff847f3ee0) at __assert+0x48 uvm_fault_unwire_locked(ffff800001aeb998,200000000000,200000003000) at uvm_fault_unwire_locked+0x55f end trace frame: 0xffff800029a99710, count: 0 ddb{0}> trace x86_ipi_db(ffffffff8502eff0) at x86_ipi_db+0x19 x86_ipi_handler() at x86_ipi_handler+0x112 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff85447b00) at __mp_lock+0x272 softintr_dispatch(0) at softintr_dispatch+0x215 dosoftint(0) at dosoftint+0x7b Xsoftclock() at Xsoftclock+0x27 cnputc(61) at cnputc+0xaf db_putchar(61) at db_putchar+0x29f kprintf() at kprintf+0x2aad db_printf(ffffffff847f7500) at db_printf+0x102 panic(ffffffff847f7460) at panic+0x17d __assert(ffffffff847f3360,ffffffff847f3380,6e4,ffffffff847f3ee0) at __assert+0x48 uvm_fault_unwire_locked(ffff800001aeb998,200000000000,200000003000) at uvm_fault_unwire_locked+0x55f uvm_fault_wire(ffff800001aeb998,200000000000,200000010000,3) at uvm_fault_wire+0x12d uvm_vslock_device(ffff800029934030,200000000000,10000,3,ffff800029a99940) at uvm_vslock_device+0x187 physio(ffffffff8198edf0,2902,8000,ffffffff84181c30,ffff800029a99ea0) at physio+0x4a7 spec_read(ffff800029a99bc0) at spec_read+0x29a VOP_READ(ffff80000195f950,ffff800029a99ea0,0,ffff800000119548) at VOP_READ+0x1a8 vn_read(ffff8000017ba030,ffff800029a99ea0,1) at vn_read+0x1fc dofilereadv(ffff800029934030,4,ffff800029a99ea0,1,ffff800029a9a080) at dofilereadv+0x386 sys_preadv(ffff800029934030,ffff800029a9a110,ffff800029a9a080) at sys_preadv+0x1b3 syscall(ffff800029a9a110) at syscall+0x1089 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xc7d653ed1d0, count: -24 ddb{0}> machine ddbcpu 1 Stopped at proc_trampoline+0xc7: movl $0,%gs:0x688 proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x790c1eb99180, count: 14 ddb{1}> trace proc_trampoline() at proc_trampoline+0xc7 end of kernel end trace frame: 0x790c1eb99180, count: -1