assert failed: cd->cd_map != NULL

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: ef911aaccf6f xen_rtc_set: Zero-initialize op before passin..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1778e08e980000
kernel config: https://syzkaller.appspot.com/x/.config?x=739e57438eb9ed9e
dashboard link: https://syzkaller.appspot.com/bug?extid=8a192f44b6e7680aacf9
compiler: Debian clang version 15.0.6

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/adfcf0f66884/disk-ef911aac.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/23e4a44052f6/netbsd-ef911aac.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8a192f...@syzkaller.appspotmail.com

[ 1.1931177] panic: kernel diagnostic assertion "cd->cd_map != NULL" failed: file "/syzkaller/managers/ci2-netbsd-kmsan/kernel/sys/net/npf/npf_conndb.c", line 141
[ 1.1931177] dk0 at sd0: "49b813d1-8009-4c4f-b3e1-2cc288366ecc", 2097085 blocks at 64, type: ffs
[ 1.1931177] cpu1: Begin traceback...
[ 1.2189453] dk1 at sd0: "2a5f9479-33b7-499d-8cc4-f8d9ae0937b7", 2097119 blocks at 2097152, type: swap
[ 1.2318403] sd0: async, 8-bit transfers, tagged queueing
[ 1.2431067] vpanic() at netbsd:vpanic+0xc9d
[ 1.2831071] kern_assert() at netbsd:kern_assert+0x228
[ 1.3431002] npf_conndb_create() at netbsd:npf_conndb_create+0x24a
[ 1.3931026] npf_conn_init() at netbsd:npf_conn_init+0x437 sys/net/npf/npf_conn.c:178
[ 1.4231541] npfk_create() at netbsd:npfk_create+0x219 sys/net/npf/npf.c:90
[ 1.4531440] npf_modcmd() at netbsd:npf_modcmd+0x298 sys/net/npf/npf_os.c:184
[ 1.4831555] module_do_builtin() at netbsd:module_do_builtin+0x1739 sys/kern/kern_module.c:950
[ 1.5231424] module_init_class() at netbsd:module_init_class+0x393 sys/kern/kern_module.c:606
[ 1.5531531] main() at netbsd:main+0x1011 sys/kern/init_main.c:663
[ 1.5631613] cpu1: End traceback...
[ 1.5631613] fatal breakpoint trap in supervisor mode
[ 1.5631613] trap type 1 code 0 rip 0xffffffff8023687d cs 0x8 rflags 0x282 cr2 0 ilevel 0 rsp 0xffffffff86e818e0
[ 1.5731476] curlwp 0xffffffff86a6fa40 pid 0.0 lowest kstack 0xffffffff86e7a2c0
Stopped in pid 0.0 (system) at netbsd:breakpoint+0x5: leave
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0xc9d
kern_assert() at netbsd:kern_assert+0x228
npf_conndb_create() at netbsd:npf_conndb_create+0x24a
npf_conn_init() at netbsd:npf_conn_init+0x437 sys/net/npf/npf_conn.c:178
npfk_create() at netbsd:npfk_create+0x219 sys/net/npf/npf.c:90
npf_modcmd() at netbsd:npf_modcmd+0x298 sys/net/npf/npf_os.c:184
module_do_builtin() at netbsd:module_do_builtin+0x1739 sys/kern/kern_module.c:950
module_init_class() at netbsd:module_init_class+0x393 sys/kern/kern_module.c:606
main() at netbsd:main+0x1011 sys/kern/init_main.c:663
ds 8918
es 3ba3
fs 18d0
gs 0
rdi 5
rsi 0
rbp ffffffff86e818e0
rbx 0
rdx 1
rcx ffffffff86a6fa40 lwp0
rax ffffffff86a98918 msan_lwp0+0x1918
r8 0
--db_more--

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.