netbsd boot error: panic: UBSan: Undefined Behavior in /syzkaller/managers/netbsd-kubsan/kernel/sys/dev/raidframe/rf_netbsdkintf.c:LINE, me

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 320188d7 Unbreak the sanitizers for gcc. The sanitizer off..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=11173c0f600000
kernel config: https://syzkaller.appspot.com/x/.config?x=824b23e1f4b6c76b
dashboard link: https://syzkaller.appspot.com/bug?extid=77097fae0e3aad6de088

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+77097f...@syzkaller.appspotmail.com

[ 1.4916731] panic: UBSan: Undefined Behavior in
/syzkaller/managers/netbsd-kubsan/kernel/sys/dev/raidframe/rf_netbsdkintf.c:521:7,
member access within null pointer of type 'struct raid_softc'

[ 1.5016614] cpu1: Begin traceback...
[ 1.5116543] vpanic() at netbsd:vpanic+0x258 sys/kern/subr_prf.c:336
[ 1.5320375] isAlreadyReported() at netbsd:isAlreadyReported
[ 1.5516159] HandleTypeMismatch() at netbsd:HandleTypeMismatch
[ 1.5620084] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x7b
sys/../common/lib/libc/misc/ubsan.c:396
[ 1.5818327] rf_buildroothack() at netbsd:rf_buildroothack+0x4c3
sys/dev/raidframe/rf_netbsdkintf.c:526
[ 1.6015966] rf_autoconfig() at netbsd:rf_autoconfig+0x75 rf_autoconfig
sys/dev/raidframe/rf_netbsdkintf.c:432 [inline]
[ 1.6015966] rf_autoconfig() at netbsd:rf_autoconfig+0x75
sys/dev/raidframe/rf_netbsdkintf.c:400
[ 1.6220520] config_finalize() at netbsd:config_finalize+0x13d
sys/kern/subr_autoconf.c:2148
[ 1.6422736] main() at netbsd:main+0x594 sys/kern/init_main.c:647
[ 1.6422736] cpu1: End traceback...
[ 1.6422736] fatal breakpoint trap in supervisor mode
[ 1.6520900] trap type 1 code 0 rip 0xffffffff8021dddd cs 0x8 rflags
0x282 cr2 0 ilevel 0 rsp 0xffffffff85e1d7d0
[ 1.6520900] curlwp 0xffffffff84bbc160 pid 0.1 lowest kstack
0xffffffff85e192c0
Stopped in pid 0.1 (system) at netbsd:breakpoint+0x5: leave
db{1}>


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.