UBSan: Undefined Behavior in rf_fail_disk

4 views

Skip to first unread message

syzbot

unread,

Jun 27, 2022, 5:28:26 AM6/27/22

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: d96d91ac552a Remove confusable comment.
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1287fa38080000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=037d1813186571cb2d38
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+037d18...@syzkaller.appspotmail.com

[ 132.6647307] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/dev/raidframe/rf_netbsdkintf.c:1141:25, member access within null pointer of type 'const struct RF_LayoutSW_t'

[ 132.6871578] cpu0: Begin traceback...
[ 132.7147147] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:293
[ 132.8147157] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 132.8947194] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 132.9547221] rf_fail_disk() at netbsd:rf_fail_disk+0x52e sys/dev/raidframe/rf_netbsdkintf.c:1141
[ 133.0247174] raidframe_ioctl_80() at netbsd:raidframe_ioctl_80+0xfe5 rf_fail_disk80 sys/dev/raidframe/rf_compat80.c:304 [inline]
[ 133.0247174] raidframe_ioctl_80() at netbsd:raidframe_ioctl_80+0xfe5 sys/dev/raidframe/rf_compat80.c:342
[ 133.0947186] raidioctl() at netbsd:raidioctl+0x35db sys/dev/raidframe/rf_netbsdkintf.c:1793
[ 133.1647175] cdev_ioctl() at netbsd:cdev_ioctl+0x1b2 sys/kern/subr_devsw.c:1223
[ 133.2247184] spec_ioctl() at netbsd:spec_ioctl+0xf2 sys/miscfs/specfs/spec_vnops.c:1294
[ 133.2947166] VOP_IOCTL() at netbsd:VOP_IOCTL+0x147 sys/kern/vnode_if.c:934
[ 133.3647204] vn_ioctl() at netbsd:vn_ioctl+0x196 sys/kern/vfs_vnops.c:865
[ 133.4347175] sys_ioctl() at netbsd:sys_ioctl+0xd84 sys/kern/sys_generic.c:673
[ 133.4947165] sys___syscall() at netbsd:sys___syscall+0x1e3 sy_call sys/sys/syscallvar.h:65 [inline]
[ 133.4947165] sys___syscall() at netbsd:sys___syscall+0x1e3 sys/kern/sys_syscall.c:90
[ 133.5647167] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 133.5647167] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 133.5647167] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 133.5847184] --- syscall (number 198) ---
[ 133.6047161] netbsd:syscall+0x2da:
[ 133.6047161] cpu0: End traceback...
[ 133.6047161] fatal breakpoint trap in supervisor mode
[ 133.6177282] trap type 1 code 0 rip 0xffffffff80221ab5 cs 0x8 rflags 0x246 cr2 0x7a64c8c0f000 ilevel 0 rsp 0xffffca00d148b4f0
[ 133.6307292] curlwp 0xfffff5c2bbd52500 pid 12889.13110 lowest kstack 0xffffca00d14872c0
Stopped in pid 12889.13110 (syz-executor.3) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:293
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
rf_fail_disk() at netbsd:rf_fail_disk+0x52e sys/dev/raidframe/rf_netbsdkintf.c:1141
raidframe_ioctl_80() at netbsd:raidframe_ioctl_80+0xfe5 rf_fail_disk80 sys/dev/raidframe/rf_compat80.c:304 [inline]
raidframe_ioctl_80() at netbsd:raidframe_ioctl_80+0xfe5 sys/dev/raidframe/rf_compat80.c:342
raidioctl() at netbsd:raidioctl+0x35db sys/dev/raidframe/rf_netbsdkintf.c:1793
cdev_ioctl() at netbsd:cdev_ioctl+0x1b2 sys/kern/subr_devsw.c:1223
spec_ioctl() at netbsd:spec_ioctl+0xf2 sys/miscfs/specfs/spec_vnops.c:1294
VOP_IOCTL() at netbsd:VOP_IOCTL+0x147 sys/kern/vnode_if.c:934
vn_ioctl() at netbsd:vn_ioctl+0x196 sys/kern/vfs_vnops.c:865
sys_ioctl() at netbsd:sys_ioctl+0xd84 sys/kern/sys_generic.c:673
sys___syscall() at netbsd:sys___syscall+0x1e3 sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x1e3 sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 198) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/dev/raidframe/rf_netbsdkintf.c:1141:25, member access within null pointer of type 'const struct RF_LayoutSW_t'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
12845 12848 2 0 0 fffff5c2bb62f300 syz-executor.2
12845 12845 2 1 10000000 fffff5c2bc171980 syz-executor.2
11459 12637 3 1 180 fffff5c2bb8838c0 syz-executor.0 parked
11459 11459 2 0 10000000 fffff5c2b3db0580 syz-executor.0
12889>13110 7 0 100 fffff5c2bbd52500 syz-executor.3
12889 12889 2 0 10000000 fffff5c2bbd520c0 syz-executor.3
12885 12983 3 0 180 fffff5c2bb8476c0 syz-executor.5 parked
12885 10299 3 1 180 fffff5c2bb78e340 syz-executor.5 parked
12885 13109 3 0 180 fffff5c2bc419580 syz-executor.5 msgwait
12885 12885 2 1 10000140 fffff5c2bb52a680 syz-executor.5
10326 10326 2 0 0 fffff5c2bb604700 syz-executor.1
969 969 3 0 180 fffff5c2bb52aac0 syz-executor.1 parked
1628 1628 3 0 180 fffff5c2bb78e780 syz-executor.1 parked
979 979 2 0 140 fffff5c2b3db0140 syz-executor.5
1086 >1086 7 1 40 fffff5c2b2d41980 syz-executor.4
1222 1222 2 0 140 fffff5c2b2d41540 syz-executor.2
1228 1228 2 1 140 fffff5c2b2d41100 syz-executor.3
425 425 2 0 40 fffff5c2ae584500 syz-executor.1
1223 1223 2 1 140 fffff5c2ae584940 syz-executor.0
1194 1221 3 1 180 fffff5c2ad8f0b00 syz-fuzzer parked
1194 1076 3 0 180 fffff5c2adc3e780 syz-fuzzer kqueue
1194 1220 3 1 180 fffff5c2ae5840c0 syz-fuzzer parked
1194 1192 3 1 180 fffff5c2ad427ac0 syz-fuzzer parked
1194 1195 3 0 180 fffff5c2ad8f0280 syz-fuzzer parked
1194 1080 2 0 140 fffff5c2ad427680 syz-fuzzer
1194 1253 2 0 140 fffff5c2ad1fa600 syz-fuzzer
1194 1194 3 0 180 fffff5c2ae4a4900 syz-fuzzer parked
1127 1127 3 0 180 fffff5c2aeb188c0 sshd select
1254 1254 3 1 180 fffff5c2ae4a4080 getty nanoslp
1073 1073 3 0 180 fffff5c2aeb18040 getty nanoslp
1103 1103 3 0 180 fffff5c2ad8a5b40 getty nanoslp
1068 1068 3 0 1c0 fffff5c2ad427240 getty ttyraw
926 926 3 1 180 fffff5c2ae4a44c0 sshd select
954 954 3 0 180 fffff5c2adc3ebc0 powerd kqueue
690 690 3 1 180 fffff5c2aeb18480 syslogd kqueue
546 546 3 1 180 fffff5c2adc3e340 dhcpcd poll
600 600 3 1 180 fffff5c2ad976740 dhcpcd poll
602 602 3 1 180 fffff5c2ad976300 dhcpcd poll
589 589 3 1 180 fffff5c2ad8a5700 dhcpcd poll
289 289 3 1 180 fffff5c2ad976b80 dhcpcd poll
288 288 3 0 180 fffff5c2ad8a52c0 dhcpcd poll
351 351 3 1 180 fffff5c2ad8f06c0 dhcpcd poll
1 1 3 0 180 fffff5c2a505e540 init wait
0 6191 3 1 200 fffff5c2ba5dd640 ktrace ktrwait
0 1513 5 1 200 fffff5c2ba5dda80 (zombie)
0 968 3 1 200 fffff5c2ad1faa40 physiod physiod
0 194 3 0 200 fffff5c2ad275a80 pooldrain pooldrain
0 193 2 0 240 fffff5c2ad275640 ioflush
0 192 3 1 200 fffff5c2ad275200 pgdaemon pgdaemon
0 167 3 0 200 fffff5c2ad1fa1c0 usb7 usbevt
0 166 3 0 200 fffff5c2aa185a00 usb6 usbevt
0 165 3 1 200 fffff5c2aa1855c0 usb5 usbevt
0 164 3 0 200 fffff5c2aa185180 usb4 usbevt
0 31 3 0 200 fffff5c2a71209c0 usb3 usbevt
0 63 3 1 200 fffff5c2a7120580 usb2 usbevt
0 126 3 0 200 fffff5c2a7120140 usb1 usbevt
0 125 3 0 200 fffff5c2a4fdd300 usb0 usbevt
0 124 3 1 200 fffff5c2a4fdd740 usbtask-dr usbtsk
0 123 3 0 200 fffff5c2a493d6c0 usbtask-hc usbtsk
0 122 2 0 240 fffff5c2a505e980 npfgc0
0 121 3 1 200 fffff5c2a505e100 rt_free rt_free
0 120 3 1 200 fffff5c2a5059940 unpgc unpgc
0 119 2 0 200 fffff5c2a5059500 key_timehandler
0 118 3 1 200 fffff5c2a50590c0 icmp6_wqinput/1 icmp6_wqinput
0 117 3 0 200 fffff5c2a5024900 icmp6_wqinput/0 icmp6_wqinput
0 116 2 0 200 fffff5c2a50244c0 nd6_timer
0 115 3 1 200 fffff5c2a5024080 carp6_wqinput/1 carp6_wqinput
0 114 3 0 200 fffff5c2a50178c0 carp6_wqinput/0 carp6_wqinput
0 113 3 1 200 fffff5c2a5017480 carp_wqinput/1 carp_wqinput
0 112 3 0 200 fffff5c2a5017040 carp_wqinput/0 carp_wqinput
0 111 3 1 200 fffff5c2a4feabc0 icmp_wqinput/1 icmp_wqinput
0 110 3 0 200 fffff5c2a4fea780 icmp_wqinput/0 icmp_wqinput
0 109 2 0 200 fffff5c2a4fddb80 rt_timer
0 108 3 0 200 fffff5c2a4fea340 vmem_rehash vmem_rehash
0 99 3 0 200 fffff5c2a494ab40 entbutler entropy
0 98 3 1 200 fffff5c2a494a700 viomb balloon
0 97 3 1 200 fffff5c2a494a2c0 vioif0_txrx/1 vioif0_txrx
0 96 3 0 200 fffff5c2a493db00 vioif0_txrx/0 vioif0_txrx
0 29 3 1 200 fffff5c2a493d280 scsibus0 sccomp
0 28 3 0 200 fffff5c2a33c3ac0 pms0 pmsreset
0 27 3 1 200 fffff5c2a33c3680 xcall/1 xcall
0 26 1 1 200 fffff5c2a33c3240 softser/1
0 25 1 1 200 fffff5c2a338ea80 softclk/1
0 24 1 1 200 fffff5c2a338e640 softbio/1
0 23 1 1 200 fffff5c2a338e200 softnet/1
0 22 1 1 201 fffff5c3d2335a40 idle/1
0 21 3 1 200 fffff5c3d2335600 lnxsyswq lnxsyswq
0 20 3 1 200 fffff5c3d23351c0 lnxubdwq lnxubdwq
0 19 3 0 200 fffff5c3d2344a00 lnxpwrwq lnxpwrwq
0 18 3 1 200 fffff5c3d23445c0 lnxlngwq lnxlngwq
0 17 3 1 200 fffff5c3d2344180 lnxhipwq lnxhipwq
0 16 3 1 200 fffff5c3d235d9c0 lnxrcugc lnxrcugc
0 15 3 0 200 fffff5c3d235d580 sysmon smtaskq
0 14 3 1 200 fffff5c3d235d140 pmfsuspend pmfsuspend
0 13 3 0 200 fffff5c3d236a980 pmfevent pmfevent
0 12 3 1 200 fffff5c3d236a540 sopendfree sopendfr
0 11 3 0 200 fffff5c3d236a100 iflnkst iflnkst
0 10 3 1 200 fffff5c3d339b940 nfssilly nfssilly
0 9 3 0 200 fffff5c3d339b500 vdrain vdrain
0 8 3 1 200 fffff5c3d339b0c0 modunload mod_unld
0 7 3 0 200 fffff5c3d33c2900 xcall/0 xcall
0 6 1 0 200 fffff5c3d33c24c0 softser/0
0 5 1 0 200 fffff5c3d33c2080 softclk/0
0 4 1 0 200 fffff5c3d33f18c0 softbio/0
0 3 1 0 200 fffff5c3d33f1480 softnet/0
0 2 1 0 201 fffff5c3d33f1040 idle/0
0 0 2 0 240 ffffffff86750840 swapper
[Locks tracked through LWPs]

****** LWP 12845.12845 (syz-executor.2) @ 0xfffff5c2bc171980, l_stat=2

*** Locks held:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xfffff5c2a506b980 type : sleep/adaptive
initialized : 0xffffffff8100054d
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xfffff5c2bc171980 last held: 0xfffff5c2bc171980
last locked* : 0xffffffff8100012b unlocked : 0xffffffff81003333
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 11459.11459 (syz-executor.0) @ 0xfffff5c2b3db0580, l_stat=2

*** Locks held:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xfffff5c2ae497180 type : sleep/adaptive
initialized : 0xffffffff8100054d
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffff5c2b3db0580 last held: 0xfffff5c2b3db0580
last locked* : 0xffffffff81002c56 unlocked : 0xffffffff81003333
owner field : 0xfffff5c2b3db0580 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1086.1086 (syz-executor.4) @ 0xfffff5c2b2d41980, l_stat=7

*** Locks held:

* Lock 0 (initialized at vcache_alloc)
lock address : 0xfffff5c2bba06540 type : sleep/adaptive
initialized : 0xffffffff839f36b0
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xfffff5c2b2d41980 last held: 0xfffff5c2b2d41980
last locked* : 0xffffffff83a52e70 unlocked : 0xffffffff83a52ff4
owner/count : 0xfffff5c2b2d41980 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at vcache_alloc)
lock address : 0xfffff5c2bcdc0540 type : sleep/adaptive
initialized : 0xffffffff839f36b0
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xfffff5c2b2d41980 last held: 0xfffff5c2b2d41980
last locked* : 0xffffffff83a52e70 unlocked : 0xffffffff83a52ff4
owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 425.425 (syz-executor.1) @ 0xfffff5c2ae584500, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at amap_alloc1)
lock address : 0xfffff5c2ae59a300 type : sleep/adaptive
initialized : 0xffffffff835aa1fa
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1
relevant cpu : 0 last held: 0
relevant lwp : 0xfffff5c2ae584500 last held: 000000000000000000
last locked : 0xffffffff835af99a unlocked*: 0xffffffff835aff7b
owner/count : 000000000000000000 flags : 000000000000000000
Turnstile: no active turnstile for this lock.

****** LWP 600.600 (dhcpcd) @ 0xfffff5c2ad976740, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff86beb1c0 type : sleep/adaptive
initialized : 0xffffffff8370d5e7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffff5c2ad976740 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 602.602 (dhcpcd) @ 0xfffff5c2ad976300, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff86beb1c0 type : sleep/adaptive
initialized : 0xffffffff8370d5e7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffff5c2ad976300 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 288.288 (dhcpcd) @ 0xfffff5c2ad8a52c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff86beb1c0 type : sleep/adaptive
initialized : 0xffffffff8370d5e7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffff5c2ad8a52c0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 351.351 (dhcpcd) @ 0xfffff5c2ad8f06c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff86beb1c0 type : sleep/adaptive
initialized : 0xffffffff8370d5e7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffff5c2ad8f06c0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.25 (softclk/1) @ 0xfffff5c2a338ea80, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff86beb1c0 type : sleep/adaptive
initialized : 0xffffffff8370d5e7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffff5c2a338ea80 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xfffff5c3d236a100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff86beb1c0 type : sleep/adaptive
initialized : 0xffffffff8370d5e7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffff5c3d236a100 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff86750840, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff86beb1c0 type : sleep/adaptive
initialized : 0xffffffff8370d5e7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff86750840 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at main)
lock address : 0xffffffff86beb0c0 type : spin
initialized : 0xffffffff83ffb2c9
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffff5c2bbd52500 last held: 0xfffff5c2bbd52500
last locked* : 0xffffffff83802259 unlocked : 0xffffffff8294cfd3
curcpu holds : 1 wanted by: 000000000000000000

* Lock 1 (initialized at kprintf_init)
lock address : 0xffffffff86cce668 type : spin
initialized : 0xffffffff8385b253
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffff5c2bbd52500 last held: 0xfffff5c2bbd52500
last locked* : 0xffffffff8385b2e1 unlocked : 0xffffffff8385b35c
owner field : 0x0000000000000800 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffffca0000007180 0045 00000000 0x0 0x0
0xffffca0000007200 0045 00000000 0x0 0x0
0xffffca0000007280 0045 00000000 0x0 0x0
0xffffca0000007300 0045 00000000 0x0 0x0
0xffffca0000007380 0045 00000000 0x0 0x0
0xffffca0000007400 0045 00000000 0x0 0x0
0xffffca0000007480 0045 00000000 0x0 0x0
0xffffca0000007500 0045 00000000 0x0 0x0
0xffffca0000007580 0045 00000000 0x0 0x0
0xffffca0000007600 0045 00000000 0x0 0x0
0xffffca0000007680 0041 00000000 0x0 0x0
0xffffca0000007700 0041 00000000 0x0 0x0
0xffffca0000007780 0041 00000000 0x0 0x0
0xffffca0000007800 0041 00000000 0x0 0x0
0xffffca0000007880 0041 00000000 0x0 0x0
0xffffca0000007900 0045 00000000 0x0 0x0
0xffffca0000007980 0041 00000000 0x0 0x0
0xffffca0000007a00 0041 00000000 0x0 0x0
0xffffca0000007a80 0041 00000000 0x0 0x0
0xffffca0000007b00 0041 00000000 0x0 0x0
0xffffca0000007b80 0041 00000000 0x0 0x0
0xffffca0000007c00 0041 00000000 0x0 0x0
0xffffca0000007c80 0041 00000000 0x0 0x0
0xffffca0000007d00 0041 00000000 0x0 0x0
0xffffca0000007d80 0041 00000000 0x0 0x0
0xffffca0000007e00 0041 00000000 0x0 0x0
0xffffca0000007e80 0041 00000000 0x0 0x0
0xffffca0000007f00 0041 00000000 0x0 0x0
0xffffca0000007f80 0041 00000000 0x0 0x0
0xffffca0000008000 0041 00000000 0x0 0x0
0xffffca0000008080 0041 00000000 0x0 0x0
0xffffca0000008100 0041 00000000 0x0 0x0
0xffffca0000008180 0041 00000000 0x0 0x0
0xffffca0000008200 0041 00000000 0x0 0x0
0xffffca0000008280 0041 00000000 0x0 0x0
0xffffca0000008300 0041 00000000 0x0 0x0
0xffffca0000008380 0041 00000000 0x0 0x0
0xffffca0000008400 0041 00000000 0x0 0x0
0xffffca0000008480 0041 00000000 0x0 0x0
0xffffca0000008500 0041 00000000 0x0 0x0
0xffffca0000008580 0041 00000000 0x0 0x0
0xffffca0000008600 0041 00000000 0x0 0x0
0xffffca0000008680 0041 00000000 0x0 0x0
0xffffca0000008700 0041 00000000 0x0 0x0
0xffffca0000008780 0041 00000000 0x0 0x0
0xffffca0000008800 0041 00000000 0x0 0x0
0xffffca0000008880 0041 00000000 0x0 0x0
0xffffca0000008900 0041 00000000 0x0 0x0
0xffffca0000008980 0041 00000000 0x0 0x0
0xffffca0000008a00 0041 00000000 0x0 0x0
0xffffca0000008a80 0041 00000000 0x0 0x0
0xffffca0000008b00 0041 00000000 0x0 0x0
0xffffca0000008b80 0045 00000000 0x0 0x0
0xffffca0000008c00 0045 00000000 0x0 0x0
0xffffca0000008c80 0041 00000000 0x0 0x0
0xffffca0000008d00 0041 00000000 0x0 0x0
0xffffca0000008d80 0041 00000000 0x0 0x0
0xffffca0000008e00 0041 00000000 0x0 0x0
0xffffca0000008e80 0041 00000000 0x0 0x0
0xffffca0000008f00 0041 00000000 0x0 0x0
0xffffca0000008f80 0041 00000000 0x0 0x0
0xffffca0000009000 0041 00000000 0x0 0x0
0xffffca0000009080 0045 00000000 0x0 0x0
0xffffca0000009100 0041 00000000 0x0 0x0
0xffffca0000009180 0041 00000000 0x0 0x0
0xffffca0000009200 0041 00000000 0x0 0x0
0xffffca0000009280 0041 00000000 0x0 0x0
0xffffca0000009300 0041 00000000 0x0 0x0
0xffffca0000009380 0041 00000000 0x0 0x0
0xffffca0000009400 0041 00000000 0x0 0x0
0xffffca0000009480 0041 00000000 0x0 0x0
0xffffca0000009500 0041 00000000 0x0 0x0
0xffffca0000009580 0041 00000000 0x0 0x0
0xffffca0000009600 0041 00000000 0x0 0x0
0xffffca0000009680 0041 00000000 0x0 0x0
0xffffca0000009700 0041 00000000 0x0 0x0
0xffffca0000009780 0041 00000000 0x0 0x0
0xffffca0000009800 0041 00000000 0x0 0x0
0xffffca0000009880 0041 00000000 0x0 0x0
0xffffca0000009900 0041 00000000 0x0 0x0
0xffffca0000009980 0041 00000000 0x0 0x0
0xffffca0000009a00 0041 00000000 0x0 0x0
0xffffca0000009a80 0041 00000000 0x0 0x0
0xffffca0000009b00 0041 00000000 0x0 0x0
0xffffca0000009b80 0041 00000000 0x0 0x0
0xffffca0000009c00 0041 00000000 0x0 0x0
0xffffca0000009c80 0041 00000000 0x0 0x0
0xffffca0000009d00 0041 00000000 0x0 0x0
0xffffca0000009d80 0041 00000000 0x0 0x0
0xffffca0000009e00 0041 00000000 0x0 0x0
0xffffca0000009e80 0041 00000000 0x0 0x0
0xffffca0000009f00 0041 00000000 0x0 0x0
0xffffca0000009f80 0041 00000000 0x0 0x0
0xffffca000000a000 0041 00000000 0x0 0x0
0xffffca000000a080 0041 00000000 0x0 0x0
0xffffca000000a100 0041 00000000 0x0 0x0
0xffffca000000a180 0041 00000000 0x0 0x0
0xffffca000000a200 0041 00000000 0x0 0x0
0xffffca000000a280 0045 00000000 0x0 0x0
0xffffca000000a300 0041 00000000 0x0 0x0
0xffffca000000a380 0041 00000000 0x0 0x0
0xffffca000000a400 0041 00000000 0x0 0x0
0xffffca000000a480 0041 00000000 0x0 0x0
0xffffca000000a500 0041 00000000 0x0 0x0
0xffffca000000a580 0041 00000000 0x0 0x0
0xffffca000000a600 0045 00000000 0x0 0x0
0xffffca000000a680 0041 00000000 0x0 0x0
0xffffca000000a700 0041 00000000 0x0 0x0
0xffffca000000a780 0041 00000000 0x0 0x0
0xffffca000000a800 0041 00000000 0x0 0x0
0xffffca000000a880 0041 00000000 0x0 0x0
0xffffca000000a900 0041 00000000 0x0 0x0
0xffffca000000a980 0041 00000000 0x0 0x0
0xffffca000000aa00 0041 00000000 0x0 0x0
0xffffca000000aa80 0041 00000000 0x0 0x0
0xffffca000000ab00 0041 00000000 0x0 0x0
0xffffca000000ab80 0041 00000000 0x0 0x0
0xffffca000000ac00 0041 00000000 0x0 0x0
0xffffca000000ac80 0041 00000000 0x0 0x0
0xffffca000000ad00 0041 00000000 0x0 0x0
0xffffca000000ad80 0041 00000000 0x0 0x0
0xffffca000000ae00 0041 00000000 0x0 0x0
0xffffca000000ae80 0045 00000000 0x0 0x0
0xffffca000000af00 0045 00000000 0x0 0x0
0xffffca000000af80 0041 00000000 0x0 0x0
0xffffca000000b000 0041 00000000 0x0 0x0
0xffffca000000b080 0041 00000000 0x0 0x0
0xffffca000000b100 0041 00000000 0x0 0x0
0xffffca000000b180 0045 00000000 0x0 0x0
0xffffca000000b200 0045 00000000 0x0 0x0
0xffffca000000b280 0045 00000000 0x0 0x0
0xffffca000000b300 0045 00000000 0x0 0x0
0xffffca000000b380 0045 00000000 0x0 0x0
0xffffca000000b400 0041 00000000 0x0 0x0
0xffffca000000b480 0041 00000000 0x0 0x0
0xffffca000000b500 0045 00000000 0x0 0x0
0xffffca000000b580 0045 00000000 0x0 0x0
0xffffca000000b600 0045 00000000 0x0 0x0
0xffffca000000b680 0045 00000000 0x0 0x0
0xffffca000000b700 0045 00000000 0x0 0x0
0xffffca000000b780 0045 00000000 0x0 0x0
0xffffca000000b800 0041 00000000 0x0 0x0
0xffffca000000b880 0041 00000000 0x0 0x0
0xffffca000000b900 0045 00000000 0x0 0x0
0xffffca000000b980 0045 00000000 0x0 0x0
0xffffca000000ba00 0045 00000000 0x0 0x0
0xffffca000000ba80 0045 00000000 0x0 0x0
0xffffca000000bb00 0045 00000000 0x0 0x0
0xffffca000000bb80 0045 00000000 0x0 0x0
0xffffca000000bc00 0045 00000000 0x0 0x0
0xffffca000000bc80 0041 00000000 0x0 0x0
0xffffca000000bd00 0045 00000000 0x0 0x0
0xffffca000000bd80 0045 00000000 0x0 0x0
0xffffca000000be00 0045 00000000 0x0 0x0
0xffffca000000be80 0045 00000000 0x0 0x0
0xffffca000000bf00 0045 00000000 0x0 0x0
0xffffca000000bf80 0045 00000000 0x0 0x0
0xffffca000000c000 0045 00000000 0x0 0x0
0xffffca000000c080 0045 00000000 0x0 0x0
0xffffca000000c100 0045 00000000 0x0 0x0
0xffffca000000c180 0045 00000000 0x0 0x0
0xffffca000000c200 0045 00000000 0x0 0x0
0xffffca000000c280 0045 00000000 0x0 0x0
0xffffca000000c300 0045 00000000 0x0 0x0
0xffffca000000c380 0045 00000000 0x0 0x0
0xffffca000000c400 0045 00000000 0x0 0x0
0xffffca000000c480 0045 00000000 0x0 0x0
0xffffca000000c500 0045 00000000 0x0 0x0
0xffffca000000c580 0045 00000000 0x0 0x0
0xffffca000000c600 0045 00000000 0x0 0x0
0xffffca000000c680 0045 00000000 0x0 0x0
0xffffca000000c700 0041 00000000 0x0 0x0
0xffffca000000c780 0045 00000000 0x0 0x0
0xffffca000000c800 0045 00000000 0x0 0x0
0xffffca000000c880 0045 00000000 0x0 0x0
0xffffca000000c900 0045 00000000 0x0 0x0
0xffffca000000c980 0045 00000000 0x0 0x0
0xffffca000000ca00 0045 00000000 0x0 0x0
0xffffca000000ca80 0041 00000000 0x0 0x0
0xffffca000000cb00 0041 00000000 0x0 0x0
0xffffca000000cb80 0041 00000000 0x0 0x0
0xffffca000000cc00 0045 00000000 0x0 0x0
0xffffca000000cc80 0045 00000000 0x0 0x0
0xffffca000000cd00 0041 00000000 0x0 0x0
0xffffca000000cd80 0041 00000000 0x0 0x0
0xffffca000000ce00 0041 00000000 0x0 0x0
0xffffca000000ce80 0041 00000000 0x0 0x0
0xffffca000000cf00 0041 00000000 0x0 0x0
0xffffca000000cf80 0041 00000000 0x0 0x0
0xffffca000000d000 0045 00000000 0x0 0x0
0xffffca000000d080 0045 00000000 0x0 0x0
0xffffca000000d100 0041 00000000 0x0 0x0
0xffffca000000d180 0041 00000000 0x0 0x0
0xffffca000000d200 0041 00000000 0x0 0x0
0xffffca000000d280 0041 00000000 0x0 0x0
0xffffca000000d300 0045 00000000 0x0 0x0
0xffffca000000d380 0041 00000000 0x0 0x0
0xffffca000000d400 0041 00000000 0x0 0x0
0xffffca000000d480 0045 00000000 0x0 0x0
0xffffca000000d500 0041 00000000 0x0 0x0
0xffffca000000d580 0041 00000000 0x0 0x0
0xffffca000000d600 0041 00000000 0x0 0x0
0xffffca000000d680 0045 00000000 0x0 0x0
0xffffca000000d700 0041 00000000 0x0 0x0
0xffffca000000d780 0045 00000000 0x0 0x0
0xffffca000000d800 0041 00000000 0x0 0x0
0xffffca000000d880 0041 00000000 0x0 0x0
0xffffca000000d900 0041 00000000 0x0 0x0
0xffffca000000d980 0041 00000000 0x0 0x0
0xffffca000000da00 0041 00000000 0x0 0x0
0xffffca000000da80 0041 00000000 0x0 0x0
0xffffca000000db00 0045 00000000 0x0 0x0
0xffffca000000db80 0041 00000000 0x0 0x0
0xffffca000000dc00 0041 00000000 0x0 0x0
0xffffca000000dc80 0041 00000000 0x0 0x0
0xffffca000000dd00 0041 00000000 0x0 0x0
0xffffca000000dd80 0041 00000000 0x0 0x0
0xffffca000000de00 0041 00000000 0x0 0x0
0xffffca000000de80 0041 00000000 0x0 0x0
0xffffca000000df00 0045 00000000 0x0 0x0
0xffffca000000df80 0045 00000000 0x0 0x0
0xffffca000000e000 0045 00000000 0x0 0x0
0xffffca000000e080 0041 00000000 0x0 0x0
0xffffca000000e100 0045 00000000 0x0 0x0
0xffffca000000e180 0045 00000000 0x0 0x0
0xffffca000000e200 0045 00000000 0x0 0x0
0xffffca000000e280 0045 00000000 0x0 0x0
0xffffca000000e300 0045 00000000 0x0 0x0
0xffffca000000e380 0045 00000000 0x0 0x0
0xffffca000000e400 0041 00000000 0x0 0x0
0xffffca000000e480 0045 00000000 0x0 0x0
0xffffca000000e500 0041 00000000 0x0 0x0
0xffffca000000e580 0041 00000000 0x0 0x0
0xffffca000000e600 0041 00000000 0x0 0x0
0xffffca000000e680 0041 00000000 0x0 0x0
0xffffca000000e700 0041 00000000 0x0 0x0
0xffffca000000e780 0045 00000000 0x0 0x0
0xffffca000000e800 0045 00000000 0x0 0x0
0xffffca000000e880 0041 00000000 0x0 0x0
0xffffca000000e900 0041 00000000 0x0 0x0
0xffffca000000e980 0041 00000000 0x0 0x0
0xffffca000000ea00 0041 00000000 0x0 0x0
0xffffca000000ea80 0045 00000000 0x0 0x0
0xffffca000000eb00 0041 00000000 0x0 0x0
0xffffca000000eb80 0041 00000000 0x0 0x0
0xffffca000000ec00 0045 00000000 0x0 0x0
0xffffca000000ec80 0045 00000000 0x0 0x0
0xffffca000000ed00 0045 00000000 0x0 0x0
0xffffca000000ed80 0041 00000000 0x0 0x0
0xffffca000000ee00 0041 00000000 0x0 0x0
0xffffca000000ee80 0041 00000000 0x0 0x0
0xffffca000000ef00 0041 00000000 0x0 0x0
0xffffca000000ef80 0041 00000000 0x0 0x0
0xffffca000000f000 0045 00000000 0x0 0x0
0xffffca000000f080 0041 00000000 0x0 0x0
0xffffca000000f100 0041 00000000 0x0 0x0
0xffffca000000f180 0041 00000000 0x0 0x0
0xffffca000000f200 0041 00000000 0x0 0x0
0xffffca000000f280 0045 00000000 0x0 0x0
0xffffca000000f300 0041 00000000 0x0 0x0
0xffffca000000f380 0045 00000000 0x0 0x0
0xffffca000000f400 0041 00000000 0x0 0x0
0xffffca000000f480 0041 00000000 0x0 0x0
0xffffca000000f500 0041 00000000 0x0 0x0
0xffffca000000f580 0041 00000000 0x0 0x0
0xffffca000000f600 0041 00000000 0x0 0x0
0xffffca000000f680 0041 00000000 0x0 0x0
0xffffca000000f700 0041 00000000 0x0 0x0
0xffffca000000f780 0041 00000000 0x0 0x0
0xffffca000000f800 0041 00000000 0x0 0x0
0xffffca000000f880 0045 00000000 0x0 0x0
0xffffca000000f900 0041 00000000 0x0 0x0
0xffffca000000f980 0045 00000000 0x0 0x0
0xffffca000000fa00 0045 00000000 0x0 0x0
0xffffca000000fa80 0041 00000000 0x0 0x0
0xffffca000000fb00 0041 00000000 0x0 0x0
0xffffca000000fb80 0041 00000000 0x0 0x0
0xffffca000000fc00 0045 00000000 0x0 0x0
0xffffca000000fc80 0041 00000000 0x0 0x0
0xffffca000000fd00 0045 00000000 0x0 0x0
0xffffca000000fd80 0041 00000000 0x0 0x0
0xffffca000000fe00 0041 00000000 0x0 0x0
0xffffca000000fe80 0041 00000000 0x0 0x0
0xffffca000000ff00 0041 00000000 0x0 0x0
0xffffca000000ff80 0041 00000000 0x0 0x0
0xffffca0000010000 0041 00000000 0x0 0x0
0xffffca0000010080 0041 00000000 0x0 0x0
0xffffca0000010100 0041 00000000 0x0 0x0
0xffffca0000010180 0041 00000000 0x0 0x0
0xffffca0000010200 0041 00000000 0x0 0x0
0xffffca0000010280 0041 00000000 0x0 0x0
0xffffca0000010300 0041 00000000 0x0 0x0
0xffffca0000010380 0041 00000000 0x0 0x0
0xffffca0000010400 0045 00000000 0x0 0x0
0xffffca0000010480 0045 00000000 0x0 0x0
0xffffca0000010500 0045 00000000 0x0 0x0
0xffffca0000010580 0045 00000000 0x0 0x0
0xffffca0000010600 0045 00000000 0x0 0x0
0xffffca0000010680 0041 00000000 0x0 0x0
0xffffca0000010700 0045 00000000 0x0 0x0
0xffffca0000010780 0041 00000000 0x0 0x0
0xffffca0000010800 0041 00000000 0x0 0x0
0xffffca0000010880 0041 00000000 0x0 0x0
0xffffca0000010900 0041 00000000 0x0 0x0
0xffffca0000010980 0041 00000000 0x0 0x0
0xffffca0000010a00 0041 00000000 0x0 0x0
0xffffca0000010a80 0045 00000000 0x0 0x0
0xffffca0000010b00 0041 00000000 0x0 0x0
0xffffca0000010b80 0041 00000000 0x0 0x0
0xffffca0000010c00 0041 00000000 0x0 0x0
0xffffca0000010c80 0045 00000000 0x0 0x0
0xffffca0000010d00 0041 00000000 0x0 0x0
0xffffca0000010d80 0041 00000000 0x0 0x0
0xffffca0000010e00 0045 00000000 0x0 0x0
0xffffca0000010e80 0041 00000000 0x0 0x0
0xffffca0000010f00 0041 00000000 0x0 0x0
0xffffca0000010f80 0041 00000000 0x0 0x0
0xffffca0000011000 0041 00000000 0x0 0x0
0xffffca0000011080 0041 00000000 0x0 0x0
0xffffca0000011100 0041 00000000 0x0 0x0
0xffffca0000011180 0041 00000000 0x0 0x0
0xffffca0000011200 0041 00000000 0x0 0x0
0xffffca0000011280 0041 00000000 0x0 0x0
0xffffca0000011300 0041 00000000 0x0 0x0
0xffffca0000011380 0041 00000000 0x0 0x0
0xffffca0000011400 0041 00000000 0x0 0x0
0xffffca0000011480 0041 00000000 0x0 0x0
0xffffca0000011500 0041 00000000 0x0 0x0
0xffffca0000011580 0041 00000000 0x0 0x0
0xffffca0000011600 0041 00000000 0x0 0x0
0xffffca0000011680 0041 00000000 0x0 0x0
0xffffca0000011700 0041 00000000 0x0 0x0
0xffffca0000011780 0041 00000000 0x0 0x0
0xffffca0000011800 0041 00000000 0x0 0x0
0xffffca0000011880 0041 00000000 0x0 0x0
0xffffca0000011900 0041 00000000 0x0 0x0
0xffffca0000011980 0045 00000000 0x0 0x0
0xffffca0000011a00 0041 00000000 0x0 0x0
0xffffca0000011a80 0045 00000000 0x0 0x0
0xffffca0000011b00 0045 00000000 0x0 0x0
0xffffca0000011b80 0041 00000000 0x0 0x0
0xffffca0000011c00 0041 00000000 0x0 0x0
0xffffca0000011c80 0041 00000000 0x0 0x0
0xffffca0000011d00 0045 00000000 0x0 0x0
0xffffca0000011d80 0041 00000000 0x0 0x0
0xffffca0000011e00 0045 00000000 0x0 0x0
0xffffca0000011e80 0041 00000000 0x0 0x0
0xffffca0000011f00 0041 00000000 0x0 0x0
0xffffca0000011f80 0045 00000000 0x0 0x0
0xffffca0000012000 0041 00000000 0x0 0x0
0xffffca0000012080 0041 00000000 0x0 0x0
0xffffca0000012100 0041 00000000 0x0 0x0
0xffffca0000012180 0041 00000000 0x0 0x0
0xffffca0000012200 0041 00000000 0x0 0x0
0xffffca0000012280 0041 00000000 0x0 0x0
0xffffca0000012300 0041 00000000 0x0 0x0
0xffffca0000012380 0041 00000000 0x0 0x0
0xffffca0000012400 0041 00000000 0x0 0x0
0xffffca0000012480 0041 00000000 0x0 0x0
0xffffca0000012500 0041 00000000 0x0 0x0
0xffffca0000012580 0041 00000000 0x0 0x0
0xffffca0000012600 0041 00000000 0x0 0x0
0xffffca0000012680 0041 00000000 0x0 0x0
0xffffca0000012700 0041 00000000 0x0 0x0
0xffffca0000012780 0041 00000000 0x0 0x0
0xffffca0000012800 0041 00000000 0x0 0x0
0xffffca0000012880 0041 00000000 0x0 0x0
0xffffca0000012900 0041 00000000 0x0 0x0
0xffffca0000012980 0041 00000000 0x0 0x0
0xffffca0000012a00 0041 00000000 0x0 0x0
0xffffca0000012a80 0041 00000000 0x0 0x0
0xffffca0000012b00 0041 00000000 0x0 0x0
0xffffca0000012b80 0041 00000000 0x0 0x0
0xffffca0000012c00 0041 00000000 0x0 0x0
0xffffca0000012c80 0045 00000000 0x0 0x0
0xffffca0000012d00 0001 00000000 0x0 0x0
0xffffca0000012d80 0001 00000000 0x0 0x0
0xffffca0000012e00 0001 00000000 0x0 0x0
0xffffca0000012e80 0001 00000000 0x0 0x0
0xffffca0000012f00 0001 00000000 0x0 0x0
0xffffca0000012f80 0001 00000000 0x0 0x0
0xffffca0000013000 0001 00000000 0x0 0x0
0xffffca0000013080 0001 00000000 0x0 0x0
0xffffca0000013100 0001 00000000 0x0 0x0
0xffffca0000013180 0001 00000000 0x0 0x0
0xffffca0000013200 0001 00000000 0x0 0x0
0xffffca0000013280 0001 00000000 0x0 0x0
0xffffca0000013300 0001 00000000 0x0 0x0
0xffffca0000013380 0001 00000000 0x0 0x0
0xffffca0000013400 0001 00000000 0x0 0x0
0xffffca0000013480 0001 00000000 0x0 0x0
0xffffca0000013500 0001 00000000 0x0 0x0
0xffffca0000013580 0001 00000000 0x0 0x0
0xffffca0000013600 0001 00000000 0x0 0x0
0xffffca0000013680 0001 00000000 0x0 0x0
0xffffca0000013700 0001 00000000 0x0 0x0
0xffffca0000013780 0001 00000000 0x0 0x0
0xffffca0000013800 0001 00000000 0x0 0x0
0xffffca0000013880 0001 00000000 0x0 0x0
0xffffca0000013900 0001 00000000 0x0 0x0
0xffffca0000013980 0001 00000000 0x0 0x0
0xffffca0000013a00 0001 00000000 0x0 0x0
0xffffca0000013a80 0001 00000000 0x0 0x0
0xffffca0000013b00 0001 00000000 0x0 0x0
0xffffca0000013b80 0001 00000000 0x0 0x0
0xffffca0000013c00 0001 00000000 0x0 0x0
0xffffca0000013c80 0001 00000000 0x0 0x0
0xffffca0000013d00 0001 00000000 0x0 0x0
0xffffca0000013d80 0001 00000000 0x0 0x0
0xffffca0000013e00 0001 00000000 0x0 0x0
0xffffca0000013e80 0001 00000000 0x0 0x0
0xffffca0000013f00 0001 00000000 0x0 0x0
0xffffca0000013f80 0001 00000000 0x0 0x0
0xffffca0000014000 0001 00000000 0x0 0x0
0xffffca0000014080 0001 00000000 0x0 0x0
0xffffca0000014100 0001 00000000 0x0 0x0
0xffffca0000014180 0001 00000000 0x0 0x0
0xffffca0000014200 0001 00000000 0x0 0x0
0xffffca0000014280 0001 00000000 0x0 0x0
0xffffca0000014300 0001 00000000 0x0 0x0
0xffffca0000014380 0001 00000000 0x0 0x0
0xffffca0000014400 0001 00000000 0x0 0x0
0xffffca0000014480 0001 00000000 0x0 0x0
0xffffca0000014500 0001 00000000 0x0 0x0
0xffffca0000014580 0001 00000000 0x0 0x0
0xffffca0000014600 0001 00000000 0x0 0x0
0xffffca0000014680 0001 00000000 0x0 0x0
0xffffca0000014700 0001 00000000 0x0 0x0
0xffffca0000014780 0001 00000000 0x0 0x0
0xffffca0000014800 0041 00000000 0x0 0x0
0xffffca0000014880 0041 00000000 0x0 0x0
0xffffca0000014900 0041 00000000 0x0 0x0
0xffffca0000014980 0041 00000000 0x0 0x0
0xffffca0000014a00 0041 00000000 0x0 0x0
0xffffca0000014a80 0041 00000000 0x0 0x0
0xffffca0000014b00 0041 00000000 0x0 0x0
0xffffca0000014b80 0041 00000000 0x0 0x0
0xffffca0000014c00 0041 00000000 0x0 0x0
0xffffca0000014c80 0041 00000000 0x0 0x0
0xffffca0000014d00 0041 00000000 0x0 0x0
0xffffca0000014d80 0041 00000000 0x0 0x0
0xffffca0000014e00 0041 00000000 0x0 0x0
0xffffca0000014e80 0041 00000000 0x0 0x0
0xffffca0000014f00 0041 00000000 0x0 0x0
0xffffca0000014f80 0041 00000000 0x0 0x0
0xffffca0000015000 0041 00000000 0x0 0x0
0xffffca0000015080 0041 00000000 0x0 0x0
0xffffca0000015100 0041 00000000 0x0 0x0
0xffffca0000015180 0041 00000000 0x0 0x0
0xffffca0000015200 0041 00000000 0x0 0x0
0xffffca0000015280 0041 00000000 0x0 0x0
0xffffca0000015300 0041 00000000 0x0 0x0
0xffffca0000015380 0041 00000000 0x0 0x0
0xffffca0000015400 0041 00000000 0x0 0x0
0xffffca0000015480 0041 00000000 0x0 0x0
0xffffca0000015500 0041 00000000 0x0 0x0
0xffffca0000015580 0041 00000000 0x0 0x0
0xffffca0000015600 0041 00000000 0x0 0x0
0xffffca0000015680 0041 00000000 0x0 0x0
0xffffca0000015700 0041 00000000 0x0 0x0
0xffffca0000015780 0041 00000000 0x0 0x0
0xffffca0000015800 0041 00000000 0x0 0x0
0xffffca0000015880 0041 00000000 0x0 0x0
0xffffca0000015900 0041 00000000 0x0 0x0
0xffffca0000015980 0041 00000000 0x0 0x0
0xffffca0000015a00 0041 00000000 0x0 0x0
0xffffca0000015a80 0041 00000000 0x0 0x0
0xffffca0000015b00 0041 00000000 0x0 0x0
0xffffca0000015b80 0041 00000000 0x0 0x0
0xffffca0000015c00 0041 00000000 0x0 0x0
0xffffca0000015c80 0041 00000000 0x0 0x0
0xffffca0000015d00 0001 00000000 0x0 0x0
0xffffca0000015d80 0001 00000000 0x0 0x0
0xffffca0000015e00 0001 00000000 0x0 0x0
0xffffca0000015e80 0001 00000000 0x0 0x0
0xffffca0000015f00 0001 00000000 0x0 0x0
0xffffca0000015f80 0001 00000000 0x0 0x0
0xffffca0000016000 0001 00000000 0x0 0x0
0xffffca0000016080 0001 00000000 0x0 0x0
0xffffca0000016100 0001 00000000 0x0 0x0
0xffffca0000016180 0001 00000000 0x0 0x0
0xffffca0000016200 0001 00000000 0x0 0x0
0xffffca0000016280 0001 00000000 0x0 0x0
0xffffca0000016300 0001 00000000 0x0 0x0
0xffffca0000016380 0001 00000000 0x0 0x0
0xffffca0000016400 0001 00000000 0x0 0x0
0xffffca0000016480 0001 00000000 0x0 0x0
0xffffca0000016500 0001 00000000 0x0 0x0
0xffffca0000016580 0001 00000000 0x0 0x0
0xffffca0000016600 0001 00000000 0x0 0x0
0xffffca0000016680 0001 00000000 0x0 0x0
0xffffca0000016700 0001 00000000 0x0 0x0
0xffffca0000016780 0001 00000000 0x0 0x0
0xffffca0000016800 0001 00000000 0x0 0x0
0xffffca0000016880 0001 00000000 0x0 0x0
0xffffca0000016900 0001 00000000 0x0 0x0
0xffffca0000016980 0001 00000000 0x0 0x0
0xffffca0000016a00 0001 00000000 0x0 0x0
0xffffca0000016a80 0001 00000000 0x0 0x0
0xffffca0000016b00 0001 00000000 0x0 0x0
0xffffca0000016b80 0001 00000000 0x0 0x0
0xffffca0000016c00 0001 00000000 0x0 0x0
0xffffca0000016c80 0001 00000000 0x0 0x0
0xffffca0000016d00 0001 00000000 0x0 0x0
0xffffca0000016d80 0001 00000000 0x0 0x0
0xffffca0000016e00 0001 00000000 0x0 0x0
0xffffca0000016e80 0001 00000000 0x0 0x0
0xffffca0000016f00 0001 00000000 0x0 0x0
0xffffca0000016f80 0001 00000000 0x0 0x0
0xffffca0000017000 0001 00000000 0x0 0x0
0xffffca0000017080 0001 00000000 0x0 0x0
0xffffca0000017100 0001 00000000 0x0 0x0
0xffffca0000017180 0001 00000000 0x0 0x0
0xffffca0000017200 0001 00000000 0x0 0x0
0xffffca0000017280 0001 00000000 0x0 0x0
0xffffca0000017300 0001 00000000 0x0 0x0
0xffffca0000017380 0001 00000000 0x0 0x0
0xffffca0000017400 0001 00000000 0x0 0x0
0xffffca0000017480 0001 00000000 0x0 0x0
0xffffca0000017500 0001 00000000 0x0 0x0
0xffffca0000017580 0001 00000000 0x0 0x0
0xffffca0000017600 0001 00000000 0x0 0x0
0xffffca0000017680 0001 00000000 0x0 0x0
0xffffca0000017700 0001 00000000 0x0 0x0
0xffffca0000017780 0001 00000000 0x0 0x0
0xffffca0000017800 0041 00000000 0x0 0x0
0xffffca0000017880 0041 00000000 0x0 0x0
0xffffca0000017900 0041 00000000 0x0 0x0
0xffffca0000017980 0041 00000000 0x0 0x0
0xffffca0000017a00 0041 00000000 0x0 0x0
0xffffca0000017a80 0041 00000000 0x0 0x0
0xffffca0000017b00 0041 00000000 0x0 0x0
0xffffca0000017b80 0041 00000000 0x0 0x0
0xffffca0000017c00 0041 00000000 0x0 0x0
0xffffca0000017c80 0041 00000000 0x0 0x0
0xffffca0000017d00 0041 00000000 0x0 0x0
0xffffca0000017d80 0041 00000000 0x0 0x0
0xffffca0000017e00 0041 00000000 0x0 0x0
0xffffca0000017e80 0041 00000000 0x0 0x0
0xffffca0000017f00 0041 00000000 0x0 0x0
0xffffca0000017f80 0041 00000000 0x0 0x0
0xffffca0000018000 0041 00000000 0x0 0x0
0xffffca0000018080 0041 00000000 0x0 0x0
0xffffca0000018100 0041 00000000 0x0 0x0
0xffffca0000018180 0041 00000000 0x0 0x0
0xffffca0000018200 0041 00000000 0x0 0x0
0xffffca0000018280 0041 00000000 0x0 0x0
0xffffca0000018300 0041 00000000 0x0 0x0
0xffffca0000018380 0041 00000000 0x0 0x0
0xffffca0000018400 0041 00000000 0x0 0x0
0xffffca0000018480 0041 00000000 0x0 0x0
0xffffca0000018500 0041 00000000 0x0 0x0
0xffffca0000018580 0041 00000000 0x0 0x0
0xffffca0000018600 0041 00000000 0x0 0x0
0xffffca0000018680 0041 00000000 0x0 0x0
0xffffca0000018700 0041 00000000 0x0 0x0
0xffffca0000018780 0041 00000000 0x0 0x0
0xffffca0000018800 0041 00000000 0x0 0x0
0xffffca0000018880 0041 00000000 0x0 0x0
0xffffca0000018900 0041 00000000 0x0 0x0
0xffffca0000018980 0041 00000000 0x0 0x0
0xffffca0000018a00 0041 00000000 0x0 0x0
0xffffca0000018a80 0041 00000000 0x0 0x0
0xffffca0000018b00 0041 00000000 0x0 0x0
0xffffca0000018b80 0041 00000000 0x0 0x0
0xffffca0000018c00 0041 00000000 0x0 0x0
0xffffca0000018c80 0041 00000000 0x0 0x0
0xffffca0000018d00 0001 00000000 0x0 0x0
0xffffca0000018d80 0001 00000000 0x0 0x0
0xffffca0000018e00 0001 00000000 0x0 0x0
0xffffca0000018e80 0001 00000000 0x0 0x0
0xffffca0000018f00 0001 00000000 0x0 0x0
0xffffca0000018f80 0001 00000000 0x0 0x0
0xffffca0000019000 0001 00000000 0x0 0x0
0xffffca0000019080 0001 00000000 0x0 0x0
0xffffca0000019100 0001 00000000 0x0 0x0
0xffffca0000019180 0001 00000000 0x0 0x0
0xffffca0000019200 0001 00000000 0x0 0x0
0xffffca0000019280 0001 00000000 0x0 0x0
0xffffca0000019300 0001 00000000 0x0 0x0
0xffffca0000019380 0001 00000000 0x0 0x0
0xffffca0000019400 0001 00000000 0x0 0x0
0xffffca0000019480 0001 00000000 0x0 0x0
0xffffca0000019500 0001 00000000 0x0 0x0
0xffffca0000019580 0001 00000000 0x0 0x0
0xffffca0000019600 0001 00000000 0x0 0x0
0xffffca0000019680 0001 00000000 0x0 0x0
0xffffca0000019700 0001 00000000 0x0 0x0
0xffffca0000019780 0001 00000000 0x0 0x0
0xffffca0000019800 0001 00000000 0x0 0x0
0xffffca0000019880 0001 00000000 0x0 0x0
0xffffca0000019900 0001 00000000 0x0 0x0
0xffffca0000019980 0001 00000000 0x0 0x0
0xffffca0000019a00 0001 00000000 0x0 0x0
0xffffca0000019a80 0001 00000000 0x0 0x0
0xffffca0000019b00 0001 00000000 0x0 0x0
0xffffca0000019b80 0001 00000000 0x0 0x0
0xffffca0000019c00 0001 00000000 0x0 0x0
0xffffca0000019c80 0001 00000000 0x0 0x0
0xffffca0000019d00 0001 00000000 0x0 0x0
0xffffca0000019d80 0001 00000000 0x0 0x0
0xffffca0000019e00 0001 00000000 0x0 0x0
0xffffca0000019e80 0001 00000000 0x0 0x0
0xffffca0000019f00 0001 00000000 0x0 0x0
0xffffca0000019f80 0001 00000000 0x0 0x0
0xffffca000001a000 0001 00000000 0x0 0x0
0xffffca000001a080 0001 00000000 0x0 0x0
0xffffca000001a100 0001 00000000 0x0 0x0
0xffffca000001a180 0001 00000000 0x0 0x0
0xffffca000001a200 0001 00000000 0x0 0x0
0xffffca000001a280 0001 00000000 0x0 0x0
0xffffca000001a300 0001 00000000 0x0 0x0
0xffffca000001a380 0001 00000000 0x0 0x0
0xffffca000001a400 0001 00000000 0x0 0x0
0xffffca000001a480 0001 00000000 0x0 0x0
0xffffca000001a500 0001 00000000 0x0 0x0
0xffffca000001a580 0001 00000000 0x0 0x0
0xffffca000001a600 0001 00000000 0x0 0x0
0xffffca000001a680 0001 00000000 0x0 0x0
0xffffca000001a700 0001 00000000 0x0 0x0
0xffffca000001a780 0001 00000000 0x0 0x0
0xffffca000001a800 0041 00000000 0x0 0x0
0xffffca000001a880 0041 00000000 0x0 0x0
0xffffca000001a900 0041 00000000 0x0 0x0
0xffffca000001a980 0041 00000000 0x0 0x0
0xffffca000001aa00 0041 00000000 0x0 0x0
0xffffca000001aa80 0041 00000000 0x0 0x0
0xffffca000001ab00 0041 00000000 0x0 0x0
0xffffca000001ab80 0041 00000000 0x0 0x0
0xffffca000001ac00 0041 00000000 0x0 0x0
0xffffca000001ac80 0041 00000000

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Jun 27, 2022, 5:38:23 AM6/27/22

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: d96d91ac552a Remove confusable comment.
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=10b5464c080000

kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=037d1813186571cb2d38
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1687fa38080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1012fefff00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+037d18...@syzkaller.appspotmail.com

login: [ 44.1796449] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/dev/raidframe/rf_netbsdkintf.c:1141:25, member access within null pointer of type 'const struct RF_LayoutSW_t'

[ 44.1796449] cpu1: Begin traceback...
[ 44.1996346] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:293
[ 44.2596350] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 44.2996336] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 44.3396338] rf_fail_disk() at netbsd:rf_fail_disk+0x52e sys/dev/raidframe/rf_netbsdkintf.c:1141
[ 44.3796332] raidframe_ioctl_80() at netbsd:raidframe_ioctl_80+0xfe5 rf_fail_disk80 sys/dev/raidframe/rf_compat80.c:304 [inline]
[ 44.3796332] raidframe_ioctl_80() at netbsd:raidframe_ioctl_80+0xfe5 sys/dev/raidframe/rf_compat80.c:342
[ 44.4296361] raidioctl() at netbsd:raidioctl+0x35db sys/dev/raidframe/rf_netbsdkintf.c:1793
[ 44.4696341] cdev_ioctl() at netbsd:cdev_ioctl+0x1b2 sys/kern/subr_devsw.c:1223
[ 44.5096372] spec_ioctl() at netbsd:spec_ioctl+0xf2 sys/miscfs/specfs/spec_vnops.c:1294
[ 44.5496349] VOP_IOCTL() at netbsd:VOP_IOCTL+0x147 sys/kern/vnode_if.c:934
[ 44.5896355] vn_ioctl() at netbsd:vn_ioctl+0x196 sys/kern/vfs_vnops.c:865
[ 44.6296382] sys_ioctl() at netbsd:sys_ioctl+0xd84 sys/kern/sys_generic.c:673
[ 44.6696387] sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 44.6696387] sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 44.7196337] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 44.7196337] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 44.7196337] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 44.7296344] --- syscall (number 54 via SYS_syscall) ---
[ 44.7396314] netbsd:syscall+0x2da:
[ 44.7396314] cpu1: End traceback...
[ 44.7496346] fatal breakpoint trap in supervisor mode
[ 44.7496346] trap type 1 code 0 rip 0xffffffff80221ab5 cs 0x8 rflags 0x246 cr2 0x7f7fc10036c5 ilevel 0 rsp 0xffffd980c83f24f0
[ 44.7596307] curlwp 0xffffb9605cb5fa80 pid 425.425 lowest kstack 0xffffd980c83ee2c0
Stopped in pid 425.425 (syz-executor2678) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:293
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
rf_fail_disk() at netbsd:rf_fail_disk+0x52e sys/dev/raidframe/rf_netbsdkintf.c:1141
raidframe_ioctl_80() at netbsd:raidframe_ioctl_80+0xfe5 rf_fail_disk80 sys/dev/raidframe/rf_compat80.c:304 [inline]
raidframe_ioctl_80() at netbsd:raidframe_ioctl_80+0xfe5 sys/dev/raidframe/rf_compat80.c:342
raidioctl() at netbsd:raidioctl+0x35db sys/dev/raidframe/rf_netbsdkintf.c:1793
cdev_ioctl() at netbsd:cdev_ioctl+0x1b2 sys/kern/subr_devsw.c:1223
spec_ioctl() at netbsd:spec_ioctl+0xf2 sys/miscfs/specfs/spec_vnops.c:1294
VOP_IOCTL() at netbsd:VOP_IOCTL+0x147 sys/kern/vnode_if.c:934
vn_ioctl() at netbsd:vn_ioctl+0x196 sys/kern/vfs_vnops.c:865
sys_ioctl() at netbsd:sys_ioctl+0xd84 sys/kern/sys_generic.c:673

sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90

syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138

--- syscall (number 54 via SYS_syscall) ---

netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/dev/raidframe/rf_netbsdkintf.c:1141:25, member access within null pointer of type 'const struct RF_LayoutSW_t'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1192 1192 2 1 0 ffffb9605b2462c0 syz-executor2678
1223 1223 2 1 0 ffffb9605d360ac0 syz-executor2678
1130 1130 2 0 0 ffffb9605d360680 syz-executor2678
826 826 2 0 0 ffffb9605b4b59c0 syz-executor2678
1075 >1075 7 0 0 ffffb9605d360240 syz-executor2678
1107 1107 2 1 0 ffffb9605bc45180 syz-executor2678
1195 1195 2 0 0 ffffb9605abfa600 syz-executor2678
425 > 425 7 1 0 ffffb9605cb5fa80 syz-executor2678
1220 1220 2 1 140 ffffb9605bc455c0 syz-executor2678
1221 1221 2 0 140 ffffb9605b0276c0 syz-executor2678
1222 1222 2 1 140 ffffb9605afcaac0 syz-executor2678
1054 1054 2 1 140 ffffb9605afca240 syz-executor2678
1078 1078 3 0 180 ffffb9605ce111c0 syz-executor2678 nanoslp
1084 1084 3 1 40180 ffffb9605afca680 sshd select
1074 1074 3 1 180 ffffb9605bc45a00 getty nanoslp
1000 1000 3 0 180 ffffb9605b4b5580 getty nanoslp
1073 1073 3 0 180 ffffb9605cb5f640 getty nanoslp
1115 1115 3 1 1c0 ffffb9605ce11a40 getty ttyraw
1066 1066 3 0 180 ffffb9605cb5f200 sshd select
942 942 3 1 180 ffffb9605ce11600 powerd kqueue
687 687 3 0 180 ffffb9605b5db780 syslogd kqueue
547 547 3 0 180 ffffb9605b246b40 dhcpcd poll
546 546 3 0 180 ffffb9605c6680c0 dhcpcd poll
600 600 3 0 180 ffffb9605c668500 dhcpcd poll
587 587 3 0 180 ffffb9605b62a300 dhcpcd poll
289 289 3 0 180 ffffb9605b5db340 dhcpcd poll
288 288 3 0 180 ffffb9605b62a740 dhcpcd poll
351 351 3 0 180 ffffb9605b62ab80 dhcpcd poll
1 1 3 0 180 ffffb96052a5e540 init wait
0 968 3 0 200 ffffb9605abfaa40 physiod physiod
0 194 3 0 200 ffffb9605ac6da80 pooldrain pooldrain
0 193 3 0 200 ffffb9605ac6d640 ioflush syncer
0 192 3 1 200 ffffb9605ac6d200 pgdaemon pgdaemon
0 167 3 1 200 ffffb9605abfa1c0 usb7 usbevt
0 166 3 1 200 ffffb96057b7da00 usb6 usbevt
0 165 3 1 200 ffffb96057b7d5c0 usb5 usbevt
0 164 3 1 200 ffffb96057b7d180 usb4 usbevt
0 31 3 1 200 ffffb96054b209c0 usb3 usbevt
0 63 3 0 200 ffffb96054b20580 usb2 usbevt
0 126 3 0 200 ffffb96054b20140 usb1 usbevt
0 125 3 0 200 ffffb960529dd300 usb0 usbevt
0 124 3 1 200 ffffb960529dd740 usbtask-dr usbtsk
0 123 3 0 200 ffffb9605233d6c0 usbtask-hc usbtsk
0 122 3 0 200 ffffb96052a5e980 npfgc0 npfgcw
0 121 3 1 200 ffffb96052a5e100 rt_free rt_free
0 120 3 1 200 ffffb96052a59940 unpgc unpgc
0 119 3 0 200 ffffb96052a59500 key_timehandler key_timehandler
0 118 3 1 200 ffffb96052a590c0 icmp6_wqinput/1 icmp6_wqinput
0 117 3 0 200 ffffb96052a24900 icmp6_wqinput/0 icmp6_wqinput
0 116 3 0 200 ffffb96052a244c0 nd6_timer nd6_timer
0 115 3 1 200 ffffb96052a24080 carp6_wqinput/1 carp6_wqinput
0 114 3 0 200 ffffb96052a178c0 carp6_wqinput/0 carp6_wqinput
0 113 3 1 200 ffffb96052a17480 carp_wqinput/1 carp_wqinput
0 112 3 0 200 ffffb96052a17040 carp_wqinput/0 carp_wqinput
0 111 3 1 200 ffffb960529eabc0 icmp_wqinput/1 icmp_wqinput
0 110 3 0 200 ffffb960529ea780 icmp_wqinput/0 icmp_wqinput
0 109 3 0 200 ffffb960529ddb80 rt_timer rt_timer
0 108 3 0 200 ffffb960529ea340 vmem_rehash vmem_rehash
0 99 3 1 200 ffffb9605234ab40 entbutler entropy
0 98 3 1 200 ffffb9605234a700 viomb balloon
0 97 3 1 200 ffffb9605234a2c0 vioif0_txrx/1 vioif0_txrx
0 96 3 0 200 ffffb9605233db00 vioif0_txrx/0 vioif0_txrx
0 29 3 1 200 ffffb9605233d280 scsibus0 sccomp
0 28 3 0 200 ffffb96050dc3ac0 pms0 pmsreset
0 27 3 1 200 ffffb96050dc3680 xcall/1 xcall
0 26 1 1 200 ffffb96050dc3240 softser/1
0 25 1 1 200 ffffb96050d8ea80 softclk/1
0 24 1 1 200 ffffb96050d8e640 softbio/1
0 23 1 1 200 ffffb96050d8e200 softnet/1
0 22 1 1 201 ffffb9617fd35a40 idle/1
0 21 3 0 200 ffffb9617fd35600 lnxsyswq lnxsyswq
0 20 3 1 200 ffffb9617fd351c0 lnxubdwq lnxubdwq
0 19 3 1 200 ffffb9617fd44a00 lnxpwrwq lnxpwrwq
0 18 3 1 200 ffffb9617fd445c0 lnxlngwq lnxlngwq
0 17 3 1 200 ffffb9617fd44180 lnxhipwq lnxhipwq
0 16 3 1 200 ffffb9617fd5d9c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffffb9617fd5d580 sysmon smtaskq
0 14 3 1 200 ffffb9617fd5d140 pmfsuspend pmfsuspend
0 13 3 0 200 ffffb9617fd6a980 pmfevent pmfevent
0 12 3 1 200 ffffb9617fd6a540 sopendfree sopendfr
0 11 3 0 200 ffffb9617fd6a100 iflnkst iflnkst
0 10 3 1 200 ffffb96180d9b940 nfssilly nfssilly
0 9 3 0 200 ffffb96180d9b500 vdrain vdrain
0 8 3 1 200 ffffb96180d9b0c0 modunload mod_unld
0 7 3 0 200 ffffb96180dc2900 xcall/0 xcall
0 6 1 0 200 ffffb96180dc24c0 softser/0
0 > 5 7 0 200 ffffb96180dc2080 softclk/0
0 4 1 0 200 ffffb96180df18c0 softbio/0
0 3 1 0 200 ffffb96180df1480 softnet/0
0 2 1 0 201 ffffb96180df1040 idle/0
0 0 3 0 200 ffffffff86750840 swapper uvm
[Locks tracked through LWPs]

****** LWP 1192.1192 (syz-executor2678) @ 0xffffb9605b2462c0, l_stat=2

*** Locks held:

* Lock 0 (initialized at pmap_ctor)

lock address : 0xffffb9605b5a1980 type : sleep/adaptive

initialized : 0xffffffff8100054d
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1

relevant lwp : 0xffffb9605b2462c0 last held: 0xffffb9605b2462c0
last locked* : 0xffffffff81002c56 unlocked : 0xffffffff81000318
owner field : 0xffffb9605b2462c0 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1223.1223 (syz-executor2678) @ 0xffffb9605d360ac0, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xffffb96052a6b580 type : sleep/adaptive
initialized : 0xffffffff8100054d

shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1

relevant cpu : 1 last held: 1

relevant lwp : 0xffffb9605d360ac0 last held: 000000000000000000
last locked : 0xffffffff8100012b unlocked*: 0xffffffff81000318
owner field : 0xffffb9605d360ac0 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

****** LWP 1075.1075 (syz-executor2678) @ 0xffffb9605d360240, l_stat=7

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at main)
lock address : 0xffffffff86beb0c0 type : spin
initialized : 0xffffffff83ffb2c9
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 1

relevant cpu : 0 last held: 1
relevant lwp : 0xffffb9605d360240 last held: 0xffffb9605cb5fa80
last locked* : 0xffffffff83802259 unlocked : 0xffffffff83802293

curcpu holds : 1 wanted by: 000000000000000000

****** LWP 1107.1107 (syz-executor2678) @ 0xffffb9605bc45180, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xffffb9605b68ad80 type : sleep/adaptive
initialized : 0xffffffff8100054d

shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1

relevant cpu : 1 last held: 1

relevant lwp : 0xffffb9605bc45180 last held: 000000000000000000
last locked : 0xffffffff81002c56 unlocked*: 0xffffffff81003333
owner field : 0xffffb9605bc45180 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

****** LWP 546.546 (dhcpcd) @ 0xffffb9605c6680c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff86beb1c0 type : sleep/adaptive
initialized : 0xffffffff8370d5e7
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffb9605c6680c0 last held: 000000000000000000