UBSan: Undefined Behavior in tcp_shutdown_wrapper

4 views

Skip to first unread message

syzbot

unread,

Oct 28, 2022, 8:57:40 AM10/28/22

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 4218bdda2e25 Adjust userland commands for struct inpcb sep..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=15387212880000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=1dea84a29b0f03c1fa1c
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8813f5f371a8/disk-4218bdda.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/e5d1760d89e4/netbsd-4218bdda.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1dea84...@syzkaller.appspotmail.com

[ 43.3555549] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/tcp_usrreq.c:774:5, member access within null pointer of type 'struct inpcb'

[ 43.3718886] cpu0: Begin traceback...
[ 43.3955417] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 43.5055413] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 43.5855409] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 43.6755419] tcp_shutdown_wrapper() at netbsd:tcp_shutdown_wrapper+0xdf tcp_shutdown sys/netinet/tcp_usrreq.c:774 [inline]
[ 43.6755419] tcp_shutdown_wrapper() at netbsd:tcp_shutdown_wrapper+0xdf sys/netinet/tcp_usrreq.c:2296
[ 43.7455422] soshutdown() at netbsd:soshutdown+0xe5 sys/kern/uipc_socket.c:1675
[ 43.8255424] sys_shutdown() at netbsd:sys_shutdown+0x11f sys/kern/uipc_syscalls.c:1161
[ 43.8955415] sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 43.8955415] sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 43.9655447] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 43.9655447] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 43.9655447] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 43.9855414] --- syscall (number 134 via SYS_syscall) ---
[ 44.0055404] netbsd:syscall+0x2da:
[ 44.0156777] cpu0: End traceback...
[ 44.0156777] fatal breakpoint trap in supervisor mode
[ 44.0156777] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0x6fbc67c46880 ilevel 0 rsp 0xffff9a8249a7e930
[ 44.0356533] curlwp 0xffffea0f1dfa6b00 pid 1592.720 lowest kstack 0xffff9a8249a7a2c0
Stopped in pid 1592.720 (syz-executor.1) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
tcp_shutdown_wrapper() at netbsd:tcp_shutdown_wrapper+0xdf tcp_shutdown sys/netinet/tcp_usrreq.c:774 [inline]
tcp_shutdown_wrapper() at netbsd:tcp_shutdown_wrapper+0xdf sys/netinet/tcp_usrreq.c:2296
soshutdown() at netbsd:soshutdown+0xe5 sys/kern/uipc_socket.c:1675
sys_shutdown() at netbsd:sys_shutdown+0x11f sys/kern/uipc_syscalls.c:1161
sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 134 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/tcp_usrreq.c:774:5, member access within null pointer of type 'struct inpcb'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
1715 1715 2 0 0 ffffea0f1ecf0740 syz-executor.5
1753 1753 2 0 0 ffffea0f1dece240 syz-executor.0
1718 1586 2 0 0 ffffea0f1ecf0b80 syz-executor.2
1718 837 2 0 0 ffffea0f1ecf0300 syz-executor.2
1718 1579 2 0 0 ffffea0f1e3b2480 syz-executor.2
1718 1718 2 1 10040000 ffffea0f1de85780 syz-executor.2
1341 1747 2 0 0 ffffea0f1dfe42c0 syz-executor.3
1341 1644 2 0 0 ffffea0f1dfe4b40 syz-executor.3
1341 1341 2 1 10000000 ffffea0f1de85bc0 syz-executor.3
1623 844 2 1 100 ffffea0f1e3b2040 syz-executor.4
1623 1623 2 1 10040000 ffffea0f1e267080 syz-executor.4
1592 > 720 7 0 100 ffffea0f1dfa6b00 syz-executor.1
1592 1592 2 0 10040000 ffffea0f1de1ea80 syz-executor.1
1200 1200 2 0 140 ffffea0f14acfa00 syz-executor.5
1205 1205 2 0 140 ffffea0f14acf5c0 syz-executor.4
1204 1204 2 0 140 ffffea0f145fe9c0 syz-executor.3
1240 1240 2 0 140 ffffea0f1137ebc0 syz-executor.2
1245 1245 2 0 140 ffffea0f10f2e2c0 syz-executor.1
941 > 941 7 1 140 ffffea0f145fe580 syz-executor.0
1079 1000 3 1 180 ffffea0f1dece680 syz-fuzzer parked
1079 1279 3 0 180 ffffea0f175671c0 syz-fuzzer kqueue
1079 1199 3 0 180 ffffea0f14acf180 syz-fuzzer wait
1079 1247 3 1 1c0 ffffea0f125a00c0 syz-fuzzer parked
1079 1068 3 1 180 ffffea0f11bbd4c0 syz-fuzzer wait
1079 1120 3 0 1c0 ffffea0f11bbd900 syz-fuzzer wait
1079 1243 3 1 180 ffffea0f11077740 syz-fuzzer wait
1079 1242 3 0 180 ffffea0f145fe140 syz-fuzzer parked
1079 449 3 1 180 ffffea0f13390540 syz-fuzzer parked
1079 1224 3 0 180 ffffea0f10db3b00 syz-fuzzer wait
1079 1226 3 1 180 ffffea0f10f2eb40 syz-fuzzer parked
1079 1233 3 1 180 ffffea0f10db36c0 syz-fuzzer parked
1079 1079 3 0 1c0 ffffea0f1101b480 syz-fuzzer wait
1237 1237 3 0 180 ffffea0f13390980 sshd select
1081 1081 3 0 180 ffffea0f11bbd080 getty nanoslp
1223 1223 3 1 180 ffffea0f10a77200 getty nanoslp
1222 1222 3 0 180 ffffea0f10db3280 getty nanoslp
1084 1084 3 0 1c0 ffffea0f10a85ac0 getty ttyraw
1103 1103 3 1 180 ffffea0f13390100 sshd select
1056 1056 3 0 180 ffffea0f125a0940 powerd kqueue
875 875 3 0 180 ffffea0f125a0500 syslogd kqueue
746 746 3 0 180 ffffea0f11077b80 dhcpcd poll
742 742 3 0 180 ffffea0f11077300 dhcpcd poll
466 466 3 0 180 ffffea0f1101b8c0 dhcpcd poll
598 598 3 0 180 ffffea0f1101b040 dhcpcd poll
292 292 3 0 180 ffffea0f1137e780 dhcpcd poll
485 485 3 0 180 ffffea0f1137e340 dhcpcd poll
291 291 3 0 180 ffffea0f10f2e700 dhcpcd poll
1 1 3 0 180 ffffea0f0885b100 init wait
0 673 3 0 200 ffffea0f10a77640 physiod physiod
0 196 3 0 200 ffffea0f10a85680 pooldrain pooldrain
0 195 2 0 240 ffffea0f10a85240 ioflush
0 194 3 1 200 ffffea0f10a77a80 pgdaemon pgdaemon
0 170 3 1 200 ffffea0f0e9b7a40 usb7 usbevt
0 169 3 1 200 ffffea0f0e9b7600 usb6 usbevt
0 168 3 0 200 ffffea0f0e9b71c0 usb5 usbevt
0 167 3 0 200 ffffea0f0b922a00 usb4 usbevt
0 166 3 0 200 ffffea0f0b9225c0 usb3 usbevt
0 165 3 0 200 ffffea0f0b922180 usb2 usbevt
0 31 3 0 200 ffffea0f098fd9c0 usb1 usbevt
0 63 3 1 200 ffffea0f098fd580 usb0 usbevt
0 126 3 1 200 ffffea0f098fd140 usbtask-dr usbtsk
0 125 3 1 200 ffffea0f0885b980 usbtask-hc usbtsk
0 124 3 0 200 ffffea0f06ca1b00 swwreboot swwreboot
0 123 2 0 240 ffffea0f0885b540 npfgc0
0 122 3 1 200 ffffea0f0884e940 rt_free rt_free
0 121 3 1 200 ffffea0f0884e500 unpgc unpgc
0 120 3 0 200 ffffea0f0884e0c0 key_timehandler key_timehandler
0 119 3 1 200 ffffea0f08831900 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffea0f088314c0 icmp6_wqinput/0 icmp6_wqinput
0 117 3 0 200 ffffea0f08831080 nd6_timer nd6_timer
0 116 3 1 200 ffffea0f0881c8c0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffea0f0881c480 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffea0f0881c040 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffea0f086e0740 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffea0f086e0b80 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffea0f087d7340 icmp_wqinput/0 icmp_wqinput
0 110 3 1 200 ffffea0f087d7bc0 rt_timer rt_timer
0 109 3 0 200 ffffea0f087d7780 vmem_rehash vmem_rehash
0 100 3 0 200 ffffea0f086e0300 entbutler entropy
0 99 3 0 200 ffffea0f08150b40 viomb balloon
0 98 3 1 200 ffffea0f08150700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffffea0f081502c0 vioif0_txrx/0 vioif0_txrx
0 30 3 1 200 ffffea0f06ca16c0 scsibus0 sccomp
0 29 3 0 200 ffffea0f06ca1280 pms0 pmsreset
0 28 3 1 200 ffffea0f06bb4ac0 xcall/1 xcall
0 27 1 1 200 ffffea0f06bb4680 softser/1
0 > 26 7 1 200 ffffea0f06bb4240 softclk/1
0 25 1 1 200 ffffea0f06b87a80 softbio/1
0 24 1 1 200 ffffea0f06b87640 softnet/1
0 23 1 1 201 ffffea0f06b87200 idle/1
0 22 3 1 200 ffffea1034f2da40 lnxsyswq lnxsyswq
0 21 3 1 200 ffffea1034f2d600 lnxubdwq lnxubdwq
0 20 3 1 200 ffffea1034f2d1c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 ffffea1034f34a00 lnxlngwq lnxlngwq
0 18 3 1 200 ffffea1034f345c0 lnxhipwq lnxhipwq
0 17 3 1 200 ffffea1034f34180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffea1034f539c0 sysmon smtaskq
0 15 3 1 200 ffffea1034f53580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffea1034f53140 pmfevent pmfevent
0 13 3 1 200 ffffea1034f5e980 sopendfree sopendfr
0 12 3 0 200 ffffea1034f5e540 ifwdog ifwdog
0 11 3 1 200 ffffea1034f5e100 iflnkst iflnkst
0 10 3 1 200 ffffea1035f93940 nfssilly nfssilly
0 9 3 0 200 ffffea1035f93500 vdrain vdrain
0 8 3 1 200 ffffea1035f930c0 modunload mod_unld
0 7 3 0 200 ffffea1035fbc900 xcall/0 xcall
0 6 1 0 200 ffffea1035fbc4c0 softser/0
0 5 3 0 200 ffffea1035fbc080 softclk/0 tstile
0 4 1 0 200 ffffea1035fe98c0 softbio/0
0 3 1 0 200 ffffea1035fe9480 softnet/0
0 2 1 0 201 ffffea1035fe9040 idle/0
0 0 3 0 200 ffffffff8673e8c0 swapper uvm
[Locks tracked through LWPs]

****** LWP 1753.1753 (syz-executor.0) @ 0xffffea0f1dece240, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:pmap_ctor+0x6d sys/arch/x86/x86/pmap.c:2860)
lock address : ffffea0f110b6180
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x6d
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffea0f1dece240 last held: 0xffffea0f1dece240
last locked* : netbsd:pmap_enter_ma+0x3c0
unlocked : netbsd:pmap_enter_ma+0xb24
owner field : 0xffffea0f1dece240 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1592.720 (syz-executor.1) @ 0xffffea0f1dfa6b00, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:soinit+0x1f7 sys/kern/uipc_socket.c:459)
lock address : ffffea1036469080
type : sleep/adaptive
initialized : netbsd:soinit+0x1f7
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffea0f1dfa6b00 last held: 0xffffea0f1dfa6b00
last locked* : netbsd:sys_shutdown+0xae
unlocked : netbsd:sys_shutdown+0x142
owner field : 0xffffea0f1dfa6b00 wait/spin: 1/0
Turnstile:
=> 0 waiting readers:
=> 1 waiting writers: 0xffffea1035fbc080

*** Locks wanted: none

****** LWP 742.742 (dhcpcd) @ 0xffffea0f11077300, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffea0f11077300 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 466.466 (dhcpcd) @ 0xffffea0f1101b8c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffea0f1101b8c0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 485.485 (dhcpcd) @ 0xffffea0f1137e340, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffea0f1137e340 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 291.291 (dhcpcd) @ 0xffffea0f10f2e700, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffea0f10f2e700 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffffea1034f5e100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffea1034f5e100 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffffea1035fbc080, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffea1035fbc080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff8673e8c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff8673e8c0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at netbsd:main+0x106 sys/kern/init_main.c:303)
lock address : netbsd:kernel_lock
type : spin
initialized : netbsd:main+0x106
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffea0f1dfa6b00 last held: 0xffffea0f1dfa6b00
last locked* : netbsd:tcp_shutdown_wrapper+0x1d
unlocked : netbsd:tcp_shutdown_wrapper+0xae
curcpu holds : 1 wanted by: 000000000000000000

* Lock 1 (initialized at netbsd:kprintf_init+0x72 sys/kern/subr_prf.c:155)
lock address : netbsd:kprintf_mtx
type : spin
initialized : netbsd:kprintf_init+0x72
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffea0f1dfa6b00 last held: 0xffffea0f1dfa6b00
last locked* : netbsd:kprintf_lock+0x50
unlocked : netbsd:kprintf_unlock+0x70
owner field : 0x0000000000000800 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffff9a8000007180 0045 00000000 0x0 0x0
0xffff9a8000007200 0045 00000000 0x0 0x0
0xffff9a8000007280 0045 00000000 0x0 0x0
0xffff9a8000007300 0045 00000000 0x0 0x0
0xffff9a8000007380 0045 00000000 0x0 0x0
0xffff9a8000007400 0045 00000000 0x0 0x0
0xffff9a8000007480 0045 00000000 0x0 0x0
0xffff9a8000007500 0045 00000000 0x0 0x0
0xffff9a8000007580 0045 00000000 0x0 0x0
0xffff9a8000007600 0045 00000000 0x0 0x0
0xffff9a8000007680 0045 00000000 0x0 0x0
0xffff9a8000007700 0041 00000000 0x0 0x0
0xffff9a8000007780 0041 00000000 0x0 0x0
0xffff9a8000007800 0041 00000000 0x0 0x0
0xffff9a8000007880 0041 00000000 0x0 0x0
0xffff9a8000007900 0045 00000000 0x0 0x0
0xffff9a8000007980 0041 00000000 0x0 0x0
0xffff9a8000007a00 0041 00000000 0x0 0x0
0xffff9a8000007a80 0041 00000000 0x0 0x0
0xffff9a8000007b00 0041 00000000 0x0 0x0
0xffff9a8000007b80 0041 00000000 0x0 0x0
0xffff9a8000007c00 0041 00000000 0x0 0x0
0xffff9a8000007c80 0041 00000000 0x0 0x0
0xffff9a8000007d00 0041 00000000 0x0 0x0
0xffff9a8000007d80 0041 00000000 0x0 0x0
0xffff9a8000007e00 0041 00000000 0x0 0x0
0xffff9a8000007e80 0041 00000000 0x0 0x0
0xffff9a8000007f00 0041 00000000 0x0 0x0
0xffff9a8000007f80 0041 00000000 0x0 0x0
0xffff9a8000008000 0041 00000000 0x0 0x0
0xffff9a8000008080 0041 00000000 0x0 0x0
0xffff9a8000008100 0041 00000000 0x0 0x0
0xffff9a8000008180 0041 00000000 0x0 0x0
0xffff9a8000008200 0041 00000000 0x0 0x0
0xffff9a8000008280 0041 00000000 0x0 0x0
0xffff9a8000008300 0041 00000000 0x0 0x0
0xffff9a8000008380 0041 00000000 0x0 0x0
0xffff9a8000008400 0041 00000000 0x0 0x0
0xffff9a8000008480 0041 00000000 0x0 0x0
0xffff9a8000008500 0041 00000000 0x0 0x0
0xffff9a8000008580 0041 00000000 0x0 0x0
0xffff9a8000008600 0045 00000000 0x0 0x0
0xffff9a8000008680 0041 00000000 0x0 0x0
0xffff9a8000008700 0041 00000000 0x0 0x0
0xffff9a8000008780 0041 00000000 0x0 0x0
0xffff9a8000008800 0045 00000000 0x0 0x0
0xffff9a8000008880 0041 00000000 0x0 0x0
0xffff9a8000008900 0041 00000000 0x0 0x0
0xffff9a8000008980 0041 00000000 0x0 0x0
0xffff9a8000008a00 0041 00000000 0x0 0x0
0xffff9a8000008a80 0041 00000000 0x0 0x0
0xffff9a8000008b00 0041 00000000 0x0 0x0
0xffff9a8000008b80 0041 00000000 0x0 0x0
0xffff9a8000008c00 0041 00000000 0x0 0x0
0xffff9a8000008c80 0041 00000000 0x0 0x0
0xffff9a8000008d00 0041 00000000 0x0 0x0
0xffff9a8000008d80 0041 00000000 0x0 0x0
0xffff9a8000008e00 0041 00000000 0x0 0x0
0xffff9a8000008e80 0041 00000000 0x0 0x0
0xffff9a8000008f00 0041 00000000 0x0 0x0
0xffff9a8000008f80 0041 00000000 0x0 0x0
0xffff9a8000009000 0041 00000000 0x0 0x0
0xffff9a8000009080 0045 00000000 0x0 0x0
0xffff9a8000009100 0041 00000000 0x0 0x0
0xffff9a8000009180 0041 00000000 0x0 0x0
0xffff9a8000009200 0041 00000000 0x0 0x0
0xffff9a8000009280 0041 00000000 0x0 0x0
0xffff9a8000009300 0041 00000000 0x0 0x0
0xffff9a8000009380 0041 00000000 0x0 0x0
0xffff9a8000009400 0041 00000000 0x0 0x0
0xffff9a8000009480 0041 00000000 0x0 0x0
0xffff9a8000009500 0041 00000000 0x0 0x0
0xffff9a8000009580 0041 00000000 0x0 0x0
0xffff9a8000009600 0041 00000000 0x0 0x0
0xffff9a8000009680 0041 00000000 0x0 0x0
0xffff9a8000009700 0041 00000000 0x0 0x0
0xffff9a8000009780 0041 00000000 0x0 0x0
0xffff9a8000009800 0041 00000000 0x0 0x0
0xffff9a8000009880 0041 00000000 0x0 0x0
0xffff9a8000009900 0041 00000000 0x0 0x0
0xffff9a8000009980 0041 00000000 0x0 0x0
0xffff9a8000009a00 0041 00000000 0x0 0x0
0xffff9a8000009a80 0041 00000000 0x0 0x0
0xffff9a8000009b00 0041 00000000 0x0 0x0
0xffff9a8000009b80 0041 00000000 0x0 0x0
0xffff9a8000009c00 0041 00000000 0x0 0x0
0xffff9a8000009c80 0041 00000000 0x0 0x0
0xffff9a8000009d00 0041 00000000 0x0 0x0
0xffff9a8000009d80 0041 00000000 0x0 0x0
0xffff9a8000009e00 0041 00000000 0x0 0x0
0xffff9a8000009e80 0045 00000000 0x0 0x0
0xffff9a8000009f00 0041 00000000 0x0 0x0
0xffff9a8000009f80 0041 00000000 0x0 0x0
0xffff9a800000a000 0041 00000000 0x0 0x0
0xffff9a800000a080 0041 00000000 0x0 0x0
0xffff9a800000a100 0041 00000000 0x0 0x0
0xffff9a800000a180 0041 00000000 0x0 0x0
0xffff9a800000a200 0041 00000000 0x0 0x0
0xffff9a800000a280 0041 00000000 0x0 0x0
0xffff9a800000a300 0041 00000000 0x0 0x0
0xffff9a800000a380 0041 00000000 0x0 0x0
0xffff9a800000a400 0041 00000000 0x0 0x0
0xffff9a800000a480 0041 00000000 0x0 0x0
0xffff9a800000a500 0041 00000000 0x0 0x0
0xffff9a800000a580 0041 00000000 0x0 0x0
0xffff9a800000a600 0041 00000000 0x0 0x0
0xffff9a800000a680 0041 00000000 0x0 0x0
0xffff9a800000a700 0041 00000000 0x0 0x0
0xffff9a800000a780 0041 00000000 0x0 0x0
0xffff9a800000a800 0041 00000000 0x0 0x0
0xffff9a800000a880 0041 00000000 0x0 0x0
0xffff9a800000a900 0041 00000000 0x0 0x0
0xffff9a800000a980 0041 00000000 0x0 0x0
0xffff9a800000aa00 0041 00000000 0x0 0x0
0xffff9a800000aa80 0041 00000000 0x0 0x0
0xffff9a800000ab00 0041 00000000 0x0 0x0
0xffff9a800000ab80 0041 00000000 0x0 0x0
0xffff9a800000ac00 0041 00000000 0x0 0x0
0xffff9a800000ac80 0041 00000000 0x0 0x0
0xffff9a800000ad00 0041 00000000 0x0 0x0
0xffff9a800000ad80 0041 00000000 0x0 0x0
0xffff9a800000ae00 0041 00000000 0x0 0x0
0xffff9a800000ae80 0041 00000000 0x0 0x0
0xffff9a800000af00 0045 00000000 0x0 0x0
0xffff9a800000af80 0045 00000000 0x0 0x0
0xffff9a800000b000 0041 00000000 0x0 0x0
0xffff9a800000b080 0041 00000000 0x0 0x0
0xffff9a800000b100 0041 00000000 0x0 0x0
0xffff9a800000b180 0045 00000000 0x0 0x0
0xffff9a800000b200 0041 00000000 0x0 0x0
0xffff9a800000b280 0045 00000000 0x0 0x0
0xffff9a800000b300 0045 00000000 0x0 0x0
0xffff9a800000b380 0045 00000000 0x0 0x0
0xffff9a800000b400 0041 00000000 0x0 0x0
0xffff9a800000b480 0041 00000000 0x0 0x0
0xffff9a800000b500 0045 00000000 0x0 0x0
0xffff9a800000b580 0045 00000000 0x0 0x0
0xffff9a800000b600 0045 00000000 0x0 0x0
0xffff9a800000b680 0045 00000000 0x0 0x0
0xffff9a800000b700 0045 00000000 0x0 0x0
0xffff9a800000b780 0045 00000000 0x0 0x0
0xffff9a800000b800 0045 00000000 0x0 0x0
0xffff9a800000b880 0041 00000000 0x0 0x0
0xffff9a800000b900 0045 00000000 0x0 0x0
0xffff9a800000b980 0045 00000000 0x0 0x0
0xffff9a800000ba00 0045 00000000 0x0 0x0
0xffff9a800000ba80 0045 00000000 0x0 0x0
0xffff9a800000bb00 0045 00000000 0x0 0x0
0xffff9a800000bb80 0045 00000000 0x0 0x0
0xffff9a800000bc00 0045 00000000 0x0 0x0
0xffff9a800000bc80 0041 00000000 0x0 0x0
0xffff9a800000bd00 0045 00000000 0x0 0x0
0xffff9a800000bd80 0045 00000000 0x0 0x0
0xffff9a800000be00 0045 00000000 0x0 0x0
0xffff9a800000be80 0045 00000000 0x0 0x0
0xffff9a800000bf00 0045 00000000 0x0 0x0
0xffff9a800000bf80 0045 00000000 0x0 0x0
0xffff9a800000c000 0045 00000000 0x0 0x0
0xffff9a800000c080 0045 00000000 0x0 0x0
0xffff9a800000c100 0045 00000000 0x0 0x0
0xffff9a800000c180 0045 00000000 0x0 0x0
0xffff9a800000c200 0045 00000000 0x0 0x0
0xffff9a800000c280 0045 00000000 0x0 0x0
0xffff9a800000c300 0045 00000000 0x0 0x0
0xffff9a800000c380 0045 00000000 0x0 0x0
0xffff9a800000c400 0045 00000000 0x0 0x0
0xffff9a800000c480 0045 00000000 0x0 0x0
0xffff9a800000c500 0045 00000000 0x0 0x0
0xffff9a800000c580 0045 00000000 0x0 0x0
0xffff9a800000c600 0045 00000000 0x0 0x0
0xffff9a800000c680 0045 00000000 0x0 0x0
0xffff9a800000c700 0041 00000000 0x0 0x0
0xffff9a800000c780 0041 00000000 0x0 0x0
0xffff9a800000c800 0045 00000000 0x0 0x0
0xffff9a800000c880 0045 00000000 0x0 0x0
0xffff9a800000c900 0045 00000000 0x0 0x0
0xffff9a800000c980 0045 00000000 0x0 0x0
0xffff9a800000ca00 0045 00000000 0x0 0x0
0xffff9a800000ca80 0045 00000000 0x0 0x0
0xffff9a800000cb00 0041 00000000 0x0 0x0
0xffff9a800000cb80 0041 00000000 0x0 0x0
0xffff9a800000cc00 0045 00000000 0x0 0x0
0xffff9a800000cc80 0045 00000000 0x0 0x0
0xffff9a800000cd00 0045 00000000 0x0 0x0
0xffff9a800000cd80 0041 00000000 0x0 0x0
0xffff9a800000ce00 0045 00000000 0x0 0x0
0xffff9a800000ce80 0041 00000000 0x0 0x0
0xffff9a800000cf00 0041 00000000 0x0 0x0
0xffff9a800000cf80 0041 00000000 0x0 0x0
0xffff9a800000d000 0041 00000000 0x0 0x0
0xffff9a800000d080 0045 00000000 0x0 0x0
0xffff9a800000d100 0041 00000000 0x0 0x0
0xffff9a800000d180 0041 00000000 0x0 0x0
0xffff9a800000d200 0041 00000000 0x0 0x0
0xffff9a800000d280 0041 00000000 0x0 0x0
0xffff9a800000d300 0045 00000000 0x0 0x0
0xffff9a800000d380 0041 00000000 0x0 0x0
0xffff9a800000d400 0041 00000000 0x0 0x0
0xffff9a800000d480 0045 00000000 0x0 0x0
0xffff9a800000d500 0041 00000000 0x0 0x0
0xffff9a800000d580 0041 00000000 0x0 0x0
0xffff9a800000d600 0041 00000000 0x0 0x0
0xffff9a800000d680 0041 00000000 0x0 0x0
0xffff9a800000d700 0041 00000000 0x0 0x0
0xffff9a800000d780 0045 00000000 0x0 0x0
0xffff9a800000d800 0041 00000000 0x0 0x0
0xffff9a800000d880 0041 00000000 0x0 0x0
0xffff9a800000d900 0041 00000000 0x0 0x0
0xffff9a800000d980 0041 00000000 0x0 0x0
0xffff9a800000da00 0041 00000000 0x0 0x0
0xffff9a800000da80 0045 00000000 0x0 0x0
0xffff9a800000db00 0045 00000000 0x0 0x0
0xffff9a800000db80 0045 00000000 0x0 0x0
0xffff9a800000dc00 0041 00000000 0x0 0x0
0xffff9a800000dc80 0041 00000000 0x0 0x0
0xffff9a800000dd00 0041 00000000 0x0 0x0
0xffff9a800000dd80 0041 00000000 0x0 0x0
0xffff9a800000de00 0041 00000000 0x0 0x0
0xffff9a800000de80 0041 00000000 0x0 0x0
0xffff9a800000df00 0045 00000000 0x0 0x0
0xffff9a800000df80 0045 00000000 0x0 0x0
0xffff9a800000e000 0045 00000000 0x0 0x0
0xffff9a800000e080 0041 00000000 0x0 0x0
0xffff9a800000e100 0041 00000000 0x0 0x0
0xffff9a800000e180 0045 00000000 0x0 0x0
0xffff9a800000e200 0041 00000000 0x0 0x0
0xffff9a800000e280 0041 00000000 0x0 0x0
0xffff9a800000e300 0045 00000000 0x0 0x0
0xffff9a800000e380 0041 00000000 0x0 0x0
0xffff9a800000e400 0045 00000000 0x0 0x0
0xffff9a800000e480 0041 00000000 0x0 0x0
0xffff9a800000e500 0045 00000000 0x0 0x0
0xffff9a800000e580 0041 00000000 0x0 0x0
0xffff9a800000e600 0045 00000000 0x0 0x0
0xffff9a800000e680 0045 00000000 0x0 0x0
0xffff9a800000e700 0041 00000000 0x0 0x0
0xffff9a800000e780 0041 00000000 0x0 0x0
0xffff9a800000e800 0045 00000000 0x0 0x0
0xffff9a800000e880 0045 00000000 0x0 0x0
0xffff9a800000e900 0041 00000000 0x0 0x0
0xffff9a800000e980 0041 00000000 0x0 0x0
0xffff9a800000ea00 0041 00000000 0x0 0x0
0xffff9a800000ea80 0041 00000000 0x0 0x0
0xffff9a800000eb00 0041 00000000 0x0 0x0
0xffff9a800000eb80 0045 00000000 0x0 0x0
0xffff9a800000ec00 0041 00000000 0x0 0x0
0xffff9a800000ec80 0041 00000000 0x0 0x0
0xffff9a800000ed00 0041 00000000 0x0 0x0
0xffff9a800000ed80 0041 00000000 0x0 0x0
0xffff9a800000ee00 0041 00000000 0x0 0x0
0xffff9a800000ee80 0045 00000000 0x0 0x0
0xffff9a800000ef00 0041 00000000 0x0 0x0
0xffff9a800000ef80 0041 00000000 0x0 0x0
0xffff9a800000f000 0041 00000000 0x0 0x0
0xffff9a800000f080 0045 00000000 0x0 0x0
0xffff9a800000f100 0041 00000000 0x0 0x0
0xffff9a800000f180 0041 00000000 0x0 0x0
0xffff9a800000f200 0041 00000000 0x0 0x0
0xffff9a800000f280 0041 00000000 0x0 0x0
0xffff9a800000f300 0041 00000000 0x0 0x0
0xffff9a800000f380 0041 00000000 0x0 0x0
0xffff9a800000f400 0045 00000000 0x0 0x0
0xffff9a800000f480 0041 00000000 0x0 0x0
0xffff9a800000f500 0041 00000000 0x0 0x0
0xffff9a800000f580 0041 00000000 0x0 0x0
0xffff9a800000f600 0041 00000000 0x0 0x0
0xffff9a800000f680 0045 00000000 0x0 0x0
0xffff9a800000f700 0041 00000000 0x0 0x0
0xffff9a800000f780 0041 00000000 0x0 0x0
0xffff9a800000f800 0041 00000000 0x0 0x0
0xffff9a800000f880 0045 00000000 0x0 0x0
0xffff9a800000f900 0041 00000000 0x0 0x0
0xffff9a800000f980 0045 00000000 0x0 0x0
0xffff9a800000fa00 0041 00000000 0x0 0x0
0xffff9a800000fa80 0041 00000000 0x0 0x0
0xffff9a800000fb00 0041 00000000 0x0 0x0
0xffff9a800000fb80 0041 00000000 0x0 0x0
0xffff9a800000fc00 0045 00000000 0x0 0x0
0xffff9a800000fc80 0041 00000000 0x0 0x0
0xffff9a800000fd00 0045 00000000 0x0 0x0
0xffff9a800000fd80 0041 00000000 0x0 0x0
0xffff9a800000fe00 0041 00000000 0x0 0x0
0xffff9a800000fe80 0041 00000000 0x0 0x0
0xffff9a800000ff00 0041 00000000 0x0 0x0
0xffff9a800000ff80 0041 00000000 0x0 0x0
0xffff9a8000010000 0041 00000000 0x0 0x0
0xffff9a8000010080 0041 00000000 0x0 0x0
0xffff9a8000010100 0041 00000000 0x0 0x0
0xffff9a8000010180 0045 00000000 0x0 0x0
0xffff9a8000010200 0045 00000000 0x0 0x0
0xffff9a8000010280 0041 00000000 0x0 0x0
0xffff9a8000010300 0041 00000000 0x0 0x0
0xffff9a8000010380 0041 00000000 0x0 0x0
0xffff9a8000010400 0041 00000000 0x0 0x0
0xffff9a8000010480 0045 00000000 0x0 0x0
0xffff9a8000010500 0045 00000000 0x0 0x0
0xffff9a8000010580 0041 00000000 0x0 0x0
0xffff9a8000010600 0041 00000000 0x0 0x0
0xffff9a8000010680 0041 00000000 0x0 0x0
0xffff9a8000010700 0041 00000000 0x0 0x0
0xffff9a8000010780 0041 00000000 0x0 0x0
0xffff9a8000010800 0041 00000000 0x0 0x0
0xffff9a8000010880 0041 00000000 0x0 0x0
0xffff9a8000010900 0041 00000000 0x0 0x0
0xffff9a8000010980 0045 00000000 0x0 0x0
0xffff9a8000010a00 0045 00000000 0x0 0x0
0xffff9a8000010a80 0045 00000000 0x0 0x0
0xffff9a8000010b00 0041 00000000 0x0 0x0
0xffff9a8000010b80 0041 00000000 0x0 0x0
0xffff9a8000010c00 0041 00000000 0x0 0x0
0xffff9a8000010c80 0045 00000000 0x0 0x0
0xffff9a8000010d00 0041 00000000 0x0 0x0
0xffff9a8000010d80 0041 00000000 0x0 0x0
0xffff9a8000010e00 0041 00000000 0x0 0x0
0xffff9a8000010e80 0041 00000000 0x0 0x0
0xffff9a8000010f00 0041 00000000 0x0 0x0
0xffff9a8000010f80 0041 00000000 0x0 0x0
0xffff9a8000011000 0041 00000000 0x0 0x0
0xffff9a8000011080 0041 00000000 0x0 0x0
0xffff9a8000011100 0041 00000000 0x0 0x0
0xffff9a8000011180 0041 00000000 0x0 0x0
0xffff9a8000011200 0045 00000000 0x0 0x0
0xffff9a8000011280 0045 00000000 0x0 0x0
0xffff9a8000011300 0041 00000000 0x0 0x0
0xffff9a8000011380 0041 00000000 0x0 0x0
0xffff9a8000011400 0041 00000000 0x0 0x0
0xffff9a8000011480 0041 00000000 0x0 0x0
0xffff9a8000011500 0045 00000000 0x0 0x0
0xffff9a8000011580 0041 00000000 0x0 0x0
0xffff9a8000011600 0041 00000000 0x0 0x0
0xffff9a8000011680 0041 00000000 0x0 0x0
0xffff9a8000011700 0045 00000000 0x0 0x0
0xffff9a8000011780 0045 00000000 0x0 0x0
0xffff9a8000011800 0041 00000000 0x0 0x0
0xffff9a8000011880 0041 00000000 0x0 0x0
0xffff9a8000011900 0041 00000000 0x0 0x0
0xffff9a8000011980 0041 00000000 0x0 0x0
0xffff9a8000011a00 0041 00000000 0x0 0x0
0xffff9a8000011a80 0041 00000000 0x0 0x0
0xffff9a8000011b00 0041 00000000 0x0 0x0
0xffff9a8000011b80 0041 00000000 0x0 0x0
0xffff9a8000011c00 0041 00000000 0x0 0x0
0xffff9a8000011c80 0041 00000000 0x0 0x0
0xffff9a8000011d00 0041 00000000 0x0 0x0
0xffff9a8000011d80 0041 00000000 0x0 0x0
0xffff9a8000011e00 0045 00000000 0x0 0x0
0xffff9a8000011e80 0041 00000000 0x0 0x0
0xffff9a8000011f00 0041 00000000 0x0 0x0
0xffff9a8000011f80 0041 00000000 0x0 0x0
0xffff9a8000012000 0041 00000000 0x0 0x0
0xffff9a8000012080 0041 00000000 0x0 0x0
0xffff9a8000012100 0045 00000000 0x0 0x0
0xffff9a8000012180 0045 00000000 0x0 0x0
0xffff9a8000012200 0041 00000000 0x0 0x0
0xffff9a8000012280 0041 00000000 0x0 0x0
0xffff9a8000012300 0041 00000000 0x0 0x0
0xffff9a8000012380 0041 00000000 0x0 0x0
0xffff9a8000012400 0041 00000000 0x0 0x0
0xffff9a8000012480 0041 00000000 0x0 0x0
0xffff9a8000012500 0041 00000000 0x0 0x0
0xffff9a8000012580 0041 00000000 0x0 0x0
0xffff9a8000012600 0041 00000000 0x0 0x0
0xffff9a8000012680 0045 00000000 0x0 0x0
0xffff9a8000012700 0041 00000000 0x0 0x0
0xffff9a8000012780 0041 00000000 0x0 0x0
0xffff9a8000012800 0041 00000000 0x0 0x0
0xffff9a8000012880 0045 00000000 0x0 0x0
0xffff9a8000012900 0001 00000000 0x0 0x0
0xffff9a8000012980 0001 00000000 0x0 0x0
0xffff9a8000012a00 0001 00000000 0x0 0x0
0xffff9a8000012a80 0001 00000000 0x0 0x0
0xffff9a8000012b00 0001 00000000 0x0 0x0
0xffff9a8000012b80 0001 00000000 0x0 0x0
0xffff9a8000012c00 0001 00000000 0x0 0x0
0xffff9a8000012c80 0001 00000000 0x0 0x0
0xffff9a8000012d00 0001 00000000 0x0 0x0
0xffff9a8000012d80 0001 00000000 0x0 0x0
0xffff9a8000012e00 0001 00000000 0x0 0x0
0xffff9a8000012e80 0001 00000000 0x0 0x0
0xffff9a8000012f00 0001 00000000 0x0 0x0
0xffff9a8000012f80 0001 00000000 0x0 0x0
0xffff9a8000013000 0001 00000000 0x0 0x0
0xffff9a8000013080 0001 00000000 0x0 0x0
0xffff9a8000013100 0001 00000000 0x0 0x0
0xffff9a8000013180 0001 00000000 0x0 0x0
0xffff9a8000013200 0001 00000000 0x0 0x0
0xffff9a8000013280 0001 00000000 0x0 0x0
0xffff9a8000013300 0001 00000000 0x0 0x0
0xffff9a8000013380 0001 00000000 0x0 0x0
0xffff9a8000013400 0001 00000000 0x0 0x0
0xffff9a8000013480 0001 00000000 0x0 0x0
0xffff9a8000013500 0001 00000000 0x0 0x0
0xffff9a8000013580 0001 00000000 0x0 0x0
0xffff9a8000013600 0001 00000000 0x0 0x0
0xffff9a8000013680 0001 00000000 0x0 0x0
0xffff9a8000013700 0001 00000000 0x0 0x0
0xffff9a8000013780 0001 00000000 0x0 0x0
0xffff9a8000013800 0001 00000000 0x0 0x0
0xffff9a8000013880 0001 00000000 0x0 0x0
0xffff9a8000013900 0001 00000000 0x0 0x0
0xffff9a8000013980 0001 00000000 0x0 0x0
0xffff9a8000013a00 0001 00000000 0x0 0x0
0xffff9a8000013a80 0001 00000000 0x0 0x0
0xffff9a8000013b00 0001 00000000 0x0 0x0
0xffff9a8000013b80 0001 00000000 0x0 0x0
0xffff9a8000013c00 0001 00000000 0x0 0x0
0xffff9a8000013c80 0001 00000000 0x0 0x0
0xffff9a8000013d00 0001 00000000 0x0 0x0
0xffff9a8000013d80 0001 00000000 0x0 0x0
0xffff9a8000013e00 0001 00000000 0x0 0x0
0xffff9a8000013e80 0001 00000000 0x0 0x0
0xffff9a8000013f00 0001 00000000 0x0 0x0
0xffff9a8000013f80 0001 00000000 0x0 0x0
0xffff9a8000014000 0001 00000000 0x0 0x0
0xffff9a8000014080 0001 00000000 0x0 0x0
0xffff9a8000014100 0001 00000000 0x0 0x0
0xffff9a8000014180 0001 00000000 0x0 0x0
0xffff9a8000014200 0001 00000000 0x0 0x0
0xffff9a8000014280 0001 00000000 0x0 0x0
0xffff9a8000014300 0001 00000000 0x0 0x0
0xffff9a8000014380 0001 00000000 0x0 0x0
0xffff9a8000014400 0041 00000000 0x0 0x0
0xffff9a8000014480 0041 00000000 0x0 0x0
0xffff9a8000014500 0041 00000000 0x0 0x0
0xffff9a8000014580 0041 00000000 0x0 0x0
0xffff9a8000014600 0041 00000000 0x0 0x0
0xffff9a8000014680 0041 00000000 0x0 0x0
0xffff9a8000014700 0041 00000000 0x0 0x0
0xffff9a8000014780 0041 00000000 0x0 0x0
0xffff9a8000014800 0041 00000000 0x0 0x0
0xffff9a8000014880 0041 00000000 0x0 0x0
0xffff9a8000014900 0041 00000000 0x0 0x0
0xffff9a8000014980 0041 00000000 0x0 0x0
0xffff9a8000014a00 0041 00000000 0x0 0x0
0xffff9a8000014a80 0041 00000000 0x0 0x0
0xffff9a8000014b00 0041 00000000 0x0 0x0
0xffff9a8000014b80 0041 00000000 0x0 0x0
0xffff9a8000014c00 0041 00000000 0x0 0x0
0xffff9a8000014c80 0041 00000000 0x0 0x0
0xffff9a8000014d00 0041 00000000 0x0 0x0
0xffff9a8000014d80 0041 00000000 0x0 0x0
0xffff9a8000014e00 0041 00000000 0x0 0x0
0xffff9a8000014e80 0041 00000000 0x0 0x0
0xffff9a8000014f00 0041 00000000 0x0 0x0
0xffff9a8000014f80 0041 00000000 0x0 0x0
0xffff9a8000015000 0041 00000000 0x0 0x0
0xffff9a8000015080 0041 00000000 0x0 0x0
0xffff9a8000015100 0041 00000000 0x0 0x0
0xffff9a8000015180 0041 00000000 0x0 0x0
0xffff9a8000015200 0041 00000000 0x0 0x0
0xffff9a8000015280 0041 00000000 0x0 0x0
0xffff9a8000015300 0041 00000000 0x0 0x0
0xffff9a8000015380 0041 00000000 0x0 0x0
0xffff9a8000015400 0041 00000000 0x0 0x0
0xffff9a8000015480 0041 00000000 0x0 0x0
0xffff9a8000015500 0041 00000000 0x0 0x0
0xffff9a8000015580 0041 00000000 0x0 0x0
0xffff9a8000015600 0041 00000000 0x0 0x0
0xffff9a8000015680 0041 00000000 0x0 0x0
0xffff9a8000015700 0041 00000000 0x0 0x0
0xffff9a8000015780 0041 00000000 0x0 0x0
0xffff9a8000015800 0041 00000000 0x0 0x0
0xffff9a8000015880 0041 00000000 0x0 0x0
0xffff9a8000015900 0041 00000000 0x0 0x0
0xffff9a8000015980 0041 00000000 0x0 0x0
0xffff9a8000015a00 0041 00000000 0x0 0x0
0xffff9a8000015a80 0041 00000000 0x0 0x0
0xffff9a8000015b00 0001 00000000 0x0 0x0
0xffff9a8000015b80 0001 00000000 0x0 0x0
0xffff9a8000015c00 0001 00000000 0x0 0x0
0xffff9a8000015c80 0001 00000000 0x0 0x0
0xffff9a8000015d00 0001 00000000 0x0 0x0
0xffff9a8000015d80 0001 00000000 0x0 0x0
0xffff9a8000015e00 0001 00000000 0x0 0x0
0xffff9a8000015e80 0001 00000000 0x0 0x0
0xffff9a8000015f00 0001 00000000 0x0 0x0
0xffff9a8000015f80 0001 00000000 0x0 0x0
0xffff9a8000016000 0001 00000000 0x0 0x0
0xffff9a8000016080 0001 00000000 0x0 0x0
0xffff9a8000016100 0001 00000000 0x0 0x0
0xffff9a8000016180 0001 00000000 0x0 0x0
0xffff9a8000016200 0001 00000000 0x0 0x0
0xffff9a8000016280 0001 00000000 0x0 0x0
0xffff9a8000016300 0001 00000000 0x0 0x0
0xffff9a8000016380 0001 00000000 0x0 0x0
0xffff9a8000016400 0001 00000000 0x0 0x0
0xffff9a8000016480 0001 00000000 0x0 0x0
0xffff9a8000016500 0001 00000000 0x0 0x0
0xffff9a8000016580 0001 00000000 0x0 0x0
0xffff9a8000016600 0001 00000000 0x0 0x0
0xffff9a8000016680 0001 00000000 0x0 0x0
0xffff9a8000016700 0001 00000000 0x0 0x0
0xffff9a8000016780 0001 00000000 0x0 0x0
0xffff9a8000016800 0001 00000000 0x0 0x0
0xffff9a8000016880 0001 00000000 0x0 0x0
0xffff9a8000016900 0001 00000000 0x0 0x0
0xffff9a8000016980 0001 00000000 0x0 0x0
0xffff9a8000016a00 0001 00000000 0x0 0x0
0xffff9a8000016a80 0001 00000000 0x0 0x0
0xffff9a8000016b00 0001 00000000 0x0 0x0
0xffff9a8000016b80 0001 00000000 0x0 0x0
0xffff9a8000016c00 0001 00000000 0x0 0x0
0xffff9a8000016c80 0001 00000000 0x0 0x0
0xffff9a8000016d00 0001 00000000 0x0 0x0
0xffff9a8000016d80 0001 00000000 0x0 0x0
0xffff9a8000016e00 0001 00000000 0x0 0x0
0xffff9a8000016e80 0001 00000000 0x0 0x0
0xffff9a8000016f00 0001 00000000 0x0 0x0
0xffff9a8000016f80 0001 00000000 0x0 0x0
0xffff9a8000017000 0001 00000000 0x0 0x0
0xffff9a8000017080 0001 00000000 0x0 0x0
0xffff9a8000017100 0001 00000000 0x0 0x0
0xffff9a8000017180 0001 00000000 0x0 0x0
0xffff9a8000017200 0001 00000000 0x0 0x0
0xffff9a8000017280 0001 00000000 0x0 0x0
0xffff9a8000017300 0001 00000000 0x0 0x0
0xffff9a8000017380 0001 00000000 0x0 0x0
0xffff9a8000017400 0001 00000000 0x0 0x0
0xffff9a8000017480 0001 00000000 0x0 0x0
0xffff9a8000017500 0001 00000000 0x0 0x0
0xffff9a8000017580 0001 00000000 0x0 0x0
0xffff9a8000017600 0041 00000000 0x0 0x0
0xffff9a8000017680 0041 00000000 0x0 0x0
0xffff9a8000017700 0041 00000000 0x0 0x0
0xffff9a8000017780 0041 00000000 0x0 0x0
0xffff9a8000017800 0041 00000000 0x0 0x0
0xffff9a8000017880 0041 00000000 0x0 0x0
0xffff9a8000017900 0041 00000000 0x0 0x0
0xffff9a8000017980 0041 00000000 0x0 0x0
0xffff9a8000017a00 0041 00000000 0x0 0x0
0xffff9a8000017a80 0041 00000000 0x0 0x0
0xffff9a8000017b00 0041 00000000 0x0 0x0
0xffff9a8000017b80 0041 00000000 0x0 0x0
0xffff9a8000017c00 0041 00000000 0x0 0x0
0xffff9a8000017c80 0041 00000000 0x0 0x0
0xffff9a8000017d00 0041 00000000 0x0 0x0
0xffff9a8000017d80 0041 00000000 0x0 0x0
0xffff9a8000017e00 0041 00000000 0x0 0x0
0xffff9a8000017e80 0041 00000000 0x0 0x0
0xffff9a8000017f00 0041 00000000 0x0 0x0
0xffff9a8000017f80 0041 00000000 0x0 0x0
0xffff9a8000018000 0041 00000000 0x0 0x0
0xffff9a8000018080 0041 00000000 0x0 0x0
0xffff9a8000018100 0041 00000000 0x0 0x0
0xffff9a8000018180 0041 00000000 0x0 0x0
0xffff9a8000018200 0041 00000000 0x0 0x0
0xffff9a8000018280 0041 00000000 0x0 0x0
0xffff9a8000018300 0041 00000000 0x0 0x0
0xffff9a8000018380 0041 00000000 0x0 0x0
0xffff9a8000018400 0041 00000000 0x0 0x0
0xffff9a8000018480 0041 00000000 0x0 0x0
0xffff9a8000018500 0041 00000000 0x0 0x0
0xffff9a8000018580 0041 00000000 0x0 0x0
0xffff9a8000018600 0041 00000000 0x0 0x0
0xffff9a8000018680 0041 00000000 0x0 0x0
0xffff9a8000018700 0041 00000000 0x0 0x0
0xffff9a8000018780 0041 00000000 0x0 0x0
0xffff9a8000018800 0041 00000000 0x0 0x0
0xffff9a8000018880 0041 00000000 0x0 0x0
0xffff9a8000018900 0041 00000000 0x0 0x0
0xffff9a8000018980 0041 00000000 0x0 0x0
0xffff9a8000018a00 0041 00000000 0x0 0x0
0xffff9a8000018a80 0041 00000000 0x0 0x0
0xffff9a8000018b00 0041 00000000 0x0 0x0
0xffff9a8000018b80 0041 00000000 0x0 0x0
0xffff9a8000018c00 0041 00000000 0x0 0x0
0xffff9a8000018c80 0041 00000000 0x0 0x0
0xffff9a8000018d00 0001 00000000 0x0 0x0
0xffff9a8000018d80 0001 00000000 0x0 0x0
0xffff9a8000018e00 0001 00000000 0x0 0x0
0xffff9a8000018e80 0001 00000000 0x0 0x0
0xffff9a8000018f00 0001 00000000 0x0 0x0
0xffff9a8000018f80 0001 00000000 0x0 0x0
0xffff9a8000019000 0001 00000000 0x0 0x0
0xffff9a8000019080 0001 00000000 0x0 0x0
0xffff9a8000019100 0001 00000000 0x0 0x0
0xffff9a8000019180 0001 00000000 0x0 0x0
0xffff9a8000019200 0001 00000000 0x0 0x0
0xffff9a8000019280 0001 00000000 0x0 0x0
0xffff9a8000019300 0001 00000000 0x0 0x0
0xffff9a8000019380 0001 00000000 0x0 0x0
0xffff9a8000019400 0001 00000000 0x0 0x0
0xffff9a8000019480 0001 00000000 0x0 0x0
0xffff9a8000019500 0001 00000000 0x0 0x0
0xffff9a8000019580 0001 00000000 0x0 0x0
0xffff9a8000019600 0001 00000000 0x0 0x0
0xffff9a8000019680 0001 00000000 0x0 0x0
0xffff9a8000019700 0001 00000000 0x0 0x0
0xffff9a8000019780 0001 00000000 0x0 0x0
0xffff9a8000019800 0001 00000000 0x0 0x0
0xffff9a8000019880 0001 00000000 0x0 0x0
0xffff9a8000019900 0001 00000000 0x0 0x0
0xffff9a8000019980 0001 00000000 0x0 0x0
0xffff9a8000019a00 0001 00000000 0x0 0x0
0xffff9a8000019a80 0001 00000000 0x0 0x0
0xffff9a8000019b00 0001 00000000 0x0 0x0
0xffff9a8000019b80 0001 00000000 0x0 0x0
0xffff9a8000019c00 0001 00000000 0x0 0x0
0xffff9a8000019c80 0001 00000000 0x0 0x0
0xffff9a8000019d00 0001 00000000 0x0 0x0
0xffff9a8000019d80 0001 00000000 0x0 0x0
0xffff9a8000019e00 0001 00000000 0x0 0x0
0xffff9a8000019e80 0001 00000000 0x0 0x0
0xffff9a8000019f00 0001 00000000 0x0 0x0
0xffff9a8000019f80 0001 00000000 0x0 0x0
0xffff9a800001a000 0001 00000000 0x0 0x0
0xffff9a800001a080 0001 00000000 0x0 0x0
0xffff9a800001a100 0001 00000000 0x0 0x0
0xffff9a800001a180 0001 00000000 0x0 0x0
0xffff9a800001a200 0001 00000000 0x0 0x0
0xffff9a800001a280 0001 00000000 0x0 0x0
0xffff9a800001a300 0001 00000000 0x0 0x0
0xffff9a800001a380 0001 00000000 0x0 0x0
0xffff9a800001a400 0001 00000000 0x0 0x0
0xffff9a800001a480 0001 00000000 0x0 0x0
0xffff9a800001a500 0001 00000000 0x0 0x0
0xffff9a800001a580 0001 00000000 0x0 0x0
0xffff9a800001a600 0001 00000000 0x0 0x0
0xffff9a800001a680 0001 00000000 0x0 0x0
0xffff9a800001a700 0001 00000000 0x0 0x0
0xffff9a800001a780 0001 00000000 0x0 0x0
0xffff9a800001a800 0041 00000000 0x0 0x0
0xffff9a800001a880 0041 00000000 0x0 0x0
0xffff9a800001a900 0041 00000000 0x0 0x0
0xffff9a800001a980 0041 00000000 0x0 0x0
0xffff9a800001aa00 0041 00000000 0x0 0x0
0xffff9a800001aa80 0041 00000000 0x0 0x0
0xffff9a800001ab00 0041 00000000 0x0 0x0
0xffff9a800001ab80 0041 00000000 0x0 0x0
0xffff9a800001ac00 0041 00000000 0x0 0x0
0xffff9a800001ac80 0041 00000000 0x0 0x0
0xffff9a800001ad00 0041 00000000 0x0 0x0
0xffff9a800001ad80 0041 00000000 0x0 0x0
0xffff9a800001ae00 0041 00000000 0x0 0x0
0xffff9a800001ae80 0041 00000000 0x0 0x0
0xffff9a800001af00 0041 00000000 0x0 0x0
0xffff9a800001af80 0041 00000000 0x0 0x0
0xffff9a800001b000 0041 00000000 0x0 0x0
0xffff9a800001b080 0041 00000000 0x0 0x0
0xffff9a800001b100 0041 00000000 0x0 0x0
0xffff9a800001b180 0041 00000000 0x0 0x0
0xffff9a800001b200 0041 00000000 0x0 0x0
0xffff9a800001b280 0041 00000000 0x0 0x0
0xffff9a800001b300 0041 00000000 0x0 0x0
0xffff9a800001b380 0041 00000000 0x0 0x0
0xffff9a800001b400 0041 00000000 0x0 0x0
0xffff9a800001b480 0041 00000000 0x0 0x0
0xffff9a800001b500 0041 00000000 0x0 0x0
0xffff9a800001b580 0041 00000000 0x0 0x0
0xffff9a800001b600 0041 00000000 0x0 0x0
0xffff9a800001b680 0041 00000000 0x0 0x0
0xffff9a800001b700 0045 00000000 0x0 0x0
0xffff9a800001b780 0045 00000000 0x0 0x0
0xffff9a800001b800 0045 00000000 0x0 0x0
0xffff9a800001b880 0041 00000000 0x0 0x0
0xffff9a800001b900 0041 00000000 0x0 0x0
0xffff9a800001b980 0041 00000000 0x0 0x0
0xffff9a800001ba00 0045 00000000 0x0 0x0
0xffff9a800001ba80 0041

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Oct 28, 2022, 11:19:34 AM10/28/22

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 4218bdda2e25 Adjust userland commands for struct inpcb sep..
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=161a5041880000

kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=1dea84a29b0f03c1fa1c
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11403a7e880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14186d16880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8813f5f371a8/disk-4218bdda.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/e5d1760d89e4/netbsd-4218bdda.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1dea84...@syzkaller.appspotmail.com

[ 54.4823018] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/tcp_usrreq.c:774:5, member access within null pointer of type 'struct inpcb'

[ 54.4823018] cpu1: Begin traceback...
[ 54.4923062] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 54.5522896] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 54.6122929] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 54.6622895] tcp_shutdown_wrapper() at netbsd:tcp_shutdown_wrapper+0xdf tcp_shutdown sys/netinet/tcp_usrreq.c:774 [inline]
[ 54.6622895] tcp_shutdown_wrapper() at netbsd:tcp_shutdown_wrapper+0xdf sys/netinet/tcp_usrreq.c:2296
[ 54.7122882] soshutdown() at netbsd:soshutdown+0xe5 sys/kern/uipc_socket.c:1675
[ 54.7622922] sys_shutdown() at netbsd:sys_shutdown+0x11f sys/kern/uipc_syscalls.c:1161
[ 54.8022919] sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 54.8022919] sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 54.8522890] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 54.8522890] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 54.8522890] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 54.8722878] --- syscall (number 134 via SYS_syscall) ---
[ 54.8822885] netbsd:syscall+0x2da:
[ 54.8922871] cpu1: End traceback...
[ 54.8922871] fatal breakpoint trap in supervisor mode
[ 54.8922871] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0x768cb8bf7018 ilevel 0 rsp 0xffff91824839b930
[ 54.9022892] curlwp 0xffff89d99214fa00 pid 990.990 lowest kstack 0xffff9182483972c0
Stopped in pid 990.990 (syz-executor4031) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
tcp_shutdown_wrapper() at netbsd:tcp_shutdown_wrapper+0xdf tcp_shutdown sys/netinet/tcp_usrreq.c:774 [inline]
tcp_shutdown_wrapper() at netbsd:tcp_shutdown_wrapper+0xdf sys/netinet/tcp_usrreq.c:2296
soshutdown() at netbsd:soshutdown+0xe5 sys/kern/uipc_socket.c:1675
sys_shutdown() at netbsd:sys_shutdown+0x11f sys/kern/uipc_syscalls.c:1161

sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90

syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 134 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/tcp_usrreq.c:774:5, member access within null pointer of type 'struct inpcb'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

449 449 3 0 0 ffff89d990471740 syz-executor4031 tstile
1386 1386 2 1 0 ffff89d991159940 syz-executor4031
990 > 990 7 1 0 ffff89d99214fa00 syz-executor4031
1239 1239 3 0 0 ffff89d9907f4040 syz-executor4031 tstile
1241 1241 3 0 0 ffff89d98ff9bb00 syz-executor4031 tstile
942 942 3 0 0 ffff89d99214f5c0 syz-executor4031 tstile
929 929 3 0 0 ffff89d98fc5f200 syz-executor4031 tstile
829 > 829 7 0 140 ffff89d98fc9dac0 syz-executor4031
1120 1120 2 1 140 ffff89d98ff9b6c0 syz-executor4031
815 815 2 1 140 ffff89d990dc3080 syz-executor4031
1004 1004 3 0 180 ffff89d98ff9b280 syz-executor4031 nanoslp
1080 1080 3 1 40180 ffff89d99214f180 sshd select
1222 1222 3 0 180 ffff89d991870100 getty nanoslp
1184 1184 3 0 180 ffff89d991bb2580 getty nanoslp
1223 1223 3 0 180 ffff89d991bb29c0 getty nanoslp
1195 1195 3 1 1c0 ffff89d991870980 getty ttyraw
1098 1098 3 0 180 ffff89d991870540 sshd select
954 954 3 0 180 ffff89d991bb2140 powerd kqueue
702 702 3 0 180 ffff89d9901432c0 syslogd kqueue
747 747 3 0 180 ffff89d9911590c0 dhcpcd poll
742 742 3 1 180 ffff89d9907f48c0 dhcpcd poll
466 466 3 0 180 ffff89d990471b80 dhcpcd poll
598 598 3 1 180 ffff89d9907f4480 dhcpcd poll
292 292 3 0 180 ffff89d990517bc0 dhcpcd poll
485 485 3 0 180 ffff89d990517780 dhcpcd poll
291 291 3 0 180 ffff89d990143b40 dhcpcd poll
1 1 3 0 180 ffff89d987a4b980 init wait
0 987 3 0 200 ffff89d98fc5f640 physiod physiod
0 196 3 1 200 ffff89d98fc9d680 pooldrain pooldrain
0 195 3 0 200 ffff89d98fc9d240 ioflush syncer
0 194 3 0 200 ffff89d98fc5fa80 pgdaemon pgdaemon
0 170 3 1 200 ffff89d98db9fa40 usb7 usbevt
0 169 3 1 200 ffff89d98db9f600 usb6 usbevt
0 168 3 1 200 ffff89d98db9f1c0 usb5 usbevt
0 167 3 1 200 ffff89d98ab42a00 usb4 usbevt
0 166 3 1 200 ffff89d98ab425c0 usb3 usbevt
0 165 3 1 200 ffff89d98ab42180 usb2 usbevt
0 31 3 1 200 ffff89d987ab59c0 usb1 usbevt
0 63 3 1 200 ffff89d987ab5580 usb0 usbevt
0 126 3 1 200 ffff89d9878e0740 usbtask-dr usbtsk
0 125 3 1 200 ffff89d9878e0b80 usbtask-hc usbtsk
0 124 3 0 200 ffff89d985ea1b00 swwreboot swwreboot
0 123 3 0 200 ffff89d987ab5140 npfgc0 npfgcw
0 122 3 1 200 ffff89d987a4b540 rt_free rt_free
0 121 3 1 200 ffff89d987a4b100 unpgc unpgc
0 120 3 0 200 ffff89d987a46940 key_timehandler key_timehandler
0 119 3 1 200 ffff89d987a46500 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffff89d987a460c0 icmp6_wqinput/0 icmp6_wqinput
0 117 3 0 200 ffff89d987a29900 nd6_timer nd6_timer
0 116 3 1 200 ffff89d987a294c0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffff89d987a29080 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffff89d987a1c8c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffff89d987a1c480 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffff89d987a1c040 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffff89d9879d7bc0 icmp_wqinput/0 icmp_wqinput
0 110 3 0 200 ffff89d9879d7340 rt_timer rt_timer
0 109 3 0 200 ffff89d9879d7780 vmem_rehash vmem_rehash
0 100 3 1 200 ffff89d9878e0300 entbutler entropy
0 99 3 0 200 ffff89d987350b40 viomb balloon
0 98 3 1 200 ffff89d987350700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffff89d9873502c0 vioif0_txrx/0 vioif0_txrx
0 30 3 1 200 ffff89d985ea16c0 scsibus0 sccomp
0 29 3 0 200 ffff89d985ea1280 pms0 pmsreset
0 28 3 1 200 ffff89d985db4ac0 xcall/1 xcall
0 27 1 1 200 ffff89d985db4680 softser/1
0 26 1 1 200 ffff89d985db4240 softclk/1
0 25 1 1 200 ffff89d985d87a80 softbio/1
0 24 1 1 200 ffff89d985d87640 softnet/1
0 23 1 1 201 ffff89d985d87200 idle/1
0 22 3 1 200 ffff89dab412da40 lnxsyswq lnxsyswq
0 21 3 1 200 ffff89dab412d600 lnxubdwq lnxubdwq
0 20 3 1 200 ffff89dab412d1c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 ffff89dab4134a00 lnxlngwq lnxlngwq
0 18 3 1 200 ffff89dab41345c0 lnxhipwq lnxhipwq
0 17 3 1 200 ffff89dab4134180 lnxrcugc lnxrcugc
0 16 3 0 200 ffff89dab41539c0 sysmon smtaskq
0 15 3 1 200 ffff89dab4153580 pmfsuspend pmfsuspend
0 14 3 0 200 ffff89dab4153140 pmfevent pmfevent
0 13 3 1 200 ffff89dab415e980 sopendfree sopendfr
0 12 3 0 200 ffff89dab415e540 ifwdog ifwdog
0 11 3 0 200 ffff89dab415e100 iflnkst iflnkst
0 10 3 1 200 ffff89dab5193940 nfssilly nfssilly
0 9 3 0 200 ffff89dab5193500 vdrain vdrain
0 8 3 1 200 ffff89dab51930c0 modunload mod_unld
0 7 3 0 200 ffff89dab51bc900 xcall/0 xcall
0 6 1 0 200 ffff89dab51bc4c0 softser/0
0 > 5 7 0 200 ffff89dab51bc080 softclk/0
0 4 1 0 200 ffff89dab51e98c0 softbio/0
0 3 1 0 200 ffff89dab51e9480 softnet/0
0 2 1 0 201 ffff89dab51e9040 idle/0

0 0 3 0 200 ffffffff8673e8c0 swapper uvm
[Locks tracked through LWPs]

****** LWP 1386.1386 (syz-executor4031) @ 0xffff89d991159940, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:uvmspace_alloc+0x339 uvm_map_setup sys/uvm/uvm_map.c:4772 [inline])
* Lock 0 (initialized at netbsd:uvmspace_alloc+0x339 uvmspace_init sys/uvm/uvm_map.c:4115 [inline])
* Lock 0 (initialized at netbsd:uvmspace_alloc+0x339 sys/uvm/uvm_map.c:4094)
lock address : ffff89d987a6e460
type : sleep/adaptive
initialized : netbsd:uvmspace_alloc+0x339

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0

relevant cpu : 1 last held: 1
relevant lwp : 0xffff89d991159940 last held: 0xffff89d991159940
last locked* : netbsd:vm_map_lock+0x146
unlocked : netbsd:uvm_fault_internal+0x3949
owner/count : 0xffff89d991159940 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at netbsd:uvm_amap_init+0x20 sys/uvm/uvm_amap.c:308)
lock address : netbsd:amap_list_lock
type : sleep/adaptive
initialized : netbsd:uvm_amap_init+0x20

shared holds : 0 exclusive: 0

shares wanted: 0 exclusive: 1

relevant cpu : 1 last held: 0

relevant lwp : 0xffff89d991159940 last held: 000000000000000000
last locked : netbsd:amap_copy+0x147
unlocked* : netbsd:amap_copy+0x180
owner field : 0xffff89d991159940 wait/spin: 1/0

Turnstile:
=> 0 waiting readers:

=> 5 waiting writers: 0xffff89d98ff9bb00 0xffff89d9907f4040 0xffff89d98fc5f200 0xffff89d99214f5c0 0xffff89d990471740

****** LWP 990.990 (syz-executor4031) @ 0xffff89d99214fa00, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:soinit+0x1f7 sys/kern/uipc_socket.c:459)

lock address : ffff89dab5669080

type : sleep/adaptive
initialized : netbsd:soinit+0x1f7
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0

relevant cpu : 1 last held: 1
relevant lwp : 0xffff89d99214fa00 last held: 0xffff89d99214fa00

last locked* : netbsd:sys_shutdown+0xae
unlocked : netbsd:sys_shutdown+0x142

owner field : 0xffff89d99214fa00 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 929.929 (syz-executor4031) @ 0xffff89d98fc5f200, l_stat=3

*** Locks held:

* Lock 0 (initialized at netbsd:lwp_ctl_alloc+0xd9b sys/kern/kern_lwp.c:1859)
lock address : ffff89d993273dc0
type : sleep/adaptive
initialized : netbsd:lwp_ctl_alloc+0xd9b

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffff89d98fc5f200 last held: 0xffff89d98fc5f200
last locked* : netbsd:lwp_ctl_alloc+0x1da
unlocked : 0

owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at netbsd:uvmspace_alloc+0x339 uvm_map_setup sys/uvm/uvm_map.c:4772 [inline])
* Lock 1 (initialized at netbsd:uvmspace_alloc+0x339 uvmspace_init sys/uvm/uvm_map.c:4115 [inline])
* Lock 1 (initialized at netbsd:uvmspace_alloc+0x339 sys/uvm/uvm_map.c:4094)
lock address : ffff89d987a6e5c0
type : sleep/adaptive
initialized : netbsd:uvmspace_alloc+0x339

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffff89d98fc5f200 last held: 0xffff89d98fc5f200
last locked* : netbsd:uvm_map_prepare+0x11e
unlocked : netbsd:uvm_fault_upper_enter+0x473
owner/count : 0xffff89d98fc5f200 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 742.742 (dhcpcd) @ 0xffff89d9907f48c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0

relevant lwp : 0xffff89d9907f48c0 last held: 000000000000000000