assert failed: tp->t_oproc != NULL

4 views

Skip to first unread message

syzbot

unread,

Jun 14, 2022, 1:13:24 AM6/14/22

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 498e658a25d1 Restore arm in the list of architectures supp..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1541898bf00000
kernel config: https://syzkaller.appspot.com/x/.config?x=fab579639ba4bf0a
dashboard link: https://syzkaller.appspot.com/bug?extid=766981eef92a3cd0352a
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+766981...@syzkaller.appspotmail.com

[ 138.8773399] panic: kernel diagnostic assertion "tp->t_oproc != NULL" failed: file "/syzkaller/managers/ci2-netbsd/kernel/sys/dev/bluetooth/btuart.c", line 243
[ 138.8952060] cpu0: Begin traceback...
[ 138.9073296] vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:293
[ 138.9373288] _sub_D_65535_0() at netbsd:_sub_D_65535_0+-0x34c4
[ 138.9673285] btuartopen() at netbsd:btuartopen+0x2ec btuartopen sys/dev/bluetooth/btuart.c:243 [inline]
[ 138.9673285] btuartopen() at netbsd:btuartopen+0x2ec sys/dev/bluetooth/btuart.c:220
[ 138.9973286] ttioctl() at netbsd:ttioctl+0x13de sys/kern/tty.c:1232
[ 139.0273280] compat_43_ttioctl() at netbsd:compat_43_ttioctl+0xb08 sys/compat/common/tty_43.c:265
[ 139.0573288] ttioctl() at netbsd:ttioctl+0xa4f sys/kern/tty.c:1441
[ 139.0873288] ptyioctl() at netbsd:ptyioctl+0x526 sys/kern/tty_pty.c:1182
[ 139.1273303] cdev_ioctl() at netbsd:cdev_ioctl+0x1e7 sys/kern/subr_devsw.c:1223
[ 139.1573288] spec_ioctl() at netbsd:spec_ioctl+0x148 sys/miscfs/specfs/spec_vnops.c:1294
[ 139.1873303] VOP_IOCTL() at netbsd:VOP_IOCTL+0x132 sys/kern/vnode_if.c:934
[ 139.2173289] vn_ioctl() at netbsd:vn_ioctl+0x1b9 sys/kern/vfs_vnops.c:865
[ 139.2473295] sys_ioctl() at netbsd:sys_ioctl+0x8f5 sys/kern/sys_generic.c:673
[ 139.2873292] sys___syscall() at netbsd:sys___syscall+0x10e sy_call sys/sys/syscallvar.h:65 [inline]
[ 139.2873292] sys___syscall() at netbsd:sys___syscall+0x10e sys/kern/sys_syscall.c:90
[ 139.3173286] syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
[ 139.3173286] syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 139.3173286] syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
[ 139.3273307] --- syscall (number 198) ---
[ 139.3373295] netbsd:syscall+0x25a:
[ 139.3373295] cpu0: End traceback...
[ 139.3373295] fatal breakpoint trap in supervisor mode
[ 139.3502764] trap type 1 code 0 rip 0xffffffff80220a4d cs 0x8 rflags 0x282 cr2 0x7c452ce7cc50 ilevel 0x6 rsp 0xffff9f81a41d5010
[ 139.3634435] curlwp 0xffff9f8013e93240 pid 10623.10219 lowest kstack 0xffff9f81a41ce2c0
Stopped in pid 10623.10219 (syz-executor.1) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0x105 sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:293
_sub_D_65535_0() at netbsd:_sub_D_65535_0+-0x34c4
btuartopen() at netbsd:btuartopen+0x2ec btuartopen sys/dev/bluetooth/btuart.c:243 [inline]
btuartopen() at netbsd:btuartopen+0x2ec sys/dev/bluetooth/btuart.c:220
ttioctl() at netbsd:ttioctl+0x13de sys/kern/tty.c:1232
compat_43_ttioctl() at netbsd:compat_43_ttioctl+0xb08 sys/compat/common/tty_43.c:265
ttioctl() at netbsd:ttioctl+0xa4f sys/kern/tty.c:1441
ptyioctl() at netbsd:ptyioctl+0x526 sys/kern/tty_pty.c:1182
cdev_ioctl() at netbsd:cdev_ioctl+0x1e7 sys/kern/subr_devsw.c:1223
spec_ioctl() at netbsd:spec_ioctl+0x148 sys/miscfs/specfs/spec_vnops.c:1294
VOP_IOCTL() at netbsd:VOP_IOCTL+0x132 sys/kern/vnode_if.c:934
vn_ioctl() at netbsd:vn_ioctl+0x1b9 sys/kern/vfs_vnops.c:865
sys_ioctl() at netbsd:sys_ioctl+0x8f5 sys/kern/sys_generic.c:673
sys___syscall() at netbsd:sys___syscall+0x10e sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x10e sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
--- syscall (number 198) ---
netbsd:syscall+0x25a:
Panic string: kernel diagnostic assertion "tp->t_oproc != NULL" failed: file "/syzkaller/managers/ci2-netbsd/kernel/sys/dev/bluetooth/btuart.c", line 243
PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
10468 10031 3 0 0 ffff9f8012bd01c0 syz-executor.2 biowait
10468 10468 2 0 10000000 ffff9f801342b780 syz-executor.2
10623>10219 7 0 100 ffff9f8013e93240 syz-executor.1
10623 10623 2 1 10040000 ffff9f8012a01300 syz-executor.1
9785 10453 2 0 100 ffff9f8013eebb00 syz-executor.0
9785 9785 2 0 10040000 ffff9f8012c69bc0 syz-executor.0
1130 1130 2 1 40 ffff9f8013de5a80 syz-executor.5
1086 1086 2 1 140 ffff9f8013de5640 syz-executor.4
1222 >1222 7 1 40 ffff9f8013de5200 syz-executor.3
1227 1227 3 0 180 ffff9f8013ccea40 syz-executor.2 nanoslp
422 422 2 1 140 ffff9f8013cce600 syz-executor.1
1223 1223 3 0 180 ffff9f801337c180 syz-executor.0 nanoslp
1194 1105 3 0 180 ffff9f8013cce1c0 syz-fuzzer parked
1194 1224 3 0 180 ffff9f8013c335c0 syz-fuzzer parked
1194 1220 3 0 180 ffff9f80133baac0 syz-fuzzer parked
1194 972 3 0 180 ffff9f80133ba240 syz-fuzzer kqueue
1194 1113 3 1 180 ffff9f8013396a40 syz-fuzzer parked
1194 1054 3 0 180 ffff9f80126cb040 syz-fuzzer parked
1194 1084 2 1 140 ffff9f8012a01b80 syz-fuzzer
1194 1194 3 0 180 ffff9f8012aa1900 syz-fuzzer parked
1079 1079 3 0 180 ffff9f8012a63040 sshd select
1126 1126 3 1 180 ffff9f8013457980 getty nanoslp
1070 1070 3 1 180 ffff9f801347a9c0 getty nanoslp
1073 1073 3 0 180 ffff9f801347a140 getty nanoslp
1074 1074 3 1 1c0 ffff9f8012cb2540 getty ttyraw
1067 1067 3 0 180 ffff9f8013396600 sshd select
941 941 3 0 180 ffff9f8012c87480 powerd kqueue
688 688 3 1 180 ffff9f80133d1b00 syslogd kqueue
602 602 3 0 180 ffff9f8012bfeac0 dhcpcd poll
547 547 3 0 180 ffff9f8012c99900 dhcpcd poll
464 464 3 0 180 ffff9f8012bfe240 dhcpcd poll
589 589 3 1 180 ffff9f8012c57300 dhcpcd poll
289 289 3 0 180 ffff9f8012d95080 dhcpcd poll
288 288 3 0 180 ffff9f8012d808c0 dhcpcd poll
351 351 3 0 180 ffff9f8012d80480 dhcpcd poll
1 1 3 1 180 ffff9f80128549c0 init wait
0 8148 5 1 200 ffff9f8013f1db40 (zombie)
0 7357 3 1 200 ffff9f8013f1d700 ktrace ktrwait
0 819 3 0 200 ffff9f8012974ac0 physiod physiod
0 194 3 0 200 ffff9f801298bb00 pooldrain pooldrain
0 193 3 0 200 ffff9f801298b6c0 ioflush syncer
0 192 3 1 200 ffff9f801298b280 pgdaemon pgdaemon
0 169 3 1 200 ffff9f8012974240 usb7 usbevt
0 167 3 0 200 ffff9f801292ea80 usb6 usbevt
0 165 3 0 200 ffff9f801292e640 usb5 usbevt
0 164 3 0 200 ffff9f801292e200 usb4 usbevt
0 31 3 1 200 ffff9f80128e0a40 usb3 usbevt
0 63 3 1 200 ffff9f80128e0600 usb2 usbevt
0 126 3 1 200 ffff9f80128e01c0 usb1 usbevt
0 125 3 0 200 ffff9f801286fa00 usb0 usbevt
0 124 3 1 200 ffff9f801286f5c0 usbtask-dr usbtsk
0 123 3 0 200 ffff9f80120b66c0 usbtask-hc usbtsk
0 122 3 0 200 ffff9f801286f180 npfgc0 npfgcw
0 121 3 1 200 ffff9f8012854580 rt_free rt_free
0 120 3 1 200 ffff9f8012854140 unpgc unpgc
0 119 3 0 200 ffff9f80126f9980 key_timehandler key_timehandler
0 118 3 1 200 ffff9f80126f9540 icmp6_wqinput/1 icmp6_wqinput
0 117 3 0 200 ffff9f80126f9100 icmp6_wqinput/0 icmp6_wqinput
0 116 3 0 200 ffff9f80126ef940 nd6_timer nd6_timer
0 115 3 1 200 ffff9f80126ef500 carp6_wqinput/1 carp6_wqinput
0 114 3 0 200 ffff9f80126ef0c0 carp6_wqinput/0 carp6_wqinput
0 113 3 1 200 ffff9f80126e1900 carp_wqinput/1 carp_wqinput
0 112 3 0 200 ffff9f80126e14c0 carp_wqinput/0 carp_wqinput
0 111 3 1 200 ffff9f80126e1080 icmp_wqinput/1 icmp_wqinput
0 110 3 0 200 ffff9f80126cb8c0 icmp_wqinput/0 icmp_wqinput
0 109 3 0 200 ffff9f80126cb480 rt_timer rt_timer
0 108 3 0 200 ffff9f80126cabc0 vmem_rehash vmem_rehash
0 99 3 0 200 ffff9f80120bbb40 entbutler entropy
0 98 3 1 200 ffff9f80120bb700 viomb balloon
0 97 3 1 200 ffff9f80120bb2c0 vioif0_txrx/1 vioif0_txrx
0 96 3 0 200 ffff9f80120b6b00 vioif0_txrx/0 vioif0_txrx
0 29 3 0 200 ffff9f80120b6280 scsibus0 sccomp
0 28 3 0 200 ffff9f8010cbaac0 pms0 pmsreset
0 27 3 1 200 ffff9f8010cba680 xcall/1 xcall
0 26 1 1 200 ffff9f8010cba240 softser/1
0 25 1 1 200 ffff9f8010cb9a80 softclk/1
0 24 1 1 200 ffff9f8010cb9640 softbio/1
0 23 1 1 200 ffff9f8010cb9200 softnet/1
0 22 1 1 201 ffff9f800fb55a40 idle/1
0 21 3 0 200 ffff9f800fb55600 lnxsyswq lnxsyswq
0 20 3 0 200 ffff9f800fb551c0 lnxubdwq lnxubdwq
0 19 3 0 200 ffff9f800fb54a00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffff9f800fb545c0 lnxlngwq lnxlngwq
0 17 3 1 200 ffff9f800fb54180 lnxhipwq lnxhipwq
0 16 3 0 200 ffff9f800fb4b9c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffff9f800fb4b580 sysmon smtaskq
0 14 3 1 200 ffff9f800fb4b140 pmfsuspend pmfsuspend
0 13 3 0 200 ffff9f800fb48980 pmfevent pmfevent
0 12 3 0 200 ffff9f800fb48540 sopendfree sopendfr
0 11 3 1 200 ffff9f800fb48100 iflnkst iflnkst
0 10 3 0 200 ffff9f800fb3c940 nfssilly nfssilly
0 9 3 0 200 ffff9f800fb3c500 vdrain vdrain
0 8 3 0 200 ffff9f800fb3c0c0 modunload mod_unld
0 7 3 0 200 ffff9f800fb33900 xcall/0 xcall
0 6 1 0 200 ffff9f800fb334c0 softser/0
0 5 1 0 200 ffff9f800fb33080 softclk/0
0 4 1 0 200 ffff9f800fb318c0 softbio/0
0 3 1 0 200 ffff9f800fb31480 softnet/0
0 2 1 0 201 ffff9f800fb31040 idle/0
0 0 3 0 200 ffffffff83341040 swapper uvm
[Locks tracked through LWPs]

****** LWP 10468.10031 (syz-executor.2) @ 0xffff9f8012bd01c0, l_stat=3

*** Locks held:

* Lock 0 (initialized at vcache_alloc)
lock address : 0xffff9f801349b780 type : sleep/adaptive
initialized : 0xffffffff81ca4310
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9f8012bd01c0 last held: 0xffff9f8012bd01c0
last locked* : 0xffffffff81cda286 unlocked : 0xffffffff81cda2e8
owner/count : 0xffff9f8012bd01c0 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at vcache_alloc)
lock address : 0xffff9f801297b280 type : sleep/adaptive
initialized : 0xffffffff81ca4310
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9f8012bd01c0 last held: 0xffff9f8012bd01c0
last locked* : 0xffffffff81cda286 unlocked : 000000000000000000
owner/count : 0xffff9f8012bd01c0 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 10623.10219 (syz-executor.1) @ 0xffff9f8013e93240, l_stat=7

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8347f940 type : sleep/adaptive
initialized : 0xffffffff81b107b1
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9f8013e93240 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 1130.1130 (syz-executor.5) @ 0xffff9f8013de5a80, l_stat=2

*** Locks held:

* Lock 0 (initialized at uvmspace_alloc)
lock address : 0xffff9f801347da48 type : sleep/adaptive
initialized : 0xffffffff81a77017
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff9f8013de5a80 last held: 0xffff9f8013de5a80
last locked* : 0xffffffff81a6df44 unlocked : 0xffffffff81a5d987
owner/count : 0xffff9f8013de5a80 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1222.1222 (syz-executor.3) @ 0xffff9f8013de5200, l_stat=7

*** Locks held:

* Lock 0 (initialized at vcache_alloc)
lock address : 0xffff9f8013df92c0 type : sleep/adaptive
initialized : 0xffffffff81ca4310
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff9f8013de5200 last held: 0xffff9f8013de5200
last locked* : 0xffffffff81cda286 unlocked : 0xffffffff81cda2e8
owner/count : 0xffff9f8013de5200 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

* Lock 1 (initialized at vcache_alloc)
lock address : 0xffff9f8012c3d500 type : sleep/adaptive
initialized : 0xffffffff81ca4310
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xffff9f8013de5200 last held: 0xffff9f8013de5200
last locked* : 0xffffffff81cda286 unlocked : 0xffffffff81cda2e8
owner/count : 0xffff9f8013de5200 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at main)
lock address : 0xffffffff8347f840 type : spin
initialized : 0xffffffff81f60b9e
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 1
relevant cpu : 1 last held: 0
relevant lwp : 0xffff9f8013de5200 last held: 0xffff9f8013e93240
last locked* : 0xffffffff81b9d1d6 unlocked : 0xffffffff80268e82
curcpu holds : 1 wanted by: 000000000000000000

****** LWP 547.547 (dhcpcd) @ 0xffff9f8012c99900, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8347f940 type : sleep/adaptive
initialized : 0xffffffff81b107b1
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9f8012c99900 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 464.464 (dhcpcd) @ 0xffff9f8012bfe240, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8347f940 type : sleep/adaptive
initialized : 0xffffffff81b107b1
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9f8012bfe240 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 288.288 (dhcpcd) @ 0xffff9f8012d808c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8347f940 type : sleep/adaptive
initialized : 0xffffffff81b107b1
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9f8012d808c0 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 351.351 (dhcpcd) @ 0xffff9f8012d80480, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8347f940 type : sleep/adaptive
initialized : 0xffffffff81b107b1
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9f8012d80480 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffff9f800fb48100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8347f940 type : sleep/adaptive
initialized : 0xffffffff81b107b1
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff9f800fb48100 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffff9f800fb33080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8347f940 type : sleep/adaptive
initialized : 0xffffffff81b107b1
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9f800fb33080 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff83341040, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8347f940 type : sleep/adaptive
initialized : 0xffffffff81b107b1
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff83341040 last held: 000000000000000000
last locked : 000000000000000000 unlocked*: 000000000000000000
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at main)
lock address : 0xffffffff8347f840 type : spin
initialized : 0xffffffff81f60b9e
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 1
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9f8013e93240 last held: 0xffff9f8013e93240
last locked* : 0xffffffff81b9d1d6 unlocked : 0xffffffff80268e82
curcpu holds : 1 wanted by: 000000000000000000

* Lock 1 (initialized at kprintf_init)
lock address : 0xffffffff8358aea0 type : spin
initialized : 0xffffffff81bc28c5
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff9f8013e93240 last held: 0xffff9f8013e93240
last locked* : 0xffffffff81bc2936 unlocked : 0xffffffff81bc2994
owner field : 0x0000000000000800 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffff9f8000017180 0041 00000000 0x0 0x0
0xffff9f8000017200 0041 00000000 0x0 0x0
0xffff9f8000017280 0041 00000000 0x0 0x0
0xffff9f8000017300 0041 00000000 0x0 0x0
0xffff9f8000017380 0041 00000000 0x0 0x0
0xffff9f8000017400 0041 00000000 0x0 0x0
0xffff9f8000017480 0041 00000000 0x0 0x0
0xffff9f8000017500 0041 00000000 0x0 0x0
0xffff9f8000017580 0041 00000000 0x0 0x0
0xffff9f8000017600 0041 00000000 0x0 0x0
0xffff9f8000017680 0041 00000000 0x0 0x0
0xffff9f8000017700 0041 00000000 0x0 0x0
0xffff9f8000017780 0041 00000000 0x0 0x0
0xffff9f8000017800 0041 00000000 0x0 0x0
0xffff9f8000017880 0041 00000000 0x0 0x0
0xffff9f8000017900 0041 00000000 0x0 0x0
0xffff9f8000017980 0041 00000000 0x0 0x0
0xffff9f8000017a00 0041 00000000 0x0 0x0
0xffff9f8000017a80 0041 00000000 0x0 0x0
0xffff9f8000017b00 0041 00000000 0x0 0x0
0xffff9f8000017b80 0041 00000000 0x0 0x0
0xffff9f8000017c00 0041 00000000 0x0 0x0
0xffff9f8000017c80 0041 00000000 0x0 0x0
0xffff9f8000017d00 0041 00000000 0x0 0x0
0xffff9f8000017d80 0041 00000000 0x0 0x0
0xffff9f8000017e00 0041 00000000 0x0 0x0
0xffff9f8000017e80 0041 00000000 0x0 0x0
0xffff9f8000017f00 0041 00000000 0x0 0x0
0xffff9f8000017f80 0041 00000000 0x0 0x0
0xffff9f8000018000 0041 00000000 0x0 0x0
0xffff9f8000018080 0041 00000000 0x0 0x0
0xffff9f8000018100 0041 00000000 0x0 0x0
0xffff9f8000018180 0041 00000000 0x0 0x0
0xffff9f8000018200 0041 00000000 0x0 0x0
0xffff9f8000018280 0041 00000000 0x0 0x0
0xffff9f8000018300 0041 00000000 0x0 0x0
0xffff9f8000018380 0041 00000000 0x0 0x0
0xffff9f8000018400 0041 00000000 0x0 0x0
0xffff9f8000018480 0041 00000000 0x0 0x0
0xffff9f8000018500 0041 00000000 0x0 0x0
0xffff9f8000018580 0041 00000000 0x0 0x0
0xffff9f8000018600 0041 00000000 0x0 0x0
0xffff9f8000018680 0041 00000000 0x0 0x0
0xffff9f8000018700 0041 00000000 0x0 0x0
0xffff9f8000018780 0041 00000000 0x0 0x0
0xffff9f8000018800 0041 00000000 0x0 0x0
0xffff9f8000018880 0041 00000000 0x0 0x0
0xffff9f8000018900 0041 00000000 0x0 0x0
0xffff9f8000018980 0041 00000000 0x0 0x0
0xffff9f8000018a00 0041 00000000 0x0 0x0
0xffff9f8000018a80 0041 00000000 0x0 0x0
0xffff9f8000018b00 0041 00000000 0x0 0x0
0xffff9f8000018b80 0041 00000000 0x0 0x0
0xffff9f8000018c00 0041 00000000 0x0 0x0
0xffff9f8000018c80 0041 00000000 0x0 0x0
0xffff9f8000018d00 0041 00000000 0x0 0x0
0xffff9f8000018d80 0041 00000000 0x0 0x0
0xffff9f8000018e00 0041 00000000 0x0 0x0
0xffff9f8000018e80 0041 00000000 0x0 0x0
0xffff9f8000018f00 0041 00000000 0x0 0x0
0xffff9f8000018f80 0041 00000000 0x0 0x0
0xffff9f8000019000 0041 00000000 0x0 0x0
0xffff9f8000019080 0041 00000000 0x0 0x0
0xffff9f8000019100 0041 00000000 0x0 0x0
0xffff9f8000019180 0041 00000000 0x0 0x0
0xffff9f8000019200 0041 00000000 0x0 0x0
0xffff9f8000019280 0041 00000000 0x0 0x0
0xffff9f8000019300 0041 00000000 0x0 0x0
0xffff9f8000019380 0041 00000000 0x0 0x0
0xffff9f8000019400 0041 00000000 0x0 0x0
0xffff9f8000019480 0041 00000000 0x0 0x0
0xffff9f8000019500 0041 00000000 0x0 0x0
0xffff9f8000019580 0041 00000000 0x0 0x0
0xffff9f8000019600 0041 00000000 0x0 0x0
0xffff9f8000019680 0041 00000000 0x0 0x0
0xffff9f8000019700 0041 00000000 0x0 0x0
0xffff9f8000019780 0041 00000000 0x0 0x0
0xffff9f8000019800 0041 00000000 0x0 0x0
0xffff9f8000019880 0041 00000000 0x0 0x0
0xffff9f8000019900 0041 00000000 0x0 0x0
0xffff9f8000019980 0041 00000000 0x0 0x0
0xffff9f8000019a00 0041 00000000 0x0 0x0
0xffff9f8000019a80 0041 00000000 0x0 0x0
0xffff9f8000019b00 0041 00000000 0x0 0x0
0xffff9f8000019b80 0041 00000000 0x0 0x0
0xffff9f8000019c00 0041 00000000 0x0 0x0
0xffff9f8000019c80 0041 00000000 0x0 0x0
0xffff9f8000019d00 0041 00000000 0x0 0x0
0xffff9f8000019d80 0041 00000000 0x0 0x0
0xffff9f8000019e00 0041 00000000 0x0 0x0
0xffff9f8000019e80 0041 00000000 0x0 0x0
0xffff9f8000019f00 0041 00000000 0x0 0x0
0xffff9f8000019f80 0041 00000000 0x0 0x0
0xffff9f800001a000 0041 00000000 0x0 0x0
0xffff9f800001a080 0041 00000000 0x0 0x0
0xffff9f800001a100 0041 00000000 0x0 0x0
0xffff9f800001a180 0041 00000000 0x0 0x0
0xffff9f800001a200 0041 00000000 0x0 0x0
0xffff9f800001a280 0041 00000000 0x0 0x0
0xffff9f800001a300 0041 00000000 0x0 0x0
0xffff9f800001a380 0041 00000000 0x0 0x0
0xffff9f800001a400 0041 00000000 0x0 0x0
0xffff9f800001a480 0041 00000000 0x0 0x0
0xffff9f800001a500 0041 00000000 0x0 0x0
0xffff9f800001a580 0041 00000000 0x0 0x0
0xffff9f800001a600 0041 00000000 0x0 0x0
0xffff9f800001a680 0041 00000000 0x0 0x0
0xffff9f800001a700 0041 00000000 0x0 0x0
0xffff9f800001a780 0041 00000000 0x0 0x0
0xffff9f800001a800 0041 00000000 0x0 0x0
0xffff9f800001a880 0041 00000000 0x0 0x0
0xffff9f800001a900 0041 00000000 0x0 0x0
0xffff9f800001a980 0041 00000000 0x0 0x0
0xffff9f800001aa00 0041 00000000 0x0 0x0
0xffff9f800001aa80 0041 00000000 0x0 0x0
0xffff9f800001ab00 0041 00000000 0x0 0x0
0xffff9f800001ab80 0041 00000000 0x0 0x0
0xffff9f800001ac00 0041 00000000 0x0 0x0
0xffff9f800001ac80 0041 00000000 0x0 0x0
0xffff9f800001ad00 0041 00000000 0x0 0x0
0xffff9f800001ad80 0041 00000000 0x0 0x0
0xffff9f800001ae00 0041 00000000 0x0 0x0
0xffff9f800001ae80 0041 00000000 0x0 0x0
0xffff9f800001af00 0041 00000000 0x0 0x0
0xffff9f800001af80 0041 00000000 0x0 0x0
0xffff9f800001b000 0041 00000000 0x0 0x0
0xffff9f800001b080 0041 00000000 0x0 0x0
0xffff9f800001b100 0041 00000000 0x0 0x0
0xffff9f800001b180 0041 00000000 0x0 0x0
0xffff9f800001b200 0041 00000000 0x0 0x0
0xffff9f800001b280 0041 00000000 0x0 0x0
0xffff9f800001b300 0041 00000000 0x0 0x0
0xffff9f800001b380 0041 00000000 0x0 0x0
0xffff9f800001b400 0041 00000000 0x0 0x0
0xffff9f800001b480 0041 00000000 0x0 0x0
0xffff9f800001b500 0041 00000000 0x0 0x0
0xffff9f800001b580 0041 00000000 0x0 0x0
0xffff9f800001b600 0041 00000000 0x0 0x0
0xffff9f800001b680 0041 00000000 0x0 0x0
0xffff9f800001b700 0041 00000000 0x0 0x0
0xffff9f800001b780 0041 00000000 0x0 0x0
0xffff9f800001b800 0041 00000000 0x0 0x0
0xffff9f800001b880 0041 00000000 0x0 0x0
0xffff9f800001b900 0041 00000000 0x0 0x0
0xffff9f800001b980 0041 00000000 0x0 0x0
0xffff9f800001ba00 0041 00000000 0x0 0x0
0xffff9f800001ba80 0001 00000000 0x0 0x0
0xffff9f800001bb00 0001 00000000 0x0 0x0
0xffff9f800001bb80 0001 00000000 0x0 0x0
0xffff9f800001bc00 0001 00000000 0x0 0x0
0xffff9f800001bc80 0001 00000000 0x0 0x0
0xffff9f800001bd00 0001 00000000 0x0 0x0
0xffff9f800001bd80 0001 00000000 0x0 0x0
0xffff9f800001be00 0001 00000000 0x0 0x0
0xffff9f800001be80 0001 00000000 0x0 0x0
0xffff9f800001bf00 0001 00000000 0x0 0x0
0xffff9f800001bf80 0001 00000000 0x0 0x0
0xffff9f800001c000 0001 00000000 0x0 0x0
0xffff9f800001c080 0001 00000000 0x0 0x0
0xffff9f800001c100 0001 00000000 0x0 0x0
0xffff9f800001c180 0001 00000000 0x0 0x0
0xffff9f800001c200 0001 00000000 0x0 0x0
0xffff9f800001c280 0001 00000000 0x0 0x0
0xffff9f800001c300 0001 00000000 0x0 0x0
0xffff9f800001c380 0001 00000000 0x0 0x0
0xffff9f800001c400 0001 00000000 0x0 0x0
0xffff9f800001c480 0001 00000000 0x0 0x0
0xffff9f800001c500 0001 00000000 0x0 0x0
0xffff9f800001c580 0001 00000000 0x0 0x0
0xffff9f800001c600 0001 00000000 0x0 0x0
0xffff9f800001c680 0001 00000000 0x0 0x0
0xffff9f800001c700 0001 00000000 0x0 0x0
0xffff9f800001c780 0001 00000000 0x0 0x0
0xffff9f800001c800 0001 00000000 0x0 0x0
0xffff9f800001c880 0001 00000000 0x0 0x0
0xffff9f800001c900 0001 00000000 0x0 0x0
0xffff9f800001c980 0001 00000000 0x0 0x0
0xffff9f800001ca00 0001 00000000 0x0 0x0
0xffff9f800001ca80 0001 00000000 0x0 0x0
0xffff9f800001cb00 0001 00000000 0x0 0x0
0xffff9f800001cb80 0001 00000000 0x0 0x0
0xffff9f800001cc00 0001 00000000 0x0 0x0
0xffff9f800001cc80 0001 00000000 0x0 0x0
0xffff9f800001cd00 0001 00000000 0x0 0x0
0xffff9f800001cd80 0001 00000000 0x0 0x0
0xffff9f800001ce00 0001 00000000 0x0 0x0
0xffff9f800001ce80 0001 00000000 0x0 0x0
0xffff9f800001cf00 0001 00000000 0x0 0x0
0xffff9f800001cf80 0001 00000000 0x0 0x0
0xffff9f800001d000 0001 00000000 0x0 0x0
0xffff9f800001d080 0001 00000000 0x0 0x0
0xffff9f800001d100 0001 00000000 0x0 0x0
0xffff9f800001d180 0001 00000000 0x0 0x0
0xffff9f800001d200 0001 00000000 0x0 0x0
0xffff9f800001d280 0001 00000000 0x0 0x0
0xffff9f800001d300 0001 00000000 0x0 0x0
0xffff9f800001d380 0001 00000000 0x0 0x0
0xffff9f800001d400 0001 00000000 0x0 0x0
0xffff9f800001d480 0001 00000000 0x0 0x0
0xffff9f800001d500 0001 00000000 0x0 0x0
0xffff9f800001d580 0001 00000000 0x0 0x0
0xffff9f800001d600 0001 00000000 0x0 0x0
0xffff9f800001d680 0001 00000000 0x0 0x0
0xffff9f800001d700 0001 00000000 0x0 0x0
0xffff9f800001d780 0001 00000000 0x0 0x0
0xffff9f800001d800 0001 00000000 0x0 0x0
0xffff9f800001d880 0001 00000000 0x0 0x0
0xffff9f800001d900 0001 00000000 0x0 0x0
0xffff9f800001d980 0001 00000000 0x0 0x0
0xffff9f800001da00 0001 00000000 0x0 0x0
0xffff9f800001da80 0001 00000000 0x0 0x0
0xffff9f800001db00 0001 00000000 0x0 0x0
0xffff9f800001db80 0001 00000000 0x0 0x0
0xffff9f800001dc00 0001 00000000 0x0 0x0
0xffff9f800001dc80 0001 00000000 0x0 0x0
0xffff9f800001dd00 0001 00000000 0x0 0x0
0xffff9f800001dd80 0001 00000000 0x0 0x0
0xffff9f800001de00 0001 00000000 0x0 0x0
0xffff9f800001de80 0001 00000000 0x0 0x0
0xffff9f800001df00 0001 00000000 0x0 0x0
0xffff9f800001df80 0001 00000000 0x0 0x0
0xffff9f800001e000 0001 00000000 0x0 0x0
0xffff9f800001e080 0001 00000000 0x0 0x0
0xffff9f800001e100 0001 00000000 0x0 0x0
0xffff9f800001e180 0001 00000000 0x0 0x0
0xffff9f800001e200 0001 00000000 0x0 0x0
0xffff9f800001e280 0001 00000000 0x0 0x0
0xffff9f800001e300 0001 00000000 0x0 0x0
0xffff9f800001e380 0001 00000000 0x0 0x0
0xffff9f800001e400 0001 00000000 0x0 0x0
0xffff9f800001e480 0001 00000000 0x0 0x0
0xffff9f800001e500 0001 00000000 0x0 0x0
0xffff9f800001e580 0001 00000000 0x0 0x0
0xffff9f800001e600 0001 00000000 0x0 0x0
0xffff9f800001e680 0001 00000000 0x0 0x0
0xffff9f800001e700 0001 00000000 0x0 0x0
0xffff9f800001e780 0001 00000000 0x0 0x0
0xffff9f800001e800 0001 00000000 0x0 0x0
0xffff9f800001e880 0001 00000000 0x0 0x0
0xffff9f800001e900 0001 00000000 0x0 0x0
0xffff9f800001e980 0001 00000000 0x0 0x0
0xffff9f800001ea00 0001 00000000 0x0 0x0
0xffff9f800001ea80 0001 00000000 0x0 0x0
0xffff9f800001eb00 0001 00000000 0x0 0x0
0xffff9f800001eb80 0001 00000000 0x0 0x0
0xffff9f800001ec00 0001 00000000 0x0 0x0
0xffff9f800001ec80 0001 00000000 0x0 0x0
0xffff9f800001ed00 0001 00000000 0x0 0x0
0xffff9f800001ed80 0001 00000000 0x0 0x0
0xffff9f800001ee00 0001 00000000 0x0 0x0
0xffff9f800001ee80 0001 00000000 0x0 0x0
0xffff9f800001ef00 0001 00000000 0x0 0x0
0xffff9f800001ef80 0001 00000000 0x0 0x0
0xffff9f800001f000 0001 00000000 0x0 0x0
0xffff9f800001f080 0001 00000000 0x0 0x0
0xffff9f800001f100 0001 00000000 0x0 0x0
0xffff9f800001f180 0001 00000000 0x0 0x0
0xffff9f800001f200 0001 00000000 0x0 0x0
0xffff9f800001f280 0001 00000000 0x0 0x0
0xffff9f800001f300 0001 00000000 0x0 0x0
0xffff9f800001f380 0001 00000000 0x0 0x0
0xffff9f800001f400 0001 00000000 0x0 0x0
0xffff9f800001f480 0001 00000000 0x0 0x0
0xffff9f800001f500 0001 00000000 0x0 0x0
0xffff9f800001f580 0001 00000000 0x0 0x0
0xffff9f800001f600 0001 00000000 0x0 0x0
0xffff9f800001f680 0001 00000000 0x0 0x0
0xffff9f800001f700 0001 00000000 0x0 0x0
0xffff9f800001f780 0001 00000000 0x0 0x0
0xffff9f800001f800 0001 00000000 0x0 0x0
0xffff9f800001f880 0001 00000000 0x0 0x0
0xffff9f800001f900 0001 00000000 0x0 0x0
0xffff9f800001f980 0001 00000000 0x0 0x0
0xffff9f800001fa00 0001 00000000 0x0 0x0
0xffff9f800001fa80 0001 00000000 0x0 0x0
0xffff9f800001fb00 0001 00000000 0x0 0x0
0xffff9f800001fb80 0001 00000000 0x0 0x0
0xffff9f800001fc00 0001 00000000 0x0 0x0
0xffff9f800001fc80 0001 00000000 0x0 0x0
0xffff9f800001fd00 0001 00000000 0x0 0x0
0xffff9f800001fd80 0001 00000000 0x0 0x0
0xffff9f800001fe00 0001 00000000 0x0 0x0
0xffff9f800001fe80 0001 00000000 0x0 0x0
0xffff9f800001ff00 0001 00000000 0x0 0x0
0xffff9f800001ff80 0001 00000000 0x0 0x0
0xffff9f8000020000 0001 00000000 0x0 0x0
0xffff9f8000020080 0001 00000000 0x0 0x0
0xffff9f8000020100 0001 00000000 0x0 0x0
0xffff9f8000020180 0001 00000000 0x0 0x0
0xffff9f8000020200 0001 00000000 0x0 0x0
0xffff9f8000020280 0001 00000000 0x0 0x0
0xffff9f8000020300 0001 00000000 0x0 0x0
0xffff9f8000020380 0001 00000000 0x0 0x0
0xffff9f8000020400 0001 00000000 0x0 0x0
0xffff9f8000020480 0001 00000000 0x0 0x0
0xffff9f8000020500 0001 00000000 0x0 0x0
0xffff9f8000020580 0001 00000000 0x0 0x0
0xffff9f8000020600 0001 00000000 0x0 0x0
0xffff9f8000020680 0001 00000000 0x0 0x0
0xffff9f8000020700 0001 00000000 0x0 0x0
0xffff9f8000020780 0001 00000000 0x0 0x0
0xffff9f8000020800 0001 00000000 0x0 0x0
0xffff9f8000020880 0001 00000000 0x0 0x0
0xffff9f8000020900 0001 00000000 0x0 0x0
0xffff9f8000020980 0001 00000000 0x0 0x0
0xffff9f8000020a00 0001 00000000 0x0 0x0
0xffff9f8000020a80 0001 00000000 0x0 0x0
0xffff9f8000020b00 0001 00000000 0x0 0x0
0xffff9f8000020b80 0001 00000000 0x0 0x0
0xffff9f8000020c00 0001 00000000 0x0 0x0
0xffff9f8000020c80 0001 00000000 0x0 0x0
0xffff9f8000020d00 0001 00000000 0x0 0x0
0xffff9f8000020d80 0001 00000000 0x0 0x0
0xffff9f8000020e00 0001 00000000 0x0 0x0
0xffff9f8000020e80 0001 00000000 0x0 0x0
0xffff9f8000020f00 0001 00000000 0x0 0x0
0xffff9f8000020f80 0001 00000000 0x0 0x0
0xffff9f8000021000 0001 00000000 0x0 0x0
0xffff9f8000021080 0001 00000000 0x0 0x0
0xffff9f8000021100 0001 00000000 0x0 0x0
0xffff9f8000021180 0001 00000000 0x0 0x0
0xffff9f8000021200 0001 00000000 0x0 0x0
0xffff9f8000021280 0001 00000000 0x0 0x0
0xffff9f8000021300 0001 00000000 0x0 0x0
0xffff9f8000021380 0001 00000000 0x0 0x0
0xffff9f8000021400 0001 00000000 0x0 0x0
0xffff9f8000021480 0001 00000000 0x0 0x0
0xffff9f8000021500 0001 00000000 0x0 0x0
0xffff9f8000021580 0001 00000000 0x0 0x0
0xffff9f8000021600 0001 00000000 0x0 0x0
0xffff9f8000021680 0001 00000000 0x0 0x0
0xffff9f8000021700 0001 00000000 0x0 0x0
0xffff9f8000021780 0001 00000000 0x0 0x0
0xffff9f8000021800 0001 00000000 0x0 0x0
0xffff9f8000021880 0001 00000000 0x0 0x0
0xffff9f8000021900 0001 00000000 0x0 0x0
0xffff9f8000021980 0001 00000000 0x0 0x0
0xffff9f8000021a00 0001 00000000 0x0 0x0
0xffff9f8000021a80 0001 00000000 0x0 0x0
0xffff9f8000021b00 0001 00000000 0x0 0x0
0xffff9f8000021b80 0001 00000000 0x0 0x0
0xffff9f8000021c00 0001 00000000 0x0 0x0
0xffff9f8000021c80 0001 00000000 0x0 0x0
0xffff9f8000021d00 0001 00000000 0x0 0x0
0xffff9f8000021d80 0001 00000000 0x0 0x0
0xffff9f8000021e00 0001 00000000 0x0 0x0
0xffff9f8000021e80 0001 00000000 0x0 0x0
0xffff9f8000021f00 0001 00000000 0x0 0x0
0xffff9f8000021f80 0001 00000000 0x0 0x0
0xffff9f8000022000 0001 00000000 0x0 0x0
0xffff9f8000022080 0001 00000000 0x0 0x0
0xffff9f8000022100 0001 00000000 0x0 0x0
0xffff9f8000022180 0001 00000000 0x0 0x0
0xffff9f8000022200 0001 00000000 0x0 0x0
0xffff9f8000022280 0001 00000000 0x0 0x0
0xffff9f8000022300 0001 00000000 0x0 0x0
0xffff9f8000022380 0001 00000000 0x0 0x0
0xffff9f8000022400 0001 00000000 0x0 0x0
0xffff9f8000022480 0001 00000000 0x0 0x0
0xffff9f8000022500 0001 00000000 0x0 0x0
0xffff9f8000022580 0001 00000000 0x0 0x0
0xffff9f8000022600 0001 00000000 0x0 0x0
0xffff9f8000022680 0001 00000000 0x0 0x0
0xffff9f8000022700 0001 00000000 0x0 0x0
0xffff9f8000022780 0001 00000000 0x0 0x0
0xffff9f8000022800 0001 00000000 0x0 0x0
0xffff9f8000022880 0001 00000000 0x0 0x0
0xffff9f8000022900 0001 00000000 0x0 0x0
0xffff9f8000022980 0001 00000000 0x0 0x0
0xffff9f8000022a00 0001 00000000 0x0 0x0
0xffff9f8000022a80 0001 00000000 0x0 0x0
0xffff9f8000022b00 0001 00000000 0x0 0x0
0xffff9f8000022b80 0001 00000000 0x0 0x0
0xffff9f8000022c00 0001 00000000 0x0 0x0
0xffff9f8000022c80 0001 00000000 0x0 0x0
0xffff9f8000022d00 0001 00000000 0x0 0x0
0xffff9f8000022d80 0001 00000000 0x0 0x0
0xffff9f8000022e00 0001 00000000 0x0 0x0
0xffff9f8000022e80 0001 00000000 0x0 0x0
0xffff9f8000022f00 0001 00000000 0x0 0x0
0xffff9f8000022f80 0001 00000000 0x0 0x0
0xffff9f8000023000 0001 00000000 0x0 0x0
0xffff9f8000023080 0001 00000000 0x0 0x0
0xffff9f8000023100 0001 00000000 0x0 0x0
0xffff9f8000023180 0001 00000000 0x0 0x0
0xffff9f8000023200 0001 00000000 0x0 0x0
0xffff9f8000023280 0001 00000000 0x0 0x0
0xffff9f8000023300 0001 00000000 0x0 0x0
0xffff9f8000023380 0001 00000000 0x0 0x0
0xffff9f8000023400 0001 00000000 0x0 0x0
0xffff9f8000023480 0001 00000000 0x0 0x0
0xffff9f8000023500 0001 00000000 0x0 0x0
0xffff9f8000023580 0001 00000000 0x0 0x0
0xffff9f8000023600 0001 00000000 0x0 0x0
0xffff9f8000023680 0001 00000000 0x0 0x0
0xffff9f8000023700 0001 00000000 0x0 0x0
0xffff9f8000023780 0001 00000000 0x0 0x0
0xffff9f8000023800 0001 00000000 0x0 0x0
0xffff9f8000023880 0001 00000000 0x0 0x0
0xffff9f8000023900 0001 00000000 0x0 0x0
0xffff9f8000023980 0001 00000000 0x0 0x0
0xffff9f8000023a00 0001 00000000 0x0 0x0
0xffff9f8000023a80 0001 00000000 0x0 0x0
0xffff9f8000023b00 0001 00000000 0x0 0x0
0xffff9f8000023b80 0001 00000000 0x0 0x0
0xffff9f8000023c00 0001 00000000 0x0 0x0
0xffff9f8000023c80 0001 00000000 0x0 0x0
0xffff9f8000023d00 0001 00000000 0x0 0x0
0xffff9f8000023d80 0001 00000000 0x0 0x0
0xffff9f8000023e00 0001 00000000 0x0 0x0
0xffff9f8000023e80 0001 00000000 0x0 0x0
0xffff9f8000023f00 0001 00000000 0x0 0x0
0xffff9f8000023f80 0001 00000000 0x0 0x0
0xffff9f8000024000 0001 00000000 0x0 0x0
0xffff9f8000024080 0001 00000000 0x0 0x0
0xffff9f8000024100 0001 00000000 0x0 0x0
0xffff9f8000024180 0001 00000000 0x0 0x0
0xffff9f8000024200 0001 00000000 0x0 0x0
0xffff9f8000024280 0001 00000000 0x0 0x0
0xffff9f8000024300 0001 00000000 0x0 0x0
0xffff9f8000024380 0001 00000000 0x0 0x0
0xffff9f8000024400 0001 00000000 0x0 0x0
0xffff9f8000024480 0001 00000000 0x0 0x0
0xffff9f8000024500 0001 00000000 0x0 0x0
0xffff9f8000024580 0001 00000000 0x0 0x0
0xffff9f8000024600 0001 00000000 0x0 0x0
0xffff9f8000024680 0001 00000000 0x0 0x0
0xffff9f8000024700 0001 00000000 0x0 0x0
0xffff9f8000024780 0001 00000000 0x0 0x0
0xffff9f8000024800 0001 00000000 0x0 0x0
0xffff9f8000024880 0001 00000000 0x0 0x0
0xffff9f8000024900 0001 00000000 0x0 0x0
0xffff9f8000024980 0001 00000000 0x0 0x0
0xffff9f8000024a00 0001 00000000 0x0 0x0
0xffff9f8000024a80 0001 00000000 0x0 0x0
0xffff9f8000024b00 0001 00000000 0x0 0x0
0xffff9f8000024b80 0001 00000000 0x0 0x0
0xffff9f8000024c00 0001 00000000 0x0 0x0
0xffff9f8000024c80 0001 00000000 0x0 0x0
0xffff9f8000024d00 0001 00000000 0x0 0x0
0xffff9f8000024d80 0001 00000000 0x0 0x0
0xffff9f8000024e00 0001 00000000 0x0 0x0
0xffff9f8000024e80 0001 00000000 0x0 0x0
0xffff9f8000024f00 0001 00000000 0x0 0x0
0xffff9f8000024f80 0001 00000000 0x0 0x0
0xffff9f8000025000 0001 00000000 0x0 0x0
0xffff9f8000025080 0001 00000000 0x0 0x0
0xffff9f8000025100 0001 00000000 0x0 0x0
0xffff9f8000025180 0001 00000000 0x0 0x0
0xffff9f8000025200 0001 00000000 0x0 0x0
0xffff9f8000025280 0001 00000000 0x0 0x0
0xffff9f8000025300 0001 00000000 0x0 0x0
0xffff9f8000025380 0001 00000000 0x0 0x0
0xffff9f8000025400 0001 00000000 0x0 0x0
0xffff9f8000025480 0001 00000000 0x0 0x0
0xffff9f8000025500 0001 00000000 0x0 0x0
0xffff9f8000025580 0001 00000000 0x0 0x0
0xffff9f8000025600 0001 00000000 0x0 0x0
0xffff9f8000025680 0001 00000000 0x0 0x0
0xffff9f8000025700 0001 00000000 0x0 0x0
0xffff9f8000025780 0001 00000000 0x0 0x0
0xffff9f8000025800 0001 00000000 0x0 0x0
0xffff9f8000025880 0001 00000000 0x0 0x0
0xffff9f8000025900 0001 00000000 0x0 0x0
0xffff9f8000025980 0001 00000000 0x0 0x0
0xffff9f8000025a00 0001 00000000 0x0 0x0
0xffff9f8000025a80 0001 00000000 0x0 0x0
0xffff9f8000025b00 0001 00000000 0x0 0x0
0xffff9f8000025b80 0001 00000000 0x0 0x0
0xffff9f8000025c00 0001 00000000 0x0 0x0
0xffff9f8000025c80 0001 00000000 0x0 0x0
0xffff9f8000025d00 0001 00000000 0x0 0x0
0xffff9f8000025d80 0001 00000000 0x0 0x0
0xffff9f8000025e00 0001 00000000 0x0 0x0
0xffff9f8000025e80 0001 00000000 0x0 0x0
0xffff9f8000025f00 0001 00000000 0x0 0x0
0xffff9f8000025f80 0001 00000000 0x0 0x0
0xffff9f8000026000 0001 00000000 0x0 0x0
0xffff9f8000026080 0001 00000000 0x0 0x0
0xffff9f8000026100 0001 00000000 0x0 0x0
0xffff9f8000026180 0001 00000000 0x0 0x0
0xffff9f8000026200 0001 00000000 0x0 0x0
0xffff9f8000026280 0001 00000000 0x0 0x0
0xffff9f8000026300 0001 00000000 0x0 0x0
0xffff9f8000026380 0001 00000000 0x0 0x0
0xffff9f8000026400 0001 00000000 0x0 0x0
0xffff9f8000026480 0001 00000000 0x0 0x0
0xffff9f8000026500 0001 00000000 0x0 0x0
0xffff9f8000026580 0001 00000000 0x0 0x0
0xffff9f8000026600 0001 00000000 0x0 0x0
0xffff9f8000026680 0001 00000000 0x0 0x0
0xffff9f8000026700 0001 00000000 0x0 0x0
0xffff9f8000026780 0001 00000000 0x0 0x0
0xffff9f8000026800 0001 00000000 0x0 0x0
0xffff9f8000026880 0001 00000000 0x0 0x0
0xffff9f8000026900 0001 00000000 0x0 0x0
0xffff9f8000026980 0001 00000000 0x0 0x0
0xffff9f8000026a00 0001 00000000 0x0 0x0
0xffff9f8000026a80 0001 00000000 0x0 0x0
0xffff9f8000026b00 0001 00000000 0x0 0x0
0xffff9f8000026b80 0001 00000000 0x0 0x0
0xffff9f8000026c00 0001 00000000 0x0 0x0
0xffff9f8000026c80 0001 00000000 0x0 0x0
0xffff9f8000026d00 0001 00000000 0x0 0x0
0xffff9f8000026d80 0001 00000000 0x0 0x0
0xffff9f8000026e00 0001 00000000 0x0 0x0
0xffff9f8000026e80 0001 00000000 0x0 0x0
0xffff9f8000026f00 0001 00000000 0x0 0x0
0xffff9f8000026f80 0001 00000000 0x0 0x0
0xffff9f8000027000 0001 00000000 0x0 0x0
0xffff9f8000027080 0001 00000000 0x0 0x0
0xffff9f8000027100 0001 00000000 0x0 0x0
0xffff9f8000027180 0001 00000000 0x0 0x0
0xffff9f8000027200 0001 00000000 0x0 0x0
0xffff9f8000027280 0001 00000000 0x0 0x0
0xffff9f8000027300 0001 00000000 0x0 0x0
0xffff9f8000027380 0001 00000000 0x0 0x0
0xffff9f8000027400 0001 00000000 0x0 0x0
0xffff9f8000027480 0001 00000000 0x0 0x0
0xffff9f8000027500 0001 00000000 0x0 0x0
0xffff9f8000027580 0001 00000000 0x0 0x0
0xffff9f8000027600 0001 00000000 0x0 0x0
0xffff9f8000027680 0001 00000000 0x0 0x0
0xffff9f8000027700 0001 00000000 0x0 0x0
0xffff9f8000027780 0001 00000000 0x0 0x0
0xffff9f8000027800 0001 00000000 0x0 0x0
0xffff9f8000027880 0001 00000000 0x0 0x0
0xffff9f8000027900 0001 00000000 0x0 0x0
0xffff9f8000027980 0001 00000000 0x0 0x0
0xffff9f8000027a00 0001 00000000 0x0 0x0
0xffff9f8000027a80 0001 00000000 0x0 0x0
0xffff9f8000027b00 0001 00000000 0x0 0x0
0xffff9f8000027b80 0001 00000000 0x0 0x0
0xffff9f8000027c00 0001 00000000 0x0 0x0
0xffff9f8000027c80 0001 00000000 0x0 0x0
0xffff9f8000027d00 0001 00000000 0x0 0x0
0xffff9f8000027d80 0001 00000000 0x0 0x0
0xffff9f8000027e00 0001 00000000 0x0 0x0
0xffff9f8000027e80 0001 00000000 0x0 0x0
0xffff9f8000027f00 0001 00000000 0x0 0x0
0xffff9f8000027f80 0001 00000000 0x0 0x0
0xffff9f8000028000 0001 00000000 0x0 0x0
0xffff9f8000028080 0001 00000000 0x0 0x0
0xffff9f8000028100 0001 00000000 0x0 0x0
0xffff9f8000028180 0001 00000000 0x0 0x0
0xffff9f8000028200 0001 00000000 0x0 0x0
0xffff9f8000028280 0001 00000000 0x0 0x0
0xffff9f8000028300 0001 00000000 0x0 0x0
0xffff9f8000028380 0001 00000000 0x0 0x0
0xffff9f8000028400 0001 00000000 0x0 0x0
0xffff9f8000028480 0001 00000000 0x0 0x0
0xffff9f8000028500 0001 00000000 0x0 0x0
0xffff9f8000028580 0001 00000000 0x0 0x0
0xffff9f8000028600 0001 00000000 0x0 0x0
0xffff9f8000028680 0001 00000000 0x0 0x0
0xffff9f8000028700 0001 00000000 0x0 0x0
0xffff9f8000028780 0001 00000000 0x0 0x0
0xffff9f8000028800 0001 00000000 0x0 0x0
0xffff9f8000028880 0001 00000000 0x0 0x0
0xffff9f8000028900 0001 00000000 0x0 0x0
0xffff9f8000028980 0001 00000000 0x0 0x0
0xffff9f8000028a00 0001 00000000 0x0 0x0
0xffff9f8000028a80 0001 00000000 0x0 0x0
0xffff9f8000028b00 0001 00000000 0x0 0x0
0xffff9f8000028b80 0001 00000000 0x0 0x0
0xffff9f8000028c00 0001 00000000 0x0 0x0
0xffff9f8000028c80 0001 00000000 0x0 0x0
0xffff9f8000028d00 0001 00000000 0x0 0x0
0xffff9f8000028d80 0001 00000000 0x0 0x0
0xffff9f8000028e00 0001 00000000 0x0 0x0
0xffff9f8000028e80 0001 00000000 0x0 0x0
0xffff9f8000028f00 0001 00000000 0x0 0x0
0xffff9f8000028f80 0001 00000000 0x0 0x0
0xffff9f8000029000 0001 00000000 0x0 0x0
0xffff9f8000029080 0001 00000000 0x0 0x0
0xffff9f8000029100 0001 00000000 0x0 0x0
0xffff9f8000029180 0001 00000000 0x0 0x0
0xffff9f8000029200 0001 00000000 0x0 0x0
0xffff9f8000029280 0001 00000000 0x0 0x0
0xffff9f8000029300 0001 00000000 0x0 0x0
0xffff9f8000029380 0001 00000000 0x0 0x0
0xffff9f8000029400 0001 00000000 0x0 0x0
0xffff9f8000029480 0001 00000000 0x0 0x0
0xffff9f8000029500 0001 00000000 0x0 0x0
0xffff9f8000029580 0001 00000000 0x0 0x0
0xffff9f8000029600 0001 00000000 0x0 0x0
0xffff9f8000029680 0001 00000000 0x0 0x0
0xffff9f8000029700 0001 00000000 0x0 0x0
0xffff9f8000029780 0001 00000000 0x0 0x0
0xffff9f8000029800 0001 00000000 0x0 0x0
0xffff9f8000029880 0001 00000000 0x0 0x0
0xffff9f8000029900 0001 00000000 0x0 0x0
0xffff9f8000029980 0001 00000000 0x0 0x0
0xffff9f8000029a00 0001 00000000 0x0 0x0
0xffff9f8000029a80 0001 00000000 0x0 0x0
0xffff9f8000029b00 0001 00000000 0x0 0x0
0xffff9f8000029b80 0001 00000000 0x0 0x0
0xffff9f8000029c00 0001 00000000 0x0 0x0
0xffff9f8000029c80 0001 00000000 0x0 0x0
0xffff9f8000029d00 0001 00000000 0x0 0x0
0xffff9f8000029d80 0001 00000000 0x0 0x0
0xffff9f8000029e00 0001 00000000 0x0 0x0
0xffff9f8000029e80 0001 00000000 0x0 0x0
0xffff9f8000029f00 0001 00000000 0x0 0x0
0xffff9f8000029f80 0001 00000000 0x0 0x0
0xffff9f800002a000 0001 00000000 0x0 0x0
0xffff9f800002a080 0001 00000000 0x0 0x0
0xffff9f800002a100 0001 00000000 0x0 0x0
0xffff9f800002a180 0001 00000000 0x0 0x0
0xffff9f800002a200 0001 00000000 0x0 0x0
0xffff9f800002a280 0001 00000000 0x0 0x0
0xffff9f800002a300 0001 00000000 0x0 0x0
0xffff9f800002a380 0001 00000000 0x0 0x0
0xffff9f800002a400 0001 00000000 0x0 0x0
0xffff9f800002a480 0001 00000000 0x0 0x0
0xffff9f800002a500 0001 00000000 0x0 0x0
0xffff9f800002a580 0001 00000000 0x0 0x0
0xffff9f800002a600 0001 00000000 0x0 0x0
0xffff9f800002a680 0001 00000000 0x0 0x0
0xffff9f800002a700 0001 00000000 0x0 0x0
0xffff9f800002a780 0001 00000000 0x0 0x0
0xffff9f800002a800 0001 00000000 0x0 0x0
0xffff9f800002a880 0001 00000000 0x0 0x0
0xffff9f800002a900 0001 00000000 0x0 0x0
0xffff9f800002a980 0001 00

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Jun 14, 2022, 1:28:22 AM6/14/22

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 498e658a25d1 Restore arm in the list of architectures supp..
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=14747df7f00000

kernel config: https://syzkaller.appspot.com/x/.config?x=fab579639ba4bf0a
dashboard link: https://syzkaller.appspot.com/bug?extid=766981eef92a3cd0352a
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16be1980080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117d94fdf00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+766981...@syzkaller.appspotmail.com

login: [ 60.5993433] panic: kernel diagnostic assertion "tp->t_oproc != NULL" failed: file "/syzkaller/managers/ci2-netbsd/kernel/sys/dev/bluetooth/btuart.c", line 243
[ 60.6093249] cpu1: Begin traceback...
[ 60.6093249] vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:293
[ 60.6293254] _sub_D_65535_0() at netbsd:_sub_D_65535_0+-0x34c4
[ 60.6593261] btuartopen() at netbsd:btuartopen+0x2ec btuartopen sys/dev/bluetooth/btuart.c:243 [inline]
[ 60.6593261] btuartopen() at netbsd:btuartopen+0x2ec sys/dev/bluetooth/btuart.c:220
[ 60.6893247] ttioctl() at netbsd:ttioctl+0x13de sys/kern/tty.c:1232
[ 60.7193315] compat_43_ttioctl() at netbsd:compat_43_ttioctl+0xb08 sys/compat/common/tty_43.c:265
[ 60.7393255] ttioctl() at netbsd:ttioctl+0xa4f sys/kern/tty.c:1441
[ 60.7693253] ptyioctl() at netbsd:ptyioctl+0x526 sys/kern/tty_pty.c:1182
[ 60.7893259] cdev_ioctl() at netbsd:cdev_ioctl+0x1e7 sys/kern/subr_devsw.c:1223
[ 60.8193279] spec_ioctl() at netbsd:spec_ioctl+0x148 sys/miscfs/specfs/spec_vnops.c:1294
[ 60.8393284] VOP_IOCTL() at netbsd:VOP_IOCTL+0x132 sys/kern/vnode_if.c:934
[ 60.8693251] vn_ioctl() at netbsd:vn_ioctl+0x1b9 sys/kern/vfs_vnops.c:865
[ 60.8893284] sys_ioctl() at netbsd:sys_ioctl+0x8f5 sys/kern/sys_generic.c:673
[ 60.9193254] sys_syscall() at netbsd:sys_syscall+0x10e sy_call sys/sys/syscallvar.h:65 [inline]
[ 60.9193254] sys_syscall() at netbsd:sys_syscall+0x10e sys/kern/sys_syscall.c:90
[ 60.9393272] syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
[ 60.9393272] syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 60.9393272] syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138
[ 60.9493274] --- syscall (number 0) ---
[ 60.9593270] netbsd:syscall+0x25a:
[ 60.9593270] cpu1: End traceback...
[ 60.9693242] fatal breakpoint trap in supervisor mode
[ 60.9693242] trap type 1 code 0 rip 0xffffffff80220a4d cs 0x8 rflags 0x282 cr2 0x74bd237eac90 ilevel 0x6 rsp 0xffff93019d953010
[ 60.9793237] curlwp 0xffff930013c35a00 pid 972.972 lowest kstack 0xffff93019d94c2c0
Stopped in pid 972.972 (syz-executor1627) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0x105 sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x282 sys/kern/subr_prf.c:293
_sub_D_65535_0() at netbsd:_sub_D_65535_0+-0x34c4
btuartopen() at netbsd:btuartopen+0x2ec btuartopen sys/dev/bluetooth/btuart.c:243 [inline]
btuartopen() at netbsd:btuartopen+0x2ec sys/dev/bluetooth/btuart.c:220
ttioctl() at netbsd:ttioctl+0x13de sys/kern/tty.c:1232
compat_43_ttioctl() at netbsd:compat_43_ttioctl+0xb08 sys/compat/common/tty_43.c:265
ttioctl() at netbsd:ttioctl+0xa4f sys/kern/tty.c:1441
ptyioctl() at netbsd:ptyioctl+0x526 sys/kern/tty_pty.c:1182
cdev_ioctl() at netbsd:cdev_ioctl+0x1e7 sys/kern/subr_devsw.c:1223
spec_ioctl() at netbsd:spec_ioctl+0x148 sys/miscfs/specfs/spec_vnops.c:1294
VOP_IOCTL() at netbsd:VOP_IOCTL+0x132 sys/kern/vnode_if.c:934
vn_ioctl() at netbsd:vn_ioctl+0x1b9 sys/kern/vfs_vnops.c:865
sys_ioctl() at netbsd:sys_ioctl+0x8f5 sys/kern/sys_generic.c:673

sys_syscall() at netbsd:sys_syscall+0x10e sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0x10e sys/kern/sys_syscall.c:90

syscall() at netbsd:syscall+0x25a sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x25a sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x25a sys/arch/x86/x86/syscall.c:138

--- syscall (number 0) ---

netbsd:syscall+0x25a:
Panic string: kernel diagnostic assertion "tp->t_oproc != NULL" failed: file "/syzkaller/managers/ci2-netbsd/kernel/sys/dev/bluetooth/btuart.c", line 243
PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1222 1222 3 0 0 ffff930013cc2600 syz-executor1627 tstile
1075 1075 3 0 0 ffff930013cc21c0 syz-executor1627 tstile
422 422 2 1 0 ffff9300134739c0 syz-executor1627
1223 1223 3 0 0 ffff930013473580 syz-executor1627 tstile
1105 1105 3 0 0 ffff930013473140 syz-executor1627 tstile
972 > 972 7 1 0 ffff930013c35a00 syz-executor1627
1224 >1224 7 0 140 ffff930013c355c0 syz-executor1627
1221 1221 3 1 180 ffff9300133b4ac0 syz-executor1627 nanoslp
1220 1220 3 1 180 ffff9300133b4240 syz-executor1627 nanoslp
1113 1113 3 0 180 ffff930012b45500 syz-executor1627 nanoslp
1128 1128 3 1 40180 ffff930012aa0080 sshd select
1064 1064 3 0 180 ffff930013390a40 getty nanoslp
1001 1001 3 1 180 ffff93001339ea80 getty nanoslp
1252 1252 3 1 180 ffff93001339e640 getty nanoslp
1115 1115 3 0 1c0 ffff930013450980 getty ttyraw
1067 1067 3 1 180 ffff930013390600 sshd select
949 949 3 0 180 ffff930012c76480 powerd kqueue
689 689 3 0 180 ffff9300133c8b00 syslogd kqueue
602 602 3 0 180 ffff930012c1b700 dhcpcd poll
547 547 3 0 180 ffff930012c82900 dhcpcd poll
464 464 3 1 180 ffff930012c4db80 dhcpcd poll
589 589 3 1 180 ffff930012c4d300 dhcpcd poll
289 289 3 0 180 ffff930012d83080 dhcpcd poll
288 288 3 0 180 ffff930012d6b8c0 dhcpcd poll
351 351 3 0 180 ffff930012d6b480 dhcpcd poll
1 1 3 0 180 ffff9300128549c0 init wait
0 971 3 0 200 ffff930012974ac0 physiod physiod
0 194 3 0 200 ffff93001298bb00 pooldrain pooldrain
0 193 3 0 200 ffff93001298b6c0 ioflush syncer
0 192 3 1 200 ffff93001298b280 pgdaemon pgdaemon
0 169 3 1 200 ffff930012974240 usb7 usbevt
0 167 3 1 200 ffff93001292ea80 usb6 usbevt
0 165 3 1 200 ffff93001292e640 usb5 usbevt
0 164 3 0 200 ffff93001292e200 usb4 usbevt
0 31 3 0 200 ffff9300128e0a40 usb3 usbevt
0 63 3 0 200 ffff9300128e0600 usb2 usbevt
0 126 3 0 200 ffff9300128e01c0 usb1 usbevt
0 125 3 1 200 ffff930012868a00 usb0 usbevt
0 124 3 1 200 ffff9300128685c0 usbtask-dr usbtsk
0 123 3 1 200 ffff9300120b66c0 usbtask-hc usbtsk
0 122 3 0 200 ffff930012868180 npfgc0 npfgcw
0 121 3 1 200 ffff930012854580 rt_free rt_free
0 120 3 1 200 ffff930012854140 unpgc unpgc
0 119 3 0 200 ffff9300126f9980 key_timehandler key_timehandler
0 118 3 1 200 ffff9300126f9540 icmp6_wqinput/1 icmp6_wqinput
0 117 3 0 200 ffff9300126f9100 icmp6_wqinput/0 icmp6_wqinput
0 116 3 0 200 ffff9300126ee940 nd6_timer nd6_timer
0 115 3 1 200 ffff9300126ee500 carp6_wqinput/1 carp6_wqinput
0 114 3 0 200 ffff9300126ee0c0 carp6_wqinput/0 carp6_wqinput
0 113 3 1 200 ffff9300126df900 carp_wqinput/1 carp_wqinput
0 112 3 0 200 ffff9300126df4c0 carp_wqinput/0 carp_wqinput
0 111 3 1 200 ffff9300126df080 icmp_wqinput/1 icmp_wqinput
0 110 3 0 200 ffff9300126cb8c0 icmp_wqinput/0 icmp_wqinput
0 109 3 0 200 ffff9300126cb480 rt_timer rt_timer
0 108 3 0 200 ffff9300126cabc0 vmem_rehash vmem_rehash
0 99 3 0 200 ffff9300120bbb40 entbutler entropy
0 98 3 0 200 ffff9300120bb700 viomb balloon
0 97 3 1 200 ffff9300120bb2c0 vioif0_txrx/1 vioif0_txrx
0 96 3 0 200 ffff9300120b6b00 vioif0_txrx/0 vioif0_txrx
0 29 3 0 200 ffff9300120b6280 scsibus0 sccomp
0 28 3 0 200 ffff930010cbaac0 pms0 pmsreset
0 27 3 1 200 ffff930010cba680 xcall/1 xcall
0 26 1 1 200 ffff930010cba240 softser/1
0 25 1 1 200 ffff930010cb9a80 softclk/1
0 24 1 1 200 ffff930010cb9640 softbio/1
0 23 1 1 200 ffff930010cb9200 softnet/1
0 22 1 1 201 ffff93000fb55a40 idle/1
0 21 3 0 200 ffff93000fb55600 lnxsyswq lnxsyswq
0 20 3 0 200 ffff93000fb551c0 lnxubdwq lnxubdwq
0 19 3 0 200 ffff93000fb54a00 lnxpwrwq lnxpwrwq
0 18 3 0 200 ffff93000fb545c0 lnxlngwq lnxlngwq
0 17 3 0 200 ffff93000fb54180 lnxhipwq lnxhipwq
0 16 3 0 200 ffff93000fb4b9c0 lnxrcugc lnxrcugc
0 15 3 0 200 ffff93000fb4b580 sysmon smtaskq
0 14 3 0 200 ffff93000fb4b140 pmfsuspend pmfsuspend
0 13 3 0 200 ffff93000fb48980 pmfevent pmfevent
0 12 3 0 200 ffff93000fb48540 sopendfree sopendfr
0 11 3 1 200 ffff93000fb48100 iflnkst iflnkst
0 10 3 0 200 ffff93000fb3c940 nfssilly nfssilly
0 9 3 0 200 ffff93000fb3c500 vdrain vdrain
0 8 3 0 200 ffff93000fb3c0c0 modunload mod_unld
0 7 3 0 200 ffff93000fb33900 xcall/0 xcall
0 6 1 0 200 ffff93000fb334c0 softser/0
0 > 5 7 0 200 ffff93000fb33080 softclk/0
0 4 1 0 200 ffff93000fb318c0 softbio/0
0 3 1 0 200 ffff93000fb31480 softnet/0
0 2 1 0 201 ffff93000fb31040 idle/0

0 0 3 0 200 ffffffff83341040 swapper uvm
[Locks tracked through LWPs]

****** LWP 422.422 (syz-executor1627) @ 0xffff9300134739c0, l_stat=2

*** Locks held:

* Lock 0 (initialized at amap_ctor)
lock address : 0xffff930012b9c640 type : sleep/adaptive
initialized : 0xffffffff81a4f3eb

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 1

relevant cpu : 1 last held: 1
relevant lwp : 0xffff9300134739c0 last held: 0xffff9300134739c0
last locked* : 0xffffffff81a5ff24 unlocked : 0xffffffff81a5d966
owner/count : 0xffff9300134739c0 flags : 0x0000000000000007
Turnstile:
=> 0 waiting readers:
=> 4 waiting writers: 0xffff930013473580 0xffff930013cc21c0 0xffff930013cc2600 0xffff930013473140

*** Locks wanted:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xffff93001347cf80 type : sleep/adaptive
initialized : 0xffffffff8094f139

shared holds : 0 exclusive: 0

shares wanted: 0 exclusive: 1

relevant cpu : 1 last held: 1
relevant lwp : 0xffff9300134739c0 last held: 000000000000000000
last locked : 0xffffffff8094ed9a unlocked*: 0xffffffff8094f001
owner field : 0xffff9300134739c0 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

****** LWP 1223.1223 (syz-executor1627) @ 0xffff930013473580, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at amap_ctor)
lock address : 0xffff930012b9c640 type : sleep/adaptive
initialized : 0xffffffff81a4f3eb

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 1

relevant cpu : 0 last held: 1
relevant lwp : 0xffff930013473580 last held: 0xffff9300134739c0
last locked* : 0xffffffff81a5ff24 unlocked : 0xffffffff81a5d966
owner/count : 0xffff9300134739c0 flags : 0x0000000000000007
Turnstile:
=> 0 waiting readers:
=> 4 waiting writers: 0xffff930013473580 0xffff930013cc21c0 0xffff930013cc2600 0xffff930013473140

****** LWP 1105.1105 (syz-executor1627) @ 0xffff930013473140, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at pmap_ctor)
lock address : 0xffff93001347cb80 type : sleep/adaptive
initialized : 0xffffffff8094f139

shared holds : 0 exclusive: 0

shares wanted: 0 exclusive: 1
relevant cpu : 0 last held: 0

relevant lwp : 0xffff930013473140 last held: 000000000000000000
last locked : 0xffffffff8094ed9a unlocked*: 0xffffffff8094f001

owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 972.972 (syz-executor1627) @ 0xffff930013c35a00, l_stat=7

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at module_hook_init)
lock address : 0xffffffff8347f940 type : sleep/adaptive
initialized : 0xffffffff81b107b1
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0

relevant cpu : 1 last held: 0

relevant lwp : 0xffff930013c35a00 last held: 000000000000000000