UBSan: Undefined Behavior in tcp_sockaddr_wrapper

4 views

Skip to first unread message

syzbot

unread,

Oct 28, 2022, 8:59:42 AM10/28/22

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 4218bdda2e25 Adjust userland commands for struct inpcb sep..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=17a8e2ea880000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=e7588d061bec77246529
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8813f5f371a8/disk-4218bdda.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/e5d1760d89e4/netbsd-4218bdda.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e7588d...@syzkaller.appspotmail.com

[ 139.4981399] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/tcp_usrreq.c:877:5, member access within null pointer of type 'struct inpcb'

[ 139.5151419] cpu0: Begin traceback...
[ 139.5481214] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 139.6481200] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 139.7281200] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 139.8081255] tcp_sockaddr_wrapper() at netbsd:tcp_sockaddr_wrapper+0x138 tcp_sockaddr sys/netinet/tcp_usrreq.c:877 [inline]
[ 139.8081255] tcp_sockaddr_wrapper() at netbsd:tcp_sockaddr_wrapper+0x138 sys/netinet/tcp_usrreq.c:2296
[ 139.8881238] do_sys_getsockname() at netbsd:do_sys_getsockname+0x16a sys/kern/uipc_syscalls.c:1398
[ 139.9681184] sys_getsockname() at netbsd:sys_getsockname+0x4a sys/kern/uipc_syscalls.c:1500
[ 140.0381199] sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 140.0381199] sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 140.1181217] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 140.1181217] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 140.1181217] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 140.1281205] --- syscall (number 32 via SYS_syscall) ---
[ 140.1581193] netbsd:syscall+0x2da:
[ 140.1581193] cpu0: End traceback...
[ 140.1581193] fatal breakpoint trap in supervisor mode
[ 140.1699522] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0x410240 ilevel 0 rsp 0xffff83824812f820
[ 140.1822740] curlwp 0xfffffcfe99e32700 pid 6716.2036 lowest kstack 0xffff83824812b2c0
Stopped in pid 6716.2036 (syz-executor.1) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
tcp_sockaddr_wrapper() at netbsd:tcp_sockaddr_wrapper+0x138 tcp_sockaddr sys/netinet/tcp_usrreq.c:877 [inline]
tcp_sockaddr_wrapper() at netbsd:tcp_sockaddr_wrapper+0x138 sys/netinet/tcp_usrreq.c:2296
do_sys_getsockname() at netbsd:do_sys_getsockname+0x16a sys/kern/uipc_syscalls.c:1398
sys_getsockname() at netbsd:sys_getsockname+0x4a sys/kern/uipc_syscalls.c:1500
sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 32 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/tcp_usrreq.c:877:5, member access within null pointer of type 'struct inpcb'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
5887 5887 2 1 0 fffffcfe9b07a280 syz-executor.2
6716 >2036 7 0 100 fffffcfe99e32700 syz-executor.1
6716 6716 2 0 10000000 fffffcfe9a4f9b00 syz-executor.1
2362 2362 2 1 140 fffffcfe92f2e5c0 syz-executor.1
2735 2735 2 0 140 fffffcfe9784da80 syz-executor.2
2761 2761 2 1 140 fffffcfe9a7a1580 syz-executor.3
1664 1664 2 1 40 fffffcfe90d57a40 syz-executor.0
4283 >4283 7 1 140 fffffcfe9a651780 syz-executor.5
1569 1569 3 0 180 fffffcfe9b058640 syz-executor.1 parked
905 905 3 0 180 fffffcfe907df740 syz-executor.5 parked
913 913 3 0 180 fffffcfe9a680680 syz-executor.2 parked
919 919 3 1 180 fffffcfe8d88c100 syz-executor.5 parked
918 918 3 0 180 fffffcfe9a651340 syz-executor.2 parked
5210 5210 3 1 180 fffffcfe9a243a40 syz-executor.5 parked
764 764 3 0 180 fffffcfe9a7a1140 syz-executor.5 parked
1230 4663 3 1 1c0 fffffcfe9b058200 syz-fuzzer wait
1230 1244 3 1 180 fffffcfe8d95c4c0 syz-fuzzer parked
1230 1202 3 0 1c0 fffffcfe8d89e040 syz-fuzzer wait
1230 1131 3 0 1c0 fffffcfe8db57940 syz-fuzzer wait
1230 941 3 0 180 fffffcfe90d57600 syz-fuzzer wait
1230 1247 3 0 180 fffffcfe90d571c0 syz-fuzzer parked
1230 1120 3 0 180 fffffcfe8db86a00 syz-fuzzer wait
1230 1239 3 0 180 fffffcfe8d89e8c0 syz-fuzzer parked
1230 815 3 0 180 fffffcfe8cb8b280 syz-fuzzer parked
1230 449 2 1 100 fffffcfe8cf1f740 syz-fuzzer
1230 1243 3 0 180 fffffcfe8cb8b6c0 syz-fuzzer parked
1230 1216 3 0 180 fffffcfe8cb8bb00 syz-fuzzer parked
1230 1236 2 1 100 fffffcfe8c88dac0 syz-fuzzer
1230 1230 3 0 180 fffffcfe8c86f200 syz-fuzzer parked
1233 1233 3 1 180 fffffcfe8db83140 sshd select
1223 1223 3 0 180 fffffcfe8d88c980 getty nanoslp
1004 1004 3 1 180 fffffcfe8db865c0 getty nanoslp
1224 1224 3 0 180 fffffcfe8db839c0 getty nanoslp
1195 1195 3 0 1c0 fffffcfe8db57500 getty ttyraw
1097 1097 3 1 180 fffffcfe8db83580 sshd select
953 953 3 1 180 fffffcfe8db86180 powerd kqueue
698 698 3 0 180 fffffcfe8d254780 syslogd kqueue
746 746 3 0 180 fffffcfe8ccd6b40 dhcpcd poll
743 743 3 0 180 fffffcfe8cf1fb80 dhcpcd poll
742 742 3 1 180 fffffcfe8d95c080 dhcpcd poll
597 597 3 0 180 fffffcfe8d254bc0 dhcpcd poll
292 292 3 0 180 fffffcfe8ccd6700 dhcpcd poll
485 485 3 0 180 fffffcfe8cf1f300 dhcpcd poll
291 291 3 0 180 fffffcfe8d254340 dhcpcd poll
1 1 3 0 180 fffffcfe84653980 init wait
0 2668 5 1 200 fffffcfe9991f8c0 (zombie)
0 4840 3 1 200 fffffcfe9a243600 ktrace ktrwait
0 673 3 0 200 fffffcfe8c86f640 physiod physiod
0 196 3 0 200 fffffcfe8c88d680 pooldrain pooldrain
0 195 3 0 200 fffffcfe8c88d240 ioflush syncer
0 194 3 1 200 fffffcfe8c86fa80 pgdaemon pgdaemon
0 170 3 0 200 fffffcfe8a7afa40 usb7 usbevt
0 169 3 0 200 fffffcfe8a7af600 usb6 usbevt
0 168 3 1 200 fffffcfe8a7af1c0 usb5 usbevt
0 167 3 1 200 fffffcfe8772aa00 usb4 usbevt
0 166 3 0 200 fffffcfe8772a5c0 usb3 usbevt
0 165 3 0 200 fffffcfe8772a180 usb2 usbevt
0 31 3 0 200 fffffcfe856fd9c0 usb1 usbevt
0 63 3 1 200 fffffcfe856fd580 usb0 usbevt
0 126 3 1 200 fffffcfe856fd140 usbtask-dr usbtsk
0 125 3 1 200 fffffcfe844e0740 usbtask-hc usbtsk
0 124 3 0 200 fffffcfe82aa1b00 swwreboot swwreboot
0 123 3 1 200 fffffcfe844e0b80 npfgc0 npfgcw
0 122 3 1 200 fffffcfe84653540 rt_free rt_free
0 121 3 1 200 fffffcfe84653100 unpgc unpgc
0 120 3 0 200 fffffcfe84646940 key_timehandler key_timehandler
0 119 3 1 200 fffffcfe84646500 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 fffffcfe846460c0 icmp6_wqinput/0 icmp6_wqinput
0 117 3 0 200 fffffcfe84631900 nd6_timer nd6_timer
0 116 3 1 200 fffffcfe846314c0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 fffffcfe84631080 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 fffffcfe846148c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 fffffcfe84614480 carp_wqinput/0 carp_wqinput
0 112 3 1 200 fffffcfe84614040 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 fffffcfe845d7bc0 icmp_wqinput/0 icmp_wqinput
0 110 2 1 200 fffffcfe845d7340 rt_timer
0 109 3 0 200 fffffcfe845d7780 vmem_rehash vmem_rehash
0 100 3 0 200 fffffcfe844e0300 entbutler entropy
0 99 3 0 200 fffffcfe83f50b40 viomb balloon
0 98 3 1 200 fffffcfe83f50700 vioif0_txrx/1 vioif0_txrx
0 97 2 0 200 fffffcfe83f502c0 vioif0_txrx/0
0 30 3 1 200 fffffcfe82aa16c0 scsibus0 sccomp
0 29 3 0 200 fffffcfe82aa1280 pms0 pmsreset
0 28 3 1 200 fffffcfe829b4ac0 xcall/1 xcall
0 27 1 1 200 fffffcfe829b4680 softser/1
0 26 1 1 200 fffffcfe829b4240 softclk/1
0 25 1 1 200 fffffcfe82987a80 softbio/1
0 24 1 1 200 fffffcfe82987640 softnet/1
0 23 1 1 201 fffffcfe82987200 idle/1
0 22 3 1 200 fffffcffb0d2da40 lnxsyswq lnxsyswq
0 21 3 1 200 fffffcffb0d2d600 lnxubdwq lnxubdwq
0 20 3 0 200 fffffcffb0d2d1c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 fffffcffb0d34a00 lnxlngwq lnxlngwq
0 18 3 1 200 fffffcffb0d345c0 lnxhipwq lnxhipwq
0 17 3 1 200 fffffcffb0d34180 lnxrcugc lnxrcugc
0 16 3 0 200 fffffcffb0d539c0 sysmon smtaskq
0 15 3 1 200 fffffcffb0d53580 pmfsuspend pmfsuspend
0 14 3 0 200 fffffcffb0d53140 pmfevent pmfevent
0 13 3 1 200 fffffcffb0d5e980 sopendfree sopendfr
0 12 3 0 200 fffffcffb0d5e540 ifwdog ifwdog
0 11 3 1 200 fffffcffb0d5e100 iflnkst iflnkst
0 10 3 1 200 fffffcffb1d93940 nfssilly nfssilly
0 9 3 0 200 fffffcffb1d93500 vdrain vdrain
0 8 3 1 200 fffffcffb1d930c0 modunload mod_unld
0 7 3 0 200 fffffcffb1dbc900 xcall/0 xcall
0 6 1 0 200 fffffcffb1dbc4c0 softser/0
0 5 3 0 200 fffffcffb1dbc080 softclk/0 tstile
0 4 1 0 200 fffffcffb1de98c0 softbio/0
0 3 1 0 200 fffffcffb1de9480 softnet/0
0 2 1 0 201 fffffcffb1de9040 idle/0
0 0 3 0 200 ffffffff8673e8c0 swapper uvm
[Locks tracked through LWPs]

****** LWP 6716.2036 (syz-executor.1) @ 0xfffffcfe99e32700, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:soinit+0x1f7 sys/kern/uipc_socket.c:459)
lock address : fffffcffb2269080
type : sleep/adaptive
initialized : netbsd:soinit+0x1f7
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffcfe99e32700 last held: 0xfffffcfe99e32700
last locked* : netbsd:do_sys_getsockname+0xa7
unlocked : netbsd:sys_shutdown+0x142
owner field : 0xfffffcfe99e32700 wait/spin: 1/0
Turnstile:
=> 0 waiting readers:
=> 1 waiting writers: 0xfffffcffb1dbc080

*** Locks wanted: none

****** LWP 1664.1664 (syz-executor.0) @ 0xfffffcfe90d57a40, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:amap_alloc1+0x30a sys/uvm/uvm_amap.c:167)
lock address : fffffcfe946282c0
type : sleep/adaptive
initialized : netbsd:amap_alloc1+0x30a
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1
relevant lwp : 0xfffffcfe90d57a40 last held: 0xfffffcfe90d57a40
last locked* : netbsd:uvm_fault_internal+0x75d
unlocked : netbsd:uvm_fault_upper_enter+0x454
owner/count : 0xfffffcfe90d57a40 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at netbsd:pmap_ctor+0x6d sys/arch/x86/x86/pmap.c:2860)
lock address : fffffcfe8daf4180
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x6d
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1
relevant cpu : 1 last held: 1
relevant lwp : 0xfffffcfe90d57a40 last held: 000000000000000000
last locked : netbsd:pmap_extract+0xdb
unlocked* : netbsd:pmap_extract+0x2c8
owner field : 0xfffffcfe90d57a40 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 1230.449 (syz-fuzzer) @ 0xfffffcfe8cf1f740, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:sched_cpuattach+0x299 sys/kern/kern_runq.c:147)
lock address : fffffcffb2269340
type : spin
initialized : netbsd:sched_cpuattach+0x299
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1
relevant cpu : 1 last held: 1
relevant lwp : 0xfffffcfe8cf1f740 last held: 000000000000000000
last locked : netbsd:preempt+0xaf
unlocked* : netbsd:mi_switch+0x112e
owner field : 0x0000000000000700 wait/spin: 0/1

****** LWP 743.743 (dhcpcd) @ 0xfffffcfe8cf1fb80, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffcfe8cf1fb80 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 742.742 (dhcpcd) @ 0xfffffcfe8d95c080, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffffcfe8d95c080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 485.485 (dhcpcd) @ 0xfffffcfe8cf1f300, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffcfe8cf1f300 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 291.291 (dhcpcd) @ 0xfffffcfe8d254340, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffcfe8d254340 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xfffffcffb0d5e100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xfffffcffb0d5e100 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xfffffcffb1dbc080, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffcffb1dbc080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff8673e8c0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff8673e8c0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at netbsd:main+0x106 sys/kern/init_main.c:303)
lock address : netbsd:kernel_lock
type : spin
initialized : netbsd:main+0x106
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffcfe99e32700 last held: 0xfffffcfe99e32700
last locked* : netbsd:tcp_sockaddr_wrapper+0x20
unlocked : netbsd:tcp_shutdown_wrapper+0xae
curcpu holds : 1 wanted by: 000000000000000000

* Lock 1 (initialized at netbsd:kprintf_init+0x72 sys/kern/subr_prf.c:155)
lock address : netbsd:kprintf_mtx
type : spin
initialized : netbsd:kprintf_init+0x72
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xfffffcfe99e32700 last held: 0xfffffcfe99e32700
last locked* : netbsd:kprintf_lock+0x50
unlocked : netbsd:kprintf_unlock+0x70
owner field : 0x0000000000000800 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffff838000007180 0045 00000000 0x0 0x0
0xffff838000007200 0045 00000000 0x0 0x0
0xffff838000007280 0045 00000000 0x0 0x0
0xffff838000007300 0045 00000000 0x0 0x0
0xffff838000007380 0045 00000000 0x0 0x0
0xffff838000007400 0045 00000000 0x0 0x0
0xffff838000007480 0045 00000000 0x0 0x0
0xffff838000007500 0045 00000000 0x0 0x0
0xffff838000007580 0045 00000000 0x0 0x0
0xffff838000007600 0045 00000000 0x0 0x0
0xffff838000007680 0045 00000000 0x0 0x0
0xffff838000007700 0041 00000000 0x0 0x0
0xffff838000007780 0041 00000000 0x0 0x0
0xffff838000007800 0041 00000000 0x0 0x0
0xffff838000007880 0041 00000000 0x0 0x0
0xffff838000007900 0045 00000000 0x0 0x0
0xffff838000007980 0041 00000000 0x0 0x0
0xffff838000007a00 0041 00000000 0x0 0x0
0xffff838000007a80 0041 00000000 0x0 0x0
0xffff838000007b00 0041 00000000 0x0 0x0
0xffff838000007b80 0041 00000000 0x0 0x0
0xffff838000007c00 0041 00000000 0x0 0x0
0xffff838000007c80 0041 00000000 0x0 0x0
0xffff838000007d00 0041 00000000 0x0 0x0
0xffff838000007d80 0041 00000000 0x0 0x0
0xffff838000007e00 0041 00000000 0x0 0x0
0xffff838000007e80 0041 00000000 0x0 0x0
0xffff838000007f00 0041 00000000 0x0 0x0
0xffff838000007f80 0041 00000000 0x0 0x0
0xffff838000008000 0041 00000000 0x0 0x0
0xffff838000008080 0041 00000000 0x0 0x0
0xffff838000008100 0041 00000000 0x0 0x0
0xffff838000008180 0041 00000000 0x0 0x0
0xffff838000008200 0041 00000000 0x0 0x0
0xffff838000008280 0041 00000000 0x0 0x0
0xffff838000008300 0041 00000000 0x0 0x0
0xffff838000008380 0041 00000000 0x0 0x0
0xffff838000008400 0041 00000000 0x0 0x0
0xffff838000008480 0041 00000000 0x0 0x0
0xffff838000008500 0041 00000000 0x0 0x0
0xffff838000008580 0041 00000000 0x0 0x0
0xffff838000008600 0045 00000000 0x0 0x0
0xffff838000008680 0041 00000000 0x0 0x0
0xffff838000008700 0041 00000000 0x0 0x0
0xffff838000008780 0041 00000000 0x0 0x0
0xffff838000008800 0045 00000000 0x0 0x0
0xffff838000008880 0041 00000000 0x0 0x0
0xffff838000008900 0041 00000000 0x0 0x0
0xffff838000008980 0041 00000000 0x0 0x0
0xffff838000008a00 0041 00000000 0x0 0x0
0xffff838000008a80 0041 00000000 0x0 0x0
0xffff838000008b00 0041 00000000 0x0 0x0
0xffff838000008b80 0041 00000000 0x0 0x0
0xffff838000008c00 0041 00000000 0x0 0x0
0xffff838000008c80 0041 00000000 0x0 0x0
0xffff838000008d00 0041 00000000 0x0 0x0
0xffff838000008d80 0041 00000000 0x0 0x0
0xffff838000008e00 0041 00000000 0x0 0x0
0xffff838000008e80 0041 00000000 0x0 0x0
0xffff838000008f00 0041 00000000 0x0 0x0
0xffff838000008f80 0041 00000000 0x0 0x0
0xffff838000009000 0041 00000000 0x0 0x0
0xffff838000009080 0045 00000000 0x0 0x0
0xffff838000009100 0041 00000000 0x0 0x0
0xffff838000009180 0041 00000000 0x0 0x0
0xffff838000009200 0041 00000000 0x0 0x0
0xffff838000009280 0041 00000000 0x0 0x0
0xffff838000009300 0041 00000000 0x0 0x0
0xffff838000009380 0041 00000000 0x0 0x0
0xffff838000009400 0041 00000000 0x0 0x0
0xffff838000009480 0041 00000000 0x0 0x0
0xffff838000009500 0041 00000000 0x0 0x0
0xffff838000009580 0041 00000000 0x0 0x0
0xffff838000009600 0041 00000000 0x0 0x0
0xffff838000009680 0041 00000000 0x0 0x0
0xffff838000009700 0041 00000000 0x0 0x0
0xffff838000009780 0041 00000000 0x0 0x0
0xffff838000009800 0041 00000000 0x0 0x0
0xffff838000009880 0041 00000000 0x0 0x0
0xffff838000009900 0041 00000000 0x0 0x0
0xffff838000009980 0041 00000000 0x0 0x0
0xffff838000009a00 0041 00000000 0x0 0x0
0xffff838000009a80 0041 00000000 0x0 0x0
0xffff838000009b00 0041 00000000 0x0 0x0
0xffff838000009b80 0041 00000000 0x0 0x0
0xffff838000009c00 0041 00000000 0x0 0x0
0xffff838000009c80 0041 00000000 0x0 0x0
0xffff838000009d00 0041 00000000 0x0 0x0
0xffff838000009d80 0041 00000000 0x0 0x0
0xffff838000009e00 0041 00000000 0x0 0x0
0xffff838000009e80 0045 00000000 0x0 0x0
0xffff838000009f00 0041 00000000 0x0 0x0
0xffff838000009f80 0041 00000000 0x0 0x0
0xffff83800000a000 0041 00000000 0x0 0x0
0xffff83800000a080 0041 00000000 0x0 0x0
0xffff83800000a100 0041 00000000 0x0 0x0
0xffff83800000a180 0041 00000000 0x0 0x0
0xffff83800000a200 0041 00000000 0x0 0x0
0xffff83800000a280 0041 00000000 0x0 0x0
0xffff83800000a300 0041 00000000 0x0 0x0
0xffff83800000a380 0041 00000000 0x0 0x0
0xffff83800000a400 0041 00000000 0x0 0x0
0xffff83800000a480 0041 00000000 0x0 0x0
0xffff83800000a500 0041 00000000 0x0 0x0
0xffff83800000a580 0041 00000000 0x0 0x0
0xffff83800000a600 0041 00000000 0x0 0x0
0xffff83800000a680 0041 00000000 0x0 0x0
0xffff83800000a700 0041 00000000 0x0 0x0
0xffff83800000a780 0041 00000000 0x0 0x0
0xffff83800000a800 0041 00000000 0x0 0x0
0xffff83800000a880 0041 00000000 0x0 0x0
0xffff83800000a900 0041 00000000 0x0 0x0
0xffff83800000a980 0041 00000000 0x0 0x0
0xffff83800000aa00 0041 00000000 0x0 0x0
0xffff83800000aa80 0041 00000000 0x0 0x0
0xffff83800000ab00 0041 00000000 0x0 0x0
0xffff83800000ab80 0041 00000000 0x0 0x0
0xffff83800000ac00 0041 00000000 0x0 0x0
0xffff83800000ac80 0041 00000000 0x0 0x0
0xffff83800000ad00 0041 00000000 0x0 0x0
0xffff83800000ad80 0041 00000000 0x0 0x0
0xffff83800000ae00 0041 00000000 0x0 0x0
0xffff83800000ae80 0041 00000000 0x0 0x0
0xffff83800000af00 0045 00000000 0x0 0x0
0xffff83800000af80 0045 00000000 0x0 0x0
0xffff83800000b000 0041 00000000 0x0 0x0
0xffff83800000b080 0041 00000000 0x0 0x0
0xffff83800000b100 0041 00000000 0x0 0x0
0xffff83800000b180 0045 00000000 0x0 0x0
0xffff83800000b200 0041 00000000 0x0 0x0
0xffff83800000b280 0045 00000000 0x0 0x0
0xffff83800000b300 0045 00000000 0x0 0x0
0xffff83800000b380 0045 00000000 0x0 0x0
0xffff83800000b400 0041 00000000 0x0 0x0
0xffff83800000b480 0041 00000000 0x0 0x0
0xffff83800000b500 0045 00000000 0x0 0x0
0xffff83800000b580 0045 00000000 0x0 0x0
0xffff83800000b600 0045 00000000 0x0 0x0
0xffff83800000b680 0045 00000000 0x0 0x0
0xffff83800000b700 0045 00000000 0x0 0x0
0xffff83800000b780 0045 00000000 0x0 0x0
0xffff83800000b800 0045 00000000 0x0 0x0
0xffff83800000b880 0041 00000000 0x0 0x0
0xffff83800000b900 0045 00000000 0x0 0x0
0xffff83800000b980 0045 00000000 0x0 0x0
0xffff83800000ba00 0045 00000000 0x0 0x0
0xffff83800000ba80 0045 00000000 0x0 0x0
0xffff83800000bb00 0045 00000000 0x0 0x0
0xffff83800000bb80 0045 00000000 0x0 0x0
0xffff83800000bc00 0045 00000000 0x0 0x0
0xffff83800000bc80 0041 00000000 0x0 0x0
0xffff83800000bd00 0045 00000000 0x0 0x0
0xffff83800000bd80 0045 00000000 0x0 0x0
0xffff83800000be00 0045 00000000 0x0 0x0
0xffff83800000be80 0045 00000000 0x0 0x0
0xffff83800000bf00 0045 00000000 0x0 0x0
0xffff83800000bf80 0045 00000000 0x0 0x0
0xffff83800000c000 0045 00000000 0x0 0x0
0xffff83800000c080 0045 00000000 0x0 0x0
0xffff83800000c100 0045 00000000 0x0 0x0
0xffff83800000c180 0045 00000000 0x0 0x0
0xffff83800000c200 0045 00000000 0x0 0x0
0xffff83800000c280 0045 00000000 0x0 0x0
0xffff83800000c300 0045 00000000 0x0 0x0
0xffff83800000c380 0045 00000000 0x0 0x0
0xffff83800000c400 0045 00000000 0x0 0x0
0xffff83800000c480 0045 00000000 0x0 0x0
0xffff83800000c500 0045 00000000 0x0 0x0
0xffff83800000c580 0045 00000000 0x0 0x0
0xffff83800000c600 0045 00000000 0x0 0x0
0xffff83800000c680 0045 00000000 0x0 0x0
0xffff83800000c700 0041 00000000 0x0 0x0
0xffff83800000c780 0041 00000000 0x0 0x0
0xffff83800000c800 0045 00000000 0x0 0x0
0xffff83800000c880 0045 00000000 0x0 0x0
0xffff83800000c900 0045 00000000 0x0 0x0
0xffff83800000c980 0045 00000000 0x0 0x0
0xffff83800000ca00 0045 00000000 0x0 0x0
0xffff83800000ca80 0045 00000000 0x0 0x0
0xffff83800000cb00 0041 00000000 0x0 0x0
0xffff83800000cb80 0041 00000000 0x0 0x0
0xffff83800000cc00 0045 00000000 0x0 0x0
0xffff83800000cc80 0045 00000000 0x0 0x0
0xffff83800000cd00 0045 00000000 0x0 0x0
0xffff83800000cd80 0041 00000000 0x0 0x0
0xffff83800000ce00 0045 00000000 0x0 0x0
0xffff83800000ce80 0041 00000000 0x0 0x0
0xffff83800000cf00 0041 00000000 0x0 0x0
0xffff83800000cf80 0041 00000000 0x0 0x0
0xffff83800000d000 0041 00000000 0x0 0x0
0xffff83800000d080 0045 00000000 0x0 0x0
0xffff83800000d100 0041 00000000 0x0 0x0
0xffff83800000d180 0041 00000000 0x0 0x0
0xffff83800000d200 0041 00000000 0x0 0x0
0xffff83800000d280 0041 00000000 0x0 0x0
0xffff83800000d300 0045 00000000 0x0 0x0
0xffff83800000d380 0041 00000000 0x0 0x0
0xffff83800000d400 0041 00000000 0x0 0x0
0xffff83800000d480 0045 00000000 0x0 0x0
0xffff83800000d500 0041 00000000 0x0 0x0
0xffff83800000d580 0041 00000000 0x0 0x0
0xffff83800000d600 0041 00000000 0x0 0x0
0xffff83800000d680 0041 00000000 0x0 0x0
0xffff83800000d700 0041 00000000 0x0 0x0
0xffff83800000d780 0045 00000000 0x0 0x0
0xffff83800000d800 0041 00000000 0x0 0x0
0xffff83800000d880 0041 00000000 0x0 0x0
0xffff83800000d900 0041 00000000 0x0 0x0
0xffff83800000d980 0041 00000000 0x0 0x0
0xffff83800000da00 0041 00000000 0x0 0x0
0xffff83800000da80 0045 00000000 0x0 0x0
0xffff83800000db00 0045 00000000 0x0 0x0
0xffff83800000db80 0045 00000000 0x0 0x0
0xffff83800000dc00 0041 00000000 0x0 0x0
0xffff83800000dc80 0041 00000000 0x0 0x0
0xffff83800000dd00 0041 00000000 0x0 0x0
0xffff83800000dd80 0041 00000000 0x0 0x0
0xffff83800000de00 0041 00000000 0x0 0x0
0xffff83800000de80 0041 00000000 0x0 0x0
0xffff83800000df00 0045 00000000 0x0 0x0
0xffff83800000df80 0045 00000000 0x0 0x0
0xffff83800000e000 0045 00000000 0x0 0x0
0xffff83800000e080 0041 00000000 0x0 0x0
0xffff83800000e100 0041 00000000 0x0 0x0
0xffff83800000e180 0045 00000000 0x0 0x0
0xffff83800000e200 0041 00000000 0x0 0x0
0xffff83800000e280 0041 00000000 0x0 0x0
0xffff83800000e300 0045 00000000 0x0 0x0
0xffff83800000e380 0041 00000000 0x0 0x0
0xffff83800000e400 0045 00000000 0x0 0x0
0xffff83800000e480 0041 00000000 0x0 0x0
0xffff83800000e500 0045 00000000 0x0 0x0
0xffff83800000e580 0041 00000000 0x0 0x0
0xffff83800000e600 0045 00000000 0x0 0x0
0xffff83800000e680 0045 00000000 0x0 0x0
0xffff83800000e700 0041 00000000 0x0 0x0
0xffff83800000e780 0041 00000000 0x0 0x0
0xffff83800000e800 0045 00000000 0x0 0x0
0xffff83800000e880 0045 00000000 0x0 0x0
0xffff83800000e900 0041 00000000 0x0 0x0
0xffff83800000e980 0041 00000000 0x0 0x0
0xffff83800000ea00 0041 00000000 0x0 0x0
0xffff83800000ea80 0041 00000000 0x0 0x0
0xffff83800000eb00 0041 00000000 0x0 0x0
0xffff83800000eb80 0045 00000000 0x0 0x0
0xffff83800000ec00 0041 00000000 0x0 0x0
0xffff83800000ec80 0041 00000000 0x0 0x0
0xffff83800000ed00 0041 00000000 0x0 0x0
0xffff83800000ed80 0041 00000000 0x0 0x0
0xffff83800000ee00 0041 00000000 0x0 0x0
0xffff83800000ee80 0045 00000000 0x0 0x0
0xffff83800000ef00 0041 00000000 0x0 0x0
0xffff83800000ef80 0041 00000000 0x0 0x0
0xffff83800000f000 0041 00000000 0x0 0x0
0xffff83800000f080 0045 00000000 0x0 0x0
0xffff83800000f100 0041 00000000 0x0 0x0
0xffff83800000f180 0041 00000000 0x0 0x0
0xffff83800000f200 0041 00000000 0x0 0x0
0xffff83800000f280 0041 00000000 0x0 0x0
0xffff83800000f300 0041 00000000 0x0 0x0
0xffff83800000f380 0041 00000000 0x0 0x0
0xffff83800000f400 0045 00000000 0x0 0x0
0xffff83800000f480 0041 00000000 0x0 0x0
0xffff83800000f500 0041 00000000 0x0 0x0
0xffff83800000f580 0041 00000000 0x0 0x0
0xffff83800000f600 0041 00000000 0x0 0x0
0xffff83800000f680 0045 00000000 0x0 0x0
0xffff83800000f700 0041 00000000 0x0 0x0
0xffff83800000f780 0041 00000000 0x0 0x0
0xffff83800000f800 0041 00000000 0x0 0x0
0xffff83800000f880 0045 00000000 0x0 0x0
0xffff83800000f900 0041 00000000 0x0 0x0
0xffff83800000f980 0045 00000000 0x0 0x0
0xffff83800000fa00 0041 00000000 0x0 0x0
0xffff83800000fa80 0041 00000000 0x0 0x0
0xffff83800000fb00 0041 00000000 0x0 0x0
0xffff83800000fb80 0041 00000000 0x0 0x0
0xffff83800000fc00 0045 00000000 0x0 0x0
0xffff83800000fc80 0041 00000000 0x0 0x0
0xffff83800000fd00 0045 00000000 0x0 0x0
0xffff83800000fd80 0041 00000000 0x0 0x0
0xffff83800000fe00 0041 00000000 0x0 0x0
0xffff83800000fe80 0041 00000000 0x0 0x0
0xffff83800000ff00 0041 00000000 0x0 0x0
0xffff83800000ff80 0041 00000000 0x0 0x0
0xffff838000010000 0041 00000000 0x0 0x0
0xffff838000010080 0041 00000000 0x0 0x0
0xffff838000010100 0041 00000000 0x0 0x0
0xffff838000010180 0045 00000000 0x0 0x0
0xffff838000010200 0045 00000000 0x0 0x0
0xffff838000010280 0041 00000000 0x0 0x0
0xffff838000010300 0041 00000000 0x0 0x0
0xffff838000010380 0041 00000000 0x0 0x0
0xffff838000010400 0041 00000000 0x0 0x0
0xffff838000010480 0045 00000000 0x0 0x0
0xffff838000010500 0045 00000000 0x0 0x0
0xffff838000010580 0041 00000000 0x0 0x0
0xffff838000010600 0041 00000000 0x0 0x0
0xffff838000010680 0041 00000000 0x0 0x0
0xffff838000010700 0041 00000000 0x0 0x0
0xffff838000010780 0041 00000000 0x0 0x0
0xffff838000010800 0041 00000000 0x0 0x0
0xffff838000010880 0041 00000000 0x0 0x0
0xffff838000010900 0041 00000000 0x0 0x0
0xffff838000010980 0045 00000000 0x0 0x0
0xffff838000010a00 0045 00000000 0x0 0x0
0xffff838000010a80 0045 00000000 0x0 0x0
0xffff838000010b00 0041 00000000 0x0 0x0
0xffff838000010b80 0041 00000000 0x0 0x0
0xffff838000010c00 0041 00000000 0x0 0x0
0xffff838000010c80 0045 00000000 0x0 0x0
0xffff838000010d00 0041 00000000 0x0 0x0
0xffff838000010d80 0041 00000000 0x0 0x0
0xffff838000010e00 0041 00000000 0x0 0x0
0xffff838000010e80 0041 00000000 0x0 0x0
0xffff838000010f00 0041 00000000 0x0 0x0
0xffff838000010f80 0041 00000000 0x0 0x0
0xffff838000011000 0041 00000000 0x0 0x0
0xffff838000011080 0041 00000000 0x0 0x0
0xffff838000011100 0041 00000000 0x0 0x0
0xffff838000011180 0041 00000000 0x0 0x0
0xffff838000011200 0045 00000000 0x0 0x0
0xffff838000011280 0045 00000000 0x0 0x0
0xffff838000011300 0041 00000000 0x0 0x0
0xffff838000011380 0041 00000000 0x0 0x0
0xffff838000011400 0041 00000000 0x0 0x0
0xffff838000011480 0041 00000000 0x0 0x0
0xffff838000011500 0045 00000000 0x0 0x0
0xffff838000011580 0041 00000000 0x0 0x0
0xffff838000011600 0041 00000000 0x0 0x0
0xffff838000011680 0041 00000000 0x0 0x0
0xffff838000011700 0045 00000000 0x0 0x0
0xffff838000011780 0045 00000000 0x0 0x0
0xffff838000011800 0041 00000000 0x0 0x0
0xffff838000011880 0041 00000000 0x0 0x0
0xffff838000011900 0041 00000000 0x0 0x0
0xffff838000011980 0041 00000000 0x0 0x0
0xffff838000011a00 0041 00000000 0x0 0x0
0xffff838000011a80 0041 00000000 0x0 0x0
0xffff838000011b00 0041 00000000 0x0 0x0
0xffff838000011b80 0041 00000000 0x0 0x0
0xffff838000011c00 0041 00000000 0x0 0x0
0xffff838000011c80 0041 00000000 0x0 0x0
0xffff838000011d00 0041 00000000 0x0 0x0
0xffff838000011d80 0041 00000000 0x0 0x0
0xffff838000011e00 0045 00000000 0x0 0x0
0xffff838000011e80 0041 00000000 0x0 0x0
0xffff838000011f00 0041 00000000 0x0 0x0
0xffff838000011f80 0041 00000000 0x0 0x0
0xffff838000012000 0041 00000000 0x0 0x0
0xffff838000012080 0041 00000000 0x0 0x0
0xffff838000012100 0045 00000000 0x0 0x0
0xffff838000012180 0045 00000000 0x0 0x0
0xffff838000012200 0041 00000000 0x0 0x0
0xffff838000012280 0041 00000000 0x0 0x0
0xffff838000012300 0041 00000000 0x0 0x0
0xffff838000012380 0041 00000000 0x0 0x0
0xffff838000012400 0041 00000000 0x0 0x0
0xffff838000012480 0041 00000000 0x0 0x0
0xffff838000012500 0041 00000000 0x0 0x0
0xffff838000012580 0041 00000000 0x0 0x0
0xffff838000012600 0041 00000000 0x0 0x0
0xffff838000012680 0045 00000000 0x0 0x0
0xffff838000012700 0041 00000000 0x0 0x0
0xffff838000012780 0041 00000000 0x0 0x0
0xffff838000012800 0041 00000000 0x0 0x0
0xffff838000012880 0045 00000000 0x0 0x0
0xffff838000012900 0001 00000000 0x0 0x0
0xffff838000012980 0001 00000000 0x0 0x0
0xffff838000012a00 0001 00000000 0x0 0x0
0xffff838000012a80 0001 00000000 0x0 0x0
0xffff838000012b00 0001 00000000 0x0 0x0
0xffff838000012b80 0001 00000000 0x0 0x0
0xffff838000012c00 0001 00000000 0x0 0x0
0xffff838000012c80 0001 00000000 0x0 0x0
0xffff838000012d00 0001 00000000 0x0 0x0
0xffff838000012d80 0001 00000000 0x0 0x0
0xffff838000012e00 0001 00000000 0x0 0x0
0xffff838000012e80 0001 00000000 0x0 0x0
0xffff838000012f00 0001 00000000 0x0 0x0
0xffff838000012f80 0001 00000000 0x0 0x0
0xffff838000013000 0001 00000000 0x0 0x0
0xffff838000013080 0001 00000000 0x0 0x0
0xffff838000013100 0001 00000000 0x0 0x0
0xffff838000013180 0001 00000000 0x0 0x0
0xffff838000013200 0001 00000000 0x0 0x0
0xffff838000013280 0001 00000000 0x0 0x0
0xffff838000013300 0001 00000000 0x0 0x0
0xffff838000013380 0001 00000000 0x0 0x0
0xffff838000013400 0001 00000000 0x0 0x0
0xffff838000013480 0001 00000000 0x0 0x0
0xffff838000013500 0001 00000000 0x0 0x0
0xffff838000013580 0001 00000000 0x0 0x0
0xffff838000013600 0001 00000000 0x0 0x0
0xffff838000013680 0001 00000000 0x0 0x0
0xffff838000013700 0001 00000000 0x0 0x0
0xffff838000013780 0001 00000000 0x0 0x0
0xffff838000013800 0001 00000000 0x0 0x0
0xffff838000013880 0001 00000000 0x0 0x0
0xffff838000013900 0001 00000000 0x0 0x0
0xffff838000013980 0001 00000000 0x0 0x0
0xffff838000013a00 0001 00000000 0x0 0x0
0xffff838000013a80 0001 00000000 0x0 0x0
0xffff838000013b00 0001 00000000 0x0 0x0
0xffff838000013b80 0001 00000000 0x0 0x0
0xffff838000013c00 0001 00000000 0x0 0x0
0xffff838000013c80 0001 00000000 0x0 0x0
0xffff838000013d00 0001 00000000 0x0 0x0
0xffff838000013d80 0001 00000000 0x0 0x0
0xffff838000013e00 0001 00000000 0x0 0x0
0xffff838000013e80 0001 00000000 0x0 0x0
0xffff838000013f00 0001 00000000 0x0 0x0
0xffff838000013f80 0001 00000000 0x0 0x0
0xffff838000014000 0001 00000000 0x0 0x0
0xffff838000014080 0001 00000000 0x0 0x0
0xffff838000014100 0001 00000000 0x0 0x0
0xffff838000014180 0001 00000000 0x0 0x0
0xffff838000014200 0001 00000000 0x0 0x0
0xffff838000014280 0001 00000000 0x0 0x0
0xffff838000014300 0001 00000000 0x0 0x0
0xffff838000014380 0001 00000000 0x0 0x0
0xffff838000014400 0041 00000000 0x0 0x0
0xffff838000014480 0041 00000000 0x0 0x0
0xffff838000014500 0041 00000000 0x0 0x0
0xffff838000014580 0041 00000000 0x0 0x0
0xffff838000014600 0041 00000000 0x0 0x0
0xffff838000014680 0041 00000000 0x0 0x0
0xffff838000014700 0041 00000000 0x0 0x0
0xffff838000014780 0041 00000000 0x0 0x0
0xffff838000014800 0041 00000000 0x0 0x0
0xffff838000014880 0041 00000000 0x0 0x0
0xffff838000014900 0041 00000000 0x0 0x0
0xffff838000014980 0041 00000000 0x0 0x0
0xffff838000014a00 0041 00000000 0x0 0x0
0xffff838000014a80 0041 00000000 0x0 0x0
0xffff838000014b00 0041 00000000 0x0 0x0
0xffff838000014b80 0041 00000000 0x0 0x0
0xffff838000014c00 0041 00000000 0x0 0x0
0xffff838000014c80 0041 00000000 0x0 0x0
0xffff838000014d00 0041 00000000 0x0 0x0
0xffff838000014d80 0041 00000000 0x0 0x0
0xffff838000014e00 0041 00000000 0x0 0x0
0xffff838000014e80 0041 00000000 0x0 0x0
0xffff838000014f00 0041 00000000 0x0 0x0
0xffff838000014f80 0041 00000000 0x0 0x0
0xffff838000015000 0041 00000000 0x0 0x0
0xffff838000015080 0041 00000000 0x0 0x0
0xffff838000015100 0041 00000000 0x0 0x0
0xffff838000015180 0041 00000000 0x0 0x0
0xffff838000015200 0041 00000000 0x0 0x0
0xffff838000015280 0041 00000000 0x0 0x0
0xffff838000015300 0041 00000000 0x0 0x0
0xffff838000015380 0041 00000000 0x0 0x0
0xffff838000015400 0041 00000000 0x0 0x0
0xffff838000015480 0041 00000000 0x0 0x0
0xffff838000015500 0041 00000000 0x0 0x0
0xffff838000015580 0041 00000000 0x0 0x0
0xffff838000015600 0041 00000000 0x0 0x0
0xffff838000015680 0041 00000000 0x0 0x0
0xffff838000015700 0041 00000000 0x0 0x0
0xffff838000015780 0041 00000000 0x0 0x0
0xffff838000015800 0041 00000000 0x0 0x0
0xffff838000015880 0041 00000000 0x0 0x0
0xffff838000015900 0041 00000000 0x0 0x0
0xffff838000015980 0041 00000000 0x0 0x0
0xffff838000015a00 0041 00000000 0x0 0x0
0xffff838000015a80 0041 00000000 0x0 0x0
0xffff838000015b00 0001 00000000 0x0 0x0
0xffff838000015b80 0001 00000000 0x0 0x0
0xffff838000015c00 0001 00000000 0x0 0x0
0xffff838000015c80 0001 00000000 0x0 0x0
0xffff838000015d00 0001 00000000 0x0 0x0
0xffff838000015d80 0001 00000000 0x0 0x0
0xffff838000015e00 0001 00000000 0x0 0x0
0xffff838000015e80 0001 00000000 0x0 0x0
0xffff838000015f00 0001 00000000 0x0 0x0
0xffff838000015f80 0001 00000000 0x0 0x0
0xffff838000016000 0001 00000000 0x0 0x0
0xffff838000016080 0001 00000000 0x0 0x0
0xffff838000016100 0001 00000000 0x0 0x0
0xffff838000016180 0001 00000000 0x0 0x0
0xffff838000016200 0001 00000000 0x0 0x0
0xffff838000016280 0001 00000000 0x0 0x0
0xffff838000016300 0001 00000000 0x0 0x0
0xffff838000016380 0001 00000000 0x0 0x0
0xffff838000016400 0001 00000000 0x0 0x0
0xffff838000016480 0001 00000000 0x0 0x0
0xffff838000016500 0001 00000000 0x0 0x0
0xffff838000016580 0001 00000000 0x0 0x0
0xffff838000016600 0001 00000000 0x0 0x0
0xffff838000016680 0001 00000000 0x0 0x0
0xffff838000016700 0001 00000000 0x0 0x0
0xffff838000016780 0001 00000000 0x0 0x0
0xffff838000016800 0001 00000000 0x0 0x0
0xffff838000016880 0001 00000000 0x0 0x0
0xffff838000016900 0001 00000000 0x0 0x0
0xffff838000016980 0001 00000000 0x0 0x0
0xffff838000016a00 0001 00000000 0x0 0x0
0xffff838000016a80 0001 00000000 0x0 0x0
0xffff838000016b00 0001 00000000 0x0 0x0
0xffff838000016b80 0001 00000000 0x0 0x0
0xffff838000016c00 0001 00000000 0x0 0x0
0xffff838000016c80 0001 00000000 0x0 0x0
0xffff838000016d00 0001 00000000 0x0 0x0
0xffff838000016d80 0001 00000000 0x0 0x0
0xffff838000016e00 0001 00000000 0x0 0x0
0xffff838000016e80 0001 00000000 0x0 0x0
0xffff838000016f00 0001 00000000 0x0 0x0
0xffff838000016f80 0001 00000000 0x0 0x0
0xffff838000017000 0001 00000000 0x0 0x0
0xffff838000017080 0001 00000000 0x0 0x0
0xffff838000017100 0001 00000000 0x0 0x0
0xffff838000017180 0001 00000000 0x0 0x0
0xffff838000017200 0001 00000000 0x0 0x0
0xffff838000017280 0001 00000000 0x0 0x0
0xffff838000017300 0001 00000000 0x0 0x0
0xffff838000017380 0001 00000000 0x0 0x0
0xffff838000017400 0001 00000000 0x0 0x0
0xffff838000017480 0001 00000000 0x0 0x0
0xffff838000017500 0001 00000000 0x0 0x0
0xffff838000017580 0001 00000000 0x0 0x0
0xffff838000017600 0041 00000000 0x0 0x0
0xffff838000017680 0041 00000000 0x0 0x0
0xffff838000017700 0041 00000000 0x0 0x0
0xffff838000017780 0041 00000000 0x0 0x0
0xffff838000017800 0041 00000000 0x0 0x0
0xffff838000017880 0041 00000000 0x0 0x0
0xffff838000017900 0041 00000000 0x0 0x0
0xffff838000017980 0041 00000000 0x0 0x0
0xffff838000017a00 0041 00000000 0x0 0x0
0xffff838000017a80 0041 00000000 0x0 0x0
0xffff838000017b00 0041 00000000 0x0 0x0
0xffff838000017b80 0041 00000000 0x0 0x0
0xffff838000017c00 0041 00000000 0x0 0x0
0xffff838000017c80 0041 00000000 0x0 0x0
0xffff838000017d00 0041 00000000 0x0 0x0
0xffff838000017d80 0041 00000000 0x0 0x0
0xffff838000017e00 0041 00000000 0x0 0x0
0xffff838000017e80 0041 00000000 0x0 0x0
0xffff838000017f00 0041 00000000 0x0 0x0
0xffff838000017f80 0041 00000000 0x0 0x0
0xffff838000018000 0041 00000000 0x0 0x0
0xffff838000018080 0041 00000000 0x0 0x0
0xffff838000018100 0041 00000000 0x0 0x0
0xffff838000018180 0041 00000000 0x0 0x0
0xffff838000018200 0041 00000000 0x0 0x0
0xffff838000018280 0041 00000000 0x0 0x0
0xffff838000018300 0041 00000000 0x0 0x0
0xffff838000018380 0041 00000000 0x0 0x0
0xffff838000018400 0041 00000000 0x0 0x0
0xffff838000018480 0041 00000000 0x0 0x0
0xffff838000018500 0041 00000000 0x0 0x0
0xffff838000018580 0041 00000000 0x0 0x0
0xffff838000018600 0041 00000000 0x0 0x0
0xffff838000018680 0041 00000000 0x0 0x0
0xffff838000018700 0041 00000000 0x0 0x0
0xffff838000018780 0041 00000000 0x0 0x0
0xffff838000018800 0041 00000000 0x0 0x0
0xffff838000018880 0041 00000000 0x0 0x0
0xffff838000018900 0041 00000000 0x0 0x0
0xffff838000018980 0041 00000000 0x0 0x0
0xffff838000018a00 0041 00000000 0x0 0x0
0xffff838000018a80 0041 00000000 0x0 0x0
0xffff838000018b00 0041 00000000 0x0 0x0
0xffff838000018b80 0041 00000000 0x0 0x0
0xffff838000018c00 0041 00000000 0x0 0x0
0xffff838000018c80 0041 00000000 0x0 0x0
0xffff838000018d00 0001 00000000 0x0 0x0
0xffff838000018d80 0001 00000000 0x0 0x0
0xffff838000018e00 0001 00000000 0x0 0x0
0xffff838000018e80 0001 00000000 0x0 0x0
0xffff838000018f00 0001 00000000 0x0 0x0
0xffff838000018f80 0001 00000000 0x0 0x0
0xffff838000019000 0001 00000000 0x0 0x0
0xffff838000019080 0001 00000000 0x0 0x0
0xffff838000019100 0001 00000000 0x0 0x0
0xffff838000019180 0001 00000000 0x0 0x0
0xffff838000019200 0001 00000000 0x0 0x0
0xffff838000019280 0001 00000000 0x0 0x0
0xffff838000019300 0001 00000000 0x0 0x0
0xffff838000019380 0001 00000000 0x0 0x0
0xffff838000019400 0001 00000000 0x0 0x0
0xffff838000019480 0001 00000000 0x0 0x0
0xffff838000019500 0001 00000000 0x0 0x0
0xffff838000019580 0001 00000000 0x0 0x0
0xffff838000019600 0001 00000000 0x0 0x0
0xffff838000019680 0001 00000000 0x0 0x0
0xffff838000019700 0001 00000000 0x0 0x0
0xffff838000019780 0001 00000000 0x0 0x0
0xffff838000019800 0001 00000000 0x0 0x0
0xffff838000019880 0001 00000000 0x0 0x0
0xffff838000019900 0001 00000000 0x0 0x0
0xffff838000019980 0001 00000000 0x0 0x0
0xffff838000019a00 0001 00000000 0x0 0x0
0xffff838000019a80 0001 00000000 0x0 0x0
0xffff838000019b00 0001 00000000 0x0 0x0
0xffff838000019b80 0001 00000000 0x0 0x0
0xffff838000019c00 0001 00000000 0x0 0x0
0xffff838000019c80 0001 00000000 0x0 0x0
0xffff838000019d00 0001 00000000 0x0 0x0
0xffff838000019d80 0001 00000000 0x0 0x0
0xffff838000019e00 0001 00000000 0x0 0x0
0xffff838000019e80 0001 00000000 0x0 0x0
0xffff838000019f00 0001 00000000 0x0 0x0
0xffff838000019f80 0001 00000000 0x0 0x0
0xffff83800001a000 0001 00000000 0x0 0x0
0xffff83800001a080 0001 00000000 0x0 0x0
0xffff83800001a100 0001 00000000 0x0 0x0
0xffff83800001a180 0001 00000000 0x0 0x0
0xffff83800001a200 0001 00000000 0x0 0x0
0xffff83800001a280 0001 00000000 0x0 0x0
0xffff83800001a300 0001 00000000 0x0 0x0
0xffff83800001a380 0001 00000000 0x0 0x0
0xffff83800001a400 0001 00000000 0x0 0x0
0xffff83800001a480 0001 00000000 0x0 0x0
0xffff83800001a500 0001 00000000 0x0 0x0
0xffff83800001a580 0001 00000000 0x0 0x0
0xffff83800001a600 0001 00000000 0x0 0x0
0xffff83800001a680 0001 00000000 0x0 0x0
0xffff83800001a700 0001 00000000 0x0 0x0
0xffff83800001a780 0001 00000000 0x0 0x0
0xffff83800001a800 0041 00000000 0x0 0x0
0xffff83800001a880 0041 00000000 0x0 0x0
0xffff83800001a900 0041 00000000 0x0 0x0
0xffff83800001a980 0041 00000000 0x0 0x0
0xffff83800001aa00 0041 00000000 0x0 0x0
0xffff83800001aa80 0041 00000000 0x0 0x0
0xffff83800001ab00 0041 00000000 0x0 0x0
0xffff83800001ab80 0041 00000000 0x0 0x0
0xffff83800001ac00 0041 00000000 0x0 0x0
0xffff83800001ac80 0041 00000000 0x0 0x0
0xffff83800001ad00 0041 00000000 0x0 0x0
0xffff83800001ad80 0041 00000000 0x0 0x0
0xffff83800001ae00 0041 00000000 0x0 0x0
0xffff83800001ae80 0041 00000000 0x0 0x0
0xffff83800001af00 0041 00000000 0x0 0x0
0xffff83800001af80 0041 00000000 0x0 0x0
0xffff83800001b000 0041 00000000 0x0 0x0
0xffff83800001b080 0041 00000000 0x0 0x0
0xffff83800001b100 0041 00000000

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Oct 28, 2022, 11:02:49 AM10/28/22

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 4218bdda2e25 Adjust userland commands for struct inpcb sep..
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=1421516e880000

kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=e7588d061bec77246529
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ddd716880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14babcea880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8813f5f371a8/disk-4218bdda.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/e5d1760d89e4/netbsd-4218bdda.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e7588d...@syzkaller.appspotmail.com

[ 47.1592479] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/tcp_usrreq.c:877:5, member access within null pointer of type 'struct inpcb'

[ 47.1592479] cpu0: Begin traceback...
[ 47.1792391] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
[ 47.2492380] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 47.2992429] HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
[ 47.3492373] tcp_sockaddr_wrapper() at netbsd:tcp_sockaddr_wrapper+0x138 tcp_sockaddr sys/netinet/tcp_usrreq.c:877 [inline]
[ 47.3492373] tcp_sockaddr_wrapper() at netbsd:tcp_sockaddr_wrapper+0x138 sys/netinet/tcp_usrreq.c:2296
[ 47.3992387] do_sys_getsockname() at netbsd:do_sys_getsockname+0x16a sys/kern/uipc_syscalls.c:1398
[ 47.4492365] sys_getsockname() at netbsd:sys_getsockname+0x4a sys/kern/uipc_syscalls.c:1500
[ 47.4992378] sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 47.4992378] sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 47.5492363] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 47.5492363] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 47.5492363] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 47.5592357] --- syscall (number 32 via SYS_syscall) ---
[ 47.5792346] netbsd:syscall+0x2da:
[ 47.5896139] cpu0: End traceback...
[ 47.5896139] fatal breakpoint trap in supervisor mode
[ 47.5896139] trap type 1 code 0 rip 0xffffffff80235375 cs 0x8 rflags 0x246 cr2 0x7b0b4e41e0d0 ilevel 0 rsp 0xffffb202483d4820
[ 47.6089855] curlwp 0xffffeb05e75e7a80 pid 1127.1127 lowest kstack 0xffffb202483d02c0
Stopped in pid 1127.1127 (syz-executor2450) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:291
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandleTypeMismatch() at netbsd:HandleTypeMismatch+0x1fb sys/../common/lib/libc/misc/ubsan.c:429
tcp_sockaddr_wrapper() at netbsd:tcp_sockaddr_wrapper+0x138 tcp_sockaddr sys/netinet/tcp_usrreq.c:877 [inline]
tcp_sockaddr_wrapper() at netbsd:tcp_sockaddr_wrapper+0x138 sys/netinet/tcp_usrreq.c:2296
do_sys_getsockname() at netbsd:do_sys_getsockname+0x16a sys/kern/uipc_syscalls.c:1398
sys_getsockname() at netbsd:sys_getsockname+0x4a sys/kern/uipc_syscalls.c:1500

sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90

syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 32 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/netinet/tcp_usrreq.c:877:5, member access within null pointer of type 'struct inpcb'

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

449 449 2 0 0 ffffeb05e6e8e680 syz-executor2450
1242 1242 2 0 0 ffffeb05e62df180 syz-executor2450
829 829 2 0 0 ffffeb05e6e8e240 syz-executor2450
1239 1239 2 0 0 ffffeb05e62df5c0 syz-executor2450
1004 1004 2 0 0 ffffeb05e6cf09c0 syz-executor2450
1127 >1127 7 0 0 ffffeb05e75e7a80 syz-executor2450
929 929 2 0 140 ffffeb05e5393b00 syz-executor2450
1238 1238 2 1 140 ffffeb05e506f200 syz-executor2450
1120 >1120 7 1 0 ffffeb05e78201c0 syz-executor2450
815 815 2 1 140 ffffeb05e75e7200 syz-executor2450
941 941 3 0 180 ffffeb05e75e7640 syz-executor2450 nanoslp
1233 1233 3 1 0 ffffeb05e5393280 sshd tstile
1222 1222 3 1 180 ffffeb05e7820a40 getty nanoslp
1184 1184 3 1 180 ffffeb05e7820600 getty nanoslp
1083 1083 3 0 180 ffffeb05e6461540 getty nanoslp
1195 1195 3 1 1c0 ffffeb05e5075ac0 getty ttyraw
1098 1098 3 1 180 ffffeb05e62dfa00 sshd select
1095 1095 3 0 180 ffffeb05e53936c0 powerd kqueue
698 698 3 0 180 ffffeb05e55d7b80 syslogd kqueue
745 745 3 0 180 ffffeb05e591c340 dhcpcd poll
742 742 3 1 180 ffffeb05e5526b40 dhcpcd poll
466 466 3 1 180 ffffeb05e62ce940 dhcpcd poll
603 603 3 1 180 ffffeb05e5f2d040 dhcpcd poll
292 292 3 0 180 ffffeb05e591c780 dhcpcd poll
485 485 3 0 180 ffffeb05e55262c0 dhcpcd poll
291 291 3 0 180 ffffeb05e5526700 dhcpcd poll
1 1 3 0 180 ffffeb05dce5b100 init wait
0 734 3 0 200 ffffeb05e506f640 physiod physiod
0 196 3 0 200 ffffeb05e5075680 pooldrain pooldrain
0 195 3 0 200 ffffeb05e5075240 ioflush syncer
0 194 3 1 200 ffffeb05e506fa80 pgdaemon pgdaemon
0 170 3 1 200 ffffeb05e2fafa40 usb7 usbevt
0 169 3 1 200 ffffeb05e2faf600 usb6 usbevt
0 168 3 1 200 ffffeb05e2faf1c0 usb5 usbevt
0 167 3 1 200 ffffeb05dff2aa00 usb4 usbevt
0 166 3 1 200 ffffeb05dff2a5c0 usb3 usbevt
0 165 3 1 200 ffffeb05dff2a180 usb2 usbevt
0 31 3 0 200 ffffeb05ddef59c0 usb1 usbevt
0 63 3 0 200 ffffeb05ddef5580 usb0 usbevt
0 126 3 1 200 ffffeb05ddef5140 usbtask-dr usbtsk
0 125 3 1 200 ffffeb05dce5b980 usbtask-hc usbtsk
0 124 3 0 200 ffffeb05db2a1b00 swwreboot swwreboot
0 123 3 1 200 ffffeb05dce5b540 npfgc0 npfgcw
0 122 3 1 200 ffffeb05dce46940 rt_free rt_free
0 121 3 1 200 ffffeb05dce46500 unpgc unpgc
0 120 2 0 200 ffffeb05dce460c0 key_timehandler
0 119 3 1 200 ffffeb05dce39900 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffeb05dce394c0 icmp6_wqinput/0 icmp6_wqinput
0 117 2 0 200 ffffeb05dce39080 nd6_timer
0 116 3 1 200 ffffeb05dce248c0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffeb05dce24480 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffeb05dce24040 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffeb05dcce0740 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffeb05dcce0b80 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffeb05dcdd7340 icmp_wqinput/0 icmp_wqinput
0 110 2 0 200 ffffeb05dcdd7bc0 rt_timer
0 109 3 0 200 ffffeb05dcdd7780 vmem_rehash vmem_rehash
0 100 3 0 200 ffffeb05dcce0300 entbutler entropy
0 99 3 1 200 ffffeb05dc750b40 viomb balloon
0 98 3 1 200 ffffeb05dc750700 vioif0_txrx/1 vioif0_txrx
0 97 2 0 200 ffffeb05dc7502c0 vioif0_txrx/0
0 30 3 1 200 ffffeb05db2a16c0 scsibus0 sccomp
0 29 3 0 200 ffffeb05db2a1280 pms0 pmsreset
0 28 3 1 200 ffffeb05db1b4ac0 xcall/1 xcall
0 27 1 1 200 ffffeb05db1b4680 softser/1
0 26 3 1 200 ffffeb05db1b4240 softclk/1 tstile
0 25 1 1 200 ffffeb05db187a80 softbio/1
0 24 1 1 200 ffffeb05db187640 softnet/1
0 23 1 1 201 ffffeb05db187200 idle/1
0 22 3 1 200 ffffeb070952da40 lnxsyswq lnxsyswq
0 21 3 1 200 ffffeb070952d600 lnxubdwq lnxubdwq
0 20 3 0 200 ffffeb070952d1c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 ffffeb0709534a00 lnxlngwq lnxlngwq
0 18 3 1 200 ffffeb07095345c0 lnxhipwq lnxhipwq
0 17 3 1 200 ffffeb0709534180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffeb07095539c0 sysmon smtaskq
0 15 3 1 200 ffffeb0709553580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffeb0709553140 pmfevent pmfevent
0 13 3 1 200 ffffeb070955e980 sopendfree sopendfr
0 12 3 0 200 ffffeb070955e540 ifwdog ifwdog
0 11 3 0 200 ffffeb070955e100 iflnkst iflnkst
0 10 3 1 200 ffffeb070a593940 nfssilly nfssilly
0 9 3 0 200 ffffeb070a593500 vdrain vdrain
0 8 3 1 200 ffffeb070a5930c0 modunload mod_unld
0 7 3 0 200 ffffeb070a5bc900 xcall/0 xcall
0 6 1 0 200 ffffeb070a5bc4c0 softser/0
0 5 3 0 200 ffffeb070a5bc080 softclk/0 tstile
0 4 1 0 200 ffffeb070a5e98c0 softbio/0
0 3 1 0 200 ffffeb070a5e9480 softnet/0
0 2 1 0 201 ffffeb070a5e9040 idle/0

0 0 3 0 200 ffffffff8673e8c0 swapper uvm
[Locks tracked through LWPs]

****** LWP 1127.1127 (syz-executor2450) @ 0xffffeb05e75e7a80, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:soinit+0x1f7 sys/kern/uipc_socket.c:459)

lock address : ffffeb070aa69080

type : sleep/adaptive
initialized : netbsd:soinit+0x1f7
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 1

relevant cpu : 0 last held: 0

relevant lwp : 0xffffeb05e75e7a80 last held: 0xffffeb05e75e7a80

last locked* : netbsd:do_sys_getsockname+0xa7
unlocked : netbsd:sys_shutdown+0x142

owner field : 0xffffeb05e75e7a80 wait/spin: 1/0

Turnstile:
=> 0 waiting readers:

=> 3 waiting writers: 0xffffeb070a5bc080 0xffffeb05db1b4240 0xffffeb05e5393280

*** Locks wanted: none

****** LWP 1120.1120 (syz-executor2450) @ 0xffffeb05e78201c0, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:uvmspace_alloc+0x339 uvm_map_setup sys/uvm/uvm_map.c:4772 [inline])
* Lock 0 (initialized at netbsd:uvmspace_alloc+0x339 uvmspace_init sys/uvm/uvm_map.c:4115 [inline])
* Lock 0 (initialized at netbsd:uvmspace_alloc+0x339 sys/uvm/uvm_map.c:4094)
lock address : ffffeb05dce70720
type : sleep/adaptive
initialized : netbsd:uvmspace_alloc+0x339

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 1

relevant lwp : 0xffffeb05e78201c0 last held: 0xffffeb05e78201c0
last locked* : netbsd:vm_map_lock+0x146
unlocked : netbsd:uvm_fault_lower_enter+0x88c
owner/count : 000000000000000000 flags : 000000000000000000

Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at netbsd:amap_alloc1+0x30a sys/uvm/uvm_amap.c:167)

lock address : ffffeb05e76941c0

type : sleep/adaptive
initialized : netbsd:amap_alloc1+0x30a

shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1

relevant cpu : 1 last held: 0
relevant lwp : 0xffffeb05e78201c0 last held: 000000000000000000
last locked : netbsd:amap_ref+0x3c
unlocked* : netbsd:uvm_mapent_clone+0x1ef
owner/count : 000000000000000000 flags : 000000000000000000

Turnstile: no active turnstile for this lock.

****** LWP 1233.1233 (sshd) @ 0xffffeb05e5393280, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:soinit+0x1f7 sys/kern/uipc_socket.c:459)

lock address : ffffeb070aa69080

type : sleep/adaptive
initialized : netbsd:soinit+0x1f7
shared holds : 0 exclusive: 1

shares wanted: 0 exclusive: 1

relevant cpu : 1 last held: 0
relevant lwp : 0xffffeb05e5393280 last held: 0xffffeb05e75e7a80

last locked* : netbsd:do_sys_getsockname+0xa7
unlocked : netbsd:sys_shutdown+0x142

owner field : 0xffffeb05e75e7a80 wait/spin: 1/0

Turnstile:
=> 0 waiting readers:

=> 3 waiting writers: 0xffffeb070a5bc080 0xffffeb05db1b4240 0xffffeb05e5393280

****** LWP 742.742 (dhcpcd) @ 0xffffeb05e5526b40, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0

relevant lwp : 0xffffeb05e5526b40 last held: 000000000000000000