page fault in tcp_recvoob_wrapper

4 views

Skip to first unread message

syzbot

unread,

Oct 28, 2022, 9:51:45 AM10/28/22

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 4218bdda2e25 Adjust userland commands for struct inpcb sep..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=125753ce880000
kernel config: https://syzkaller.appspot.com/x/.config?x=739e57438eb9ed9e
dashboard link: https://syzkaller.appspot.com/bug?extid=9cd3aa2efee7e821817f
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/006e687c98b1/disk-4218bdda.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/2959d02ecae2/netbsd-4218bdda.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9cd3aa...@syzkaller.appspotmail.com

[ 64.6158415] fatal page fault in supervisor mode
[ 64.6264018] trap type 6 code 0 rip 0xffffffff83e6c803 cs 0x8 rflags 0x10246 cr2 0x38 ilevel 0 rsp 0xffff8c00c7b2c630
[ 64.6367422] curlwp 0xffff8c0013a878c0 pid 2489.830 lowest kstack 0xffff8c00c7b252c0
kernel: page fault trap, code=0
Stopped in pid 2489.830 (syz-executor.5) at netbsd:tcp_recvoob_wrapper+0x93: movq 0(%rbx),%rax
?
tcp_recvoob_wrapper() at netbsd:tcp_recvoob_wrapper+0x93 tcp_recvoob sys/netinet/tcp_usrreq.c:937 [inline]
tcp_recvoob_wrapper() at netbsd:tcp_recvoob_wrapper+0x93 sys/netinet/tcp_usrreq.c:2296
soreceive() at netbsd:soreceive+0x99de
do_sys_recvmsg_so() at netbsd:do_sys_recvmsg_so+0xc80 sys/kern/uipc_syscalls.c:978
sys_recvmmsg() at netbsd:sys_recvmmsg+0x9da sys/kern/uipc_syscalls.c:1088
sys___syscall() at netbsd:sys___syscall+0x2c6 sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x60c sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x60c sys/arch/x86/x86/syscall.c:138
--- syscall (number 475 via SYS_syscall) ---
netbsd:syscall+0x60c:
Panic string: (null)
PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
322 322 2 0 40000 ffff8c0013691ac0 syz-executor.4
447 577 3 0 40180 ffff8c0013aa1080 syz-executor.3 parked
447 447 2 1 10040000 ffff8c00134a7580 syz-executor.3
2489 > 830 7 0 100 ffff8c0013a878c0 syz-executor.5
2489 2489 2 0 10040000 ffff8c0013691240 syz-executor.5
1464 2364 2 1 100 ffff8c0013691680 syz-executor.0
1464 >1464 7 1 10040000 ffff8c00133d1540 syz-executor.0
2736 2487 3 1 40180 ffff8c001380e780 syz-executor.2 parked
2736 2100 3 0 180 ffff8c001380ebc0 syz-executor.2 parked
2736 2736 2 1 10040000 ffff8c001362ca80 syz-executor.2
2227 2227 3 0 180 ffff8c0013a87480 syz-executor.2 parked
1232 1232 3 1 180 ffff8c0013a87040 syz-executor.2 parked
2106 2106 3 0 180 ffff8c0013581a40 syz-executor.2 parked
1972 1972 2 1 140 ffff8c0013746280 syz-executor.1
1998 1998 2 1 40 ffff8c001362c200 syz-executor.4
2025 2025 3 1 180 ffff8c001375eb40 syz-executor.2 parked
1841 1841 2 0 140 ffff8c001375e2c0 syz-executor.3
971 971 3 1 180 ffff8c0013746b00 syz-executor.2 parked
844 844 3 0 180 ffff8c001362c640 syz-executor.2 parked
1364 1364 2 0 140 ffff8c00137466c0 syz-executor.0
1741 1741 2 0 140 ffff8c00134c5180 syz-executor.2
1240 1240 2 0 140 ffff8c00134c5a00 syz-executor.5
1080 294 3 1 180 ffff8c0013805740 syz-fuzzer parked
1080 1205 3 1 1c0 ffff8c0013581600 syz-fuzzer wait
1080 1383 3 1 1c0 ffff8c00135811c0 syz-fuzzer parked
1080 941 3 1 180 ffff8c00134c55c0 syz-fuzzer wait
1080 829 3 1 180 ffff8c00134a79c0 syz-fuzzer wait
1080 1128 3 0 1c0 ffff8c00134a7140 syz-fuzzer wait
1080 942 3 1 180 ffff8c00133d1100 syz-fuzzer wait
1080 1113 3 1 180 ffff8c0012c2c500 syz-fuzzer kqueue
1080 1120 3 0 180 ffff8c0012c2c0c0 syz-fuzzer parked
1080 449 3 0 180 ffff8c0012b86900 syz-fuzzer wait
1080 1132 3 1 180 ffff8c0012b864c0 syz-fuzzer parked
1080 1224 3 1 180 ffff8c0012b86080 syz-fuzzer parked
1080 1233 3 1 180 ffff8c00125cc780 syz-fuzzer parked
1080 1080 3 1 180 ffff8c00123742c0 syz-fuzzer parked
1237 1237 3 1 180 ffff8c00122de6c0 sshd select
1222 1222 3 0 180 ffff8c00122deb00 getty nanoslp
1184 1184 3 1 180 ffff8c00122de280 getty nanoslp
1216 1216 3 1 180 ffff8c00121deac0 getty nanoslp
1193 1193 3 0 1c0 ffff8c00121db200 getty ttyraw
1098 1098 3 1 180 ffff8c0012502300 sshd select
1095 1095 3 1 180 ffff8c0012b5b8c0 powerd kqueue
702 702 3 0 180 ffff8c0012b5b480 syslogd kqueue
746 746 3 1 180 ffff8c0012b5b040 dhcpcd poll
747 747 3 0 180 ffff8c0012502740 dhcpcd poll
742 742 3 1 180 ffff8c00125ccbc0 dhcpcd poll
598 598 3 1 180 ffff8c0012374700 dhcpcd poll
292 292 3 0 180 ffff8c00125cc340 dhcpcd poll
485 485 3 0 180 ffff8c0012374b40 dhcpcd poll
291 291 3 0 180 ffff8c0012502b80 dhcpcd poll
1 1 3 1 180 ffff8c0011ece100 init wait
0 386 3 0 200 ffff8c0013805b80 ktrace ktrwait
0 2103 3 1 200 ffff8c0012c2c940 ktrace ktrwait
0 1884 5 1 200 ffff8c001380e340 (zombie)
0 1498 3 1 200 ffff8c001375e700 ktrace ktrwait
0 734 3 0 200 ffff8c00121db640 physiod physiod
0 196 3 0 200 ffff8c00121de680 pooldrain pooldrain
0 195 2 0 240 ffff8c00121de240 ioflush
0 194 3 1 200 ffff8c00121dba80 pgdaemon pgdaemon
0 167 3 1 200 ffff8c001214ba40 usb7 usbevt
0 172 3 1 200 ffff8c001214b600 usb6 usbevt
0 170 3 1 200 ffff8c001214b1c0 usb5 usbevt
0 168 3 1 200 ffff8c001211ba00 usb4 usbevt
0 166 3 1 200 ffff8c001211b5c0 usb3 usbevt
0 165 3 1 200 ffff8c001211b180 usb2 usbevt
0 31 3 1 200 ffff8c00120769c0 usb1 usbevt
0 63 3 0 200 ffff8c0012076580 usb0 usbevt
0 126 3 1 200 ffff8c0012076140 usbtask-dr usbtsk
0 125 3 1 200 ffff8c0011ece980 usbtask-hc usbtsk
0 124 3 0 200 ffff8c00103f5b00 swwreboot swwreboot
0 123 3 1 200 ffff8c0011ece540 npfgc0 npfgcw
0 122 3 1 200 ffff8c0011ec1940 rt_free rt_free
0 121 3 1 200 ffff8c0011ec1500 unpgc unpgc
0 120 3 0 200 ffff8c0011ec10c0 key_timehandler key_timehandler
0 119 3 1 200 ffff8c0011ebc900 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffff8c0011ebc4c0 icmp6_wqinput/0 icmp6_wqinput
0 117 3 0 200 ffff8c0011ebc080 nd6_timer nd6_timer
0 116 3 1 200 ffff8c0011ce0bc0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffff8c0011ce0780 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffff8c0011ce0340 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffff8c0011e9b8c0 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffff8c0011e9b480 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffff8c0011cddb80 icmp_wqinput/0 icmp_wqinput
0 110 3 0 200 ffff8c0011cdd740 rt_timer rt_timer
0 109 3 0 200 ffff8c0011e9b040 vmem_rehash vmem_rehash
0 100 3 0 200 ffff8c0011cdd300 entbutler entropy
0 99 3 1 200 ffff8c00117e0b40 viomb balloon
0 98 3 1 200 ffff8c00117e0700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffff8c00117e02c0 vioif0_txrx/0 vioif0_txrx
0 30 3 0 200 ffff8c00103f56c0 scsibus0 sccomp
0 29 3 0 200 ffff8c00103f5280 pms0 pmsreset
0 28 3 1 200 ffff8c00103daac0 xcall/1 xcall
0 27 1 1 200 ffff8c00103da680 softser/1
0 26 1 1 200 ffff8c00103da240 softclk/1
0 25 1 1 200 ffff8c00103d8a80 softbio/1
0 24 1 1 200 ffff8c00103d8640 softnet/1
0 23 1 1 201 ffff8c00103d8200 idle/1
0 22 3 0 200 ffff8c000f1f4a40 lnxsyswq lnxsyswq
0 21 3 0 200 ffff8c000f1f4600 lnxubdwq lnxubdwq
0 20 3 0 200 ffff8c000f1f41c0 lnxpwrwq lnxpwrwq
0 19 3 0 200 ffff8c000f1f2a00 lnxlngwq lnxlngwq
0 18 3 0 200 ffff8c000f1f25c0 lnxhipwq lnxhipwq
0 17 3 0 200 ffff8c000f1f2180 lnxrcugc lnxrcugc
0 16 3 0 200 ffff8c000f1ec9c0 sysmon smtaskq
0 15 3 1 200 ffff8c000f1ec580 pmfsuspend pmfsuspend
0 14 3 0 200 ffff8c000f1ec140 pmfevent pmfevent
0 13 3 0 200 ffff8c000f1e9980 sopendfree sopendfr
0 12 3 0 200 ffff8c000f1e9540 ifwdog ifwdog
0 11 3 0 200 ffff8c000f1e9100 iflnkst iflnkst
0 10 3 0 200 ffff8c000f1df940 nfssilly nfssilly
0 9 3 0 200 ffff8c000f1df500 vdrain vdrain
0 8 3 1 200 ffff8c000f1df0c0 modunload mod_unld
0 7 3 0 200 ffff8c000ebdb900 xcall/0 xcall
0 6 1 0 200 ffff8c000ebdb4c0 softser/0
0 5 1 0 200 ffff8c000ebdb080 softclk/0
0 4 1 0 200 ffff8c000ebd98c0 softbio/0
0 3 1 0 200 ffff8c000ebd9480 softnet/0
0 2 1 0 201 ffff8c000ebd9040 idle/0
0 0 3 0 200 ffffffff86869180 swapper uvm
[Locks tracked through LWPs]

****** LWP 2489.830 (syz-executor.5) @ 0xffff8c0013a878c0, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:soinit+0x4c2 sys/kern/uipc_socket.c:459)
lock address : ffff8c000ebc0080
type : sleep/adaptive
initialized : netbsd:soinit+0x4c2
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8c0013a878c0 last held: 0xffff8c0013a878c0
last locked* : netbsd:soreceive+0x988b
unlocked : netbsd:pffasttimo+0x135
owner field : 0xffff8c0013a878c0 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1464.1464 (syz-executor.0) @ 0xffff8c00133d1540, l_stat=7

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:sched_cpuattach+0xf9 sys/kern/kern_runq.c:147)
lock address : ffff8c000ebc0340
type : spin
initialized : netbsd:sched_cpuattach+0xf9
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1
relevant cpu : 1 last held: 1
relevant lwp : 0xffff8c00133d1540 last held: 000000000000000000
last locked : ffffffff851f9821
unlocked* : netbsd:lwp_unpark+0x543
owner field : 0x0000000000010700 wait/spin: 0/1

****** LWP 1998.1998 (syz-executor.4) @ 0xffff8c001362c200, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:procinit+0x85 sys/kern/kern_proc.c:386)
lock address : netbsd:proc_lock
type : sleep/adaptive
initialized : netbsd:procinit+0x85
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1
relevant cpu : 1 last held: 0
relevant lwp : 0xffff8c001362c200 last held: 000000000000000000
last locked : netbsd:do_sys_waitid+0x213
unlocked* : netbsd:do_sys_waitid+0x3c7
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 747.747 (dhcpcd) @ 0xffff8c0012502740, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x43
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8c0012502740 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 742.742 (dhcpcd) @ 0xffff8c00125ccbc0, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x43
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffff8c00125ccbc0 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 485.485 (dhcpcd) @ 0xffff8c0012374b40, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x43
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8c0012374b40 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 291.291 (dhcpcd) @ 0xffff8c0012502b80, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x43
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8c0012502b80 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffff8c000f1e9100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x43
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8c000f1e9100 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffff8c000ebdb080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x43
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8c000ebdb080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff86869180, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x43
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff86869180 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at netbsd:main+0x354 sys/kern/init_main.c:303)
lock address : netbsd:kernel_lock
type : spin
initialized : netbsd:main+0x354
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffff8c0013a878c0 last held: 0xffff8c0013a878c0
last locked* : netbsd:tcp_recvoob_wrapper+0x6d
unlocked : netbsd:frag6_fasttimo+0x326
curcpu holds : 1 wanted by: 000000000000000000

PAGE FLAG PQ UOBJECT UANON
0xffff8c0000017180 0001 00000000 0x0 0x0
0xffff8c0000017200 0041 00000000 0x0 0x0
0xffff8c0000017280 0041 00000000 0x0 0x0
0xffff8c0000017300 0041 00000000 0x0 0x0
0xffff8c0000017380 0041 00000000 0x0 0x0
0xffff8c0000017400 0041 00000000 0x0 0x0
0xffff8c0000017480 0041 00000000 0x0 0x0
0xffff8c0000017500 0041 00000000 0x0 0x0
0xffff8c0000017580 0041 00000000 0x0 0x0
0xffff8c0000017600 0041 00000000 0x0 0x0
0xffff8c0000017680 0041 00000000 0x0 0x0
0xffff8c0000017700 0041 00000000 0x0 0x0
0xffff8c0000017780 0041 00000000 0x0 0x0
0xffff8c0000017800 0041 00000000 0x0 0x0
0xffff8c0000017880 0041 00000000 0x0 0x0
0xffff8c0000017900 0041 00000000 0x0 0x0
0xffff8c0000017980 0041 00000000 0x0 0x0
0xffff8c0000017a00 0041 00000000 0x0 0x0
0xffff8c0000017a80 0041 00000000 0x0 0x0
0xffff8c0000017b00 0041 00000000 0x0 0x0
0xffff8c0000017b80 0041 00000000 0x0 0x0
0xffff8c0000017c00 0041 00000000 0x0 0x0
0xffff8c0000017c80 0041 00000000 0x0 0x0
0xffff8c0000017d00 0041 00000000 0x0 0x0
0xffff8c0000017d80 0041 00000000 0x0 0x0
0xffff8c0000017e00 0041 00000000 0x0 0x0
0xffff8c0000017e80 0041 00000000 0x0 0x0
0xffff8c0000017f00 0041 00000000 0x0 0x0
0xffff8c0000017f80 0041 00000000 0x0 0x0
0xffff8c0000018000 0041 00000000 0x0 0x0
0xffff8c0000018080 0041 00000000 0x0 0x0
0xffff8c0000018100 0041 00000000 0x0 0x0
0xffff8c0000018180 0041 00000000 0x0 0x0
0xffff8c0000018200 0041 00000000 0x0 0x0
0xffff8c0000018280 0041 00000000 0x0 0x0
0xffff8c0000018300 0041 00000000 0x0 0x0
0xffff8c0000018380 0041 00000000 0x0 0x0
0xffff8c0000018400 0041 00000000 0x0 0x0
0xffff8c0000018480 0041 00000000 0x0 0x0
0xffff8c0000018500 0041 00000000 0x0 0x0
0xffff8c0000018580 0041 00000000 0x0 0x0
0xffff8c0000018600 0041 00000000 0x0 0x0
0xffff8c0000018680 0041 00000000 0x0 0x0
0xffff8c0000018700 0041 00000000 0x0 0x0
0xffff8c0000018780 0041 00000000 0x0 0x0
0xffff8c0000018800 0041 00000000 0x0 0x0
0xffff8c0000018880 0041 00000000 0x0 0x0
0xffff8c0000018900 0041 00000000 0x0 0x0
0xffff8c0000018980 0041 00000000 0x0 0x0
0xffff8c0000018a00 0041 00000000 0x0 0x0
0xffff8c0000018a80 0041 00000000 0x0 0x0
0xffff8c0000018b00 0041 00000000 0x0 0x0
0xffff8c0000018b80 0041 00000000 0x0 0x0
0xffff8c0000018c00 0041 00000000 0x0 0x0
0xffff8c0000018c80 0041 00000000 0x0 0x0
0xffff8c0000018d00 0041 00000000 0x0 0x0
0xffff8c0000018d80 0041 00000000 0x0 0x0
0xffff8c0000018e00 0041 00000000 0x0 0x0
0xffff8c0000018e80 0041 00000000 0x0 0x0
0xffff8c0000018f00 0041 00000000 0x0 0x0
0xffff8c0000018f80 0041 00000000 0x0 0x0
0xffff8c0000019000 0041 00000000 0x0 0x0
0xffff8c0000019080 0041 00000000 0x0 0x0
0xffff8c0000019100 0041 00000000 0x0 0x0
0xffff8c0000019180 0041 00000000 0x0 0x0
0xffff8c0000019200 0041 00000000 0x0 0x0
0xffff8c0000019280 0041 00000000 0x0 0x0
0xffff8c0000019300 0041 00000000 0x0 0x0
0xffff8c0000019380 0041 00000000 0x0 0x0
0xffff8c0000019400 0041 00000000 0x0 0x0
0xffff8c0000019480 0041 00000000 0x0 0x0
0xffff8c0000019500 0041 00000000 0x0 0x0
0xffff8c0000019580 0041 00000000 0x0 0x0
0xffff8c0000019600 0041 00000000 0x0 0x0
0xffff8c0000019680 0041 00000000 0x0 0x0
0xffff8c0000019700 0041 00000000 0x0 0x0
0xffff8c0000019780 0041 00000000 0x0 0x0
0xffff8c0000019800 0041 00000000 0x0 0x0
0xffff8c0000019880 0041 00000000 0x0 0x0
0xffff8c0000019900 0041 00000000 0x0 0x0
0xffff8c0000019980 0041 00000000 0x0 0x0
0xffff8c0000019a00 0041 00000000 0x0 0x0
0xffff8c0000019a80 0041 00000000 0x0 0x0
0xffff8c0000019b00 0041 00000000 0x0 0x0
0xffff8c0000019b80 0041 00000000 0x0 0x0
0xffff8c0000019c00 0041 00000000 0x0 0x0
0xffff8c0000019c80 0041 00000000 0x0 0x0
0xffff8c0000019d00 0041 00000000 0x0 0x0
0xffff8c0000019d80 0041 00000000 0x0 0x0
0xffff8c0000019e00 0041 00000000 0x0 0x0
0xffff8c0000019e80 0041 00000000 0x0 0x0
0xffff8c0000019f00 0041 00000000 0x0 0x0
0xffff8c0000019f80 0041 00000000 0x0 0x0
0xffff8c000001a000 0041 00000000 0x0 0x0
0xffff8c000001a080 0041 00000000 0x0 0x0
0xffff8c000001a100 0041 00000000 0x0 0x0
0xffff8c000001a180 0041 00000000 0x0 0x0
0xffff8c000001a200 0041 00000000 0x0 0x0
0xffff8c000001a280 0041 00000000 0x0 0x0
0xffff8c000001a300 0041 00000000 0x0 0x0
0xffff8c000001a380 0041 00000000 0x0 0x0
0xffff8c000001a400 0041 00000000 0x0 0x0
0xffff8c000001a480 0041 00000000 0x0 0x0
0xffff8c000001a500 0041 00000000 0x0 0x0
0xffff8c000001a580 0041 00000000 0x0 0x0
0xffff8c000001a600 0041 00000000 0x0 0x0
0xffff8c000001a680 0041 00000000 0x0 0x0
0xffff8c000001a700 0041 00000000 0x0 0x0
0xffff8c000001a780 0041 00000000 0x0 0x0
0xffff8c000001a800 0041 00000000 0x0 0x0
0xffff8c000001a880 0041 00000000 0x0 0x0
0xffff8c000001a900 0041 00000000 0x0 0x0
0xffff8c000001a980 0041 00000000 0x0 0x0
0xffff8c000001aa00 0041 00000000 0x0 0x0
0xffff8c000001aa80 0041 00000000 0x0 0x0
0xffff8c000001ab00 0041 00000000 0x0 0x0
0xffff8c000001ab80 0041 00000000 0x0 0x0
0xffff8c000001ac00 0041 00000000 0x0 0x0
0xffff8c000001ac80 0041 00000000 0x0 0x0
0xffff8c000001ad00 0041 00000000 0x0 0x0
0xffff8c000001ad80 0041 00000000 0x0 0x0
0xffff8c000001ae00 0041 00000000 0x0 0x0
0xffff8c000001ae80 0041 00000000 0x0 0x0
0xffff8c000001af00 0041 00000000 0x0 0x0
0xffff8c000001af80 0041 00000000 0x0 0x0
0xffff8c000001b000 0041 00000000 0x0 0x0
0xffff8c000001b080 0041 00000000 0x0 0x0
0xffff8c000001b100 0041 00000000 0x0 0x0
0xffff8c000001b180 0041 00000000 0x0 0x0
0xffff8c000001b200 0041 00000000 0x0 0x0
0xffff8c000001b280 0041 00000000 0x0 0x0
0xffff8c000001b300 0041 00000000 0x0 0x0
0xffff8c000001b380 0041 00000000 0x0 0x0
0xffff8c000001b400 0041 00000000 0x0 0x0
0xffff8c000001b480 0041 00000000 0x0 0x0
0xffff8c000001b500 0041 00000000 0x0 0x0
0xffff8c000001b580 0041 00000000 0x0 0x0
0xffff8c000001b600 0041 00000000 0x0 0x0
0xffff8c000001b680 0041 00000000 0x0 0x0
0xffff8c000001b700 0041 00000000 0x0 0x0
0xffff8c000001b780 0041 00000000 0x0 0x0
0xffff8c000001b800 0041 00000000 0x0 0x0
0xffff8c000001b880 0041 00000000 0x0 0x0
0xffff8c000001b900 0041 00000000 0x0 0x0
0xffff8c000001b980 0041 00000000 0x0 0x0
0xffff8c000001ba00 0041 00000000 0x0 0x0
0xffff8c000001ba80 0041 00000000 0x0 0x0
0xffff8c000001bb00 0041 00000000 0x0 0x0
0xffff8c000001bb80 0041 00000000 0x0 0x0
0xffff8c000001bc00 0041 00000000 0x0 0x0
0xffff8c000001bc80 0041 00000000 0x0 0x0
0xffff8c000001bd00 0041 00000000 0x0 0x0
0xffff8c000001bd80 0041 00000000 0x0 0x0
0xffff8c000001be00 0041 00000000 0x0 0x0
0xffff8c000001be80 0041 00000000 0x0 0x0
0xffff8c000001bf00 0041 00000000 0x0 0x0
0xffff8c000001bf80 0041 00000000 0x0 0x0
0xffff8c000001c000 0041 00000000 0x0 0x0
0xffff8c000001c080 0041 00000000 0x0 0x0
0xffff8c000001c100 0041 00000000 0x0 0x0
0xffff8c000001c180 0041 00000000 0x0 0x0
0xffff8c000001c200 0041 00000000 0x0 0x0
0xffff8c000001c280 0041 00000000 0x0 0x0
0xffff8c000001c300 0041 00000000 0x0 0x0
0xffff8c000001c380 0041 00000000 0x0 0x0
0xffff8c000001c400 0041 00000000 0x0 0x0
0xffff8c000001c480 0041 00000000 0x0 0x0
0xffff8c000001c500 0041 00000000 0x0 0x0
0xffff8c000001c580 0041 00000000 0x0 0x0
0xffff8c000001c600 0041 00000000 0x0 0x0
0xffff8c000001c680 0041 00000000 0x0 0x0
0xffff8c000001c700 0041 00000000 0x0 0x0
0xffff8c000001c780 0001 00000000 0x0 0x0
0xffff8c000001c800 0001 00000000 0x0 0x0
0xffff8c000001c880 0001 00000000 0x0 0x0
0xffff8c000001c900 0001 00000000 0x0 0x0
0xffff8c000001c980 0001 00000000 0x0 0x0
0xffff8c000001ca00 0001 00000000 0x0 0x0
0xffff8c000001ca80 0001 00000000 0x0 0x0
0xffff8c000001cb00 0001 00000000 0x0 0x0
0xffff8c000001cb80 0001 00000000 0x0 0x0
0xffff8c000001cc00 0001 00000000 0x0 0x0
0xffff8c000001cc80 0001 00000000 0x0 0x0
0xffff8c000001cd00 0001 00000000 0x0 0x0
0xffff8c000001cd80 0001 00000000 0x0 0x0
0xffff8c000001ce00 0001 00000000 0x0 0x0
0xffff8c000001ce80 0001 00000000 0x0 0x0
0xffff8c000001cf00 0001 00000000 0x0 0x0
0xffff8c000001cf80 0001 00000000 0x0 0x0
0xffff8c000001d000 0001 00000000 0x0 0x0
0xffff8c000001d080 0001 00000000 0x0 0x0
0xffff8c000001d100 0001 00000000 0x0 0x0
0xffff8c000001d180 0001 00000000 0x0 0x0
0xffff8c000001d200 0001 00000000 0x0 0x0
0xffff8c000001d280 0001 00000000 0x0 0x0
0xffff8c000001d300 0001 00000000 0x0 0x0
0xffff8c000001d380 0001 00000000 0x0 0x0
0xffff8c000001d400 0001 00000000 0x0 0x0
0xffff8c000001d480 0001 00000000 0x0 0x0
0xffff8c000001d500 0001 00000000 0x0 0x0
0xffff8c000001d580 0001 00000000 0x0 0x0
0xffff8c000001d600 0001 00000000 0x0 0x0
0xffff8c000001d680 0001 00000000 0x0 0x0
0xffff8c000001d700 0001 00000000 0x0 0x0
0xffff8c000001d780 0001 00000000 0x0 0x0
0xffff8c000001d800 0001 00000000 0x0 0x0
0xffff8c000001d880 0001 00000000 0x0 0x0
0xffff8c000001d900 0001 00000000 0x0 0x0
0xffff8c000001d980 0001 00000000 0x0 0x0
0xffff8c000001da00 0001 00000000 0x0 0x0
0xffff8c000001da80 0001 00000000 0x0 0x0
0xffff8c000001db00 0001 00000000 0x0 0x0
0xffff8c000001db80 0001 00000000 0x0 0x0
0xffff8c000001dc00 0001 00000000 0x0 0x0
0xffff8c000001dc80 0001 00000000 0x0 0x0
0xffff8c000001dd00 0001 00000000 0x0 0x0
0xffff8c000001dd80 0001 00000000 0x0 0x0
0xffff8c000001de00 0001 00000000 0x0 0x0
0xffff8c000001de80 0001 00000000 0x0 0x0
0xffff8c000001df00 0001 00000000 0x0 0x0
0xffff8c000001df80 0001 00000000 0x0 0x0
0xffff8c000001e000 0001 00000000 0x0 0x0
0xffff8c000001e080 0001 00000000 0x0 0x0
0xffff8c000001e100 0001 00000000 0x0 0x0
0xffff8c000001e180 0001 00000000 0x0 0x0
0xffff8c000001e200 0001 00000000 0x0 0x0
0xffff8c000001e280 0001 00000000 0x0 0x0
0xffff8c000001e300 0001 00000000 0x0 0x0
0xffff8c000001e380 0001 00000000 0x0 0x0
0xffff8c000001e400 0001 00000000 0x0 0x0
0xffff8c000001e480 0001 00000000 0x0 0x0
0xffff8c000001e500 0001 00000000 0x0 0x0
0xffff8c000001e580 0001 00000000 0x0 0x0
0xffff8c000001e600 0001 00000000 0x0 0x0
0xffff8c000001e680 0001 00000000 0x0 0x0
0xffff8c000001e700 0001 00000000 0x0 0x0
0xffff8c000001e780 0001 00000000 0x0 0x0
0xffff8c000001e800 0001 00000000 0x0 0x0
0xffff8c000001e880 0001 00000000 0x0 0x0
0xffff8c000001e900 0001 00000000 0x0 0x0
0xffff8c000001e980 0001 00000000 0x0 0x0
0xffff8c000001ea00 0001 00000000 0x0 0x0
0xffff8c000001ea80 0001 00000000 0x0 0x0
0xffff8c000001eb00 0001 00000000 0x0 0x0
0xffff8c000001eb80 0001 00000000 0x0 0x0
0xffff8c000001ec00 0001 00000000 0x0 0x0
0xffff8c000001ec80 0001 00000000 0x0 0x0
0xffff8c000001ed00 0001 00000000 0x0 0x0
0xffff8c000001ed80 0001 00000000 0x0 0x0
0xffff8c000001ee00 0001 00000000 0x0 0x0
0xffff8c000001ee80 0001 00000000 0x0 0x0
0xffff8c000001ef00 0001 00000000 0x0 0x0
0xffff8c000001ef80 0001 00000000 0x0 0x0
0xffff8c000001f000 0001 00000000 0x0 0x0
0xffff8c000001f080 0001 00000000 0x0 0x0
0xffff8c000001f100 0001 00000000 0x0 0x0
0xffff8c000001f180 0001 00000000 0x0 0x0
0xffff8c000001f200 0001 00000000 0x0 0x0
0xffff8c000001f280 0001 00000000 0x0 0x0
0xffff8c000001f300 0001 00000000 0x0 0x0
0xffff8c000001f380 0001 00000000 0x0 0x0
0xffff8c000001f400 0001 00000000 0x0 0x0
0xffff8c000001f480 0001 00000000 0x0 0x0
0xffff8c000001f500 0001 00000000 0x0 0x0
0xffff8c000001f580 0001 00000000 0x0 0x0
0xffff8c000001f600 0001 00000000 0x0 0x0
0xffff8c000001f680 0001 00000000 0x0 0x0
0xffff8c000001f700 0001 00000000 0x0 0x0
0xffff8c000001f780 0001 00000000 0x0 0x0
0xffff8c000001f800 0001 00000000 0x0 0x0
0xffff8c000001f880 0001 00000000 0x0 0x0
0xffff8c000001f900 0001 00000000 0x0 0x0
0xffff8c000001f980 0001 00000000 0x0 0x0
0xffff8c000001fa00 0001 00000000 0x0 0x0
0xffff8c000001fa80 0001 00000000 0x0 0x0
0xffff8c000001fb00 0001 00000000 0x0 0x0
0xffff8c000001fb80 0001 00000000 0x0 0x0
0xffff8c000001fc00 0001 00000000 0x0 0x0
0xffff8c000001fc80 0001 00000000 0x0 0x0
0xffff8c000001fd00 0001 00000000 0x0 0x0
0xffff8c000001fd80 0001 00000000 0x0 0x0
0xffff8c000001fe00 0001 00000000 0x0 0x0
0xffff8c000001fe80 0001 00000000 0x0 0x0
0xffff8c000001ff00 0001 00000000 0x0 0x0
0xffff8c000001ff80 0001 00000000 0x0 0x0
0xffff8c0000020000 0001 00000000 0x0 0x0
0xffff8c0000020080 0001 00000000 0x0 0x0
0xffff8c0000020100 0001 00000000 0x0 0x0
0xffff8c0000020180 0001 00000000 0x0 0x0
0xffff8c0000020200 0001 00000000 0x0 0x0
0xffff8c0000020280 0001 00000000 0x0 0x0
0xffff8c0000020300 0001 00000000 0x0 0x0
0xffff8c0000020380 0001 00000000 0x0 0x0
0xffff8c0000020400 0001 00000000 0x0 0x0
0xffff8c0000020480 0001 00000000 0x0 0x0
0xffff8c0000020500 0001 00000000 0x0 0x0
0xffff8c0000020580 0001 00000000 0x0 0x0
0xffff8c0000020600 0001 00000000 0x0 0x0
0xffff8c0000020680 0001 00000000 0x0 0x0
0xffff8c0000020700 0001 00000000 0x0 0x0
0xffff8c0000020780 0001 00000000 0x0 0x0
0xffff8c0000020800 0001 00000000 0x0 0x0
0xffff8c0000020880 0001 00000000 0x0 0x0
0xffff8c0000020900 0001 00000000 0x0 0x0
0xffff8c0000020980 0001 00000000 0x0 0x0
0xffff8c0000020a00 0001 00000000 0x0 0x0
0xffff8c0000020a80 0001 00000000 0x0 0x0
0xffff8c0000020b00 0001 00000000 0x0 0x0
0xffff8c0000020b80 0001 00000000 0x0 0x0
0xffff8c0000020c00 0001 00000000 0x0 0x0
0xffff8c0000020c80 0001 00000000 0x0 0x0
0xffff8c0000020d00 0001 00000000 0x0 0x0
0xffff8c0000020d80 0001 00000000 0x0 0x0
0xffff8c0000020e00 0001 00000000 0x0 0x0
0xffff8c0000020e80 0001 00000000 0x0 0x0
0xffff8c0000020f00 0001 00000000 0x0 0x0
0xffff8c0000020f80 0001 00000000 0x0 0x0
0xffff8c0000021000 0001 00000000 0x0 0x0
0xffff8c0000021080 0001 00000000 0x0 0x0
0xffff8c0000021100 0001 00000000 0x0 0x0
0xffff8c0000021180 0001 00000000 0x0 0x0
0xffff8c0000021200 0001 00000000 0x0 0x0
0xffff8c0000021280 0001 00000000 0x0 0x0
0xffff8c0000021300 0001 00000000 0x0 0x0
0xffff8c0000021380 0001 00000000 0x0 0x0
0xffff8c0000021400 0001 00000000 0x0 0x0
0xffff8c0000021480 0001 00000000 0x0 0x0
0xffff8c0000021500 0001 00000000 0x0 0x0
0xffff8c0000021580 0001 00000000 0x0 0x0
0xffff8c0000021600 0001 00000000 0x0 0x0
0xffff8c0000021680 0001 00000000 0x0 0x0
0xffff8c0000021700 0001 00000000 0x0 0x0
0xffff8c0000021780 0001 00000000 0x0 0x0
0xffff8c0000021800 0001 00000000 0x0 0x0
0xffff8c0000021880 0001 00000000 0x0 0x0
0xffff8c0000021900 0001 00000000 0x0 0x0
0xffff8c0000021980 0001 00000000 0x0 0x0
0xffff8c0000021a00 0001 00000000 0x0 0x0
0xffff8c0000021a80 0001 00000000 0x0 0x0
0xffff8c0000021b00 0001 00000000 0x0 0x0
0xffff8c0000021b80 0001 00000000 0x0 0x0
0xffff8c0000021c00 0001 00000000 0x0 0x0
0xffff8c0000021c80 0001 00000000 0x0 0x0
0xffff8c0000021d00 0001 00000000 0x0 0x0
0xffff8c0000021d80 0001 00000000 0x0 0x0
0xffff8c0000021e00 0001 00000000 0x0 0x0
0xffff8c0000021e80 0001 00000000 0x0 0x0
0xffff8c0000021f00 0001 00000000 0x0 0x0
0xffff8c0000021f80 0001 00000000 0x0 0x0
0xffff8c0000022000 0001 00000000 0x0 0x0
0xffff8c0000022080 0001 00000000 0x0 0x0
0xffff8c0000022100 0001 00000000 0x0 0x0
0xffff8c0000022180 0001 00000000 0x0 0x0
0xffff8c0000022200 0001 00000000 0x0 0x0
0xffff8c0000022280 0001 00000000 0x0 0x0
0xffff8c0000022300 0001 00000000 0x0 0x0
0xffff8c0000022380 0001 00000000 0x0 0x0
0xffff8c0000022400 0001 00000000 0x0 0x0
0xffff8c0000022480 0001 00000000 0x0 0x0
0xffff8c0000022500 0001 00000000 0x0 0x0
0xffff8c0000022580 0001 00000000 0x0 0x0
0xffff8c0000022600 0001 00000000 0x0 0x0
0xffff8c0000022680 0001 00000000 0x0 0x0
0xffff8c0000022700 0001 00000000 0x0 0x0
0xffff8c0000022780 0001 00000000 0x0 0x0
0xffff8c0000022800 0001 00000000 0x0 0x0
0xffff8c0000022880 0001 00000000 0x0 0x0
0xffff8c0000022900 0001 00000000 0x0 0x0
0xffff8c0000022980 0001 00000000 0x0 0x0
0xffff8c0000022a00 0001 00000000 0x0 0x0
0xffff8c0000022a80 0001 00000000 0x0 0x0
0xffff8c0000022b00 0001 00000000 0x0 0x0
0xffff8c0000022b80 0001 00000000 0x0 0x0
0xffff8c0000022c00 0001 00000000 0x0 0x0
0xffff8c0000022c80 0001 00000000 0x0 0x0
0xffff8c0000022d00 0001 00000000 0x0 0x0
0xffff8c0000022d80 0001 00000000 0x0 0x0
0xffff8c0000022e00 0001 00000000 0x0 0x0
0xffff8c0000022e80 0001 00000000 0x0 0x0
0xffff8c0000022f00 0001 00000000 0x0 0x0
0xffff8c0000022f80 0001 00000000 0x0 0x0
0xffff8c0000023000 0001 00000000 0x0 0x0
0xffff8c0000023080 0001 00000000 0x0 0x0
0xffff8c0000023100 0001 00000000 0x0 0x0
0xffff8c0000023180 0001 00000000 0x0 0x0
0xffff8c0000023200 0001 00000000 0x0 0x0
0xffff8c0000023280 0001 00000000 0x0 0x0
0xffff8c0000023300 0001 00000000 0x0 0x0
0xffff8c0000023380 0001 00000000 0x0 0x0
0xffff8c0000023400 0001 00000000 0x0 0x0
0xffff8c0000023480 0001 00000000 0x0 0x0
0xffff8c0000023500 0001 00000000 0x0 0x0
0xffff8c0000023580 0001 00000000 0x0 0x0
0xffff8c0000023600 0001 00000000 0x0 0x0
0xffff8c0000023680 0001 00000000 0x0 0x0
0xffff8c0000023700 0001 00000000 0x0 0x0
0xffff8c0000023780 0001 00000000 0x0 0x0
0xffff8c0000023800 0001 00000000 0x0 0x0
0xffff8c0000023880 0001 00000000 0x0 0x0
0xffff8c0000023900 0001 00000000 0x0 0x0
0xffff8c0000023980 0001 00000000 0x0 0x0
0xffff8c0000023a00 0001 00000000 0x0 0x0
0xffff8c0000023a80 0001 00000000 0x0 0x0
0xffff8c0000023b00 0001 00000000 0x0 0x0
0xffff8c0000023b80 0001 00000000 0x0 0x0
0xffff8c0000023c00 0001 00000000 0x0 0x0
0xffff8c0000023c80 0001 00000000 0x0 0x0
0xffff8c0000023d00 0001 00000000 0x0 0x0
0xffff8c0000023d80 0001 00000000 0x0 0x0
0xffff8c0000023e00 0001 00000000 0x0 0x0
0xffff8c0000023e80 0001 00000000 0x0 0x0
0xffff8c0000023f00 0001 00000000 0x0 0x0
0xffff8c0000023f80 0001 00000000 0x0 0x0
0xffff8c0000024000 0001 00000000 0x0 0x0
0xffff8c0000024080 0001 00000000 0x0 0x0
0xffff8c0000024100 0001 00000000 0x0 0x0
0xffff8c0000024180 0001 00000000 0x0 0x0
0xffff8c0000024200 0001 00000000 0x0 0x0
0xffff8c0000024280 0001 00000000 0x0 0x0
0xffff8c0000024300 0001 00000000 0x0 0x0
0xffff8c0000024380 0001 00000000 0x0 0x0
0xffff8c0000024400 0001 00000000 0x0 0x0
0xffff8c0000024480 0001 00000000 0x0 0x0
0xffff8c0000024500 0001 00000000 0x0 0x0
0xffff8c0000024580 0001 00000000 0x0 0x0
0xffff8c0000024600 0001 00000000 0x0 0x0
0xffff8c0000024680 0001 00000000 0x0 0x0
0xffff8c0000024700 0001 00000000 0x0 0x0
0xffff8c0000024780 0001 00000000 0x0 0x0
0xffff8c0000024800 0001 00000000 0x0 0x0
0xffff8c0000024880 0001 00000000 0x0 0x0
0xffff8c0000024900 0001 00000000 0x0 0x0
0xffff8c0000024980 0001 00000000 0x0 0x0
0xffff8c0000024a00 0001 00000000 0x0 0x0
0xffff8c0000024a80 0001 00000000 0x0 0x0
0xffff8c0000024b00 0001 00000000 0x0 0x0
0xffff8c0000024b80 0001 00000000 0x0 0x0
0xffff8c0000024c00 0001 00000000 0x0 0x0
0xffff8c0000024c80 0001 00000000 0x0 0x0
0xffff8c0000024d00 0001 00000000 0x0 0x0
0xffff8c0000024d80 0001 00000000 0x0 0x0
0xffff8c0000024e00 0001 00000000 0x0 0x0
0xffff8c0000024e80 0001 00000000 0x0 0x0
0xffff8c0000024f00 0001 00000000 0x0 0x0
0xffff8c0000024f80 0001 00000000 0x0 0x0
0xffff8c0000025000 0001 00000000 0x0 0x0
0xffff8c0000025080 0001 00000000 0x0 0x0
0xffff8c0000025100 0001 00000000 0x0 0x0
0xffff8c0000025180 0001 00000000 0x0 0x0
0xffff8c0000025200 0001 00000000 0x0 0x0
0xffff8c0000025280 0001 00000000 0x0 0x0
0xffff8c0000025300 0001 00000000 0x0 0x0
0xffff8c0000025380 0001 00000000 0x0 0x0
0xffff8c0000025400 0001 00000000 0x0 0x0
0xffff8c0000025480 0001 00000000 0x0 0x0
0xffff8c0000025500 0001 00000000 0x0 0x0
0xffff8c0000025580 0001 00000000 0x0 0x0
0xffff8c0000025600 0001 00000000 0x0 0x0
0xffff8c0000025680 0001 00000000 0x0 0x0
0xffff8c0000025700 0001 00000000 0x0 0x0
0xffff8c0000025780 0001 00000000 0x0 0x0
0xffff8c0000025800 0001 00000000 0x0 0x0
0xffff8c0000025880 0001 00000000 0x0 0x0
0xffff8c0000025900 0001 00000000 0x0 0x0
0xffff8c0000025980 0001 00000000 0x0 0x0
0xffff8c0000025a00 0001 00000000 0x0 0x0
0xffff8c0000025a80 0001 00000000 0x0 0x0
0xffff8c0000025b00 0001 00000000 0x0 0x0
0xffff8c0000025b80 0001 00000000 0x0 0x0
0xffff8c0000025c00 0001 00000000 0x0 0x0
0xffff8c0000025c80 0001 00000000 0x0 0x0
0xffff8c0000025d00 0001 00000000 0x0 0x0
0xffff8c0000025d80 0001 00000000 0x0 0x0
0xffff8c0000025e00 0001 00000000 0x0 0x0
0xffff8c0000025e80 0001 00000000 0x0 0x0
0xffff8c0000025f00 0001 00000000 0x0 0x0
0xffff8c0000025f80 0001 00000000 0x0 0x0
0xffff8c0000026000 0001 00000000 0x0 0x0
0xffff8c0000026080 0001 00000000 0x0 0x0
0xffff8c0000026100 0001 00000000 0x0 0x0
0xffff8c0000026180 0001 00000000 0x0 0x0
0xffff8c0000026200 0001 00000000 0x0 0x0
0xffff8c0000026280 0001 00000000 0x0 0x0
0xffff8c0000026300 0001 00000000 0x0 0x0
0xffff8c0000026380 0001 00000000 0x0 0x0
0xffff8c0000026400 0001 00000000 0x0 0x0
0xffff8c0000026480 0001 00000000 0x0 0x0
0xffff8c0000026500 0001 00000000 0x0 0x0
0xffff8c0000026580 0001 00000000 0x0 0x0
0xffff8c0000026600 0001 00000000 0x0 0x0
0xffff8c0000026680 0001 00000000 0x0 0x0
0xffff8c0000026700 0001 00000000 0x0 0x0
0xffff8c0000026780 0001 00000000 0x0 0x0
0xffff8c0000026800 0001 00000000 0x0 0x0
0xffff8c0000026880 0001 00000000 0x0 0x0
0xffff8c0000026900 0001 00000000 0x0 0x0
0xffff8c0000026980 0001 00000000 0x0 0x0
0xffff8c0000026a00 0001 00000000 0x0 0x0
0xffff8c0000026a80 0001 00000000 0x0 0x0
0xffff8c0000026b00 0001 00000000 0x0 0x0
0xffff8c0000026b80 0001 00000000 0x0 0x0
0xffff8c0000026c00 0001 00000000 0x0 0x0
0xffff8c0000026c80 0001 00000000 0x0 0x0
0xffff8c0000026d00 0001 00000000 0x0 0x0
0xffff8c0000026d80 0001 00000000 0x0 0x0
0xffff8c0000026e00 0001 00000000 0x0 0x0
0xffff8c0000026e80 0001 00000000 0x0 0x0
0xffff8c0000026f00 0001 00000000 0x0 0x0
0xffff8c0000026f80 0001 00000000 0x0 0x0
0xffff8c0000027000 0001 00000000 0x0 0x0
0xffff8c0000027080 0001 00000000 0x0 0x0
0xffff8c0000027100 0001 00000000 0x0 0x0
0xffff8c0000027180 0001 00000000 0x0 0x0
0xffff8c0000027200 0001 00000000 0x0 0x0
0xffff8c0000027280 0001 00000000 0x0 0x0
0xffff8c0000027300 0001 00000000 0x0 0x0
0xffff8c0000027380 0001 00000000 0x0 0x0
0xffff8c0000027400 0001 00000000 0x0 0x0
0xffff8c0000027480 0001 00000000 0x0 0x0
0xffff8c0000027500 0001 00000000 0x0 0x0
0xffff8c0000027580 0001 00000000 0x0 0x0
0xffff8c0000027600 0001 00000000 0x0 0x0
0xffff8c0000027680 0001 00000000 0x0 0x0
0xffff8c0000027700 0001 00000000 0x0 0x0
0xffff8c0000027780 0001 00000000 0x0 0x0
0xffff8c0000027800 0001 00000000 0x0 0x0
0xffff8c0000027880 0001 00000000 0x0 0x0
0xffff8c0000027900 0001 00000000 0x0 0x0
0xffff8c0000027980 0001 00000000 0x0 0x0
0xffff8c0000027a00 0001 00000000 0x0 0x0
0xffff8c0000027a80 0001 00000000 0x0 0x0
0xffff8c0000027b00 0001 00000000 0x0 0x0
0xffff8c0000027b80 0001 00000000 0x0 0x0
0xffff8c0000027c00 0001 00000000 0x0 0x0
0xffff8c0000027c80 0001 00000000 0x0 0x0
0xffff8c0000027d00 0001 00000000 0x0 0x0
0xffff8c0000027d80 0001 00000000 0x0 0x0
0xffff8c0000027e00 0001 00000000 0x0 0x0
0xffff8c0000027e80 0001 00000000 0x0 0x0
0xffff8c0000027f00 0001 00000000 0x0 0x0
0xffff8c0000027f80 0001 00000000 0x0 0x0
0xffff8c0000028000 0001 00000000 0x0 0x0
0xffff8c0000028080 0001 00000000 0x0 0x0
0xffff8c0000028100 0001 00000000 0x0 0x0
0xffff8c0000028180 0001 00000000 0x0 0x0
0xffff8c0000028200 0001 00000000 0x0 0x0
0xffff8c0000028280 0001 00000000 0x0 0x0
0xffff8c0000028300 0001 00000000 0x0 0x0
0xffff8c0000028380 0001 00000000 0x0 0x0
0xffff8c0000028400 0001 00000000 0x0 0x0
0xffff8c0000028480 0001 00000000 0x0 0x0
0xffff8c0000028500 0001 00000000 0x0 0x0
0xffff8c0000028580 0001 00000000 0x0 0x0
0xffff8c0000028600 0001 00000000 0x0 0x0
0xffff8c0000028680 0001 00000000 0x0 0x0
0xffff8c0000028700 0001 00000000 0x0 0x0
0xffff8c0000028780 0001 00000000 0x0 0x0
0xffff8c0000028800 0001 00000000 0x0 0x0
0xffff8c0000028880 0001 00000000 0x0 0x0
0xffff8c0000028900 0001 00000000 0x0 0x0
0xffff8c0000028980 0001 00000000 0x0 0x0
0xffff8c0000028a00 0001 00000000 0x0 0x0
0xffff8c0000028a80 0001 00000000 0x0 0x0
0xffff8c0000028b00 0001 00000000 0x0 0x0
0xffff8c0000028b80 0001 00000000 0x0 0x0
0xffff8c0000028c00 0001 00000000 0x0 0x0
0xffff8c0000028c80 0001 00000000 0x0 0x0
0xffff8c0000028d00 0001 00000000 0x0 0x0
0xffff8c0000028d80 0001 00000000 0x0 0x0
0xffff8c0000028e00 0001 00000000 0x0 0x0
0xffff8c0000028e80 0001 00000000 0x0 0x0
0xffff8c0000028f00 0001 00000000 0x0 0x0
0xffff8c0000028f80 0001 00000000 0x0 0x0
0xffff8c0000029000 0001 00000000 0x0 0x0
0xffff8c0000029080 0001 00000000 0x0 0x0
0xffff8c0000029100 0001 00000000 0x0 0x0
0xffff8c0000029180 0001 00000000 0x0 0x0
0xffff8c0000029200 0001 00000000 0x0 0x0
0xffff8c0000029280 0001 00000000 0x0 0x0
0xffff8c0000029300 0001 00000000 0x0 0x0
0xffff8c0000029380 0001 00000000 0x0 0x0
0xffff8c0000029400 0001 00000000 0x0 0x0
0xffff8c0000029480 0001 00000000 0x0 0x0
0xffff8c0000029500 0001 00000000 0x0 0x0
0xffff8c0000029580 0001 00000000 0x0 0x0
0xffff8c0000029600 0001 00000000 0x0 0x0
0xffff8c0000029680 0001 00000000 0x0 0x0
0xffff8c0000029700 0001 00000000 0x0 0x0
0xffff8c0000029780 0001 00000000 0x0 0x0
0xffff8c0000029800 0001 00000000 0x0 0x0
0xffff8c0000029880 0001 00000000 0x0 0x0
0xffff8c0000029900 0001 00000000 0x0 0x0
0xffff8c0000029980 0001 00000000 0x0 0x0
0xffff8c0000029a00 0001 00000000 0x0 0x0
0xffff8c0000029a80 0001 00000000 0x0 0x0
0xffff8c0000029b00 0001 00000000 0x0 0x0
0xffff8c0000029b80 0001 00000000 0x0 0x0
0xffff8c0000029c00 0001 00000000 0x0 0x0
0xffff8c0000029c80 0001 00000000 0x0 0x0
0xffff8c0000029d00 0001 00000000 0x0 0x0
0xffff8c0000029d80 0001 00000000 0x0 0x0
0xffff8c0000029e00 0001 00000000 0x0 0x0
0xffff8c0000029e80 0001 00000000 0x0 0x0
0xffff8c0000029f00 0001 00000000 0x0 0x0
0xffff8c0000029f80 0001 00000000 0x0 0x0
0xffff8c000002a000 0001 00000000 0x0 0x0
0xffff8c000002a080 0001 00000000 0x0 0x0
0xffff8c000002a100 0001 00000000 0x0 0x0
0xffff8c000002a180 0001 00000000 0x0 0x0
0xffff8c000002a200 0001 00000000 0x0 0x0
0xffff8c000002a280 0001 00000000 0x0 0x0
0xffff8c000002a300 0001 00000000 0x0 0x0
0xffff8c000002a380 0001 00000000 0x0 0x0
0xffff8c000002a400 0001 00000000 0x0 0x0
0xffff8c000002a480 0001 00000000 0x0 0x0
0xffff8c000002a500 0001 00000000 0x0 0x0
0xffff8c000002a580 0001 00000000 0x0 0x0
0xffff8c000002a600 0001 00000000 0x0 0x0
0xffff8c000002a680 0001 00000000 0x0 0x0
0xffff8c000002a700 0001 00000000 0x0 0x0
0xffff8c000002a780 0001 00000000 0x0 0x0
0xffff8c000002a800 0001 00000000 0x0 0x0
0xffff8c000002a880 0001 00000000 0x0 0x0
0xffff8c000002a900 0001 00000000 0x0 0x0
0xffff8c000002a980 0001 00000000 0x0 0x0
0xffff8c000002aa00 0001 00000000 0x0 0x0
0xffff8c000002aa80 0001 00000000 0x0 0x0
0xffff8c000002ab00 0001 00000000 0x0 0x0
0xffff8c000002ab80 0001 00000000 0x0 0x0
0xffff8c000002ac00 0001 00000000 0x0 0x0
0xffff8c000002ac80 0001 00000000 0x0 0x0
0xffff8c000002ad00 0001 00000000 0x0 0x0
0xffff8c000002ad80 0001 00000000 0x0 0x0
0xffff8c000002ae00 0001 00000000 0x0 0x0
0xffff8c000002ae80 0001 00000000 0x0 0x0
0xffff8c000002af00 0001 00000000 0x0 0x0
0xffff8c000002af80 0001 00000000 0x0 0x0
0xffff8c000002b000 0001 00000000 0x0 0x0
0xffff8c000002b080 0001 00000000 0x0 0x0
0xffff8c000002b100 0001 00000000 0x0 0x0
0xffff8c000002b180 0001 00000000 0x0 0x0
0xffff8c000002b200 0001 00000000 0x0 0x0
0xffff8c000002b280 0001 00000000 0x0 0x0
0xffff8c000002b300 0001 00000000 0x0 0x0
0xffff8c000002b380 0001 00000000 0x0 0x0
0xffff8c000002b400 0001 00000000 0x0 0x0
0xffff8c000002b480 0001 00000000 0x0 0x0
0xffff8c000002b500 0001 00000000 0x0 0x0
0xffff8c000002b580 0001 00000000 0x0 0x0
0xffff8c000002b600 0001 00000000 0x0 0x0
0xffff8c000002b680 0001 00000000 0x0 0x0
0xffff8c000002b700 0001 00000000 0x0 0x0
0xffff8c000002b780 0001 00000000 0x0 0x0
0xffff8c000002b800 0001 00000000 0x0 0x0
0xffff8c000002b880 0001 00000000 0x0 0x0
0xffff8c000002b900 0001 00000000 0x0 0x0
0xffff8c000002b980 0001 00000000 0x0 0x0
0xffff8c000002ba00 0001 00000000 0x0 0x0
0xffff8c000002ba80 0001 00000000 0x0 0x0
0xffff8c000002bb00 0001 00000000 0x0 0x0
0xffff8c000002bb80 0001 00000000 0x0 0x0
0xffff8c000002bc00 0001 00000000 0x0 0x0
0xffff8c000002bc80 0001 00000000 0x0 0x0
0xffff8c000002bd00 0001 00000000 0x0 0x0
0xffff8c000002bd80 0001 00000000 0x0 0x0
0xffff8c000002be00 0001 00000000 0x0 0x0
0xffff8c000002be80 0001 00000000 0x0 0x0
0xffff8c000002bf00 0001 00000000 0x0 0x0
0xffff8c000002bf80 0001 00000000 0x0 0x0
0xffff8c000002c000 0001 00000000 0x0 0x0
0xffff8c000002c080 0001 00000000 0x0 0x0
0xffff8c000002c100 0001 00000000 0x0 0x0
0xffff8c000002c180 0001 00000000 0x0 0x0
0xffff8c000002c200 0001 00000000 0x0 0x0
0xffff8c000002c280 0001 00000000 0x0 0x0
0xffff8c000002c300 0001 00000000 0x0 0x0
0xffff8c000002c380 0001 00000000 0x0 0x0
0xffff8c000002c400

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,

Oct 28, 2022, 12:20:44 PM10/28/22

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 4218bdda2e25 Adjust userland commands for struct inpcb sep..
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=17526446880000

kernel config: https://syzkaller.appspot.com/x/.config?x=739e57438eb9ed9e
dashboard link: https://syzkaller.appspot.com/bug?extid=9cd3aa2efee7e821817f
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=109a5041880000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14f57cee880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/006e687c98b1/disk-4218bdda.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/2959d02ecae2/netbsd-4218bdda.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9cd3aa...@syzkaller.appspotmail.com

[ 41.2493529] fatal page fault in supervisor mode
[ 41.2493529] trap type 6 code 0 rip 0xffffffff83e6c803 cs 0x8 rflags 0x10246 cr2 0x38 ilevel 0 rsp 0xffffc400c7924630
[ 41.2493529] curlwp 0xffffc40012b81900 pid 1243.1243 lowest kstack 0xffffc400c791d2c0

kernel: page fault trap, code=0

Stopped in pid 1243.1243 (syz-executor3781) at netbsd:tcp_recvoob_wrapper+0x93: movq 0(%rbx),%rax

?
tcp_recvoob_wrapper() at netbsd:tcp_recvoob_wrapper+0x93 tcp_recvoob sys/netinet/tcp_usrreq.c:937 [inline]
tcp_recvoob_wrapper() at netbsd:tcp_recvoob_wrapper+0x93 sys/netinet/tcp_usrreq.c:2296
soreceive() at netbsd:soreceive+0x99de
do_sys_recvmsg_so() at netbsd:do_sys_recvmsg_so+0xc80 sys/kern/uipc_syscalls.c:978
sys_recvmmsg() at netbsd:sys_recvmmsg+0x9da sys/kern/uipc_syscalls.c:1088

sys_syscall() at netbsd:sys_syscall+0x2c5 sys/kern/sys_syscall.c:90

syscall() at netbsd:syscall+0x60c sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x60c sys/arch/x86/x86/syscall.c:138
--- syscall (number 475 via SYS_syscall) ---
netbsd:syscall+0x60c:
Panic string: (null)
PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

1386 1386 2 0 0 ffffc400133a6540 syz-executor3781
990 990 2 0 0 ffffc400133a6100 syz-executor3781
1239 1239 2 0 0 ffffc40012c41940 syz-executor3781
1241 >1241 7 0 0 ffffc40012c41500 syz-executor3781
1242 1242 2 0 0 ffffc40012c410c0 syz-executor3781
1243 >1243 7 1 0 ffffc40012b81900 syz-executor3781
829 829 3 0 180 ffffc40012b814c0 syz-executor3781 nanoslp
929 929 2 1 140 ffffc40012b81080 syz-executor3781
449 449 2 1 140 ffffc400123702c0 syz-executor3781
942 942 3 0 180 ffffc400122de6c0 syz-executor3781 nanoslp
1237 1237 3 1 180 ffffc400124fd300 sshd select
1223 1223 3 0 180 ffffc400122deb00 getty nanoslp
1151 1151 3 0 180 ffffc400122de280 getty nanoslp
1222 1222 3 1 180 ffffc400121deac0 getty nanoslp
1082 1082 3 1 1c0 ffffc400121db200 getty ttyraw
1102 1102 3 1 180 ffffc40012b528c0 sshd select
1088 1088 3 1 180 ffffc40012b52480 powerd kqueue
700 700 3 1 180 ffffc400125df780 syslogd kqueue
747 747 3 0 180 ffffc40012b52040 dhcpcd poll
742 742 3 0 180 ffffc400124fd740 dhcpcd poll
466 466 3 0 180 ffffc40012370700 dhcpcd poll
598 598 3 1 180 ffffc400125dfbc0 dhcpcd poll
292 292 3 0 180 ffffc400125df340 dhcpcd poll
485 485 3 0 180 ffffc40012370b40 dhcpcd poll
291 291 3 1 180 ffffc400124fdb80 dhcpcd poll
1 1 3 1 180 ffffc40011ece100 init wait
0 557 3 0 200 ffffc400121db640 physiod physiod
0 196 3 0 200 ffffc400121de680 pooldrain pooldrain
0 195 3 0 200 ffffc400121de240 ioflush syncer
0 194 3 1 200 ffffc400121dba80 pgdaemon pgdaemon
0 167 3 1 200 ffffc4001214ba40 usb7 usbevt
0 172 3 0 200 ffffc4001214b600 usb6 usbevt
0 170 3 0 200 ffffc4001214b1c0 usb5 usbevt
0 168 3 0 200 ffffc4001211ba00 usb4 usbevt
0 166 3 0 200 ffffc4001211b5c0 usb3 usbevt
0 165 3 0 200 ffffc4001211b180 usb2 usbevt
0 31 3 0 200 ffffc400120769c0 usb1 usbevt
0 63 3 0 200 ffffc40012076580 usb0 usbevt
0 126 3 1 200 ffffc40012076140 usbtask-dr usbtsk
0 125 3 1 200 ffffc40011ece980 usbtask-hc usbtsk
0 124 3 0 200 ffffc400103f5b00 swwreboot swwreboot
0 123 3 0 200 ffffc40011ece540 npfgc0 npfgcw
0 122 3 1 200 ffffc40011ec1940 rt_free rt_free
0 121 3 1 200 ffffc40011ec1500 unpgc unpgc
0 120 3 0 200 ffffc40011ec10c0 key_timehandler key_timehandler
0 119 3 1 200 ffffc40011ebc900 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffc40011ebc4c0 icmp6_wqinput/0 icmp6_wqinput
0 117 3 1 200 ffffc40011ebc080 nd6_timer nd6_timer
0 116 3 1 200 ffffc40011ce0bc0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffc40011ce0780 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffc40011ce0340 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffc40011e9b8c0 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffc40011e9b480 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffc40011cddb80 icmp_wqinput/0 icmp_wqinput
0 110 3 0 200 ffffc40011cdd740 rt_timer rt_timer
0 109 3 1 200 ffffc40011e9b040 vmem_rehash vmem_rehash
0 100 3 1 200 ffffc40011cdd300 entbutler entropy
0 99 3 1 200 ffffc400117e0b40 viomb balloon
0 98 3 1 200 ffffc400117e0700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffffc400117e02c0 vioif0_txrx/0 vioif0_txrx
0 30 3 0 200 ffffc400103f56c0 scsibus0 sccomp
0 29 3 0 200 ffffc400103f5280 pms0 pmsreset
0 28 3 1 200 ffffc400103daac0 xcall/1 xcall
0 27 1 1 200 ffffc400103da680 softser/1
0 26 1 1 200 ffffc400103da240 softclk/1
0 25 1 1 200 ffffc400103d8a80 softbio/1
0 24 1 1 200 ffffc400103d8640 softnet/1
0 23 1 1 201 ffffc400103d8200 idle/1
0 22 3 0 200 ffffc4000f1f4a40 lnxsyswq lnxsyswq
0 21 3 0 200 ffffc4000f1f4600 lnxubdwq lnxubdwq
0 20 3 0 200 ffffc4000f1f41c0 lnxpwrwq lnxpwrwq
0 19 3 0 200 ffffc4000f1f2a00 lnxlngwq lnxlngwq
0 18 3 0 200 ffffc4000f1f25c0 lnxhipwq lnxhipwq
0 17 3 0 200 ffffc4000f1f2180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffc4000f1ec9c0 sysmon smtaskq
0 15 3 1 200 ffffc4000f1ec580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffc4000f1ec140 pmfevent pmfevent
0 13 3 0 200 ffffc4000f1e9980 sopendfree sopendfr
0 12 3 0 200 ffffc4000f1e9540 ifwdog ifwdog
0 11 3 0 200 ffffc4000f1e9100 iflnkst iflnkst
0 10 3 0 200 ffffc4000f1df940 nfssilly nfssilly
0 9 3 0 200 ffffc4000f1df500 vdrain vdrain
0 8 3 1 200 ffffc4000f1df0c0 modunload mod_unld
0 7 3 0 200 ffffc4000ebdb900 xcall/0 xcall
0 6 1 0 200 ffffc4000ebdb4c0 softser/0
0 5 1 0 200 ffffc4000ebdb080 softclk/0
0 4 1 0 200 ffffc4000ebd98c0 softbio/0
0 3 1 0 200 ffffc4000ebd9480 softnet/0
0 2 1 0 201 ffffc4000ebd9040 idle/0

0 0 3 0 200 ffffffff86869180 swapper uvm
[Locks tracked through LWPs]

****** LWP 1241.1241 (syz-executor3781) @ 0xffffc40012c41500, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:amap_ctor+0xdf sys/uvm/uvm_amap.c:265)
lock address : ffffc400121c8cc0
type : sleep/adaptive
initialized : netbsd:amap_ctor+0xdf

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffc40012c41500 last held: 0xffffc40012c41500
last locked* : netbsd:uvm_fault_internal+0x1d28
unlocked : netbsd:uvm_fault_upper_enter+0x12e9
owner/count : 0xffffc40012c41500 flags : 0x0000000000000004

Turnstile: no active turnstile for this lock.

*** Locks wanted:

* Lock 0 (initialized at netbsd:pmap_ctor+0xc0 sys/arch/x86/x86/pmap.c:2860)
lock address : ffffc40012b7e8c0
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0xc0

shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1

relevant cpu : 0 last held: 0

relevant lwp : 0xffffc40012c41500 last held: 000000000000000000
last locked : netbsd:pmap_enter_ma+0x11ce
unlocked* : netbsd:pmap_enter_ma+0x6f3f
owner field : 0xffffc40012c41500 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

****** LWP 1242.1242 (syz-executor3781) @ 0xffffc40012c410c0, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:pmap_ctor+0xc0 sys/arch/x86/x86/pmap.c:2860)
lock address : ffffc40012b7e700
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0xc0

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffc40012c410c0 last held: 0xffffc40012c410c0
last locked* : netbsd:pmap_enter_ma+0x11ce
unlocked : netbsd:pmap_extract+0x72d
owner field : 0xffffc40012c410c0 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1243.1243 (syz-executor3781) @ 0xffffc40012b81900, l_stat=7

*** Locks held:

* Lock 0 (initialized at netbsd:soinit+0x4c2 sys/kern/uipc_socket.c:459)

lock address : ffffc4000ebc0080

type : sleep/adaptive
initialized : netbsd:soinit+0x4c2
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0

relevant cpu : 1 last held: 1

relevant lwp : 0xffffc40012b81900 last held: 0xffffc40012b81900
last locked* : netbsd:soreceive+0x988b
unlocked : netbsd:sys_shutdown+0x32b
owner field : 0xffffc40012b81900 wait/spin: 0/0

Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 742.742 (dhcpcd) @ 0xffffc400124fd740, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x43 sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x43
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffc400124fd740 last held: 000000000000000000