UBSan: Undefined Behavior in uioskip

6 views

Skip to first unread message

syzbot

unread,

Jun 23, 2023, 10:56:51 AM6/23/23

to syzkaller-...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 21b18fa1a8ce tests/make: demonstrate inconsistency in patt..
git tree: netbsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1344fa50a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=2d1d4e6756991c98e9c5
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ed66b44ab98b/disk-21b18fa1.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/b407e06d29e2/netbsd-21b18fa1.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2d1d4e...@syzkaller.appspotmail.com

[ 62.0887087] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/subr_copy.c:247:41, pointer expression with base 0xffffffffffffffff overflowed to 0x44

[ 62.1028117] cpu0: Begin traceback...
[ 62.1386930] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:292
[ 62.2586992] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 62.3686816] HandlePointerOverflow() at netbsd:HandlePointerOverflow+0xd2 sys/../common/lib/libc/misc/ubsan.c:706
[ 62.4586822] uioskip() at netbsd:uioskip+0x2bf sys/kern/subr_copy.c:247
[ 62.5386828] ttwrite() at netbsd:ttwrite+0x201 sys/kern/tty.c:2380
[ 62.6286825] comwrite() at netbsd:comwrite+0x135 sys/dev/ic/com.c:1252
[ 62.7086819] cdev_write() at netbsd:cdev_write+0x14c sys/kern/subr_devsw.c:1507
[ 62.7886990] cnwrite() at netbsd:cnwrite+0xcb sys/dev/cons.c:231
[ 62.8686834] cdev_write() at netbsd:cdev_write+0x14c sys/kern/subr_devsw.c:1507
[ 62.9587228] spec_write() at netbsd:spec_write+0x278 sys/miscfs/specfs/spec_vnops.c:1225
[ 63.0486955] VOP_WRITE() at netbsd:VOP_WRITE+0x2ab sys/kern/vnode_if.c:824
[ 63.1486827] vn_write() at netbsd:vn_write+0x309 sys/kern/vfs_vnops.c:715
[ 63.2386877] do_filewritev.part.0() at netbsd:do_filewritev.part.0+0x56d
[ 63.3286817] sys_writev() at netbsd:sys_writev+0x5e do_filewritev sys/kern/sys_generic.c:383 [inline]
[ 63.3286817] sys_writev() at netbsd:sys_writev+0x5e sys/kern/sys_generic.c:383
[ 63.4186813] sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 63.4186813] sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 63.5086822] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 63.5086822] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 63.5086822] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 63.5287022] --- syscall (number 121 via SYS_syscall) ---
[ 63.5586810] netbsd:syscall+0x2da:
[ 63.5686947] cpu0: End traceback...
[ 63.5686947] fatal breakpoint trap in supervisor mode
[ 63.5686947] trap type 1 code 0 rip 0xffffffff80235485 cs 0x8 rflags 0x246 cr2 0x79a0fa624e03 ilevel 0 rsp 0xffff8b8251417440
[ 63.5886820] curlwp 0xffffacdd1e0a2280 pid 1200.1209 lowest kstack 0xffff8b82514132c0
Stopped in pid 1200.1209 (syz-executor.3) at netbsd:breakpoint+0x5: leave
?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:292
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandlePointerOverflow() at netbsd:HandlePointerOverflow+0xd2 sys/../common/lib/libc/misc/ubsan.c:706
uioskip() at netbsd:uioskip+0x2bf sys/kern/subr_copy.c:247
ttwrite() at netbsd:ttwrite+0x201 sys/kern/tty.c:2380
comwrite() at netbsd:comwrite+0x135 sys/dev/ic/com.c:1252
cdev_write() at netbsd:cdev_write+0x14c sys/kern/subr_devsw.c:1507
cnwrite() at netbsd:cnwrite+0xcb sys/dev/cons.c:231
cdev_write() at netbsd:cdev_write+0x14c sys/kern/subr_devsw.c:1507
spec_write() at netbsd:spec_write+0x278 sys/miscfs/specfs/spec_vnops.c:1225
VOP_WRITE() at netbsd:VOP_WRITE+0x2ab sys/kern/vnode_if.c:824
vn_write() at netbsd:vn_write+0x309 sys/kern/vfs_vnops.c:715
do_filewritev.part.0() at netbsd:do_filewritev.part.0+0x56d
sys_writev() at netbsd:sys_writev+0x5e do_filewritev sys/kern/sys_generic.c:383 [inline]
sys_writev() at netbsd:sys_writev+0x5e sys/kern/sys_generic.c:383
sys___syscall() at netbsd:sys___syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys___syscall() at netbsd:sys___syscall+0x1e4 sys/kern/sys_syscall.c:90
syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 121 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/subr_copy.c:247:41, pointer expression with base 0xffffffffffffffff overflowed to 0x44

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT
331 331 2 0 0 ffffacdd1d574640 syz-executor.5
1211 1211 2 0 0 ffffacdd1e0a26c0 syz-executor.1
1204 1204 2 0 0 ffffacdd1de7c240 syz-executor.0
991 991 2 0 0 ffffacdd1d574a80 syz-executor.2
1200 >1209 7 0 100100 ffffacdd1e0a2280 syz-executor.3
1200 1200 3 1 10000000 ffffacdd1575ba40 syz-executor.3 lwpwait
1203 1203 2 1 40 ffffacdd1575b1c0 syz-executor.5
1245 1245 3 1 1c0 ffffacdd0fe17340 syz-executor.4 pipe_rd
1239 1239 2 1 140 ffffacdd10be9480 syz-executor.2
449 > 449 7 1 140 ffffacdd0fbfd280 syz-executor.3
1241 1241 2 0 140 ffffacdd10a6d0c0 syz-executor.1
813 813 2 0 0 ffffacdd10875080 syz-executor.0
1231 1240 2 0 100 ffffacdd1575b600 syz-fuzzer
1231 1236 3 0 180 ffffacdd1164f140 syz-fuzzer wait
1231 1199 3 0 180 ffffacdd1170ca00 syz-fuzzer wait
1231 1244 3 1 180 ffffacdd0f8adac0 syz-fuzzer parked
1231 829 3 1 180 ffffacdd108754c0 syz-fuzzer wait
1231 990 3 1 180 ffffacdd0f867200 syz-fuzzer wait
1231 929 3 0 180 ffffacdd0fecf300 syz-fuzzer wait
1231 1056 3 0 180 ffffacdd10a6d940 syz-fuzzer parked
1231 1237 3 0 180 ffffacdd0fbfdb00 syz-fuzzer wait
1231 1120 3 1 180 ffffacdd10a6d500 syz-fuzzer parked
1231 1226 3 0 180 ffffacdd0fe17780 syz-fuzzer parked
1231 1229 2 0 140 ffffacdd10875900 syz-fuzzer
1231 1231 3 0 180 ffffacdd0fc562c0 syz-fuzzer parked
1230 1230 3 0 180 ffffacdd10aa4100 sshd select
1224 1224 3 1 180 ffffacdd10aa4540 getty nanoslp
1225 1225 3 1 180 ffffacdd10aa4980 getty nanoslp
1216 1216 3 0 180 ffffacdd1170c5c0 getty nanoslp
1132 1132 3 0 1c0 ffffacdd1170c180 getty ttyraw
952 952 3 0 180 ffffacdd1164f580 sshd select
1067 1067 3 0 180 ffffacdd1164f9c0 powerd kqueue
700 700 3 0 180 ffffacdd0fbfd6c0 syslogd kqueue
746 746 3 0 180 ffffacdd10be98c0 dhcpcd poll
747 747 3 0 180 ffffacdd10be9040 dhcpcd poll
743 743 3 0 180 ffffacdd0fc56700 dhcpcd poll
602 602 3 1 180 ffffacdd0fe17bc0 dhcpcd poll
292 292 3 0 180 ffffacdd0fecf740 dhcpcd poll
485 485 3 1 180 ffffacdd0fecfb80 dhcpcd poll
291 291 3 1 180 ffffacdd0fc56b40 dhcpcd poll
1 1 3 0 180 ffffacdd0766b980 init wait
0 686 3 0 200 ffffacdd0f867640 physiod physiod
0 196 3 0 200 ffffacdd0f8ad680 pooldrain pooldrain
0 195 2 0 240 ffffacdd0f8ad240 ioflush
0 194 3 1 200 ffffacdd0f867a80 pgdaemon pgdaemon
0 170 3 0 200 ffffacdd0d7b7a40 usb7 usbevt
0 169 3 0 200 ffffacdd0d7b7600 usb6 usbevt
0 168 3 0 200 ffffacdd0d7b71c0 usb5 usbevt
0 167 3 0 200 ffffacdd0a752a00 usb4 usbevt
0 166 3 0 200 ffffacdd0a7525c0 usb3 usbevt
0 165 3 0 200 ffffacdd0a752180 usb2 usbevt
0 31 2 0 240 ffffacdd076bd9c0 usb1
0 63 2 0 240 ffffacdd076bd580 usb0
0 126 3 0 200 ffffacdd074f0740 usbtask-dr usbtsk
0 125 3 1 200 ffffacdd074f0b80 usbtask-hc usbtsk
0 124 3 0 200 ffffacdd05aa1b00 swwreboot swwreboot
0 123 2 0 240 ffffacdd076bd140 npfgc0
0 122 3 1 200 ffffacdd0766b540 rt_free rt_free
0 121 3 1 200 ffffacdd0766b100 unpgc unpgc
0 120 2 0 200 ffffacdd07656940 key_timehandler
0 119 3 1 200 ffffacdd07656500 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffacdd076560c0 icmp6_wqinput/0 icmp6_wqinput
0 117 2 0 200 ffffacdd07649900 nd6_timer
0 116 3 1 200 ffffacdd076494c0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffacdd07649080 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffacdd076248c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffacdd07624480 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffacdd07624040 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffacdd075e7bc0 icmp_wqinput/0 icmp_wqinput
0 110 2 0 200 ffffacdd075e7340 rt_timer
0 109 2 0 200 ffffacdd075e7780 vmem_rehash
0 100 3 0 200 ffffacdd074f0300 entbutler entropy
0 99 2 0 240 ffffacdd06f50b40 viomb
0 98 3 1 200 ffffacdd06f50700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffffacdd06f502c0 vioif0_txrx/0 vioif0_txrx
0 30 3 0 200 ffffacdd05aa16c0 scsibus0 sccomp
0 29 3 0 200 ffffacdd05aa1280 pms0 pmsreset
0 28 3 1 200 ffffacdd059acac0 xcall/1 xcall
0 27 1 1 200 ffffacdd059ac680 softser/1
0 26 1 1 200 ffffacdd059ac240 softclk/1
0 25 1 1 200 ffffacdd05987a80 softbio/1
0 24 1 1 200 ffffacdd05987640 softnet/1
0 23 1 1 201 ffffacdd05987200 idle/1
0 22 3 0 200 ffffacde33d2da40 lnxsyswq lnxsyswq
0 21 3 0 200 ffffacde33d2d600 lnxubdwq lnxubdwq
0 20 3 0 200 ffffacde33d2d1c0 lnxpwrwq lnxpwrwq
0 19 3 1 200 ffffacde33d34a00 lnxlngwq lnxlngwq
0 18 3 0 200 ffffacde33d345c0 lnxhipwq lnxhipwq
0 17 3 1 200 ffffacde33d34180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffacde33d539c0 sysmon smtaskq
0 15 3 0 200 ffffacde33d53580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffacde33d53140 pmfevent pmfevent
0 13 3 0 200 ffffacde33d5e980 sopendfree sopendfr
0 12 3 0 200 ffffacde33d5e540 ifwdog ifwdog
0 11 3 0 200 ffffacde33d5e100 iflnkst iflnkst
0 10 3 0 200 ffffacde34d93940 nfssilly nfssilly
0 9 3 0 200 ffffacde34d93500 vdrain vdrain
0 8 3 0 200 ffffacde34d930c0 modunload mod_unld
0 7 3 0 200 ffffacde34dba900 xcall/0 xcall
0 6 1 0 200 ffffacde34dba4c0 softser/0
0 5 1 0 200 ffffacde34dba080 softclk/0
0 4 1 0 200 ffffacde34de98c0 softbio/0
0 3 1 0 200 ffffacde34de9480 softnet/0
0 2 1 0 201 ffffacde34de9040 idle/0
0 0 2 0 240 ffffffff8674df00 swapper
[Locks tracked through LWPs]

****** LWP 991.991 (syz-executor.2) @ 0xffffacdd1d574a80, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:pmap_ctor+0x6d sys/arch/x86/x86/pmap.c:2860)
lock address : ffffacdd07677580
type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x6d
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 1
relevant cpu : 0 last held: 0
relevant lwp : 0xffffacdd1d574a80 last held: 000000000000000000
last locked : netbsd:pmap_extract+0xdb
unlocked* : netbsd:pmap_extract+0x2c8
owner field : 0xffffacdd1d574a80 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 813.813 (syz-executor.0) @ 0xffffacdd10875080, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:amap_alloc1+0x30a sys/uvm/uvm_amap.c:167)
lock address : ffffacdd11246cc0
type : sleep/adaptive
initialized : netbsd:amap_alloc1+0x30a
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffacdd10875080 last held: 0xffffacdd10875080
last locked* : netbsd:uvm_fault_internal+0x75d
unlocked : netbsd:uvm_fault_upper_enter+0x454
owner/count : 0xffffacdd10875080 flags : 0x0000000000000004
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 747.747 (dhcpcd) @ 0xffffacdd10be9040, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffacdd10be9040 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 743.743 (dhcpcd) @ 0xffffacdd0fc56700, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffacdd0fc56700 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 485.485 (dhcpcd) @ 0xffffacdd0fecfb80, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffacdd0fecfb80 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 291.291 (dhcpcd) @ 0xffffacdd0fc56b40, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 1 last held: 0
relevant lwp : 0xffffacdd0fc56b40 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.11 (iflnkst) @ 0xffffacde33d5e100, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffacde33d5e100 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.5 (softclk/0) @ 0xffffacde34dba080, l_stat=1

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffacde34dba080 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

****** LWP 0.0 (swapper) @ 0xffffffff8674df00, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffffff8674df00 last held: 000000000000000000
last locked : 0
unlocked* : 0
owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

[Locks tracked through CPUs]

******* Locks held on cpu0:

* Lock 0 (initialized at netbsd:main+0x106 sys/kern/init_main.c:303)
lock address : netbsd:kernel_lock
type : spin
initialized : netbsd:main+0x106
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffacdd1e0a2280 last held: 0xffffacdd1e0a2280
last locked* : netbsd:cdev_write+0x1a5
unlocked : netbsd:softint_dispatch+0xa37
curcpu holds : 1 wanted by: 000000000000000000

* Lock 1 (initialized at netbsd:kprintf_init+0x72 sys/kern/subr_prf.c:156)
lock address : netbsd:kprintf_mtx
type : spin
initialized : netbsd:kprintf_init+0x72
shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0
relevant lwp : 0xffffacdd1e0a2280 last held: 0xffffacdd1e0a2280
last locked* : netbsd:kprintf_lock+0x50
unlocked : netbsd:kprintf_unlock+0x70
owner field : 0x0000000000000800 wait/spin: 0/1

PAGE FLAG PQ UOBJECT UANON
0xffff8b8000007180 0045 00000000 0x0 0x0
0xffff8b8000007200 0045 00000000 0x0 0x0
0xffff8b8000007280 0045 00000000 0x0 0x0
0xffff8b8000007300 0045 00000000 0x0 0x0
0xffff8b8000007380 0045 00000000 0x0 0x0
0xffff8b8000007400 0045 00000000 0x0 0x0
0xffff8b8000007480 0045 00000000 0x0 0x0
0xffff8b8000007500 0045 00000000 0x0 0x0
0xffff8b8000007580 0045 00000000 0x0 0x0
0xffff8b8000007600 0045 00000000 0x0 0x0
0xffff8b8000007680 0041 00000000 0x0 0x0
0xffff8b8000007700 0041 00000000 0x0 0x0
0xffff8b8000007780 0041 00000000 0x0 0x0
0xffff8b8000007800 0041 00000000 0x0 0x0
0xffff8b8000007880 0045 00000000 0x0 0x0
0xffff8b8000007900 0045 00000000 0x0 0x0
0xffff8b8000007980 0041 00000000 0x0 0x0
0xffff8b8000007a00 0041 00000000 0x0 0x0
0xffff8b8000007a80 0041 00000000 0x0 0x0
0xffff8b8000007b00 0041 00000000 0x0 0x0
0xffff8b8000007b80 0041 00000000 0x0 0x0
0xffff8b8000007c00 0041 00000000 0x0 0x0
0xffff8b8000007c80 0041 00000000 0x0 0x0
0xffff8b8000007d00 0041 00000000 0x0 0x0
0xffff8b8000007d80 0041 00000000 0x0 0x0
0xffff8b8000007e00 0041 00000000 0x0 0x0
0xffff8b8000007e80 0041 00000000 0x0 0x0
0xffff8b8000007f00 0041 00000000 0x0 0x0
0xffff8b8000007f80 0041 00000000 0x0 0x0
0xffff8b8000008000 0041 00000000 0x0 0x0
0xffff8b8000008080 0041 00000000 0x0 0x0
0xffff8b8000008100 0041 00000000 0x0 0x0
0xffff8b8000008180 0041 00000000 0x0 0x0
0xffff8b8000008200 0041 00000000 0x0 0x0
0xffff8b8000008280 0041 00000000 0x0 0x0
0xffff8b8000008300 0041 00000000 0x0 0x0
0xffff8b8000008380 0041 00000000 0x0 0x0
0xffff8b8000008400 0041 00000000 0x0 0x0
0xffff8b8000008480 0041 00000000 0x0 0x0
0xffff8b8000008500 0041 00000000 0x0 0x0
0xffff8b8000008580 0041 00000000 0x0 0x0
0xffff8b8000008600 0045 00000000 0x0 0x0
0xffff8b8000008680 0041 00000000 0x0 0x0
0xffff8b8000008700 0041 00000000 0x0 0x0
0xffff8b8000008780 0041 00000000 0x0 0x0
0xffff8b8000008800 0045 00000000 0x0 0x0
0xffff8b8000008880 0041 00000000 0x0 0x0
0xffff8b8000008900 0041 00000000 0x0 0x0
0xffff8b8000008980 0041 00000000 0x0 0x0
0xffff8b8000008a00 0041 00000000 0x0 0x0
0xffff8b8000008a80 0041 00000000 0x0 0x0
0xffff8b8000008b00 0041 00000000 0x0 0x0
0xffff8b8000008b80 0041 00000000 0x0 0x0
0xffff8b8000008c00 0041 00000000 0x0 0x0
0xffff8b8000008c80 0041 00000000 0x0 0x0
0xffff8b8000008d00 0041 00000000 0x0 0x0
0xffff8b8000008d80 0041 00000000 0x0 0x0
0xffff8b8000008e00 0041 00000000 0x0 0x0
0xffff8b8000008e80 0041 00000000 0x0 0x0
0xffff8b8000008f00 0041 00000000 0x0 0x0
0xffff8b8000008f80 0041 00000000 0x0 0x0
0xffff8b8000009000 0041 00000000 0x0 0x0
0xffff8b8000009080 0041 00000000 0x0 0x0
0xffff8b8000009100 0041 00000000 0x0 0x0
0xffff8b8000009180 0041 00000000 0x0 0x0
0xffff8b8000009200 0041 00000000 0x0 0x0
0xffff8b8000009280 0041 00000000 0x0 0x0
0xffff8b8000009300 0041 00000000 0x0 0x0
0xffff8b8000009380 0041 00000000 0x0 0x0
0xffff8b8000009400 0041 00000000 0x0 0x0
0xffff8b8000009480 0045 00000000 0x0 0x0
0xffff8b8000009500 0041 00000000 0x0 0x0
0xffff8b8000009580 0041 00000000 0x0 0x0
0xffff8b8000009600 0041 00000000 0x0 0x0
0xffff8b8000009680 0041 00000000 0x0 0x0
0xffff8b8000009700 0041 00000000 0x0 0x0
0xffff8b8000009780 0041 00000000 0x0 0x0
0xffff8b8000009800 0041 00000000 0x0 0x0
0xffff8b8000009880 0041 00000000 0x0 0x0
0xffff8b8000009900 0041 00000000 0x0 0x0
0xffff8b8000009980 0041 00000000 0x0 0x0
0xffff8b8000009a00 0041 00000000 0x0 0x0
0xffff8b8000009a80 0045 00000000 0x0 0x0
0xffff8b8000009b00 0041 00000000 0x0 0x0
0xffff8b8000009b80 0041 00000000 0x0 0x0
0xffff8b8000009c00 0041 00000000 0x0 0x0
0xffff8b8000009c80 0041 00000000 0x0 0x0
0xffff8b8000009d00 0041 00000000 0x0 0x0
0xffff8b8000009d80 0041 00000000 0x0 0x0
0xffff8b8000009e00 0041 00000000 0x0 0x0
0xffff8b8000009e80 0041 00000000 0x0 0x0
0xffff8b8000009f00 0041 00000000 0x0 0x0
0xffff8b8000009f80 0041 00000000 0x0 0x0
0xffff8b800000a000 0041 00000000 0x0 0x0
0xffff8b800000a080 0041 00000000 0x0 0x0
0xffff8b800000a100 0041 00000000 0x0 0x0
0xffff8b800000a180 0041 00000000 0x0 0x0
0xffff8b800000a200 0041 00000000 0x0 0x0
0xffff8b800000a280 0041 00000000 0x0 0x0
0xffff8b800000a300 0041 00000000 0x0 0x0
0xffff8b800000a380 0041 00000000 0x0 0x0
0xffff8b800000a400 0041 00000000 0x0 0x0
0xffff8b800000a480 0041 00000000 0x0 0x0
0xffff8b800000a500 0041 00000000 0x0 0x0
0xffff8b800000a580 0041 00000000 0x0 0x0
0xffff8b800000a600 0041 00000000 0x0 0x0
0xffff8b800000a680 0041 00000000 0x0 0x0
0xffff8b800000a700 0041 00000000 0x0 0x0
0xffff8b800000a780 0041 00000000 0x0 0x0
0xffff8b800000a800 0041 00000000 0x0 0x0
0xffff8b800000a880 0041 00000000 0x0 0x0
0xffff8b800000a900 0041 00000000 0x0 0x0
0xffff8b800000a980 0041 00000000 0x0 0x0
0xffff8b800000aa00 0041 00000000 0x0 0x0
0xffff8b800000aa80 0041 00000000 0x0 0x0
0xffff8b800000ab00 0041 00000000 0x0 0x0
0xffff8b800000ab80 0041 00000000 0x0 0x0
0xffff8b800000ac00 0041 00000000 0x0 0x0
0xffff8b800000ac80 0041 00000000 0x0 0x0
0xffff8b800000ad00 0041 00000000 0x0 0x0
0xffff8b800000ad80 0041 00000000 0x0 0x0
0xffff8b800000ae00 0041 00000000 0x0 0x0
0xffff8b800000ae80 0045 00000000 0x0 0x0
0xffff8b800000af00 0045 00000000 0x0 0x0
0xffff8b800000af80 0045 00000000 0x0 0x0
0xffff8b800000b000 0041 00000000 0x0 0x0
0xffff8b800000b080 0041 00000000 0x0 0x0
0xffff8b800000b100 0041 00000000 0x0 0x0
0xffff8b800000b180 0045 00000000 0x0 0x0
0xffff8b800000b200 0041 00000000 0x0 0x0
0xffff8b800000b280 0045 00000000 0x0 0x0
0xffff8b800000b300 0045 00000000 0x0 0x0
0xffff8b800000b380 0045 00000000 0x0 0x0
0xffff8b800000b400 0041 00000000 0x0 0x0
0xffff8b800000b480 0041 00000000 0x0 0x0
0xffff8b800000b500 0045 00000000 0x0 0x0
0xffff8b800000b580 0045 00000000 0x0 0x0
0xffff8b800000b600 0045 00000000 0x0 0x0
0xffff8b800000b680 0045 00000000 0x0 0x0
0xffff8b800000b700 0045 00000000 0x0 0x0
0xffff8b800000b780 0045 00000000 0x0 0x0
0xffff8b800000b800 0045 00000000 0x0 0x0
0xffff8b800000b880 0041 00000000 0x0 0x0
0xffff8b800000b900 0045 00000000 0x0 0x0
0xffff8b800000b980 0045 00000000 0x0 0x0
0xffff8b800000ba00 0045 00000000 0x0 0x0
0xffff8b800000ba80 0045 00000000 0x0 0x0
0xffff8b800000bb00 0045 00000000 0x0 0x0
0xffff8b800000bb80 0045 00000000 0x0 0x0
0xffff8b800000bc00 0045 00000000 0x0 0x0
0xffff8b800000bc80 0041 00000000 0x0 0x0
0xffff8b800000bd00 0045 00000000 0x0 0x0
0xffff8b800000bd80 0045 00000000 0x0 0x0
0xffff8b800000be00 0045 00000000 0x0 0x0
0xffff8b800000be80 0045 00000000 0x0 0x0
0xffff8b800000bf00 0045 00000000 0x0 0x0
0xffff8b800000bf80 0045 00000000 0x0 0x0
0xffff8b800000c000 0045 00000000 0x0 0x0
0xffff8b800000c080 0041 00000000 0x0 0x0
0xffff8b800000c100 0045 00000000 0x0 0x0
0xffff8b800000c180 0045 00000000 0x0 0x0
0xffff8b800000c200 0045 00000000 0x0 0x0
0xffff8b800000c280 0045 00000000 0x0 0x0
0xffff8b800000c300 0045 00000000 0x0 0x0
0xffff8b800000c380 0045 00000000 0x0 0x0
0xffff8b800000c400 0045 00000000 0x0 0x0
0xffff8b800000c480 0045 00000000 0x0 0x0
0xffff8b800000c500 0045 00000000 0x0 0x0
0xffff8b800000c580 0045 00000000 0x0 0x0
0xffff8b800000c600 0045 00000000 0x0 0x0
0xffff8b800000c680 0045 00000000 0x0 0x0
0xffff8b800000c700 0041 00000000 0x0 0x0
0xffff8b800000c780 0041 00000000 0x0 0x0
0xffff8b800000c800 0045 00000000 0x0 0x0
0xffff8b800000c880 0045 00000000 0x0 0x0
0xffff8b800000c900 0045 00000000 0x0 0x0
0xffff8b800000c980 0045 00000000 0x0 0x0
0xffff8b800000ca00 0045 00000000 0x0 0x0
0xffff8b800000ca80 0041 00000000 0x0 0x0
0xffff8b800000cb00 0041 00000000 0x0 0x0
0xffff8b800000cb80 0041 00000000 0x0 0x0
0xffff8b800000cc00 0045 00000000 0x0 0x0
0xffff8b800000cc80 0045 00000000 0x0 0x0
0xffff8b800000cd00 0045 00000000 0x0 0x0
0xffff8b800000cd80 0041 00000000 0x0 0x0
0xffff8b800000ce00 0045 00000000 0x0 0x0
0xffff8b800000ce80 0041 00000000 0x0 0x0
0xffff8b800000cf00 0041 00000000 0x0 0x0
0xffff8b800000cf80 0041 00000000 0x0 0x0
0xffff8b800000d000 0041 00000000 0x0 0x0
0xffff8b800000d080 0045 00000000 0x0 0x0
0xffff8b800000d100 0041 00000000 0x0 0x0
0xffff8b800000d180 0041 00000000 0x0 0x0
0xffff8b800000d200 0041 00000000 0x0 0x0
0xffff8b800000d280 0041 00000000 0x0 0x0
0xffff8b800000d300 0045 00000000 0x0 0x0
0xffff8b800000d380 0041 00000000 0x0 0x0
0xffff8b800000d400 0041 00000000 0x0 0x0
0xffff8b800000d480 0045 00000000 0x0 0x0
0xffff8b800000d500 0041 00000000 0x0 0x0
0xffff8b800000d580 0041 00000000 0x0 0x0
0xffff8b800000d600 0041 00000000 0x0 0x0
0xffff8b800000d680 0045 00000000 0x0 0x0
0xffff8b800000d700 0041 00000000 0x0 0x0
0xffff8b800000d780 0045 00000000 0x0 0x0
0xffff8b800000d800 0041 00000000 0x0 0x0
0xffff8b800000d880 0045 00000000 0x0 0x0
0xffff8b800000d900 0041 00000000 0x0 0x0
0xffff8b800000d980 0041 00000000 0x0 0x0
0xffff8b800000da00 0041 00000000 0x0 0x0
0xffff8b800000da80 0041 00000000 0x0 0x0
0xffff8b800000db00 0045 00000000 0x0 0x0
0xffff8b800000db80 0045 00000000 0x0 0x0
0xffff8b800000dc00 0041 00000000 0x0 0x0
0xffff8b800000dc80 0041 00000000 0x0 0x0
0xffff8b800000dd00 0041 00000000 0x0 0x0
0xffff8b800000dd80 0041 00000000 0x0 0x0
0xffff8b800000de00 0041 00000000 0x0 0x0
0xffff8b800000de80 0041 00000000 0x0 0x0
0xffff8b800000df00 0045 00000000 0x0 0x0
0xffff8b800000df80 0045 00000000 0x0 0x0
0xffff8b800000e000 0045 00000000 0x0 0x0
0xffff8b800000e080 0041 00000000 0x0 0x0
0xffff8b800000e100 0041 00000000 0x0 0x0
0xffff8b800000e180 0045 00000000 0x0 0x0
0xffff8b800000e200 0041 00000000 0x0 0x0
0xffff8b800000e280 0045 00000000 0x0 0x0
0xffff8b800000e300 0045 00000000 0x0 0x0
0xffff8b800000e380 0041 00000000 0x0 0x0
0xffff8b800000e400 0045 00000000 0x0 0x0
0xffff8b800000e480 0041 00000000 0x0 0x0
0xffff8b800000e500 0045 00000000 0x0 0x0
0xffff8b800000e580 0041 00000000 0x0 0x0
0xffff8b800000e600 0045 00000000 0x0 0x0
0xffff8b800000e680 0041 00000000 0x0 0x0
0xffff8b800000e700 0041 00000000 0x0 0x0
0xffff8b800000e780 0041 00000000 0x0 0x0
0xffff8b800000e800 0045 00000000 0x0 0x0
0xffff8b800000e880 0041 00000000 0x0 0x0
0xffff8b800000e900 0041 00000000 0x0 0x0
0xffff8b800000e980 0041 00000000 0x0 0x0
0xffff8b800000ea00 0041 00000000 0x0 0x0
0xffff8b800000ea80 0045 00000000 0x0 0x0
0xffff8b800000eb00 0041 00000000 0x0 0x0
0xffff8b800000eb80 0045 00000000 0x0 0x0
0xffff8b800000ec00 0041 00000000 0x0 0x0
0xffff8b800000ec80 0045 00000000 0x0 0x0
0xffff8b800000ed00 0041 00000000 0x0 0x0
0xffff8b800000ed80 0041 00000000 0x0 0x0
0xffff8b800000ee00 0041 00000000 0x0 0x0
0xffff8b800000ee80 0041 00000000 0x0 0x0
0xffff8b800000ef00 0041 00000000 0x0 0x0
0xffff8b800000ef80 0041 00000000 0x0 0x0
0xffff8b800000f000 0041 00000000 0x0 0x0
0xffff8b800000f080 0045 00000000 0x0 0x0
0xffff8b800000f100 0041 00000000 0x0 0x0
0xffff8b800000f180 0041 00000000 0x0 0x0
0xffff8b800000f200 0041 00000000 0x0 0x0
0xffff8b800000f280 0045 00000000 0x0 0x0
0xffff8b800000f300 0041 00000000 0x0 0x0
0xffff8b800000f380 0041 00000000 0x0 0x0
0xffff8b800000f400 0045 00000000 0x0 0x0
0xffff8b800000f480 0041 00000000 0x0 0x0
0xffff8b800000f500 0041 00000000 0x0 0x0
0xffff8b800000f580 0041 00000000 0x0 0x0
0xffff8b800000f600 0041 00000000 0x0 0x0
0xffff8b800000f680 0041 00000000 0x0 0x0
0xffff8b800000f700 0041 00000000 0x0 0x0
0xffff8b800000f780 0041 00000000 0x0 0x0
0xffff8b800000f800 0041 00000000 0x0 0x0
0xffff8b800000f880 0045 00000000 0x0 0x0
0xffff8b800000f900 0041 00000000 0x0 0x0
0xffff8b800000f980 0045 00000000 0x0 0x0
0xffff8b800000fa00 0041 00000000 0x0 0x0
0xffff8b800000fa80 0041 00000000 0x0 0x0
0xffff8b800000fb00 0041 00000000 0x0 0x0
0xffff8b800000fb80 0041 00000000 0x0 0x0
0xffff8b800000fc00 0045 00000000 0x0 0x0
0xffff8b800000fc80 0041 00000000 0x0 0x0
0xffff8b800000fd00 0045 00000000 0x0 0x0
0xffff8b800000fd80 0041 00000000 0x0 0x0
0xffff8b800000fe00 0041 00000000 0x0 0x0
0xffff8b800000fe80 0041 00000000 0x0 0x0
0xffff8b800000ff00 0041 00000000 0x0 0x0
0xffff8b800000ff80 0041 00000000 0x0 0x0
0xffff8b8000010000 0041 00000000 0x0 0x0
0xffff8b8000010080 0045 00000000 0x0 0x0
0xffff8b8000010100 0041 00000000 0x0 0x0
0xffff8b8000010180 0045 00000000 0x0 0x0
0xffff8b8000010200 0045 00000000 0x0 0x0
0xffff8b8000010280 0041 00000000 0x0 0x0
0xffff8b8000010300 0041 00000000 0x0 0x0
0xffff8b8000010380 0041 00000000 0x0 0x0
0xffff8b8000010400 0041 00000000 0x0 0x0
0xffff8b8000010480 0041 00000000 0x0 0x0
0xffff8b8000010500 0045 00000000 0x0 0x0
0xffff8b8000010580 0041 00000000 0x0 0x0
0xffff8b8000010600 0041 00000000 0x0 0x0
0xffff8b8000010680 0045 00000000 0x0 0x0
0xffff8b8000010700 0041 00000000 0x0 0x0
0xffff8b8000010780 0041 00000000 0x0 0x0
0xffff8b8000010800 0041 00000000 0x0 0x0
0xffff8b8000010880 0041 00000000 0x0 0x0
0xffff8b8000010900 0041 00000000 0x0 0x0
0xffff8b8000010980 0045 00000000 0x0 0x0
0xffff8b8000010a00 0045 00000000 0x0 0x0
0xffff8b8000010a80 0041 00000000 0x0 0x0
0xffff8b8000010b00 0041 00000000 0x0 0x0
0xffff8b8000010b80 0041 00000000 0x0 0x0
0xffff8b8000010c00 0041 00000000 0x0 0x0
0xffff8b8000010c80 0045 00000000 0x0 0x0
0xffff8b8000010d00 0041 00000000 0x0 0x0
0xffff8b8000010d80 0041 00000000 0x0 0x0
0xffff8b8000010e00 0041 00000000 0x0 0x0
0xffff8b8000010e80 0045 00000000 0x0 0x0
0xffff8b8000010f00 0041 00000000 0x0 0x0
0xffff8b8000010f80 0041 00000000 0x0 0x0
0xffff8b8000011000 0041 00000000 0x0 0x0
0xffff8b8000011080 0041 00000000 0x0 0x0
0xffff8b8000011100 0041 00000000 0x0 0x0
0xffff8b8000011180 0041 00000000 0x0 0x0
0xffff8b8000011200 0045 00000000 0x0 0x0
0xffff8b8000011280 0041 00000000 0x0 0x0
0xffff8b8000011300 0041 00000000 0x0 0x0
0xffff8b8000011380 0041 00000000 0x0 0x0
0xffff8b8000011400 0041 00000000 0x0 0x0
0xffff8b8000011480 0045 00000000 0x0 0x0
0xffff8b8000011500 0045 00000000 0x0 0x0
0xffff8b8000011580 0041 00000000 0x0 0x0
0xffff8b8000011600 0041 00000000 0x0 0x0
0xffff8b8000011680 0041 00000000 0x0 0x0
0xffff8b8000011700 0045 00000000 0x0 0x0
0xffff8b8000011780 0045 00000000 0x0 0x0
0xffff8b8000011800 0041 00000000 0x0 0x0
0xffff8b8000011880 0041 00000000 0x0 0x0
0xffff8b8000011900 0041 00000000 0x0 0x0
0xffff8b8000011980 0041 00000000 0x0 0x0
0xffff8b8000011a00 0041 00000000 0x0 0x0
0xffff8b8000011a80 0041 00000000 0x0 0x0
0xffff8b8000011b00 0041 00000000 0x0 0x0
0xffff8b8000011b80 0041 00000000 0x0 0x0
0xffff8b8000011c00 0041 00000000 0x0 0x0
0xffff8b8000011c80 0041 00000000 0x0 0x0
0xffff8b8000011d00 0041 00000000 0x0 0x0
0xffff8b8000011d80 0041 00000000 0x0 0x0
0xffff8b8000011e00 0045 00000000 0x0 0x0
0xffff8b8000011e80 0041 00000000 0x0 0x0
0xffff8b8000011f00 0041 00000000 0x0 0x0
0xffff8b8000011f80 0041 00000000 0x0 0x0
0xffff8b8000012000 0041 00000000 0x0 0x0
0xffff8b8000012080 0041 00000000 0x0 0x0
0xffff8b8000012100 0045 00000000 0x0 0x0
0xffff8b8000012180 0045 00000000 0x0 0x0
0xffff8b8000012200 0041 00000000 0x0 0x0
0xffff8b8000012280 0045 00000000 0x0 0x0
0xffff8b8000012300 0041 00000000 0x0 0x0
0xffff8b8000012380 0041 00000000 0x0 0x0
0xffff8b8000012400 0041 00000000 0x0 0x0
0xffff8b8000012480 0041 00000000 0x0 0x0
0xffff8b8000012500 0041 00000000 0x0 0x0
0xffff8b8000012580 0041 00000000 0x0 0x0
0xffff8b8000012600 0041 00000000 0x0 0x0
0xffff8b8000012680 0041 00000000 0x0 0x0
0xffff8b8000012700 0041 00000000 0x0 0x0
0xffff8b8000012780 0041 00000000 0x0 0x0
0xffff8b8000012800 0041 00000000 0x0 0x0
0xffff8b8000012880 0041 00000000 0x0 0x0
0xffff8b8000012900 0041 00000000 0x0 0x0
0xffff8b8000012980 0041 00000000 0x0 0x0
0xffff8b8000012a00 0041 00000000 0x0 0x0
0xffff8b8000012a80 0041 00000000 0x0 0x0
0xffff8b8000012b00 0041 00000000 0x0 0x0
0xffff8b8000012b80 0041 00000000 0x0 0x0
0xffff8b8000012c00 0041 00000000 0x0 0x0
0xffff8b8000012c80 0041 00000000 0x0 0x0
0xffff8b8000012d00 0041 00000000 0x0 0x0
0xffff8b8000012d80 0041 00000000 0x0 0x0
0xffff8b8000012e00 0041 00000000 0x0 0x0
0xffff8b8000012e80 0041 00000000 0x0 0x0
0xffff8b8000012f00 0041 00000000 0x0 0x0
0xffff8b8000012f80 0041 00000000 0x0 0x0
0xffff8b8000013000 0041 00000000 0x0 0x0
0xffff8b8000013080 0045 00000000 0x0 0x0
0xffff8b8000013100 0001 00000000 0x0 0x0
0xffff8b8000013180 0001 00000000 0x0 0x0
0xffff8b8000013200 0001 00000000 0x0 0x0
0xffff8b8000013280 0001 00000000 0x0 0x0
0xffff8b8000013300 0001 00000000 0x0 0x0
0xffff8b8000013380 0001 00000000 0x0 0x0
0xffff8b8000013400 0001 00000000 0x0 0x0
0xffff8b8000013480 0001 00000000 0x0 0x0
0xffff8b8000013500 0001 00000000 0x0 0x0
0xffff8b8000013580 0001 00000000 0x0 0x0
0xffff8b8000013600 0001 00000000 0x0 0x0
0xffff8b8000013680 0001 00000000 0x0 0x0
0xffff8b8000013700 0001 00000000 0x0 0x0
0xffff8b8000013780 0001 00000000 0x0 0x0
0xffff8b8000013800 0001 00000000 0x0 0x0
0xffff8b8000013880 0001 00000000 0x0 0x0
0xffff8b8000013900 0001 00000000 0x0 0x0
0xffff8b8000013980 0001 00000000 0x0 0x0
0xffff8b8000013a00 0001 00000000 0x0 0x0
0xffff8b8000013a80 0001 00000000 0x0 0x0
0xffff8b8000013b00 0001 00000000 0x0 0x0
0xffff8b8000013b80 0001 00000000 0x0 0x0
0xffff8b8000013c00 0001 00000000 0x0 0x0
0xffff8b8000013c80 0001 00000000 0x0 0x0
0xffff8b8000013d00 0001 00000000 0x0 0x0
0xffff8b8000013d80 0001 00000000 0x0 0x0
0xffff8b8000013e00 0001 00000000 0x0 0x0
0xffff8b8000013e80 0001 00000000 0x0 0x0
0xffff8b8000013f00 0001 00000000 0x0 0x0
0xffff8b8000013f80 0001 00000000 0x0 0x0
0xffff8b8000014000 0001 00000000 0x0 0x0
0xffff8b8000014080 0001 00000000 0x0 0x0
0xffff8b8000014100 0001 00000000 0x0 0x0
0xffff8b8000014180 0001 00000000 0x0 0x0
0xffff8b8000014200 0001 00000000 0x0 0x0
0xffff8b8000014280 0001 00000000 0x0 0x0
0xffff8b8000014300 0001 00000000 0x0 0x0
0xffff8b8000014380 0001 00000000 0x0 0x0
0xffff8b8000014400 0001 00000000 0x0 0x0
0xffff8b8000014480 0001 00000000 0x0 0x0
0xffff8b8000014500 0001 00000000 0x0 0x0
0xffff8b8000014580 0001 00000000 0x0 0x0
0xffff8b8000014600 0001 00000000 0x0 0x0
0xffff8b8000014680 0001 00000000 0x0 0x0
0xffff8b8000014700 0001 00000000 0x0 0x0
0xffff8b8000014780 0001 00000000 0x0 0x0
0xffff8b8000014800 0001 00000000 0x0 0x0
0xffff8b8000014880 0001 00000000 0x0 0x0
0xffff8b8000014900 0001 00000000 0x0 0x0
0xffff8b8000014980 0001 00000000 0x0 0x0
0xffff8b8000014a00 0001 00000000 0x0 0x0
0xffff8b8000014a80 0001 00000000 0x0 0x0
0xffff8b8000014b00 0001 00000000 0x0 0x0
0xffff8b8000014b80 0001 00000000 0x0 0x0
0xffff8b8000014c00 0041 00000000 0x0 0x0
0xffff8b8000014c80 0041 00000000 0x0 0x0
0xffff8b8000014d00 0041 00000000 0x0 0x0
0xffff8b8000014d80 0041 00000000 0x0 0x0
0xffff8b8000014e00 0041 00000000 0x0 0x0
0xffff8b8000014e80 0041 00000000 0x0 0x0
0xffff8b8000014f00 0041 00000000 0x0 0x0
0xffff8b8000014f80 0041 00000000 0x0 0x0
0xffff8b8000015000 0041 00000000 0x0 0x0
0xffff8b8000015080 0041 00000000 0x0 0x0
0xffff8b8000015100 0041 00000000 0x0 0x0
0xffff8b8000015180 0041 00000000 0x0 0x0
0xffff8b8000015200 0041 00000000 0x0 0x0
0xffff8b8000015280 0041 00000000 0x0 0x0
0xffff8b8000015300 0041 00000000 0x0 0x0
0xffff8b8000015380 0041 00000000 0x0 0x0
0xffff8b8000015400 0041 00000000 0x0 0x0
0xffff8b8000015480 0041 00000000 0x0 0x0
0xffff8b8000015500 0041 00000000 0x0 0x0
0xffff8b8000015580 0041 00000000 0x0 0x0
0xffff8b8000015600 0041 00000000 0x0 0x0
0xffff8b8000015680 0041 00000000 0x0 0x0
0xffff8b8000015700 0041 00000000 0x0 0x0
0xffff8b8000015780 0041 00000000 0x0 0x0
0xffff8b8000015800 0041 00000000 0x0 0x0
0xffff8b8000015880 0041 00000000 0x0 0x0
0xffff8b8000015900 0041 00000000 0x0 0x0
0xffff8b8000015980 0041 00000000 0x0 0x0
0xffff8b8000015a00 0041 00000000 0x0 0x0
0xffff8b8000015a80 0041 00000000 0x0 0x0
0xffff8b8000015b00 0041 00000000 0x0 0x0
0xffff8b8000015b80 0041 00000000 0x0 0x0
0xffff8b8000015c00 0041 00000000 0x0 0x0
0xffff8b8000015c80 0041 00000000 0x0 0x0
0xffff8b8000015d00 0041 00000000 0x0 0x0
0xffff8b8000015d80 0041 00000000 0x0 0x0
0xffff8b8000015e00 0041 00000000 0x0 0x0
0xffff8b8000015e80 0041 00000000 0x0 0x0
0xffff8b8000015f00 0041 00000000 0x0 0x0
0xffff8b8000015f80 0041 00000000 0x0 0x0
0xffff8b8000016000 0041 00000000 0x0 0x0
0xffff8b8000016080 0041 00000000 0x0 0x0
0xffff8b8000016100 0001 00000000 0x0 0x0
0xffff8b8000016180 0001 00000000 0x0 0x0
0xffff8b8000016200 0001 00000000 0x0 0x0
0xffff8b8000016280 0001 00000000 0x0 0x0
0xffff8b8000016300 0001 00000000 0x0 0x0
0xffff8b8000016380 0001 00000000 0x0 0x0
0xffff8b8000016400 0001 00000000 0x0 0x0
0xffff8b8000016480 0001 00000000 0x0 0x0
0xffff8b8000016500 0001 00000000 0x0 0x0
0xffff8b8000016580 0001 00000000 0x0 0x0
0xffff8b8000016600 0001 00000000 0x0 0x0
0xffff8b8000016680 0001 00000000 0x0 0x0
0xffff8b8000016700 0001 00000000 0x0 0x0
0xffff8b8000016780 0001 00000000 0x0 0x0
0xffff8b8000016800 0001 00000000 0x0 0x0
0xffff8b8000016880 0001 00000000 0x0 0x0
0xffff8b8000016900 0001 00000000 0x0 0x0
0xffff8b8000016980 0001 00000000 0x0 0x0
0xffff8b8000016a00 0001 00000000 0x0 0x0
0xffff8b8000016a80 0001 00000000 0x0 0x0
0xffff8b8000016b00 0001 00000000 0x0 0x0
0xffff8b8000016b80 0001 00000000 0x0 0x0
0xffff8b8000016c00 0001 00000000 0x0 0x0
0xffff8b8000016c80 0001 00000000 0x0 0x0
0xffff8b8000016d00 0001 00000000 0x0 0x0
0xffff8b8000016d80 0001 00000000 0x0 0x0
0xffff8b8000016e00 0001 00000000 0x0 0x0
0xffff8b8000016e80 0001 00000000 0x0 0x0
0xffff8b8000016f00 0001 00000000 0x0 0x0
0xffff8b8000016f80 0001 00000000 0x0 0x0
0xffff8b8000017000 0001 00000000 0x0 0x0
0xffff8b8000017080 0001 00000000 0x0 0x0
0xffff8b8000017100 0001 00000000 0x0 0x0
0xffff8b8000017180 0001 00000000 0x0 0x0
0xffff8b8000017200 0001 00000000 0x0 0x0
0xffff8b8000017280 0001 00000000 0x0 0x0
0xffff8b8000017300 0001 00000000 0x0 0x0
0xffff8b8000017380 0001 00000000 0x0 0x0
0xffff8b8000017400 0001 00000000 0x0 0x0
0xffff8b8000017480 0001 00000000 0x0 0x0
0xffff8b8000017500 0001 00000000 0x0 0x0
0xffff8b8000017580 0001 00000000 0x0 0x0
0xffff8b8000017600 0001 00000000 0x0 0x0
0xffff8b8000017680 0001 00000000 0x0 0x0
0xffff8b8000017700 0001 00000000 0x0 0x0
0xffff8b8000017780 0001 00000000 0x0 0x0
0xffff8b8000017800 0001 00000000 0x0 0x0
0xffff8b8000017880 0001 00000000 0x0 0x0
0xffff8b8000017900 0001 00000000 0x0 0x0
0xffff8b8000017980 0001 00000000 0x0 0x0
0xffff8b8000017a00 0001 00000000 0x0 0x0
0xffff8b8000017a80 0001 00000000 0x0 0x0
0xffff8b8000017b00 0001 00000000 0x0 0x0
0xffff8b8000017b80 0001 00000000 0x0 0x0
0xffff8b8000017c00 0041 00000000 0x0 0x0
0xffff8b8000017c80 0041 00000000 0x0 0x0
0xffff8b8000017d00 0041 00000000 0x0 0x0
0xffff8b8000017d80 0041 00000000 0x0 0x0
0xffff8b8000017e00 0041 00000000 0x0 0x0
0xffff8b8000017e80 0041 00000000 0x0 0x0
0xffff8b8000017f00 0041 00000000 0x0 0x0
0xffff8b8000017f80 0041 00000000 0x0 0x0
0xffff8b8000018000 0041 00000000 0x0 0x0
0xffff8b8000018080 0041 00000000 0x0 0x0
0xffff8b8000018100 0041 00000000 0x0 0x0
0xffff8b8000018180 0041 00000000 0x0 0x0
0xffff8b8000018200 0041 00000000 0x0 0x0
0xffff8b8000018280 0041 00000000 0x0 0x0
0xffff8b8000018300 0041 00000000 0x0 0x0
0xffff8b8000018380 0041 00000000 0x0 0x0
0xffff8b8000018400 0041 00000000 0x0 0x0
0xffff8b8000018480 0041 00000000 0x0 0x0
0xffff8b8000018500 0041 00000000 0x0 0x0
0xffff8b8000018580 0041 00000000 0x0 0x0
0xffff8b8000018600 0041 00000000 0x0 0x0
0xffff8b8000018680 0041 00000000 0x0 0x0
0xffff8b8000018700 0041 00000000 0x0 0x0
0xffff8b8000018780 0041 00000000 0x0 0x0
0xffff8b8000018800 0041 00000000 0x0 0x0
0xffff8b8000018880 0041 00000000 0x0 0x0
0xffff8b8000018900 0041 00000000 0x0 0x0
0xffff8b8000018980 0041 00000000 0x0 0x0
0xffff8b8000018a00 0041 00000000 0x0 0x0
0xffff8b8000018a80 0041 00000000 0x0 0x0
0xffff8b8000018b00 0041 00000000 0x0 0x0
0xffff8b8000018b80 0041 00000000 0x0 0x0
0xffff8b8000018c00 0041 00000000 0x0 0x0
0xffff8b8000018c80 0041 00000000 0x0 0x0
0xffff8b8000018d00 0041 00000000 0x0 0x0
0xffff8b8000018d80 0041 00000000 0x0 0x0
0xffff8b8000018e00 0041 00000000 0x0 0x0
0xffff8b8000018e80 0041 00000000 0x0 0x0
0xffff8b8000018f00 0041 00000000 0x0 0x0
0xffff8b8000018f80 0041 00000000 0x0 0x0
0xffff8b8000019000 0041 00000000 0x0 0x0
0xffff8b8000019080 0041 00000000 0x0 0x0
0xffff8b8000019100 0001 00000000 0x0 0x0
0xffff8b8000019180 0001 00000000 0x0 0x0
0xffff8b8000019200 0001 00000000 0x0 0x0
0xffff8b8000019280 0001 00000000 0x0 0x0
0xffff8b8000019300 0001 00000000 0x0 0x0
0xffff8b8000019380 0001 00000000 0x0 0x0
0xffff8b8000019400 0001 00000000 0x0 0x0
0xffff8b8000019480 0001 00000000 0x0 0x0
0xffff8b8000019500 0001 00000000 0x0 0x0
0xffff8b8000019580 0001 00000000 0x0 0x0
0xffff8b8000019600 0001 00000000 0x0 0x0
0xffff8b8000019680 0001 00000000 0x0 0x0
0xffff8b8000019700 0001 00000000 0x0 0x0
0xffff8b8000019780 0001 00000000 0x0 0x0
0xffff8b8000019800 0001 00000000 0x0 0x0
0xffff8b8000019880 0001 00000000 0x0 0x0
0xffff8b8000019900 0001 00000000 0x0 0x0
0xffff8b8000019980 0001 00000000 0x0 0x0
0xffff8b8000019a00 0001 00000000 0x0 0x0
0xffff8b8000019a80 0001 00000000 0x0 0x0
0xffff8b8000019b00 0001 00000000 0x0 0x0
0xffff8b8000019b80 0001 00000000 0x0 0x0
0xffff8b8000019c00 0001 00000000 0x0 0x0
0xffff8b8000019c80 0001 00000000 0x0 0x0
0xffff8b8000019d00 0001 00000000 0x0 0x0
0xffff8b8000019d80 0001 00000000 0x0 0x0
0xffff8b8000019e00 0001 00000000 0x0 0x0
0xffff8b8000019e80 0001 00000000 0x0 0x0
0xffff8b8000019f00 0001 00000000 0x0 0x0
0xffff8b8000019f80 0001 00000000 0x0 0x0
0xffff8b800001a000 0001 00000000 0x0 0x0
0xffff8b800001a080 0001 00000000 0x0 0x0
0xffff8b800001a100 0001 00000000 0x0 0x0
0xffff8b800001a180 0001 00000000 0x0 0x0
0xffff8b800001a200 0001 00000000 0x0 0x0
0xffff8b800001a280 0001 00000000 0x0 0x0
0xffff8b800001a300 0001 00000000 0x0 0x0
0xffff8b800001a380 0001 00000000 0x0 0x0
0xffff8b800001a400 0001 00000000 0x0 0x0
0xffff8b800001a480 0001 00000000 0x0 0x0
0xffff8b800001a500 0001 00000000 0x0 0x0
0xffff8b800001a580 0001 00000000 0x0 0x0
0xffff8b800001a600 0001 00000000 0x0 0x0
0xffff8b800001a680 0001 00000000 0x0 0x0
0xffff8b800001a700 0001 00000000 0x0 0x0
0xffff8b800001a780 0001 00000000 0x0 0x0
0xffff8b800001a800 0001 00000000 0x0 0x0
0xffff8b800001a880 0001 00000000 0x0 0x0
0xffff8b800001a900 0001 00000000 0x0 0x0
0xffff8b800001a980 0001 00000000 0x0 0x0
0xffff8b800001aa00 0001 00000000 0x0 0x0
0xffff8b800001aa80 0001 00000000 0x0 0x0
0xffff8b800001ab00 0001 00000000 0x0 0x0
0xffff8b800001ab80 0001 00000000 0x0 0x0
0xffff8b800001ac00 0041 00000000 0x0 0x0
0xffff8b800001ac80 0041 00000000 0x0 0x0
0xffff8b800001ad00 0041 00000000 0x0 0x0
0xffff8b800001ad80 0041 00000000 0x0 0x0
0xffff8b800001ae00 0041 00000000 0x0 0x0
0xffff8b800001ae80 0041 00000000 0x0 0x0
0xffff8b800001af00 0041 00000000 0x0 0x0
0xffff8b800001af80 0041 00000000 0x0 0x0
0xffff8b800001b000 0041 00000000 0x0 0x0
0xffff8b800001b080 0041 00000000 0x0 0x0
0xffff8b800001b100 0041 00000000 0x0 0x0
0xffff8b800001b180 0041 00000000 0x0 0x0
0xffff8b800001b200 0041 00000000 0x0 0x0
0xffff8b800001b280 0041 00000000 0x0 0x0
0xffff8b800001b300 0041 00000000 0x0 0x0
0xffff8b800001b380 0041 00000000 0x0 0x0
0xffff8b800001b400 0045 00000000 0x0 0x0
0xffff8b800001b480 0041 00000000 0x0 0x0
0xffff8b800001b500 0041 00000000 0x0 0x0
0xffff8b800001b580 0041 00000000 0x0 0x0
0xffff8b800001b600 0041 00000000 0x0 0x0
0xffff8b800001b680 0041 00000000 0x0 0x0
0xffff8b800001b700 0045 00000000 0x0 0x0

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,

Jun 23, 2023, 11:16:05 AM6/23/23

to syzkaller-...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 21b18fa1a8ce tests/make: demonstrate inconsistency in patt..
git tree: netbsd

console output: https://syzkaller.appspot.com/x/log.txt?x=10b9357b280000

kernel config: https://syzkaller.appspot.com/x/.config?x=1420f906d33d9f1f
dashboard link: https://syzkaller.appspot.com/bug?extid=2d1d4e6756991c98e9c5
compiler: g++ (Debian 10.2.1-6) 10.2.1 20210110

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1507a08f280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1315f0c7280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ed66b44ab98b/disk-21b18fa1.raw.xz
netbsd.gdb: https://storage.googleapis.com/syzbot-assets/b407e06d29e2/netbsd-21b18fa1.gdb.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2d1d4e...@syzkaller.appspotmail.com

[ 41.4870580] panic: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/subr_copy.c:247:41, pointer expression with base 0xffffffffffffffff overflowed to 0x44

[ 41.4970533] cpu1: Begin traceback...
[ 41.5170411] vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:292
[ 41.5870368] Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
[ 41.6470369] HandlePointerOverflow() at netbsd:HandlePointerOverflow+0xd2 sys/../common/lib/libc/misc/ubsan.c:706
[ 41.7070368] uioskip() at netbsd:uioskip+0x2bf sys/kern/subr_copy.c:247
[ 41.7570369] ttwrite() at netbsd:ttwrite+0x201 sys/kern/tty.c:2380
[ 41.8070370] comwrite() at netbsd:comwrite+0x135 sys/dev/ic/com.c:1252
[ 41.8570403] cdev_write() at netbsd:cdev_write+0x14c sys/kern/subr_devsw.c:1507
[ 41.9070617] cnwrite() at netbsd:cnwrite+0xcb sys/dev/cons.c:231
[ 41.9570468] cdev_write() at netbsd:cdev_write+0x14c sys/kern/subr_devsw.c:1507
[ 42.0070359] spec_write() at netbsd:spec_write+0x278 sys/miscfs/specfs/spec_vnops.c:1225
[ 42.0570370] VOP_WRITE() at netbsd:VOP_WRITE+0x2ab sys/kern/vnode_if.c:824
[ 42.1170368] vn_write() at netbsd:vn_write+0x309 sys/kern/vfs_vnops.c:715
[ 42.1770365] do_filewritev.part.0() at netbsd:do_filewritev.part.0+0x56d
[ 42.2270641] sys_writev() at netbsd:sys_writev+0x5e do_filewritev sys/kern/sys_generic.c:383 [inline]
[ 42.2270641] sys_writev() at netbsd:sys_writev+0x5e sys/kern/sys_generic.c:383
[ 42.2870393] sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
[ 42.2870393] sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90
[ 42.3370510] syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
[ 42.3370510] syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
[ 42.3370510] syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
[ 42.3470365] --- syscall (number 121 via SYS_syscall) ---
[ 42.3670361] netbsd:syscall+0x2da:
[ 42.3770383] cpu1: End traceback...
[ 42.3770383] fatal breakpoint trap in supervisor mode
[ 42.3770383] trap type 1 code 0 rip 0xffffffff80235485 cs 0x8 rflags 0x246 cr2 0x20000000 ilevel 0 rsp 0xffffcb82482e4440
[ 42.3870485] curlwp 0xffffbfa7f715a980 pid 449.449 lowest kstack 0xffffcb82482e02c0
Stopped in pid 449.449 (syz-executor8293) at netbsd:breakpoint+0x5: leave

?
breakpoint() at netbsd:breakpoint+0x5
db_panic() at netbsd:db_panic+0xec sys/ddb/db_panic.c:69
vpanic() at netbsd:vpanic+0x2f2 sys/kern/subr_prf.c:292
Report() at netbsd:Report+0x3b sys/../common/lib/libc/misc/ubsan.c:1352
HandlePointerOverflow() at netbsd:HandlePointerOverflow+0xd2 sys/../common/lib/libc/misc/ubsan.c:706
uioskip() at netbsd:uioskip+0x2bf sys/kern/subr_copy.c:247
ttwrite() at netbsd:ttwrite+0x201 sys/kern/tty.c:2380
comwrite() at netbsd:comwrite+0x135 sys/dev/ic/com.c:1252
cdev_write() at netbsd:cdev_write+0x14c sys/kern/subr_devsw.c:1507
cnwrite() at netbsd:cnwrite+0xcb sys/dev/cons.c:231
cdev_write() at netbsd:cdev_write+0x14c sys/kern/subr_devsw.c:1507
spec_write() at netbsd:spec_write+0x278 sys/miscfs/specfs/spec_vnops.c:1225
VOP_WRITE() at netbsd:VOP_WRITE+0x2ab sys/kern/vnode_if.c:824
vn_write() at netbsd:vn_write+0x309 sys/kern/vfs_vnops.c:715
do_filewritev.part.0() at netbsd:do_filewritev.part.0+0x56d
sys_writev() at netbsd:sys_writev+0x5e do_filewritev sys/kern/sys_generic.c:383 [inline]
sys_writev() at netbsd:sys_writev+0x5e sys/kern/sys_generic.c:383

sys_syscall() at netbsd:sys_syscall+0x1e4 sy_call sys/sys/syscallvar.h:65 [inline]
sys_syscall() at netbsd:sys_syscall+0x1e4 sys/kern/sys_syscall.c:90

syscall() at netbsd:syscall+0x2da sy_call sys/sys/syscallvar.h:65 [inline]
syscall() at netbsd:syscall+0x2da sy_invoke sys/sys/syscallvar.h:94 [inline]
syscall() at netbsd:syscall+0x2da sys/arch/x86/x86/syscall.c:138
--- syscall (number 121 via SYS_syscall) ---
netbsd:syscall+0x2da:
Panic string: UBSan: Undefined Behavior in /syzkaller/managers/ci2-netbsd-kubsan/kernel/sys/kern/subr_copy.c:247:41, pointer expression with base 0xffffffffffffffff overflowed to 0x44

PID LID S CPU FLAGS STRUCT LWP * NAME WAIT

449 > 449 7 1 0 ffffbfa7f715a980 syz-executor8293
990 990 2 1 0 ffffbfa7f6e8d940 syz-executor8293
1239 1239 2 0 0 ffffbfa7f5fe3b00 syz-executor8293
929 929 2 0 0 ffffbfa7f6d4b4c0 syz-executor8293
1243 1243 2 0 0 ffffbfa7f6e8d500 syz-executor8293
1224 1224 2 1 0 ffffbfa7f62382c0 syz-executor8293
941 941 2 1 140 ffffbfa7f67f2480 syz-executor8293
1241 1241 3 0 180 ffffbfa7f6d4b900 syz-executor8293 nanoslp
1225 1225 2 1 140 ffffbfa7f715a100 syz-executor8293
1120 1120 2 1 140 ffffbfa7f67f28c0 syz-executor8293
698 698 3 0 180 ffffbfa7f6238700 syz-executor8293 nanoslp
1230 >1230 7 0 100 ffffbfa7f715a540 sshd
1222 1222 3 0 180 ffffbfa7f81411c0 getty nanoslp
1184 1184 3 1 180 ffffbfa7f748d5c0 getty nanoslp
1083 1083 3 0 180 ffffbfa7f748da00 getty nanoslp
1196 1196 3 1 1c0 ffffbfa7f6da69c0 getty ttyraw
1109 1109 3 0 180 ffffbfa7f748d180 sshd select
1067 1067 3 0 180 ffffbfa7f6da6140 powerd kqueue
702 702 3 0 180 ffffbfa7f6238b40 syslogd kqueue
746 746 3 0 180 ffffbfa7f61c7740 dhcpcd poll
742 742 3 0 180 ffffbfa7f64e3340 dhcpcd poll
466 466 3 0 180 ffffbfa7f61c7b80 dhcpcd poll
598 598 3 0 180 ffffbfa7f61c7300 dhcpcd poll
292 292 3 0 180 ffffbfa7f67f2040 dhcpcd poll
485 485 3 1 180 ffffbfa7f64e3780 dhcpcd poll
291 291 3 0 180 ffffbfa7f64e3bc0 dhcpcd poll
1 1 3 0 180 ffffbfa7eda73980 init wait
0 986 3 0 200 ffffbfa7f5c77240 physiod physiod
0 196 3 0 200 ffffbfa7ed8f0740 ioflush syncer
0 195 3 0 200 ffffbfa7ed8f0b80 pooldrain pooldrain
0 194 3 1 200 ffffbfa7f5c77680 pgdaemon pgdaemon
0 170 3 1 200 ffffbfa7f4c0c640 usb7 usbevt
0 169 3 1 200 ffffbfa7f4c0c200 usb6 usbevt
0 168 3 1 200 ffffbfa7f1b6fa40 usb5 usbevt
0 167 3 1 200 ffffbfa7f1b6f600 usb4 usbevt
0 166 3 1 200 ffffbfa7f1b6f1c0 usb3 usbevt
0 165 3 1 200 ffffbfa7eeb0aa00 usb2 usbevt
0 31 3 1 200 ffffbfa7eeb0a5c0 usb1 usbevt
0 63 3 1 200 ffffbfa7eeb0a180 usb0 usbevt
0 126 3 1 200 ffffbfa7edade9c0 usbtask-dr usbtsk
0 125 3 0 200 ffffbfa7edade580 usbtask-hc usbtsk
0 124 3 1 200 ffffbfa7edade140 swwreboot swwreboot
0 123 3 0 200 ffffbfa7ebea1b00 npfgc0 npfgcw
0 122 3 1 200 ffffbfa7eda73540 rt_free rt_free
0 121 3 1 200 ffffbfa7eda73100 unpgc unpgc
0 120 3 0 200 ffffbfa7eda5e940 key_timehandler key_timehandler
0 119 3 1 200 ffffbfa7eda5e500 icmp6_wqinput/1 icmp6_wqinput
0 118 3 0 200 ffffbfa7eda5e0c0 icmp6_wqinput/0 icmp6_wqinput
0 117 3 0 200 ffffbfa7eda49900 nd6_timer nd6_timer
0 116 3 1 200 ffffbfa7eda494c0 carp6_wqinput/1 carp6_wqinput
0 115 3 0 200 ffffbfa7eda49080 carp6_wqinput/0 carp6_wqinput
0 114 3 1 200 ffffbfa7eda2c8c0 carp_wqinput/1 carp_wqinput
0 113 3 0 200 ffffbfa7eda2c480 carp_wqinput/0 carp_wqinput
0 112 3 1 200 ffffbfa7eda2c040 icmp_wqinput/1 icmp_wqinput
0 111 3 0 200 ffffbfa7ed9e7bc0 icmp_wqinput/0 icmp_wqinput
0 110 3 0 200 ffffbfa7ed9e7340 rt_timer rt_timer
0 109 3 0 200 ffffbfa7ed9e7780 vmem_rehash vmem_rehash
0 100 3 0 200 ffffbfa7ed8f0300 entbutler entropy
0 99 3 1 200 ffffbfa7ed350b40 viomb balloon
0 98 3 1 200 ffffbfa7ed350700 vioif0_txrx/1 vioif0_txrx
0 97 3 0 200 ffffbfa7ed3502c0 vioif0_txrx/0 vioif0_txrx
0 30 3 1 200 ffffbfa7ebea16c0 scsibus0 sccomp
0 29 3 0 200 ffffbfa7ebea1280 pms0 pmsreset
0 28 3 1 200 ffffbfa7ebdacac0 xcall/1 xcall
0 27 1 1 200 ffffbfa7ebdac680 softser/1
0 26 1 1 200 ffffbfa7ebdac240 softclk/1
0 25 1 1 200 ffffbfa7ebd87a80 softbio/1
0 24 1 1 200 ffffbfa7ebd87640 softnet/1
0 23 1 1 201 ffffbfa7ebd87200 idle/1
0 22 3 0 200 ffffbfa91a12da40 lnxsyswq lnxsyswq
0 21 3 0 200 ffffbfa91a12d600 lnxubdwq lnxubdwq
0 20 3 0 200 ffffbfa91a12d1c0 lnxpwrwq lnxpwrwq
0 19 3 0 200 ffffbfa91a134a00 lnxlngwq lnxlngwq
0 18 3 1 200 ffffbfa91a1345c0 lnxhipwq lnxhipwq
0 17 3 0 200 ffffbfa91a134180 lnxrcugc lnxrcugc
0 16 3 0 200 ffffbfa91a1539c0 sysmon smtaskq
0 15 3 1 200 ffffbfa91a153580 pmfsuspend pmfsuspend
0 14 3 0 200 ffffbfa91a153140 pmfevent pmfevent
0 13 3 0 200 ffffbfa91a15e980 sopendfree sopendfr
0 12 3 0 200 ffffbfa91a15e540 ifwdog ifwdog
0 11 3 0 200 ffffbfa91a15e100 iflnkst iflnkst
0 10 3 1 200 ffffbfa91b193940 nfssilly nfssilly
0 9 3 1 200 ffffbfa91b193500 vdrain vdrain
0 8 3 0 200 ffffbfa91b1930c0 modunload mod_unld
0 7 3 0 200 ffffbfa91b1ba900 xcall/0 xcall
0 6 1 0 200 ffffbfa91b1ba4c0 softser/0
0 5 1 0 200 ffffbfa91b1ba080 softclk/0
0 4 1 0 200 ffffbfa91b1e98c0 softbio/0
0 3 1 0 200 ffffbfa91b1e9480 softnet/0
0 2 1 0 201 ffffbfa91b1e9040 idle/0
0 0 3 0 200 ffffffff8674df00 swapper uvm
[Locks tracked through LWPs]

****** LWP 990.990 (syz-executor8293) @ 0xffffbfa7f6e8d940, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:vcache_alloc+0xba sys/kern/vfs_vnode.c:1376)
lock address : ffffbfa7f86ba540
type : sleep/adaptive
initialized : netbsd:vcache_alloc+0xba

shared holds : 0 exclusive: 0

shares wanted: 0 exclusive: 2
relevant cpu : 1 last held: 1
relevant lwp : 0xffffbfa7f6e8d940 last held: 000000000000000000
last locked : netbsd:genfs_lock+0x220
unlocked* : netbsd:genfs_unlock+0x50
owner/count : 000000000000000000 flags : 0x0000000000000002

Turnstile: no active turnstile for this lock.

****** LWP 1239.1239 (syz-executor8293) @ 0xffffbfa7f5fe3b00, l_stat=2

*** Locks held:

* Lock 0 (initialized at netbsd:pmap_ctor+0x6d sys/arch/x86/x86/pmap.c:2860)

lock address : ffffbfa7eda7f580

type : sleep/adaptive
initialized : netbsd:pmap_ctor+0x6d

shared holds : 0 exclusive: 1
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffbfa7f5fe3b00 last held: 0xffffbfa7f5fe3b00
last locked* : netbsd:pmap_enter_ma+0x3c0
unlocked : netbsd:pmap_extract+0x2c8

owner field : 000000000000000000 wait/spin: 0/0
Turnstile: no active turnstile for this lock.

*** Locks wanted: none

****** LWP 1224.1224 (syz-executor8293) @ 0xffffbfa7f62382c0, l_stat=2

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:vcache_alloc+0xba sys/kern/vfs_vnode.c:1376)
lock address : ffffbfa7f86ba540
type : sleep/adaptive
initialized : netbsd:vcache_alloc+0xba

shared holds : 0 exclusive: 0

shares wanted: 0 exclusive: 2
relevant cpu : 1 last held: 1
relevant lwp : 0xffffbfa7f62382c0 last held: 000000000000000000
last locked : netbsd:genfs_lock+0x220
unlocked* : netbsd:genfs_unlock+0x50
owner/count : 000000000000000000 flags : 0x0000000000000002

Turnstile: no active turnstile for this lock.

****** LWP 742.742 (dhcpcd) @ 0xffffbfa7f64e3340, l_stat=3

*** Locks held: none

*** Locks wanted:

* Lock 0 (initialized at netbsd:module_hook_init+0x1c sys/kern/kern_module_hook.c:132)
lock address : netbsd:module_hook
type : sleep/adaptive
initialized : netbsd:module_hook_init+0x1c
shared holds : 0 exclusive: 0
shares wanted: 0 exclusive: 0
relevant cpu : 0 last held: 0

relevant lwp : 0xffffbfa7f64e3340 last held: 000000000000000000