On Fri, Dec 26, 2025 at 01:02:17PM +0100, Alexander Bluhm wrote:
> Anyway. Currently I cannot reproduce. I will keep an eye on it.
> I will use the diff below if it happens again.
And just after writing this, I hit the crash.
[-- MARK -- Fri Dec 26 00:55:00 2025]
page still active?PAGE 0xd1858694:
flags=3010000<FREE,PMAP0,PMAP1>, vers=220, wire_count=0, pa=0xff03000
uobject=0x0, uanon=0x0, offset=0x0
[page ownership tracking disabled] vm_page_md 0xd18586d0
page found in uvm_pmemrange
panic: uvm_fault(0xd0f8a1a4, 0xfffff000, 0, 1) -> e
Stopped at db_enter+0x4: popl %ebp
TID PID UID PRFLAGS PFLAGS CPU COMMAND
150750 25821 21 0x2 0 0 c++
28956 62662 21 0x2 0 6 c++
439581 20676 21 0x2 0 11 c++
213723 31437 21 0x2 0 10 c++
127842 75476 21 0x2 0 7 c++
180998 62524 21 0x2 0 3 c++
413634 30291 21 0x2 0 5 c++
218332 54943 21 0x2 0 9 c++
474567 40936 21 0x2 0 2 c++
299976 17055 21 0x2 0 8 c++
121025 3932 21 0x2 0 4 c++
*407549 72660 0 0x14000 0x200 1K pagedaemon
db_enter() at db_enter+0x4
panic(d0cc8847) at panic+0x7a
kpageflttrap(f6897efc,ffffffff) at kpageflttrap+0x133
trap(f6897efc) at trap+0x255
calltrap() at calltrap+0xc
uvmpd_scan_active(0,0,2dcad) at uvmpd_scan_active+0x74
uvmpd_scan(0,ffffffa7,2dcad) at uvmpd_scan+0x76
uvm_pageout(d6c5200c) at uvm_pageout+0x29b
https://www.openbsd.org/ddb.html describes the minimum info required in bug
reports. Insufficient info makes it difficult to find and fix bugs.
ddb{1}>
ddb{1}> x/s version
version: OpenBSD 7.8-current (GENERIC.MP) #1: Thu Dec 25 22:16:54 CET
2025\012
[email protected]:/usr/src/sys/arch/i386/compile/GENERIC.MP\012
ddb{1}> show panic
*cpu1: uvm_fault(0xd0f8a1a4, 0xfffff000, 0, 1) -> e
ddb{1}> trace
db_enter() at db_enter+0x4
panic(d0cc8847) at panic+0x7a
kpageflttrap(f6897efc,ffffffff) at kpageflttrap+0x133
trap(f6897efc) at trap+0x255
calltrap() at calltrap+0xc
uvmpd_scan_active(0,0,2dcad) at uvmpd_scan_active+0x74
uvmpd_scan(0,ffffffa7,2dcad) at uvmpd_scan+0x76
uvm_pageout(d6c5200c) at uvm_pageout+0x29b
ddb{1}> show register
ds 0x10
es 0x10
fs 0x20
gs 0
edi 0xd0cc8847 gen12_xcs_offsets+0xee63
esi 0
ebp 0xf6897e74
ebx 0xf6537618
edx 0x10
ecx 0x86f74566
eax 0x34
eip 0xd03c5ff4 db_enter+0x4
cs 0x8
eflags 0x202
esp 0xf6897e74
ss 0x10
db_enter+0x4: popl %ebp
ddb{1}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
71150 184581 65056 21 2 0x2 c++
65056 147812 49839 21 3 0x10008a sigsusp sh
25821 150750 98178 21 7 0x2 c++
98178 218769 49839 21 3 0x10008a sigsusp sh
62662 28956 51023 21 7 0x2 c++
51023 368508 49839 21 3 0x10008a sigsusp sh
20676 439581 63259 21 7 0x2 c++
63259 521671 49839 21 3 0x10008a sigsusp sh
31437 213723 3357 21 7 0x2 c++
3357 287626 49839 21 3 0x10008a sigsusp sh
75476 127842 59174 21 7 0x2 c++
59174 11352 49839 21 3 0x10008a sigsusp sh
62524 180998 31633 21 7 0x2 c++
31633 480490 49839 21 3 0x10008a sigsusp sh
30291 413634 89721 21 7 0x2 c++
89721 97585 49839 21 3 0x10008a sigsusp sh
54943 218332 22085 21 7 0x2 c++
22085 405203 49839 21 3 0x10008a sigsusp sh
40936 474567 23855 21 7 0x2 c++
23855 127428 49839 21 3 0x10008a sigsusp sh
17055 299976 31755 21 7 0x2 c++
31755 159766 49839 21 3 0x10008a sigsusp sh
11447 461043 13295 21 2 0x2 c++
13295 123547 49839 21 3 0x10008a sigsusp sh
3932 121025 64006 21 7 0x2 c++
64006 133157 49839 21 3 0x10008a sigsusp sh
49839 496029 96489 21 3 0x10008a sigsusp make
96489 275082 83197 21 3 0x10008a sigsusp sh
83197 240924 46677 21 3 0x10008a sigsusp make
46677 47074 62228 21 3 0x10008a sigsusp sh
62228 325294 46203 21 3 0x10008a sigsusp make
46203 404728 74760 21 3 0x10008a sigsusp sh
74760 363055 34981 21 3 0x10008a sigsusp make
34981 136972 46893 21 3 0x10008a sigsusp sh
46893 271857 83805 21 3 0x10008a sigsusp make
83805 271261 80309 0 3 0x10008a sigsusp sh
80309 407112 64752 0 3 0x10008a sigsusp make
64752 243376 76522 0 3 0x10008a sigsusp make
76522 300682 34804 0 3 0x10008a sigsusp ksh
34804 156148 36075 0 3 0x98 kqread sshd-session
36075 209706 23259 0 3 0x92 kqread sshd-session
58218 210746 45140 0 3 0x100083 ttyin ksh
45140 473523 1 0 3 0x100080 kqread tmux
67591 169435 1 0 3 0x100083 ttyin getty
74499 442450 1 0 3 0x100083 ttyin getty
23136 20052 1 0 3 0x100083 ttyin getty
11405 424778 1 0 3 0x100083 ttyin getty
60534 522434 1 0 3 0x100083 ttyin getty
2986 439817 1 0 3 0x100083 ttyin getty
27085 344782 1 0 3 0x100098 kqread cron
50181 207661 1 99 3 0x1100090 kqread sndiod
84165 434104 1 110 3 0x100090 kqread sndiod
5346 353242 1 0 3 0x100090 kqread inetd
70049 507091 43980 95 3 0x1100092 kqread smtpd
36047 437246 43980 103 3 0x1100092 kqread smtpd
52064 383376 43980 95 3 0x1100092 kqread smtpd
32350 201058 43980 95 3 0x100092 kqread smtpd
3250 446360 43980 95 3 0x1100092 kqread smtpd
24809 251360 43980 95 3 0x1100092 kqread smtpd
43980 314390 1 0 3 0x100080 kqread smtpd
55846 388872 92758 91 3 0x92 kqread snmpd_metrics
3568 76833 92758 91 3 0x1100092 kqread snmpd
92758 27755 1 0 3 0x100080 kqread snmpd
23259 412419 1 0 3 0x88 kqread sshd
38734 517678 0 0 3 0x14280 nfsidl nfsio
83820 431547 0 0 3 0x14280 nfsidl nfsio
23891 51340 0 0 3 0x14280 nfsidl nfsio
44351 482917 0 0 3 0x14280 nfsidl nfsio
55237 479214 1 0 3 0x100080 kqread ntpd
94180 521617 41132 83 3 0x100092 kqread ntpd
41132 331133 1 83 3 0x1100092 kqread ntpd
4830 405799 48281 73 3 0x1100090 kqread syslogd
48281 269275 1 0 3 0x100082 sbwait syslogd
19386 298283 29711 77 3 0x100092 kqread dhcpleased
40873 120750 29711 77 3 0x100092 kqread dhcpleased
29711 164325 1 0 3 0x80 kqread dhcpleased
33771 200128 21490 115 3 0x100092 kqread slaacd
32449 231088 21490 115 3 0x100092 kqread slaacd
21490 510142 1 0 3 0x100080 kqread slaacd
33272 118812 0 0 3 0x14200 bored smr
6061 498885 0 0 3 0x14200 pgzero zerothread
97453 312584 0 0 3 0x14200 aiodoned aiodoned
16689 511017 0 0 3 0x14200 syncer update
73044 432918 0 0 3 0x14200 cleaner cleaner
52824 342617 0 0 3 0x14200 reaper reaper
*72660 407549 0 0 7 0x14200 pagedaemon
81605 482496 0 0 3 0x14200 bored wsdisplay0
5912 28166 0 0 3 0x14200 usbtsk usbtask
94098 460956 0 0 3 0x14200 usbatsk usbatsk
46923 309318 0 0 3 0x14200 bored sensors
96855 178954 0 0 3 0x40014200 acpi0 acpi0
10341 413509 0 0 3 0x40014200 idle11
39904 242772 0 0 3 0x40014200 idle10
39134 238315 0 0 3 0x40014200 idle9
88160 239044 0 0 3 0x40014200 idle8
74367 240634 0 0 3 0x40014200 idle7
44544 398788 0 0 3 0x40014200 idle6
8033 409091 0 0 3 0x40014200 idle5
47403 49859 0 0 3 0x40014200 idle4
8489 491010 0 0 3 0x40014200 idle3
49909 273039 0 0 3 0x40014200 idle2
7425 110450 0 0 3 0x40014200 idle1
67917 279499 0 0 3 0x14200 bored softnet7
47328 329784 0 0 3 0x14200 bored softnet6
95036 329128 0 0 3 0x14200 bored softnet5
3629 310536 0 0 3 0x14200 bored softnet4
38147 481979 0 0 3 0x14200 bored softnet3
11666 453986 0 0 3 0x14200 bored softnet2
63719 125476 0 0 3 0x14200 bored softnet1
97682 433885 0 0 3 0x14200 bored softnet0
19672 427215 0 0 3 0x14200 bored systqmp
2588 243921 0 0 3 0x14200 bored systq
99272 320977 0 0 3 0x14200 tmoslp softclockmp
76838 285470 0 0 3 0x40014200 tmoslp softclock
2494 302105 0 0 3 0x40014200 idle0
77695 38663 0 0 3 0x14200 kmalloc kmthread
1 103533 0 0 3 0x82 wait init
0 0 -1 0 3 0x10200 scheduler swapper
ddb{1}> show uvm
Current UVM status:
pagesize=4096 (0x1000), pagemask=0xfff, pageshift=12
765676 VM pages: 504632 active, 146883 inactive, 1 wired, 30428 free (27040
zero)
freemin=25522, free-target=34029, inactive-target=215798, wired-max=255225
faults=314954047, traps=317652474, intrs=5234361, ctxswitch=49166418
fpuswitch=408033
softint=3877144, syscalls=285698306, kmapent=15
fault counts:
noram=590790, noanon=0, noamap=0, pgwait=2, pgrele=0
relocks=3417958(9704), upgrades=0(0) anget(retries)=107431331(2619217),
amapcopy=18272949
neighbor anon/obj pg=13509017/150343653, gets(lock/unlock)=53342493/839786
cases: anon=105604779, anoncow=1825744, obj=52298757, prcopy=1002691,
przero=154222967
daemon and swap counts:
woke=159357, revs=159122, scans=35881904, obscans=264943, anscans=20569269
busy=0, freed=2989634, reactivate=15047272, deactivate=28122452
pageouts=26186707, pending=595771, nswget=2279042
nswapdev=1
swpages=849685, swpginuse=35810, swpgonly=21679 paging=0
kernel pointers:
objs(kern)=0xd0fa1230
ddb{1}> show struct vm_page 0xd1858694
struct vm_page at 0xd1858694 (76 bytes) {pageq = {tqe_next = (struct vm_page
*)0x0, tqe_prev = 0xd18535d4}, objt = {rbt_parent = (struct rb_entry
*)0xd18581dc, rbt_left = (struct rb_entry *)0xd18582c0, rbt_right = (struct
rb_entry *)0xd1858734, rbt_color = 0}, uanon = (struct vm_anon *)0x0, uobject =
(struct uvm_object *)0x0, offset = 0, pg_flags = 50397184, pg_version = 220,
wire_count = 0, phys_addr = 267399168, fpgsz = 1, mdpage = {pv_mtx = {mtx_owner
= 0, mtx_wantipl = 144, mtx_oldipl = 144}, pv_list = (struct pv_entry *)0x0}}
ddb{0}> trace
db_enter() at db_enter+0x4
i386_ipi_handler() at i386_ipi_handler+0x3f
Xipi_untramp() at Xipi_untramp+0xc2
_kernel_lock() at _kernel_lock+0x86
softintr_dispatch(0) at softintr_dispatch+0xb7
Xsoftclock() at Xsoftclock+0x12
end of kernel
ddb{0}> ps
...
*25821 150750 98178 21 7 0x2 c++
ddb{2}> trace
db_enter() at db_enter+0x4
i386_ipi_handler() at i386_ipi_handler+0x3f
Xipi_untramp() at Xipi_untramp+0xc2
mtx_enter(d0f929c8) at mtx_enter+0x166
uvm_pageactivate(d4a9fda8) at uvm_pageactivate+0x64
uvm_fault_upper_lookup(f745b4d0,f745b4a4,f745b52c,f745b4ec) at
uvm_fault_upper_lookup+0x108
uvm_fault(f955db98,5f36c000,0,1) at uvm_fault+0x11b
upageflttrap(f745b5e0,5f36cd80) at upageflttrap+0x55
trap(f745b5e0) at trap+0x1e9
calltrap() at calltrap+0xc
end of kernel
ddb{2}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
...
*40936 474567 23855 21 7 0x2 c++
ddb{3}> trace
db_enter() at db_enter+0x4
i386_ipi_handler() at i386_ipi_handler+0x3f
Xipi_untramp() at Xipi_untramp+0xc2
mtx_enter(d0f929c8) at mtx_enter+0x16c
uvm_pageactivate(d2bd12a4) at uvm_pageactivate+0x64
uvm_fault_lower(f71e7430,f71e7404,f71e744c) at uvm_fault_lower+0x3b7
uvm_fault(f955dc6c,2a57e000,0,2) at uvm_fault+0x1a1
upageflttrap(f71e7540,2a57e000) at upageflttrap+0x55
trap(f71e7540) at trap+0x1e9
calltrap() at calltrap+0xc
end of kernel
ddb{3}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
...
*62524 180998 31633 21 7 0x2 c++
ddb{4}> trace
db_enter() at db_enter+0x4
i386_ipi_handler() at i386_ipi_handler+0x3f
Xipi_untramp() at Xipi_untramp+0xc2
_kernel_lock() at _kernel_lock+0x90
uvm_swap_get(d2ed0c10,48e0,2) at uvm_swap_get+0x27
uvmfault_anonget(f71a1bb0,d50fad38,f821a4d4) at uvmfault_anonget+0x2b6
uvm_fault_upper(f71a1bb0,f71a1b84,f71a1c0c) at uvm_fault_upper+0x68
uvm_fault(f955dee8,283d0000,0,1) at uvm_fault+0xd8
upageflttrap(f71a1cc0,283d001c) at upageflttrap+0x55
trap(f71a1cc0) at trap+0x1e9
calltrap() at calltrap+0xc
end of kernel
ddb{4}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
...
* 3932 121025 64006 21 7 0x2 c++
ddb{5}> trace
db_enter() at db_enter+0x4
i386_ipi_handler() at i386_ipi_handler+0x3f
Xipi_untramp() at Xipi_untramp+0xc2
mtx_enter(d0f929c8) at mtx_enter+0x168
uvm_pageactivate(d4370b68) at uvm_pageactivate+0x64
uvm_fault_upper_lookup(f7165ea0,f7165e74,f7165efc,f7165ebc) at
uvm_fault_upper_lookup+0x108
uvm_fault(f955d774,34eb9000,0,1) at uvm_fault+0x11b
upageflttrap(f7165fb0,34eb94c8) at upageflttrap+0x55
trap(f7165fb0) at trap+0x1e9
calltrap() at calltrap+0xc
end of kernel
ddb{5}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
...
*30291 413634 89721 21 7 0x2 c++
ddb{6}> trace
db_enter() at db_enter+0x4
i386_ipi_handler() at i386_ipi_handler+0x3f
Xipi_untramp() at Xipi_untramp+0xc2
_kernel_lock() at _kernel_lock+0x86
doopenat(f71aae0c,ffffff9c,cf7dbc5c,10000,0,f731a548) at doopenat+0x175
sys_open(f71aae0c,f731a550,f731a548) at sys_open+0x1b
syscall(f731a590) at syscall+0x57b
Xsyscall_untramp() at Xsyscall_untramp+0xa9
end of kernel
ddb{6}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
...
*62662 28956 51023 21 7 0x2 c++
ddb{7}> trace
db_enter() at db_enter+0x4
i386_ipi_handler() at i386_ipi_handler+0x3f
Xipi_untramp() at Xipi_untramp+0xc2
mtx_enter(d0f929c8) at mtx_enter+0x168
uvm_pageactivate(d448fb78) at uvm_pageactivate+0x64
uvm_fault_lower(f73de9d0,f73de9a4,f73de9ec) at uvm_fault_lower+0x3b7
uvm_fault(f955d1a8,5f705000,0,2) at uvm_fault+0x1a1
upageflttrap(f73deae0,5f705000) at upageflttrap+0x55
trap(f73deae0) at trap+0x1e9
calltrap() at calltrap+0xc
end of kernel
ddb{7}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
...
*75476 127842 59174 21 7 0x2 c++
ddb{8}> trace
db_enter() at db_enter+0x4
i386_ipi_handler() at i386_ipi_handler+0x3f
Xipi_untramp() at Xipi_untramp+0xc2
mtx_enter(d0f929c8) at mtx_enter+0x16c
uvm_pageactivate(d2780454) at uvm_pageactivate+0x64
uvm_fault_upper(f72bc830,f72bc804,f72bc88c) at uvm_fault_upper+0x310
uvm_fault(f955d0d4,37899000,0,1) at uvm_fault+0xd8
upageflttrap(f72bc940,37899550) at upageflttrap+0x55
trap(f72bc940) at trap+0x1e9
calltrap() at calltrap+0xc
end of kernel
ddb{8}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
...
*17055 299976 31755 21 7 0x2 c++
ddb{9}> trace
db_enter() at db_enter+0x4
i386_ipi_handler() at i386_ipi_handler+0x3f
Xipi_untramp() at Xipi_untramp+0xc2
mtx_enter(d0f929c8) at mtx_enter+0x168
uvm_pageclean(d1858648) at uvm_pageclean+0xe4
uvm_pagefree(d1858648) at uvm_pagefree+0xb
uvm_anfree(f9291f90) at uvm_anfree+0x58
amap_wipeout(fc907f50) at amap_wipeout+0x133
uvm_unmap_detach(f71a5e5c,0) at uvm_unmap_detach+0x74
sys_munmap(f71aa920,f71a5ed0,f71a5ec8) at sys_munmap+0x122
syscall(f71a5f10) at syscall+0x57b
Xsyscall_untramp() at Xsyscall_untramp+0xa9
end of kernel
ddb{9}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
...
*54943 218332 22085 21 7 0x2 c++
ddb{10}> trace
db_enter() at db_enter+0x4
i386_ipi_handler() at i386_ipi_handler+0x3f
Xipi_untramp() at Xipi_untramp+0xc2
mtx_enter(d0f929c8) at mtx_enter+0x168
uvm_pageactivate(d17d1da4) at uvm_pageactivate+0x64
uvm_fault_lower(f74eaef0,f74eaec4,f74eaf0c) at uvm_fault_lower+0x3b7
uvm_fault(f955dac4,3bf7d000,0,2) at uvm_fault+0x1a1
upageflttrap(f74eb000,3bf7d000) at upageflttrap+0x55
trap(f74eb000) at trap+0x1e9
calltrap() at calltrap+0xc
end of kernel
ddb{10}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
...
*31437 213723 3357 21 7 0x2 c++
ddb{11}> trace
db_enter() at db_enter+0x4
i386_ipi_handler() at i386_ipi_handler+0x3f
Xipi_untramp() at Xipi_untramp+0xc2
mtx_enter(d0f929c8) at mtx_enter+0x16c
uvm_pageactivate(d17bf8ec) at uvm_pageactivate+0x64
uvm_fault_lower(f75d3980,f75d3954,f75d399c) at uvm_fault_lower+0x3b7
uvm_fault(d68a6778,2f676000,0,2) at uvm_fault+0x1a1
upageflttrap(f75d3a90,2f676000) at upageflttrap+0x55
trap(f75d3a90) at trap+0x1e9
calltrap() at calltrap+0xc
end of kernel
ddb{11}> ps
PID TID PPID UID S FLAGS WAIT COMMAND
...
*20676 439581 63259 21 7 0x2 c++
bluhm
