I've seen something like that in syzkaller before: https://syzkaller.appspot.com/bug?id=47c67ab6d3a87514d0707882a9ad6671beaa864
If you cvs up spec_vnops.c to 1.211, you may get a different assertion firing, or not; which assertion fires now might potentially help to diagnose the problem. If that still doesn't help, you could try the attached patch (which I'm not committing at the moment because it changes the kernel ABI). With the patch, it may hit the following panic: panic: kernel diagnostic assertion "sd->sd_closing == NULL" failed: file "/syzkaller/jobs/netbsd/kernel/sys/miscfs/specfs/spec_vnops.c", line 1675 sd_closing=0xffffbc0013315500 If so, the `sd_closing=0xffffbc0013315500' part gives you an lwp address, which you can feed to `bt/a' to get a stack trace: db> bt/a 0xffffbc0013315500 Finding out what that lwp is up to might help diagnose the problem.
