NetBSD Problem Report #60312

From www@netbsd.org  Sat Jun  6 21:06:31 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "R13" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 397E51A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sat,  6 Jun 2026 21:06:31 +0000 (UTC)
Message-Id: <20260606210629.B9B021A923C@mollari.NetBSD.org>
Date: Sat,  6 Jun 2026 21:06:29 +0000 (UTC)
From: ltning-netbsd@anduin.net
Reply-To: ltning-netbsd@anduin.net
To: gnats-bugs@NetBSD.org
Subject: Frequent kernel panics with no apparent cause
X-Send-Pr-Version: www-1.0
X-From4GNATS: "ltning-netbsd@anduin.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60312
>Category:       kern
>Synopsis:       Frequent kernel panics with no apparent cause
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Jun 06 21:10:00 +0000 2026
>Last-Modified:  Sun Jun 07 15:45:01 +0000 2026
>Originator:     Eirik Øverby
>Release:        11-prerelease (beta, rc)
>Organization:
The Floppy Museum
>Environment:
NetBSD ppro2 11.0_RC2 NetBSD 11.0_RC2 (PPRO_OverDrive) #7: Mon May 25 17:10:12 CEST 2026  ltning@motherfucker:/usr/home/ltning/github/NetBSD_clean/obj_i386/sys/arch/i386/compile/PPRO_OverDrive i386
>Description:
Note: This has been observed across several builds of 11, most frequently and recently rc2 and rc4.

The machine is a dual Pentium II OverDrive (Pentium Pro socket, Deschutes core with MMX), Intel HX (Triton II) chipset. Prior to raising this PR, a 4-day burn-in memtest86 has been run to ensure RAM is not at fault. CPU+chipset cooling has been increased to rule out heat problems. When running on 10.0 and 10.1, the system was stable for well over a year. As soon as it was upgraded to 11rc2, these kernel panics started happening frequently. 

The system runs X with DRM driver and windowmaker. pcictl list output below.

## The crashes
Crashes can happen at any time, even during low load. Anecdotal evidence suggests high load can increase the risk of it happening, e.g. during significant disk I/O or network traffic. Examples of situations that often, but not always, get interrupted by a panic+reboot include
 - sysupgrade (during download or install phases)
 - publishing fediverse posts on the local snac+nginx
 - scp/rsync-ing kernel dumps to a different system
 - invoking an editor on a file (no other load at the same time)

Local interactive use is not a trigger. It has not been determined if having X running is necessary for panics to happen.
Swapping is not required for the issue to occur.

I have 6 kernel dumps available; see https://anduin.net/~ltning/netbsd/crash/ .
File listing with descriptions:

netbsd.2
netbsd.2.core
One of the first crashes, in sched_enqueue. 11.0_RC2.

netbsd.3
netbsd.3.core
Corrupt dump; from 11.0_RC4.

netbsd.4
netbsd.4.core
Crash in pmap_sync_pv.isra.0. 11.0_RC4.
This is the only repeated crash

netbsd.5
netbsd.5.core
Crash in vflushbuf. 11.0_RC4.

netbsd.6
netbsd.6.core
Another corrupted dump. 11.0_RC2.
System panicked: pmap_zap_ptp: PTE_PVLIST with pv-untracked page va = 0xbb528000pa = 0x4e87d000(0x4e87d)

netbsd.7
netbsd.7.cfg
netbsd.7.core
netbsd.7.fullkernel
Crash in pmap_sync_pv.isra.0. 11.0_RC2.
Included full kernel (with embedded config; .fullkernel file).
This is the currently running kernel.
>How-To-Repeat:
No precise reproduction steps known.
>Fix:
No known fix. There is a plan to downgrade to 10.1 and bisect, but on this hardware and with the current failures it is unknown if I can achieve this without breaking the installation.

>Audit-Trail:
From: ltning-netbsd@anduin.net
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/60312: Frequent kernel panics with no apparent cause
Date: Sat, 6 Jun 2026 23:15:26 +0200

 Forgot pcictl output..

 [ltning@ppro2] /usr$ pcictl pci0 list -N
 000:00:0: Intel 82441FX (PMC) PCI and Memory Controller (host bridge, 
 revision 0x02) [pchb0]
 000:01:0: Intel 82371SB (PIIX3) PCI-ISA Bridge (ISA bridge, revision 
 0x01) [pcib0]
 000:01:1: Intel 82371SB (PIIX3) IDE Interface (IDE mass storage, 
 interface 0x80) [piixide0]
 000:09:0: CMD Technology SiI3112 SATALink (miscellaneous mass storage, 
 revision 0x02) [satalink0]
 000:10:0: 3Com 3c905C-TX 10/100 Ethernet w/ mngmt (ethernet network, 
 revision 0x74) [ex0]
 000:11:0: Opti 82C861 (USB serial bus, OHCI, revision 0x10) [ohci0]
 000:12:0: Realtek Semiconductor 8169SC/8110SC 10/100/1000 Ethernet 
 (ethernet network, revision 0x10) [re0]
 000:13:0: ATI Technologies Radeon 9200SE 5964 (VGA display, revision 
 0x01) [radeon0]

From: ltning-netbsd@anduin.net
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: kern/60312: Frequent kernel panics with no apparent cause
Date: Sun, 7 Jun 2026 17:40:23 +0200

 As requested, stack traces from each dump, prefixed by the number in the 
 file names. Can possibly be more easily read from
    https://anduin.net/~ltning/netbsd/crash/all.txt

 Anyone who wishes to examine the cores should download them from the 
 aforementioned URL (https://anduin.net/~ltning/netbsd/crash/); 
 compressed versions have been added for your download convenience. :)

 /Eirik

 2: crash: _kvm_kvatop(0) 


 2: Crash version 11.0_RC2, image version 11.0_RC2. 


 2: Kernel compiled without options LOCKDEBUG. 


 2: System panicked: trap 


 2: Backtrace from time of crash is available. 


 2: 
 _KERNEL_OPT_MEMORY_RBFLAGS(104,0,c15215c0,c08154ca,5,d7b5fda8,c05e4b61,104,0,0) 


 2: at 0 


 2: kern_reboot(104,0,0,0,c0a2e1e0,5,c15215c0,d7b5fdb8,c05e4c18,c080a262) 
 at kern_re 

 2: boot+0xa0 


 2: 
 vpanic(c080a262,d7b5fdc4,d7b5fe80,c012da29,c080a262,d7b5fe8c,d7b5fe8c,4,d7b5e2c0 


 2: ,10213) at vpanic+0x181 


 2: 
 panic(c080a262,d7b5fe8c,d7b5fe8c,4,d7b5e2c0,10213,4e838d30,8,c1754d00,c0994e00) 


 2: at panic+0x18
 2: trap() at trap+0xbf9
 2: --- trap (number 6) ---
 2: 
 sched_enqueue(c1754d00,c1511440,c182fa44,c0999140,d7b5ff20,c057c4a5,c182fa44,c17
 2: 54d00,1,c182fa40) at sched_enqueue+0x27
 2: 
 sleepq_remove(c182fa44,c1754d00,1,c182fa40,c5167b18,d7b5ff4c,c05ea938,c182fa44,c
 2: 05ac5dd,d7a02000) at sleepq_remove+0xe0
 2: 
 cv_wakeup_all(c182fa44,c05ac5dd,d7a02000,c15fe140,7,3,c5167b18,c059e8a0,3,d7b5ff
 2: 60) at cv_wakeup_all+0x45
 2: 
 workqueue_enqueue(c182fa00,c5167b18,0,d7b5ff88,c0627b1d,c5167b18,0,0,c0100e0f,8)
 2:  at workqueue_enqueue+0x68
 2: 
 physio_biodone(c5167b18,0,0,c0100e0f,8,246,c5167b18,c0973100,d7b5ff9c,c0627c11) 

 2: at physio_biodone+0x20
 2: 
 biodone2(3,d7fe02ac,d7fe0004,d7b5ffe0,c05b36b0,0,c1c20010,d7b50030,c1520010,c152
 2: 0030) at biodone2+0x7d
 2: 
 biointr(0,c1c20010,d7b50030,c1520010,c1520030,c1520010,c15215c0,0,c1521040,c1606
 2: 200) at biointr+0x31
 2: softint_dispatch(c1521040,3,0,0,0,0,0,0,0,0) at softint_dispatch+0x90
 2: Bad frame pointer: 0xc1603900

 3: crash: _kvm_kvatop(0) 


 3: Crash version 11.0_RC2, image version 11.0_RC4. 


 3: WARNING: versions differ, you may not be able to examine this image. 


 3: Kernel compiled without options LOCKDEBUG. 


 3: System panicked: trap 


 3: Backtrace from time of crash is available. 


 3: _KERNEL_OPT_MEMORY_RBFLAGS(0,0,0,0,0,0,0,0,0,0) at 0 





 4: crash: _kvm_kvatop(0) 


 4: Crash version 11.0_RC2, image version 11.0_RC4. 


 4: WARNING: versions differ, you may not be able to examine this image.
 4: Kernel compiled without options LOCKDEBUG.
 4: System panicked: trap
 4: Backtrace from time of crash is available.
 4: 
 _KERNEL_OPT_MEMORY_RBFLAGS(104,0,c1758500,c081d64a,5,d8a52cf4,c05e61f1,104,0,0) 

 4: at 0
 4: kern_reboot(104,0,0,0,c0a37260,5,c1758500,d8a52d04,c05e62a8,c08123e2) 
 at kern_re
 4: boot+0xa0
 4: 
 vpanic(c08123e2,d8a52d10,d8a52dcc,c012da29,c08123e2,d8a52dd8,d8a52dd8,3f,d8a512c
 4: 0,210202) at vpanic+0x181
 4: 
 panic(c08123e2,d8a52dd8,d8a52dd8,3f,d8a512c0,210202,1ed44ae7,8,d8013000,c0a32fa0
 4: ) at panic+0x18
 4: trap() at trap+0xbf9
 4: --- trap (number 6) ---
 4: 
 pmap_sync_pv.isra.0(2,d8a52e77,0,8,c0568a45,c0bde930,1e82000,2456ea,530,c0bde914
 4: ) at pmap_sync_pv.isra.0+0x16
 4: pmap_pp_clear_attrs(c0bde8e8,2,d8a52ecc,c2c5f180,0,0,0,8000,0,0) at 
 pmap_pp_clea
 4: r_attrs+0x75
 4: ueNotifyRequest(0,15bd000,0,15be000,0,9,c08303dc,26ac2,0,c17587c0) at 
 ueNotifyRe
 4: quest+0x148
 4: uvm_pageout(c1758500,b47000,b4e000,0,c01005a3,0,0,0,0,0) at 
 uvm_pageout+0x41f

 5: crash: _kvm_kvatop(0) 


 5: Crash version 11.0_RC2, image version 11.0_RC4. 


 5: WARNING: versions differ, you may not be able to examine this image. 


 5: Kernel compiled without options LOCKDEBUG.
 5: System panicked: trap
 5: Backtrace from time of crash is available.
 5: 
 _KERNEL_OPT_MEMORY_RBFLAGS(104,0,c4024040,c081d64a,5,da33abf8,c05e61f1,104,0,0) 

 5: at 0
 5: kern_reboot(104,0,0,0,c0a37260,5,c4024040,da33ac08,c05e62a8,c08123e2) 
 at kern_re
 5: boot+0xa0
 5: 
 vpanic(c08123e2,da33ac14,da33acd0,c012da29,c08123e2,da33acdc,da33acdc,99b,da3392
 5: c0,210206) at vpanic+0x181
 5: 
 panic(c08123e2,da33acdc,da33acdc,99b,da3392c0,210206,84310f7,0,c09a7600,c0a32fa0
 5: ) at panic+0x18
 5: trap() at trap+0xbf9
 5: --- trap (number 6) ---
 5: 
 vflushbuf(c27af3c0,5,0,5,c14f5400,c14e94c0,da33ae0c,0,c27af3c0,da33adf8) 
 at vflu
 5: shbuf+0x83
 5: 
 ffs_full_fsync(c27af3c0,5,0,e,c14e94c0,c44fcf80,da33adc4,c05e326a,6,c05df5b7) 
 at
 5:  ffs_full_fsync+0x21
 5: ffs_fsync(da33ae0c,da33ae10,0,c07f9838,c27af3c0,ffffffff,5,0,0,0) at 
 ffs_fsync+0
 5: x19f
 5: VOP_FSYNC(c27af3c0,ffffffff,5,0,0,0,0,c200f544,0,c27af3c0) at 
 VOP_FSYNC+0x52
 5: 
 vinvalbuf(c27af3c0,1,ffffffff,c4024040,0,0,c27af410,8,c4024040,c1f8d000) 
 at vinv
 5: albuf+0x9c
 5: 
 vcache_reclaim(c31d48c0,302,40000001,c27af3c0,5fed,c2f9c740,da33af48,c064cbe8,c2
 5: 7af3c0,c05b4064) at vcache_reclaim+0x14d
 5: 
 vrecycle(c27af3c0,c05b4064,c1f8d000,da33af34,c2f9c740,80000000,80000000,1,2,5fed
 5: ) at vrecycle+0x122
 5: 
 vdrain_one(c09a7900,c152f640,c152f640,c382fec0,c382fec0,c15124c0,da33af9c,c05beb
 5: b5,c0a3a4a0,c15124c0) at vdrain_one+0x188
 5: 
 vdrain_task(c0a3a4a0,c15124c0,bb8,da339000,c4489200,c4024040,c382fed0,c382fed8,c
 5: 382fec0,c05beb00) at vdrain_task+0x5b
 5: threadpool_thread(c382fec0,b47000,b4e000,0,c01005a3,0,0,0,0,0) at 
 threadpool_thr
 5: ead+0xb5

 6: crash: _kvm_kvatop(0)
 6: crash: _kvm_kvatop(dbcafd00)
 6: crash: kvm_read(0xdbcafd00, 4): invalid translation (invalid PTE)
 6: Crash version 11.0_RC2, image version 11.0_RC2.
 6: Kernel compiled without options LOCKDEBUG.
 6: System panicked: pmap_zap_ptp: PTE_PVLIST with pv-untracked page va = 
 0xbb528000pa = 0x4e87d000(0x4e87d)
 6: Backtrace from time of crash is available.

 7: crash: _kvm_kvatop(0)
 7: Crash version 11.0_RC2, image version 11.0_RC2.
 7: Kernel compiled without options LOCKDEBUG.
 7: System panicked: trap
 7: Backtrace from time of crash is available.
 7: 
 _KERNEL_OPT_MEMORY_RBFLAGS(104,0,c1774d00,c0827e7f,5,d8a6cd48,c05f5a31,104,0,0) 

 7: at 0
 7: kern_reboot(104,0,0,0,c0a45360,5,c1774d00,d8a6cd58,c05f5ae8,c081c602) 
 at kern_re
 7: boot+0xa0
 7: 
 vpanic(c081c602,d8a6cd64,d8a6ce20,c012da29,c081c602,d8a6ce2c,d8a6ce2c,3f,d8a6b2c
 7: 0,10246) at vpanic+0x181
 7: 
 panic(c081c602,d8a6ce2c,d8a6ce2c,3f,d8a6b2c0,10246,bfc00000,8,d8033000,c0a410a0)
 7:  at panic+0x18
 7: trap() at trap+0xbf9
 7: --- trap (number 6) ---
 7: 
 pmap_sync_pv.isra.0(0,d8a6cec7,0,c0577415,c123e86c,16f57000,0,c123e824,c123e850,
 7: c28d21c0) at pmap_sync_pv.isra.0+0xe9
 7: 
 pmap_test_attrs(c123e824,2,0,40,8,c07f586c,d8a6cf9c,c05777e3,d8a6cf3c,1db000) 
 at
 7:  pmap_test_attrs+0x90
 7: 
 uvmpdpol_selectvictim(d8a6cf3c,1db000,0,1dc000,0,9,c083b592,1ef093,0,b918c000) 
 a
 7: t uvmpdpol_selectvictim+0xed
 7: uvm_pageout(c1774d00,b5b000,b62000,0,c01005a3,0,0,0,0,0) at 
 uvm_pageout+0x1c3

Home	PR Database Search