Re: panic: supervisor write data, protection violation (vn_read/copyout_smap_erms?)

To narrow this .. I can reliably start a kernel built at or before 
commit 277830b4d3ae.

On 3/14/26 09:06, Subbsd wrote:
> Hi,
> 
> The latest FreeBSD 16-CURRENT panics during some disk activities
> (e.g.: installing a packages, starting some services, for example
> /etc/rc.d/devd)
> 
> --
> Fatal trap 12: page fault while in kernel mode
> cpuid = 6; apic id = 06
> fault virtual address   = 0x45e4db029e00
> fault code              = supervisor write data, protection violation
> instruction pointer     = 0x20:0xffffffff81127826
> stack pointer           = 0x28:0xfffffe00ff03b930
> frame pointer           = 0x28:0xfffffe00ff03b930
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                         = DPL 0, pres 1, long 1, def32 0, gran 1
> processor eflags        = interrupt enabled, resume, IOPL = 0
> current process         = 1042 (sh)
> rdi: 000045e4db029e00 rsi: fffff80063fed000 rdx: 0000000000000400
> rcx: 0000000000000400  r8: fffff80063fed000  r9: 000000000000261f
> rax: 0000000000000000 rbx: fffff80063fed000 rbp: fffffe00ff03b930
> r10: 0000000000000400 r11: fffff8000fb9ccd0 r12: fffffe00ff03bde8
> r13: 0000000000000400 r14: 0000000000000400 r15: fffffe00ff03bda8
> trap number             = 12
> panic: page fault
> cpuid = 6
> time = 1773492421
> KDB: stack backtrace:
> db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00ff03b640
> vpanic() at vpanic+0x136/frame 0xfffffe00ff03b770
> panic() at panic+0x43/frame 0xfffffe00ff03b7d0
> trap_fatal() at trap_fatal+0x68/frame 0xfffffe00ff03b7f0
> trap_pfault() at trap_pfault+0x2ac/frame 0xfffffe00ff03b860
> calltrap() at calltrap+0x8/frame 0xfffffe00ff03b860
> --- trap 0xc, rip = 0xffffffff81127826, rsp = 0xfffffe00ff03b930, rbp
> = 0xfffffe00ff03b930 ---
> copyout_smap_erms() at copyout_smap_erms+0x196/frame 0xfffffe00ff03b930
> uiomove_fromphys() at uiomove_fromphys+0x15f/frame 0xfffffe00ff03b990
> vn_read_from_obj() at vn_read_from_obj+0x13f/frame 0xfffffe00ff03ba70
> VOP_READ_PGCACHE_APV() at VOP_READ_PGCACHE_APV+0x2a/frame 0xfffffe00ff03ba90
> vn_read() at vn_read+0x94/frame 0xfffffe00ff03bb10
> vn_io_fault_doio() at vn_io_fault_doio+0x45/frame 0xfffffe00ff03bb70
> vn_io_fault1() at vn_io_fault1+0x15e/frame 0xfffffe00ff03bcb0
> vn_io_fault() at vn_io_fault+0x19d/frame 0xfffffe00ff03bd40
> dofileread() at dofileread+0x80/frame 0xfffffe00ff03bd90
> sys_read() at sys_read+0x127/frame 0xfffffe00ff03be00
> amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe00ff03bf30
> fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00ff03bf30
> --- syscall (3, FreeBSD ELF64, read), rip = 0x3e8c57b7232a, rsp =
> 0x3e8c53973298, rbp = 0x3e8c539732e0 ---
> KDB: enter: panic
> Uptime: 17s
> --
> 
> Other info + messages in dmesg:
> 
> Kernel: GENERIC
> 
> uname -a:
> 
> FreeBSD host1.my.domain 16.0-CURRENT FreeBSD 16.0-CURRENT #0
> main-f91464171d61: Sat Mar 14 12:35:27 UTC 2026
> [email protected]:/usr/obj/usr/jails/src/src_16/src/amd64.amd64/sys/GENERIC
> amd64
> 
> Filesystem: UFS2
> 
> dmesg with suspicious entries:
> ```
> lock order reversal: (sleepable after non-sleepable)
> 1st 0xffffffff81da28a8 dev mtx (devd, sleep mutex) @
> /usr/jails/src/src_16/src/sys/kern/kern_devctl.c:572
> 2nd 0xffffffff82300d50 umareclaim (umareclaim, sx) @
> /usr/jails/src/src_16/src/sys/vm/uma_core.c:3428
> lock order devd -> umareclaim attempted at:
> #0 0xffffffff80c43fbf at witness_checkorder+0xcaf
> #1 0xffffffff80bd40f0 at _sx_xlock+0x60
> #2 0xffffffff80f9903d at uma_zdestroy+0x3d
> #3 0xffffffff80b64fce at sysctl_devctl_queue+0x8e
> #4 0xffffffff80bdb3ec at sysctl_root_handler_locked+0x9c
> #5 0xffffffff80bda74f at sysctl_root+0x22f
> #6 0xffffffff80bdae56 at userland_sysctl+0x1b6
> #7 0xffffffff80bdac65 at sys___sysctl+0x65
> #8 0xffffffff8112b719 at amd64_syscall+0x169
> #9 0xffffffff810fa54b at fast_syscall_common+0xf8
> Freed UMA keg (DEVCTL) was not empty (455 items).  Lost 114 pages of memory.
> ```
>