Re: Panic: Memory modified after free

--Apple-Mail=_7AD20AC8-3351-4B79-AAD7-9A362A4551A6
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8


> On Jul 22, 2026, at 10:01=E2=80=AFAM, Steve Kargl <[email protected]> =
wrote:
>=20
> Just received the following panic.  I was using openvpn at the time of
> the panic.  If I look at core.txt.2, I see
>=20
>=20
> Tue Jul 21 20:51:38 PDT 2026
> Jul 22 08:47:37 hotrats su[4849]: kargl to root on /dev/pts/3
> ovpn0: changing name to 'tun0'
> tun0: link state changed to UP
> Jul 22 08:48:45 hotrats openvpn[4908]: event_wait : Interrupted system =
call (fd=3D-1,code=3D4)
> ovpn0: changing name to 'tun0'
> tun0: link state changed to UP
> Jul 22 09:27:42 hotrats openvpn[5673]: event_wait : Interrupted system =
call (fd=3D-1,code=3D4)
> panic: Memory modified after free 0xfffff8037d3a3300 (256, mbuf) + 8 =3D=
 deadc0dedead40ce
>=20
> cpuid =3D 7
> time =3D 1784737711
> KDB: stack backtrace:
> db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame =
0xfffffe01498028f0
> vpanic() at vpanic+0x136/frame 0xfffffe0149802a20
> panic() at panic+0x43/frame 0xfffffe0149802a80
> trash_ctor() at trash_ctor+0x74/frame 0xfffffe0149802a90
> item_ctor() at item_ctor+0x59/frame 0xfffffe0149802ae0
> mc_get() at mc_get+0x14c/frame 0xfffffe0149802b40
> mc_uiotomc() at mc_uiotomc+0x8d/frame 0xfffffe0149802b80
> uipc_sosend_stream_or_seqpacket() at =
uipc_sosend_stream_or_seqpacket+0x13e/frame 0xfffffe0149802c60
> sousrsend() at sousrsend+0x79/frame 0xfffffe0149802cc0
> kern_sendit() at kern_sendit+0x1be/frame 0xfffffe0149802d50
> sendit() at sendit+0x1ab/frame 0xfffffe0149802da0
> sys_sendmsg() at sys_sendmsg+0x5b/frame 0xfffffe0149802e00
> amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe0149802f30
> fast_syscall_common() at fast_syscall_common+0xf8/frame =
0xfffffe0149802f30
> --- syscall (28, FreeBSD ELF64, sendmsg), rip =3D 0x39727abfe3ca, rsp =
=3D 0x397275edc298, rbp =3D 0x397275edc2c0 ---
> KDB: enter: panic
>=20
> I have crash dump and can upload to kargl@freefall if needed.

	Hm. An mbuf-related use-after-free.. I don=E2=80=99t see =
anything obviously wrong with f2202ab5abda7fb09538a1ceda77569b67d83084, =
but that=E2=80=99s the only recent commit made to the mbuf subsystem in =
the past few weeks. Can you try reverting that commit and reproing the =
issue?
Cheers,
-Enji=

--Apple-Mail=_7AD20AC8-3351-4B79-AAD7-9A362A4551A6
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEkHfexGRJ3gYRdA2gGpE5DjPsNJgFAmphFyMACgkQGpE5DjPs
NJjqow/8CvrJrv/6B5ZQQFs5kbMeKmp6GvcG/UzfArun4jLWa/PtWujRA/vznlvW
NxTEQYX0S4v/RkdwKxkSUC+xF+vPJW3ntN6WeR1Ws/EEFUZQ3cMIpuAiaeOAN/Bw
1sWZi5T7MWMALCuJ8F8p3qoX1CdMQzKeljgScAMbVJjyHz6Z41MigskQTH3t2ikZ
AdFXCgYb+OlXp5tmDZKb3czoVnfJOFnpl/GYeyT7sCG2m3ClEykmpDr+XSFFoPmO
OSZ0xUFWVYEyjVhxdZ23PdSj8DwWOXyikWx7UueewcoJ3boDaylQXUit1PYDiqYF
1w6dDnNI0blaFWjtGccBcNdhSqNFUuYIfmSo7HV8aoaB0Gnw2dosh927RH/FXOkn
qJtN6hGdx1I8QLINFZZ6KcEh5IGwUyy/kv9vrJ5h65+NhKFxMwsbOC0qGV+R5h4Y
gZ9wjuUh5b+4WwWHjuE/Bu4ZllwBprylm42QpJVUwQQ78DmMhgKCE/Tqx8cbGZTb
QM3p6aS85biELwcv3SPBWmnK/owQhxd4WrTXHR+gdyPaNzMY2U43hN1l3GV8Ma7c
GkZLFILJCGCddxcCbYrKw0v1962BU7ImvJhp7vyo6jSp2ZD/lHmmtkqUyvPpVK92
Ft39wW8Y2tRBuhb+6FGOpGEIlFFiFqVMRZnytFEyn8uglN9atdk=
=8FmC
-----END PGP SIGNATURE-----

--Apple-Mail=_7AD20AC8-3351-4B79-AAD7-9A362A4551A6--