Re: Panic on shutdown with Pi2B for May 2026 stabilization week

On Mon, May 25, 2026 at 08:25:57PM -0700, Gleb Smirnoff wrote:
> 
> No need for apologies. The stabweek is always a good reason to focus
> on old bugs as well :)
> 
> -- 

Alas, the panic on shutdown persists even at
FreeBSD www.zefox.org 16.0-CURRENT FreeBSD 16.0-CURRENT #55 n287675-95439b803fce: Sun Jul 26 17:30:39 PDT 2026     [email protected]:/usr/obj/usr/src/arm.armv7/sys/GENERIC arm armv7 1600019 1600019

On the console it reports:
....
Terminated
Jul 26 19:49:12 www syslogd: exiting on signal 15
Waiting (max 60 seconds) for system process `vnlru' to stop... done
Waiting (max 60 seconds) for system process `syncer' to stop... 
Syncing disks, vnodes remaining... 0 done
All buffers synced.
Uptime: 2m35s
smsc0: warning: Failed to read register 0x114
smsc0: warning: MII is busy
smsc0: warning: Failed to read register 0x114
smsc0: warning: MII is busy
smsc0: warning: Failed to read register 0x114
smsc0: warning: MII is busy
smsc0: warning: Failed to read register 0x114
smsc0: warning: MII is busy
smsc0: warning: Failed to read register 0x114
smsc0: warning: MII is busy
smsc0: warning: Failed to read register 0x114
smsc0: warning: MII is busy
smsc0: warning: Failed to read register 0x114
smsc0: warning: MII is busy
smsc0: warning: Failed to read register 0x114
smsc0: warning: MII is busy
ue0: link state changed to DOWN
smsc0: warning: Failed to read register 0x114
smsc0: warning: MII is busy
smsc0: warning: Failed to read register 0x114
smsc0: warning: MII is busy
smsc0: warning: Failed to read register 0x114
smsc0: warning: MII is busy
smsc0: warning: Failed to read register 0x114
smsc0: warning: MII is busy
smsc0: warning: Failed to read register 0x114
smscphy0: detached
smsc0: warning: MII is busy
Kernel page faultmiibus0: detached
 with the following non-sleepable locks held:
exclusive sleep mutex smsc0 (smsc0) r = 0 (0xd6796770) locked @ /usr/src/sys/dev/usb/net/if_smsc.c:665
stack backtrace:
#0 0xc03a4734 at witness_debugger+0x78
#1 0xc03a60a0 at witness_warn+0x4a4
#2 0xc06911bc at abort_handler+0x1fc
#3 0xc066f04c at exception_exit+0
#4 0xc00dbb2c at smscphy_status+0x80
#5 0xc00dba94 at smscphy_service+0x21c
#6 0xc00d43c0 at mii_pollstat+0x60
#7 0xc01c58dc at smsc_ifmedia_sts+0x44
#8 0xc047ebcc at ifmedia_ioctl+0x198
#9 0xc055bb04 at dump_iface+0x11c
#10 0xc055b8dc at rtnl_handle_iflink+0xac
#11 0xc0476068 at do_link_state_change+0x1e4
#12 0xc0395b38 at taskqueue_run_locked+0x1c4
#13 0xc0395938 at taskqueue_run+0x50
#14 0xc02db778 at ithread_loop+0x264
#15 0xc02d7450 at fork_exit+0xa0
#16 0xc066efe0 at swi_exit+0
Fatal kernel mode data abort: 'Translation Fault (L1)' on read
trapframe: 0xd37d0b28
FSR=00000005, FAR=deadc0de, spsr=60000013
r0 =0000003d, r1 =71b802e7, r2 =71b802e7, r3 =00000000
r4 =d69f6680, r5 =00000000, r6 =deadc0de, r7 =deadc0de
r8 =d6765580, r9 =c096e804, r10=00000000, r11=d37d0bd8
r12=d37d0ad4, ssp=d37d0bb8, slr=c01c3a3c, pc =c00dbb2c

panic: Fatal abort
cpuid = 2
time = 1785120554
KDB: stack backtrace:
db_trace_self() at db_trace_self
         pc = 0xc066c6b4  lr = 0xc007a2dc (db_trace_self_wrapper+0x40)
         sp = 0xd37d0900  fp = 0xd37d0a18
db_trace_self_wrapper() at db_trace_self_wrapper+0x40
         pc = 0xc007a2dc  lr = 0xc0325bd4 (vpanic+0x15c)
         sp = 0xd37d0a20  fp = 0xd37d0a40
         r4 = 0x00000100  r5 = 0xc076b177
         r6 = 0xc0bce484  r7 = 0x00000000
vpanic() at vpanic+0x15c
         pc = 0xc0325bd4  lr = 0xc0325a78 (vpanic)
         sp = 0xd37d0a48  fp = 0xd37d0a4c
         r4 = 0xd37d0b28  r5 = 0x00000013
         r6 = 0xdeadc0de  r7 = 0x00000005
         r8 = 0x00000005  r9 = 0x00000013
        r10 = 0xdeadc0de
vpanic() at vpanic
         pc = 0xc0325a78  lr = 0xc0691898 (abort_align)
         sp = 0xd37d0a54  fp = 0xd37d0a80
         r4 = 0x00000005  r5 = 0x00000005
         r6 = 0x00000013  r7 = 0xdeadc0de
         r8 = 0xd37d0a4c  r9 = 0xc0325a78
        r10 = 0xd37d0a54
abort_align() at abort_align
         pc = 0xc0691898  lr = 0xc06911e8 (abort_handler+0x228)
         sp = 0xd37d0a88  fp = 0xd37d0b20
         r4 = 0xc4c0bc00 r10 = 0xdeadc0de
abort_handler() at abort_handler+0x228
         pc = 0xc06911e8  lr = 0xc066f04c (exception_exit)
         sp = 0xd37d0b28  fp = 0xd37d0bd8
         r4 = 0xd69f6680  r5 = 0x00000000
         r6 = 0xdeadc0de  r7 = 0xdeadc0de
         r8 = 0xd6765580  r9 = 0xc096e804
        r10 = 0x00000000
exception_exit() at exception_exit
         pc = 0xc066f04c  lr = 0xc01c3a3c (smsc_miibus_readreg+0x84)
         sp = 0xd37d0bb8  fp = 0xd37d0bd8
         r0 = 0x0000003d  r1 = 0x71b802e7
         r2 = 0x71b802e7  r3 = 0x00000000
         r4 = 0xd69f6680  r5 = 0x00000000
         r6 = 0xdeadc0de  r7 = 0xdeadc0de
         r8 = 0xd6765580  r9 = 0xc096e804
        r10 = 0x00000000 r12 = 0xd37d0ad4
smscphy_status() at smscphy_status+0x80
         pc = 0xc00dbb2c  lr = 0xc00dba94 (smscphy_service+0x21c)
         sp = 0xd37d0be0  fp = 0xd37d0c00
         r4 = 0x00000003  r5 = 0xd69f6680
         r6 = 0xd703af20  r7 = 0xc077adc5
         r8 = 0x00000000  r9 = 0xc09cabf8
        r10 = 0x00000000
smscphy_service() at smscphy_service+0x21c
         pc = 0xc00dba94  lr = 0xc00d43c0 (mii_pollstat+0x60)
         sp = 0xd37d0c08  fp = 0xd37d0c18
         r4 = 0xd6765580  r5 = 0xd69f6680
         r6 = 0xd703af20  r7 = 0xc077adc5
         r8 = 0x00000000  r9 = 0xc09cabf8
        r10 = 0x00000000
mii_pollstat() at mii_pollstat+0x60
         pc = 0xc00d43c0  lr = 0xc01c58dc (smsc_ifmedia_sts+0x44)
         sp = 0xd37d0c20  fp = 0xd37d0c30
         r4 = 0xd37d0c70  r5 = 0xd6796780
         r6 = 0xd6765580 r10 = 0x00000000
smsc_ifmedia_sts() at smsc_ifmedia_sts+0x44
         pc = 0xc01c58dc  lr = 0xc047ebcc (ifmedia_ioctl+0x198)
         sp = 0xd37d0c38  fp = 0xd37d0c48
         r4 = 0xd37d0c70  r5 = 0x00000000
         r6 = 0xd6765580  r7 = 0x00000020
ifmedia_ioctl() at ifmedia_ioctl+0x198
         pc = 0xc047ebcc  lr = 0xc055bb04 (dump_iface+0x11c)
         sp = 0xd37d0c50  fp = 0xd37d0cc0
         r4 = 0xd37d0cd0  r5 = 0xd67d2400
         r6 = 0xd37d0c70  r7 = 0xdb92d024
dump_iface() at dump_iface+0x11c
         pc = 0xc055bb04  lr = 0xc055b8dc (rtnl_handle_iflink+0xac)
         sp = 0xd37d0cc8  fp = 0xd37d0d18
         r4 = 0xd67d2400  r5 = 0xd37d0cd0
         r6 = 0x00000000  r7 = 0xd39ab880
         r8 = 0x00000001  r9 = 0x00000000
        r10 = 0xd69e0be0
rtnl_handle_iflink() at rtnl_handle_iflink+0xac
         pc = 0xc055b8dc  lr = 0xc0476068 (do_link_state_change+0x1e4)
         sp = 0xd37d0d20  fp = 0xd37d0d48
         r4 = 0xd67d2400  r5 = 0xc07c16ee
         r6 = 0xd39ab89c r10 = 0xd69e0be0
do_link_state_change() at do_link_state_change+0x1e4
         pc = 0xc0476068  lr = 0xc0395b38 (taskqueue_run_locked+0x1c4)
         sp = 0xd37d0d50  fp = 0xd37d0da0
         r4 = 0xd3866600  r5 = 0xd3866650
         r6 = 0xd67d24f8  r7 = 0x00000001
         r8 = 0x00000000  r9 = 0xc07cd7d4
        r10 = 0x00000000
taskqueue_run_locked() at taskqueue_run_locked+0x1c4
         pc = 0xc0395b38  lr = 0xc0395938 (taskqueue_run+0x50)
         sp = 0xd37d0da8  fp = 0xd37d0db0
         r4 = 0xd3866650  r5 = 0xd3866600
         r6 = 0xd3850000  r7 = 0xd39a5880
         r8 = 0x00000000  r9 = 0xc07acbb0
        r10 = 0xd3850008
taskqueue_run() at taskqueue_run+0x50
         pc = 0xc0395938  lr = 0xc02db778 (ithread_loop+0x264)
         sp = 0xd37d0db8  fp = 0xd37d0e18
         r4 = 0x00000000  r5 = 0xd3850044
ithread_loop() at ithread_loop+0x264
         pc = 0xc02db778  lr = 0xc02d7450 (fork_exit+0xa0)
         sp = 0xd37d0e20  fp = 0xd37d0e38
         r4 = 0xd37d0e40  r5 = 0xc4c0bc00
         r6 = 0xc02db514  r7 = 0xc4c0a3a0
         r8 = 0xd3a0d140  r9 = 0x00000000
        r10 = 0x00000000
fork_exit() at fork_exit+0xa0
         pc = 0xc02d7450  lr = 0xc066efe0 (swi_exit)
         sp = 0xd37d0e40  fp = 0x00000000
         r4 = 0xc02db514  r5 = 0xd3a0d140
         r6 = 0x00000000  r7 = 0x00000000
         r8 = 0x00000000 r10 = 0x00000000
swi_exit() at swi_exit
         pc = 0xc066efe0  lr = 0xc066efe0 (swi_exit)
         sp = 0xd37d0e40  fp = 0x00000000
KDB: enter: panic
[ thread pid 11 tid 100013 ]
Stopped at      kdb_enter+0x54: ldrb    r15, [r15, r15, ror r15]!
db> 

Issuing a reboot command results in a successful restart.
The machine isn't obviously unstable when running buildworld.

If anybody can suggest things to try I'd be happy to test.

Thanks for reading,

bob prohaska