This panic issue is 100% reproducible with the Jenkins kyua test runs; see https://jenkins.freebsd.org/job/FreeBSD_HEAD-tests2/853/ for more details: lib/libc/sys/chroot_test:chroot_err -> passed [0.015s] lib/libc/sys/chroot_test:chroot_perm -> passed [0.015s] lib/libc/sys/clock_gettime_test:clock_gettime_real -> panic: wrote past end of sbuf (0 >= 0) cpuid = 0 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe009748b760 vpanic() at vpanic+0x189/frame 0xfffffe009748b7e0 kassert_panic() at kassert_panic+0x132/frame 0xfffffe009748b850 sbuf_set_drain() at sbuf_set_drain+0x28/frame 0xfffffe009748b880 sbuf_new_for_sysctl() at sbuf_new_for_sysctl+0x29/frame 0xfffffe009748b8a0 sysctl_kern_timecounter_choice() at sysctl_kern_timecounter_choice+0x18/frame 0xfffffe009748b900 sysctl_root_handler_locked() at sysctl_root_handler_locked+0x94/frame 0xfffffe009748b940 sysctl_root() at sysctl_root+0x188/frame 0xfffffe009748b990 userland_sysctl() at userland_sysctl+0x192/frame 0xfffffe009748ba30 sys___sysctl() at sys___sysctl+0x74/frame 0xfffffe009748bae0 amd64_syscall() at amd64_syscall+0x27f/frame 0xfffffe009748bbf0 Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe009748bbf0 --- syscall (202, FreeBSD ELF64, sys___sysctl), rip = 0x800b77b0a, rsp = 0x7fffffffa938, rbp = 0x7fffffffa970 --- KDB: enter: panic [ thread pid 4557 tid 100062 ] Repro: sudo pkg install -y kyua perl5 (cd /usr/tests/; sudo kyua test) It might be easier to repro by limiting the tests executed to just the libc syscall tests: sudo pkg install -y kyua perl5 (cd /usr/tests/lib/libc/sys; sudo kyua test)
Fixed in r280192, which supplies a default buffer size if the values passed in to sbuf_new_for_sysctl() are NULL, 0.