Hi FreeBSD maintainers, When fuzzing freebsd kernel with syzkaller and our generated syscall descriptions, an issue is discovered in the CAM subsystem. This issue is reproducible on the latest release (release/15.0.0-p4, commit 8ef0ed690df2dca0cc22b827819d112f868470bb). The kernel console output, kernel config, and C/syz reproducers can be found at https://drive.google.com/drive/folders/1La6VphstKGM-WaF2rkaUxPfR2IdmTF-e?usp=sharing. The issue report is also listed below (symbolized by our modified syz-symbolize) to assist with the analysis: ``` TITLE: panic: cam_periph_ccbwait: proceeding with incomplete ccb: ccb=ADDR, func_code=0x3, status=NUM, index=-NUM CORRUPTED: false () SUPPRESSED: false MAINTAINERS (TO): [] MAINTAINERS (CC): [] login: panic: cam_periph_ccbwait: proceeding with incomplete ccb: ccb=0xfffffe00ef326800, func_code=0x3, status=0, index=-1 cpuid = 2 time = 1773839813 KDB: stack backtrace: #0 0xffffffff81608a59 at kdb_backtrace+0x119 /usr/obj/usr/src/kern/subr_kdb.c:452 #1 0xffffffff81537d67 at vpanic+0x257 /usr/obj/usr/src/kern/kern_shutdown.c:960 #2 0xffffffff81537b05 at panic+0xb5 /usr/obj/usr/src/kern/kern_shutdown.c:887 #3 0xffffffff8038a496 at cam_periph_runccb+0x826 /usr/obj/usr/src/cam/cam_periph.c:1227 #4 0xffffffff8040f159 at passsendccb+0x339 /usr/obj/usr/src/cam/scsi/scsi_pass.c:0 #5 0xffffffff8040dfa5 at passdoioctl+0x615 /usr/obj/usr/src/cam/scsi/scsi_pass.c:1830 #6 0xffffffff8040d243 at passioctl+0x33 /usr/obj/usr/src/cam/scsi/scsi_pass.c:1750 #7 0xffffffff811cb236 at devfs_ioctl+0x266 /usr/obj/usr/src/fs/devfs/devfs_vnops.c:0 #8 0xffffffff822b9ad7 at VOP_IOCTL_APV+0x87 /usr/obj/usr/src/amd64.amd64/sys/CLOUD/vnode_if.c:1154 #9 0xffffffff817bd187 at vn_ioctl+0x3c7 /usr/obj/usr/src/amd64.amd64/sys/CLOUD/vnode_if.h:639 #10 0xffffffff811cc0f9 at devfs_ioctl_f+0x69 /usr/obj/usr/src/fs/devfs/devfs_vnops.c:881 #11 0xffffffff81666cfa at kern_ioctl+0x4ca /usr/obj/usr/src/sys/file.h:378 #12 0xffffffff8166673e at sys_ioctl+0x36e /usr/obj/usr/src/kern/sys_generic.c:716 #13 0xffffffff820f9372 at amd64_syscall+0x4e2 /usr/obj/usr/src/kern/subr_syscall.c:193 #14 0xffffffff8209ffab at fast_syscall_common+0xf8 /usr/obj/usr/src/amd64/amd64/exception.S:571 Uptime: 1m31s Automatic reboot in 15 seconds - press a key on the console to abort ```
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=3454d97aaec12f4a8c676c34182200471eecae24 commit 3454d97aaec12f4a8c676c34182200471eecae24 Author: Warner Losh <imp@FreeBSD.org> AuthorDate: 2026-04-24 18:31:13 +0000 Commit: Warner Losh <imp@FreeBSD.org> CommitDate: 2026-04-24 18:32:24 +0000 cam: Set ccb_h.status on XPT_GDEVLIST early-return paths XPT_GDEVLIST in xpt_action_default has two early-return paths (list changed and index not found) that set cgdl->status but not ccb_h.status. Since xpt_action sets ccb_h.status to CAM_REQ_INPROG before dispatching, and XPT_GDEVLIST is an non-queued CCB, cam_periph_ccbwait skips the sleep loop and immediately hits the KASSERT checking that status != CAM_REQ_INPROG, causing a panic. Set ccb_h.status = CAM_REQ_CMP at the top of the code rather than the bottom. Any future error paths will be right (since this command can't fail at the command level, just in the status of the data level). PR: 293899 Assisted-By: Claude Opus 4.6 (1M context) Sponsored by: Netflix Reviewed by: jhb Differential Revision: https://reviews.freebsd.org/D56487 sys/cam/cam_xpt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)