Created attachment 273406 [details]
Minimized six-call syzkaller reproducer for the devfs_kqfilter_f kernel page fault

A reproducible kernel page fault occurs in devfs_kqfilter_f() when a
  netmap descriptor is registered with kqueue while duplicated file
  descriptors and netmap interface lifetime operations are performed
  concurrently.

  Tested system:

  FreeBSD 14.4-STABLE SYZKALLER amd64
  kern.osreldate: 1404500
  Kernel build date: 2026-05-20
  Tested in a QEMU/KVM virtual machine.

  Panic:

  Fatal trap 12: page fault while in kernel mode
  fault virtual address = 0xb0
  fault code = supervisor write data, page not present

  Relevant backtrace:

  devfs_kqfilter_f
  kqueue_register
  kqueue_kevent
  kern_kevent_fp
  kern_kevent_generic
  sys_kevent
  amd64_syscall
  fast_syscall_common

  A minimized syzkaller reproducer is:

  r0 = openat$netmap(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
  socket$inet6_tcp(0x1c, 0x1, 0x0)
  r1 = dup(r0)
  ioctl$NIOCCTRL(r1, 0xc0586997, &(0x7f0000000100)={0xe, 0x1, 0x0, 'vale0:syz1\x00', 0x0, &(0x7f0000000200)=@reg={0x0, 0x0, 0x800, 0x800, 0x2, 0x2, 0x0,
  0x0, 0x0, 0x0, 0x1, 0x20}})
  r2 = kqueue()
  kevent(r2, &(0x7f0000000a40)=[{0x3, 0xfffffffffffffffe, 0x4087, 0x1000000, 0x0, 0x1, [0x8, 0x9, 0x0, 0xffff]}], 0x1, &(0x7f0000000400)=[{}], 0x1, 0x0)

  Execution settings:

  sandbox: none
  threaded: true
  repeat: true
  procs: 4
  NetDevices: disabled
  NetReset: disabled

  The original fuzzing campaign recorded the same crash eight times.
  Independent syz-repro extraction and minimization produced fourteen
  additional exact-title occurrences. The minimized six-call program also
  reproduces the panic directly with syz-execprog, normally within seconds.

  The canonical syzkaller corpus hash of the minimized reproducer is:

  d4951d904f94b1160756347dfdf9e293624b74e7

  I also checked the relationship with FreeBSD PR 293382. The tested system
  already contains the stable/14 kern_event.c change from commit
  88535adba95d019557b4281c52daa9feccade2fe. In particular, it contains the
  registration-time fget_noref_unlocked() recheck introduced for PR 293382.
  The crash remains reproducible on this post-fix kernel.

  This therefore appears to be a separate netmap/devfs file-lifetime race,
  rather than PR 293382 simply being absent from the tested kernel.

  Expected result:

  Registering a netmap descriptor with kqueue concurrently with descriptor
  teardown should either succeed or return an error without accessing an
  invalid cdev/file object.

  Actual result:

  The kernel performs a write through an invalid pointer in
  devfs_kqfilter_f() and panics.