[Bug 295792] cu(1) panics kernel if the devices detaches before successfully connecting

From: <bugzilla-noreply_at_freebsd.org>
Date: Tue, 02 Jun 2026 12:29:30 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295792

            Bug ID: 295792
           Summary: cu(1) panics kernel if the devices detaches before
                    successfully connecting
           Product: Base System
           Version: Unspecified
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: christos@freebsd.org

To reproduce:

1. Plug a serial device, in my case I use a uchcom(4) and umodem(4) to test.
2. Run `cu -l /dev/cuaU0` (or whatever the device node is)
3. Unplug the device right away, before cu(1) prints "Connected".

Sample panic message:

panic: Assertion !tty_gone(tp) failed at /mnt/src/sys/sys/ttydevsw.h:165
cpuid = 5
time = 1780410393
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe008d91d7b0
vpanic() at vpanic+0x13f/frame 0xfffffe008d91d8e0
panic() at panic+0x43/frame 0xfffffe008d91d940
ttydevsw_modem() at ttydevsw_modem+0x38/frame 0xfffffe008d91d950
ttydev_open() at ttydev_open+0x2bc/frame 0xfffffe008d91d9a0
devfs_open() at devfs_open+0x12f/frame 0xfffffe008d91da10
VOP_OPEN_APV() at VOP_OPEN_APV+0x55/frame 0xfffffe008d91da40
vn_open_vnode() at vn_open_vnode+0x180/frame 0xfffffe008d91dac0
vn_open_cred() at vn_open_cred+0x62e/frame 0xfffffe008d91dc40
openatfp() at openatfp+0x2c6/frame 0xfffffe008d91dda0
sys_openat() at sys_openat+0x45/frame 0xfffffe008d91ddd0
filemon_wrapper_openat() at filemon_wrapper_openat+0x15/frame
0xfffffe008d91de00
amd64_syscall() at amd64_syscall+0x16c/frame 0xfffffe008d91df30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe008d91df30
--- syscall (499, FreeBSD ELF64, openat), rip = 0x16eb102b9fea, rsp =
0x16eb0fa25ef8, rbp = 0x16eb0fa25ff0 ---
KDB: enter: panic
[ thread pid 6285 tid 100154 ]
Stopped at      kdb_enter+0x33: movq    $0,0x161c3b2(%rip)
db>

-- 
You are receiving this mail because:
You are the assignee for the bug.