[Bug 300036] Trap 12 crash during VM reboot in PVE / QEMU

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=300036

            Bug ID: 300036
           Summary: Trap 12 crash during VM reboot in PVE / QEMU
           Product: Base System
           Version: 15.1-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: work+freebsd@vvv.kiev.ua

Description

Actual result: A Fatal trap 12: page fault while in kernel mode occurs
frequently during the system reboot sequence, specifically right after
synchronizing buffers. This leads to a kernel panic.

Expected result: The system should flush buffers, unmount filesystems, and
complete the reboot sequence cleanly without any kernel traps.


Environment & Scope

Hypervisor: Proxmox VE 9.2.21
pve-qemu-kvm 11.0.3-4 amd64
pve-edk2-firmware-ovmf 4.2026.08-1 all
Guest OS: FreeBSD 15.1-RELEASE


Steps to Reproduce / Flakiness Pattern

- Boot a FreeBSD 15.1 virtual machine inside PVE/QEMU.

- Scenario A (Low uptime): Reboot or shut down the VM shortly after booting.
Result: The issue is usually not reproducible (reboots successfully).

- Scenario B (High uptime): Leave the VM running for at least a few days
(accumulating uptime). Then, initiate a reboot (shutdown -r now).
Result: The kernel panic/trap 12 occurs almost every time during or immediately
after the syncer finishes flushing the buffers.


Console output:

Waiting (max 60 seconds) for system process `vnlru' to stop... done
Waiting (max 60 seconds) for system process `syncer' to stop...
Syncing disks, vnodes remaining... 0 0 done
All buffers synced.


Fatal trap 12: page fault while in kernel mode
cpuid = 7; apic id = 07
fault virtual address   = 0x488
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80b62b09
stack pointer           = 0x28:0xfffffe008c7cfba0
frame pointer           = 0x28:0xfffffe008c7cfc20
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 4 (doneq0)
rdi: fffff800015b6858 rsi: 0000000000000004 rdx: 0000000000000000
rcx: fffff800015b6840  r8: 0000000000000005  r9: fffff8020db892e0
rax: 0000000000000000 rbx: fffff80001c1e2a0 rbp: fffffe008c7cfc20
r10: 0000000000000001 r11: 000000000000044c r12: 0000000000000000
r13: fffff8010164d780 r14: fffffe008c7cfbc0 r15: fffff800015b6858
trap number             = 12
panic: page fault
cpuid = 7
time = 1792590024
KDB: stack backtrace:
#0 0xffffffff80bd6e0d at kdb_backtrace+0x5d
#1 0xffffffff80b878f6 at vpanic+0x136
#2 0xffffffff80b877b3 at panic+0x43
#3 0xffffffff81099fcd at trap_pfault+0x37d
#4 0xffffffff8106fdc8 at calltrap+0x8
#5 0xffffffff80becd65 at taskqueue_enqueue_flags+0xa5
#6 0xffffffff80c52731 at bufdone+0x41
#7 0xffffffff80abd3c7 at g_io_deliver+0x2a7
#8 0xffffffff80abd3c7 at g_io_deliver+0x2a7
#9 0xffffffff80abd3c7 at g_io_deliver+0x2a7
#10 0xffffffff80aba5ac at g_disk_done+0x15c
#11 0xffffffff803c4b6b at dadone+0x50b
#12 0xffffffff80394f6b at xpt_done_process+0x34b
#13 0xffffffff803970b5 at xpt_done_td+0xf5
#14 0xffffffff80b3dd4b at fork_exit+0x7b
#15 0xffffffff81070dee at fork_trampoline+0xe
Uptime: 6d0h52m9s
Automatic reboot in 15 seconds - press a key on the console to abort
--> Press a key on the console to reboot,
--> or switch off the system now.

-- 
You are receiving this mail because:
You are the assignee for the bug.