Re: Panic: Memory modified after free

From: Enji Cooper (yaneurabeya) <yaneurabeya_at_gmail.com>
Date: Wed, 22 Jul 2026 19:16:51 UTC 
> On Jul 22, 2026, at 10:01 AM, Steve Kargl <kargls@comcast.net> wrote:
> 
> Just received the following panic.  I was using openvpn at the time of
> the panic.  If I look at core.txt.2, I see
> 
> 
> Tue Jul 21 20:51:38 PDT 2026
> Jul 22 08:47:37 hotrats su[4849]: kargl to root on /dev/pts/3
> ovpn0: changing name to 'tun0'
> tun0: link state changed to UP
> Jul 22 08:48:45 hotrats openvpn[4908]: event_wait : Interrupted system call (fd=-1,code=4)
> ovpn0: changing name to 'tun0'
> tun0: link state changed to UP
> Jul 22 09:27:42 hotrats openvpn[5673]: event_wait : Interrupted system call (fd=-1,code=4)
> panic: Memory modified after free 0xfffff8037d3a3300 (256, mbuf) + 8 = deadc0dedead40ce
> 
> cpuid = 7
> time = 1784737711
> KDB: stack backtrace:
> db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01498028f0
> vpanic() at vpanic+0x136/frame 0xfffffe0149802a20
> panic() at panic+0x43/frame 0xfffffe0149802a80
> trash_ctor() at trash_ctor+0x74/frame 0xfffffe0149802a90
> item_ctor() at item_ctor+0x59/frame 0xfffffe0149802ae0
> mc_get() at mc_get+0x14c/frame 0xfffffe0149802b40
> mc_uiotomc() at mc_uiotomc+0x8d/frame 0xfffffe0149802b80
> uipc_sosend_stream_or_seqpacket() at uipc_sosend_stream_or_seqpacket+0x13e/frame 0xfffffe0149802c60
> sousrsend() at sousrsend+0x79/frame 0xfffffe0149802cc0
> kern_sendit() at kern_sendit+0x1be/frame 0xfffffe0149802d50
> sendit() at sendit+0x1ab/frame 0xfffffe0149802da0
> sys_sendmsg() at sys_sendmsg+0x5b/frame 0xfffffe0149802e00
> amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe0149802f30
> fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0149802f30
> --- syscall (28, FreeBSD ELF64, sendmsg), rip = 0x39727abfe3ca, rsp = 0x397275edc298, rbp = 0x397275edc2c0 ---
> KDB: enter: panic
> 
> I have crash dump and can upload to kargl@freefall if needed.

	Hm. An mbuf-related use-after-free.. I don’t see anything obviously wrong with f2202ab5abda7fb09538a1ceda77569b67d83084, but that’s the only recent commit made to the mbuf subsystem in the past few weeks. Can you try reverting that commit and reproing the issue?
Cheers,
-Enji