Re: Panic (page fault) on boot after update to main-n290177-6866177454ac

On Sat, 17 Oct 2026, David Wolfskill wrote:

> Most of my machines updated to main-n290177-6866177454ac without
> incident, including most of the laptops.
>
> One, however, built OK, but on reboot, started coming up, but
> apparently did not succeed in switching video modes -- while normally,
> I expect the screen to blank, then resume the display of various
> kernel messages, it went blank ... and didn't bring up the (iwlwifi(4))
> link.  (This is the only one of the machines that uses iwlwifi(4).)
>
> I was able to boot from the previous kernel (kernel.old), but that was
> main-n290014-7a48c3fd3e6e (from 10 Oct).
>
> Eventually, I used the output of "kldstat" from that 10 Oct kernel
> (copied to another system), rebooted, escaped to the loader, then
> manually loaded each of the modules (save for if_iwx.ko -- I didn't find
> that one in either /boot/kernel or /boot/modules), then told it to
> continue with the (interrupted) boot.
>
> It proceeded for a bit, then stopped rather abruptly; a screenshot is
> available at
> https://www.catwhisker.org/~david/FreeBSD/head/n290177/crash.jpg
>
> Here's a hand-transcription of (what looks to me to be) a salient part:
>
> ...
> smbus0: <System Management Bus? on ichsmb0
> nda0 at nvme0 bus 0 scbus0 target 0 lun 1
> nda0: <SKHynix_HFS001TDE9X081N 41720 AJA5N493212305A0V
> nda0: Serial Number AJA5N493212305A0V
> nda0: nvme version 1.3
> nda0: 976762MB (2000409264 512 byte sectors)
> iwlwifi0: <iwlwifi> mem 0x603d1c4000-0x603d1c7fff at device 20.3 on pci0
> Firmware Warning (ACPI): Possibly buggy BIOS with ACPI_TYPE_INTEGER for function enumeration
> (20260408/ACPI-3222)
> Firmware Warning (ACPI): Possibly buggy BIOS with ACPI_TYPE_INTEGER for function enumeration
> (20260408/ACPI-3222)
> iwlwifi0: Detected crf-id 0x3617, cnv-id 0x20000302 wfpm id 0x80000000
> iwlwifi0: PCI dev a0f0/0070, rev=0x351, rfid=0x10a100
> iwlwifi0: Detected Intel(R) WiFi 6 AX201 160MHz
>
> Fatal trap 12: page fault while in kernel mode
> cpuid = 4; apic id = -04
> fault virtual address	= 0x4
> fault code		= supervisor read data, page not present
> instruction pointer	= 0x20: 0xffffffff80d45645
> stack pointer		= 0x28: 0xfffff300fd16e950
> frame pointer		= 0x28: 0xfffff300fd16ea20
> processor eflags	= interrupt enabled, resume, IOPL = 0
> current thread		= 0/100076 (kernel/firmware taskq)
> rdi: fffff80001877c01 rsi: fffff80001877c00 rdx: fffffe00fd16eda8
> rcx: 000000000000002c  r8: fffff80001878018  r9: fffff80001878000
> rax: 0000000000000000 rbx: fffffe00fd16ed28 rbp: fffffe00fd16ea20
> r10: 0000000000000000 r11: 0000000000000001 r12: fffff800026bb000
> r13: 0000000000000000 r14: fffffe00fd16ea3c r15: fffff800026bb000
> panic: page fault
> cpuid = 4
> time = 1
> KDB: stack backtrace:
> db_trace_self_wrapper() at db_trace_self_wrapper+ 0x36/frame 0xfffffe00fd16e680
> vpanic() at vpanic+0x149/frame 0xfffffe00fd16e7b0
> panic() at panic+0x43/frame 0xfffffe00fd16e810
> trap_pfault() at trap_pfault+0x449/frame 0xfffffe00fd16e880
> calltrap() at calltrap+0x8/frame 0xfffffe00fd16e880
> --- trap 0xc, rip = 0xffffffff80d45645, rsp = 0xfffffe00fd16e950, rpb = 0xfffffe00fd16ea20 ---
> cache_fplookup() at cache_fplookup+0x365/frame 0xfffffe00fd16ea20
> namei() at namei+0x1a4/frame 0xfffffe00fd16ea80
> vn_open_cred() at vn_open_cred+0x55a/frame 0xfffffe00fd16ec10
> loadimage() at loadimage+0x232/frame 0xfffffe00fd16ee30
> taskqueue_run_locked() at taskqueue_run_locked+0x1bb/frame 0xfffffe00fd16eec0
> taskqueue_thread_loop() at taskqueue_thread_loop+0xd3/frame 0xfffffe00fd16eef0
> fork_exit() at fork_exit+0x82/frame 0xfffffe00fd16ef30
> fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00fd16ef30
> --- trap 0x1ed031a0, rip = 0xd97d57428c36bc6a, rsp = 0x6a4da4b08b062869, rpb = 0xe1762a4783d7998c ---
> KDB: enter: panic
> [ thread pid 0 tid 100076 ]
> Stopped at	kdb_enter+0x33: movq	$0,0x115cde2(%rip)
> db>
>
>
> The machine is not one I use for critical work, so I can leave it
> in a state for debugging for a few hours.  I'm happy to poke at it,
> given clues as to the nature of the "poking."

Can you check which other thread called firmware_get() or
firmware_get_flags()?


-- 
For there shall arise false Christs, and false prophets, and shall shew
great signs and wonders; insomuch that, if it were possible, they shall
deceive the very elect. Behold, I have told you before. [Mat. 24:24-25]