Version : pfSense CE 2.8.0-DEVELOPMENT (amd64)
FreeBSD base : FreeBSD 15.0-CURRENT
Snapshot date : Tue May 21 06:08:59 UTC 2025
Crash observed : Mon Jun 3 00:55:19 2025
System uptime before crash : ~18 minutes
Daemon involved : charon (strongSwan / IPsec)
Crash type : Kernel panic — page fault in kernel mode
Fault type : Write access to unmapped memory address in kernel
Panic message

panic: page fault
cpuid = 1
time = 1717378519
KDB: stack backtrace:
db_trace_self_wrapper()
vpanic()
panic()
trap_fatal()
trap_pfault()
calltrap()
selfdfree()
kern_poll_kfds()
kern_poll()
sys_poll()
amd64_syscall()
fast_syscall_common()
Uptime: 18m11s

Details from backtrace and trap

trap number = 12
frame pointer = 0xfffffe0183766a00
rip = 0xffffffff80d6c99a (selfdfree+0x8a)
fault virtual address = 0xfffffe01a4dcc1f1
fault code = supervisor write data, page not present

Context

The crash occurred while the charon daemon (strongSwan) was active.

charon was likely handling VPN sessions (IPsec/IKE) at the time.

The fault happened in selfdfree() during a system call to poll(), likely while handling socket file descriptors.

Suggests possible double-free or mismanaged poll/kqueue data structures.