kern/59767: nouveau driver crashes kernel in bus_dmamem_unmap

[schaecsn%gmx.net@localhost]

>Number:         59767
>Category:       kern
>Synopsis:       nouveau driver crashes kernel in  bus_dmamem_unmap
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 16 20:10:00 +0000 2025
>Originator:     Stefan Schaeckeler
>Release:        10.1
>Organization:
>Environment:
NetBSD dell 10.1 NetBSD 10.1 (GENERIC) #0: Sat Jan 18 11:07:43 PST 2025  root@dell:/usr/obj/sys/arch/amd64/compile/GENERIC amd64

>Description:
Restarted firefox. Last active tab: youtube.com. Kernel crashes. I did not find a kdump upon boot.

Nvidia GeForce 9500 512MB


bootup (grep for nouveau):

[     1.033666] nouveau0 at pci1 dev 0 function 0: NVIDIA GeForce 9500 GT (rev. 0xa1)
[    22.237610] nouveau0: NVIDIA G96 (096000a1)
[    22.357610] nouveau0: bios: version 62.94.4e.00.00
[    22.377610] nouveau0: interrupting at msi2 vec 0 (nouveau0)
[    22.377610] nouveau0: notice: bios: M0203T not found
[    22.377610] nouveau0: notice: bios: M0203E not matched!
[    22.377610] nouveau0: fb: 512 MiB DDR2
[    22.417610] nouveau0: DRM: VRAM: 512 MiB
[    22.417610] nouveau0: DRM: GART: 1048576 MiB
[    22.417610] nouveau0: DRM: TMDS table version 2.0
[    22.417610] nouveau0: DRM: DCB version 4.0
[    22.417610] nouveau0: DRM: DCB outp 00: 02000300 00000028
[    22.417610] nouveau0: DRM: DCB outp 01: 01000302 00020030
[    22.417610] nouveau0: DRM: DCB outp 02: 04011310 00000028
[    22.417610] nouveau0: DRM: DCB outp 03: 02022332 00020010
[    22.417610] nouveau0: DRM: DCB conn 00: 00001030
[    22.417610] nouveau0: DRM: DCB conn 01: 00000100
[    22.417610] nouveau0: DRM: DCB conn 02: 00002261
[    22.427612] nouveau0: DRM: MM: using CRYPT for buffer copies
[    22.527611] nouveaufb0 at nouveau0
[    22.527611] [drm] Initialized nouveau 1.3.1 20120801 for nouveau0 on minor 0
[    22.527611] nouveaufb0: framebuffer at 0xc0006000, size 1920x1080, depth 32, stride 7680
[    24.527620] nouveau0: autoconfiguration error: error: DRM: core notifier timeout
[    26.527629] nouveau0: autoconfiguration error: error: DRM: base-0: timeout
[    26.937631] wsdisplay0 at nouveaufb0 kbdmux 1: console (default, vt100 emulation), using wskbd0

...

crash - last lines from dmesg

[ 747296.261851] uvm_fault(0xffffe0e3d5166650, 0x0, 1) -> e
[ 747296.261851] fatal page fault in supervisor mode
[ 747296.261851] trap type 6 code 0 rip 0xffffffff805646d3 cs 0x8 rflags 0x10246 cr2 0x11 ilevel 0 rsp 0xffff8981fb5f4b08
[ 747296.261851] curlwp 0xffffe0e35f3bf5c0 pid 16513.15236 lowest kstack 0xffff8981fb5f02c0
[ 747296.261851] panic: trap
[ 747296.261851] cpu0: Begin traceback...
[ 747296.261851] vpanic() at netbsd:vpanic+0x183
[ 747296.261851] panic() at netbsd:panic+0x3c
[ 747296.261851] trap() at netbsd:trap+0xbaf
[ 747296.271851] --- trap (number 6) ---
[ 747296.271851] bus_dmamem_unmap() at netbsd:bus_dmamem_unmap+0x9
[ 747296.271851] nvkm_object_dtor() at netbsd:nvkm_object_dtor+0x92
[ 747296.271851] nvkm_object_del() at netbsd:nvkm_object_del+0x20
[ 747296.271851] nvkm_ioctl_del() at netbsd:nvkm_ioctl_del+0x8b
[ 747296.281851] nvkm_ioctl() at netbsd:nvkm_ioctl+0x100
[ 747296.281851] nvif_object_fini() at netbsd:nvif_object_fini+0x53
[ 747296.281851] nouveau_mem_fini() at netbsd:nouveau_mem_fini+0x56
[ 747296.281851] nouveau_mem_del() at netbsd:nouveau_mem_del+0x14
[ 747296.281851] ttm_bo_release() at netbsd:ttm_bo_release+0x302
[ 747296.281851] drm_gem_object_release_handle() at netbsd:drm_gem_object_release_handle+0x75
[ 747296.291850] drm_gem_handle_delete() at netbsd:drm_gem_handle_delete+0x5c
[ 747296.291850] drm_ioctl() at netbsd:drm_ioctl+0x3fb
[ 747296.291850] drm_ioctl_shim() at netbsd:drm_ioctl_shim+0x25
[ 747296.291850] sys_ioctl() at netbsd:sys_ioctl+0x56e
[ 747296.291850] syscall() at netbsd:syscall+0x1fc
[ 747296.291850] --- syscall (number 54) ---
[ 747296.291850] netbsd:syscall+0x1fc:
[ 747296.291850] cpu0: End traceback...

[ 747296.301858] dumping to dev 0,1 (offset=29395663, size=1568422):
[ 747296.301858] dump
>How-To-Repeat:

>Fix: