kern/60965: System panicked: kernel diagnostic assertion "collision == vma" failed: file "/usr/src/sys/external/bsd/drm2/dist/drm/i915/i915_vma.c", line 241

["rvp%SDF.ORG@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60965
>Category:       kern
>Synopsis:       System panicked: kernel diagnostic assertion "collision == vma" failed: file "/usr/src/sys/external/bsd/drm2/dist/drm/i915/i915_vma.c", line 241
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Nov 05 07:40:00 +0000 2026
>Originator:     RVP
>Release:        NetBSD/amd64  11.99.9
>Organization:
>Environment:
NetBSD/amd64  11.99.9
>Description:
Kernel paniced twice when using Firefox from pkgsrc-2026Q4, both
at the same place:

CPU: Intel(R) Core(TM) i3-1005G1 CPU @ 1.20GHz
GPU: pciid=0x8a56 rev=0x07 platform=ICELAKE (subplatform=0x1) gen=11

Kernel is 11.99.9 from last week and was compiled with both DEBUG and
LOCKDEBUG. I also have the netbsd.gdb file corresponding to the kernel.

Crash and gdb output:
---START---
Script started on Wed Nov  4 07:01:08 2026

# crash -M netbsd.0.core -N netbsd.0
Crash version 11.99.9, image version 11.99.9.
System panicked: kernel diagnostic assertion "collision == vma" failed: file "/usr/src/sys/external/bsd/drm2/dist/drm/i915/i915_vma.c", line 241 
Backtrace from time of crash is available.
crash> bt
__kernel_end() at 0
kern_reboot() at kern_reboot+0x5f
vpanic() at vpanic+0x198
kern_assert() at __x86_indirect_thunk_rax
i915_vma_instance() at i915_vma_instance+0x5c4
i915_gem_object_ggtt_pin() at i915_gem_object_ggtt_pin+0x87
i915_gem_fault() at i915_gem_fault+0x446
uvm_fault_internal() at uvm_fault_internal+0x6bf
trap() at trap+0x4bb
--- trap (number 6) ---
77d1a072c41c:
crash> ^D
# 

# gdb ~/tmp/netbsd_diag.gdb
GNU gdb (GDB) 17.1
Copyright (C) 2025 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64--netbsd".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /root/tmp/netbsd_diag.gdb...
(gdb) target kvm /tmp/netbsd.0.core
0xffffffff8023739a in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0)
    at /usr/src/sys/arch/amd64/amd64/machdep.c:880
880			dumpsys();
(gdb) bt
#0  0xffffffff8023739a in cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0)
    at /usr/src/sys/arch/amd64/amd64/machdep.c:880
#1  0xffffffff807878e8 in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/kern/kern_reboot.c:91
#2  0xffffffff807d6cb5 in vpanic (fmt=0xffffffff80b238d0 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ", 
    ap=ap@entry=0xffff9802689f7ae8) at /usr/src/sys/kern/subr_prf.c:288
#3  0xffffffff80975fc4 in kern_assert (
    fmt=fmt@entry=0xffffffff80b238d0 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ")
    at /usr/src/sys/lib/libkern/kern_assert.c:51
#4  0xffffffff80452673 in vma_create (obj=0xffff86e6f60e0340, vm=0xffff980010db8f88, view=0x0)
    at /usr/src/sys/external/bsd/drm2/dist/drm/i915/i915_vma.c:241
#5  i915_vma_instance (obj=obj@entry=0xffff86e6f60e0340, vm=vm@entry=0xffff980010db8f88, view=view@entry=0x0)
    at /usr/src/sys/external/bsd/drm2/dist/drm/i915/i915_vma.c:353
#6  0xffffffff80436ee4 in i915_gem_object_ggtt_pin (obj=obj@entry=0xffff86e6f60e0340, view=view@entry=0x0, size=size@entry=0, 
    alignment=alignment@entry=0, flags=flags@entry=13) at /usr/src/sys/external/bsd/drm2/dist/drm/i915/i915_gem.c:1020
#7  0xffffffff803f2e4e in vm_fault_gtt (ufi=<optimized out>, mmo=0xffff86e7351fd108, vaddr=131741795053568, 
    pps=0xffff9802689f7e50, npages=1, centeridx=0, flags=<optimized out>)
    at /usr/src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c:460
#8  i915_gem_fault (ufi=<optimized out>, vaddr=131741795053568, pps=0xffff9802689f7e50, npages=1, centeridx=0, 
    access_type=<optimized out>, flags=66) at /usr/src/sys/external/bsd/drm2/dist/drm/i915/gem/i915_gem_mman.c:606
#9  0xffffffff80715340 in uvm_fault_internal (orig_map=orig_map@entry=0xffff86e6b1099e40, vaddr=vaddr@entry=131741795053568, 
    access_type=access_type@entry=2, fault_flag=fault_flag@entry=0) at /usr/src/sys/uvm/uvm_fault.c:932
#10 0xffffffff8023a4b4 in trap (frame=0xffff9802689f8000) at /usr/src/sys/arch/amd64/amd64/trap.c:523
#11 0xffffffff80231ef4 in alltraps ()
(gdb) thread 
[Current thread is 2.1 (<kvm>)]
(gdb) quit
A debugging session is active.

	Inferior 2 [<kvm>] will be killed.

Quit anyway? (y or n) y
You can't do that without a process to debug.
# ^D

Script done on Wed Nov  4 07:02:55 2026
---END---

>How-To-Repeat:
Run Firefox on a recent-ish -HEAD with the `intel' Xorg DDX driver.
I haven't encountered this with the `modesetting' driver, but I don't
use that a lot because it leaks wired memory.
>Fix:
No idea.