panic: Attempting to remove unmapped reservation entry

[RoundofThree]

In the latest dev branch GENERIC-MORELLO-PURECAP kernel (tested at https://github.com/CTSRD-CHERI/cheribsd/tree/6fb9ad460cd6b24b3a37c09c0aefe1de39600879), I can hit this KASSERT panic in vm_map_remove_locked.

root@cheribsd-morello-purecap:~ # ./repro 
panic: Attempting to remove unmapped reservation entry start:20ffc000 end:20ffe000
cpuid = 0
time = 1732218720
KDB: stack backtrace:
db_trace_self() at db_trace_self
db_trace_self_wrapper() at db_trace_self_wrapper+0x38
vpanic() at vpanic+0x190
panic() at panic+0x48
vm_map_remove_locked() at vm_map_remove_locked+0x208
kern_munmap() at kern_munmap+0xcc
do_el0_sync() at do_el0_sync+0x624
handle_el0_sync() at handle_el0_sync+0x34
--- exception, esr 0x56000000
KDB: enter: panic
[ thread pid 925 tid 100090 ]
Stopped at      kdb_enter+0x63: undefined       c200027f
db> 

Here you have the C reproducer:

#include <sys/mman.h>

#include <cheri/cheric.h>
#include <stdint.h>

int main(void)
{
    void *p = mmap(/*addr=*/(void *)(intptr_t)0x20000000, /*len=*/0x1000000,
            /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7,
            /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012, /*fd=*/-1,
            /*offset=*/0);
    mmap(/*addr=*/cheri_setaddress(p, 0x20ffc000), /*len=*/0x2000,
            /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7,
            /*flags=MAP_STACK|MAP_FIXED*/ 0x410, /*fd=*/-1, /*offset=*/0);
    munmap(/*addr=*/cheri_setaddress(p, 0x20ffc000), /*len=*/0x3000);
    return 0;
}

I compiled it with cc -o repro repro.c in a Morello box.