• Test vm_guest != VM_GUEST_NO rather than vm_guest == VM_GUEST_VM

In D7172#149441, @vangyzen wrote:

On line 797 of sys/amd64/amd64/pmap.c, we currently test vm_guest == VM_GUEST_VM. Should we test for != VM_GUEST_NO instead? That code seems to apply to all hypervisors. (Ditto for the i386 equivalent.)

In D6859#144877, @kib wrote:

Remove racy check for KN_INFLUX, which is additionally buggy by not chechking KN_SCAN.

I tested the 17676 patch with my original script. Haven't seen any crashes, but I am seeing spurious NOTE_EXEC events. That is, I might encounter >4000 NOTE_EXECs even though only 4000 occurred. The number of extra NOTE_EXECs is the same as the number of events where both NOTE_EXEC and NOTE_CHILD are in fflags. I think the extra knote that is created for NOTE_CHILD as well as the normal knote are both getting NOTE_EXEC added to fflags.

To make my last comment slightly more specific, I think what happens is:

The race is between the exiting process (who runs knote(..., NOTE_EXIT), then filt_proc(), then knlist_remove_inevent()) and another thread in kqueue_scan(), processing possibly a NOTE_EXEC for the same process (I've only been able to reproduce this with short lived processes). I could try to track it down more precisely, though even KTR messages can close the timing window, depending on where I put them.