Hi, after upgrading to OPNsense 25.7.9 I started seeing repeated crashes of pkg with signal 11 on my firewall and I am not sure what is going on.
System log (repeating every minute):
<13>1 2025-12-06T07:00:05+01:00 fw.sloto.space kernel - - [meta sequenceId="32"] <6>[21705] pid 39394 (pkg), jid 0, uid 0: exited on signal 11 (no core dump - bad address)
<13>1 2025-12-06T07:01:07+01:00 fw.sloto.space kernel - - [meta sequenceId="1"] <6>[21768] pid 1476 (pkg), jid 0, uid 0: exited on signal 11 (no core dump - bad address)
<13>1 2025-12-06T07:02:05+01:00 fw.sloto.space kernel - - [meta sequenceId="2"] <6>[21825] pid 49670 (pkg), jid 0, uid 0: exited on signal 11 (no core dump - bad address)
<13>1 2025-12-06T07:03:05+01:00 fw.sloto.space kernel - - [meta sequenceId="3"] <6>[21885] pid 88108 (pkg), jid 0, uid 0: exited on signal 11 (no core dump - bad address)
pkg update output:
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
Updating SunnyValley repository catalogue...
pkg: Failed to fetch https://updates.zenarmor.net/opnsense/FreeBSD:14:amd64/25.7/16d2de42-0612-444d-84cd-9da99e66f1f9/data.pkg: Not found
pkg: Failed to fetch https://updates.zenarmor.net/opnsense/FreeBSD:14:amd64/25.7/16d2de42-0612-444d-84cd-9da99e66f1f9/data.txz: Not found
SunnyValley repository is up to date.
All repositories are up to date.
Child process pid=4711 terminated abnormally: Segmentation fault
Right now the firewall seems to work, but the segmentation fault happens every time pkg update runs and clutters the logs. I am just trying to understand if this is a known issue with 25.7.9 / the new kernel, or something broken on my installation only.
Could you please advise what might be wrong or what additional diagnostics I should provide?
Thank you in advance.
Using an Intel CPU? See this, point 23 (https://forum.opnsense.org/index.php?topic=42985.0).
Thank you for the tip! I've performed diagnostics following point 23. Here are my findings:
PU: 12th Gen Intel Core i5-1235U (Alder Lake)
hw.pci.enable_aspm: 0 (disabled in /boot/loader.conf)
Microcode: no matching update found
I've tried:
Disabled ASPM by adding hw.pci.enable_aspm="0" to /boot/loader.conf → reboot
Cleared pkg cache: rm -rf /var/cache/pkg/*
Ran pkg update -f again and problem persists. The segmentation fault still occurs at exactly the same point:
SunnyValley repository update completed. 66 packages processed.
All repositories are up to date.
Child process pid=58709 terminated abnormally: Segmentation fault
This issue appeared only after upgrading to 25.7.9 (worked fine on previous versions)
Opnsense is installed on Vault Pro VP6650 – Intel i5 with X710 NIC's (ixl)
Any advice?
ASPM is your smallest problem. That is neither the first nor the only thing in point 23. You need to use the os-microcode-intel plugin and the tuneables from the linked posting in point 23 (https://forum.opnsense.org/index.php?msg=244891) with your Alder Lake CPU.
You also do not need to add anything to any files, just use the web UI to enter the tuneables and reboot afterwards.
Understood. What I did is set the remaining tunables and reboot, but this did not fix the issue.
vm.pmap.pcid_enabled="0"
hw.ibrs_disable="0"
vm.pmap.pti="1"
Then I removed SunnyValley from the active repos and reset the pkg state:
mv /usr/local/etc/pkg/repos/SunnyValley.conf /usr/local/etc/pkg/repos/SunnyValley.conf.DISABLED
rm -rf /var/cache/pkg/*
rm -f /var/db/pkg/*.sqlite
After that I reinstalled pkg using pkg-static:
/usr/local/sbin/pkg-static install -f pkg # installed pkg-2.3.1_1
So I downgraded pkg and pkg update -f now runs cleanly and no longer faults.
Does this mean there is something wrong with the pkg 2.4.2 version on this hardware/setup?
IDK, but I doubt it. Did you install the microcode updates?
I checked plugin os-cpu-microcode-intel and it was installed from beginning.
And have have the following in /boot/loader.conf:
cpu_microcode_load="YES"
cpu_microcode_name="/boot/firmware/intel-ucode.bin"
The output of dmesg | grep -i microcode shows:
CPU microcode: no matching update found
You cut the update log short, which means context could be missing. A bug exists in FreeBSD pkg using HTTPS since libcurl was added. FreeBSD has no HTTPS repositories but we do. We also have a fix.
Cheers,
Franco
Hello Franco, thank you for reply.
Here is the full output of pkg update -f from before I downgraded pkg (this is the saved log from the original state):
Updating OPNsense repository catalogue...
Fetching meta.conf: 100% 179 B 0.2kB/s 00:01
Fetching data.pkg: 100% 320 KiB 327.9kB/s 00:01
Processing entries: 100%
OPNsense repository update completed. 909 packages processed.
All repositories are up to date.
Child process pid=66405 terminated abnormally: Segmentation fault
Can you please tell me exactly which full commands and output is needed (e.g. full `pkg -vv`, `opnsense-update` run, etc.) so I can provide the complete context from my system? I can collect the logs you need, but at the moment the downgraded pkg is the only setup that runs without any errors here.
I meant the GUI check for updates log. Running arbitrary commands doesn't offer a good density of where the issue is.
But
# pkg info pkg
would also work for the suspicion here.
Cheers,
Franco
Got you, so here are the logs:
1) Current `pkg info pkg` (after downgrade):
root@fw:~# pkg info pkg
pkg: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
pkg-2.3.1_1
Name : pkg
Version : 2.3.1_1
Installed on : Sat Dec 6 15:31:32 2025 CET
Origin : ports-mgmt/pkg
Architecture : FreeBSD:14:amd64
Prefix : /usr/local
Categories : ports-mgmt
Licenses : BSD2CLAUSE
Maintainer : pkg@FreeBSD.org
WWW : https://github.com/freebsd/pkg
Comment : Package manager
Options :
DOCS : off
Shared Libs required:
libarchive.so.7
libc.so.7
libcrypto.so.30
libelf.so.2
libjail.so.1
libm.so.5
libssl.so.30
libthr.so.3
libutil.so.9
libz.so.6
Shared Libs provided:
libpkg.so.4
Annotations :
FreeBSD_version: 1403000
repo_type : binary
repository : OPNsense
Flat size : 25.1MiB
Description :
Package management tool
2) Saved log from the original pkg 2.4.x run when the issue occurred (installing os-sunnyvalley):
***GOT REQUEST TO INSTALL***
Currently running OPNsense 25.7.9 (amd64) at Sat Dec 6 15:59:56 CET 2025
Updating OPNsense repository catalogue...
OPNsense repository is up to date.
Updating SunnyValley repository catalogue...
SunnyValley repository is up to date.
All repositories are up to date.
pkg: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
The following 1 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
os-sunnyvalley: 1.5_1 [OPNsense]
Number of packages to be installed: 1
3 KiB to be downloaded.
[1/1] Fetching os-sunnyvalley-1.5_1.pkg: . done
Checking integrity... done (0 conflicting)
[1/1] Installing os-sunnyvalley-1.5_1...
[1/1] Extracting os-sunnyvalley-1.5_1: ..... done
ld-elf.so.1: Shared object "libxml2.so.16" not found, required by "php"
ld-elf.so.1: Shared object "libxml2.so.16" not found, required by "php"
pkg: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
Checking integrity... done (0 conflicting)
Nothing to do.
***DONE***
3) Current GUI "Check for updates" log with downgraded pkg (no errors):
***GOT REQUEST TO CHECK FOR UPDATES***
Currently running OPNsense 25.7.9 (amd64) at Sun Dec 7 12:53:34 CET 2025
Fetching changelog information, please wait... done
Updating OPNsense repository catalogue...
Fetching meta.conf: . done
Fetching data.pkg: .......... done
Processing entries: .......... done
OPNsense repository update completed. 909 packages processed.
Updating SunnyValley repository catalogue...
Waiting for another process to update repository SunnyValley
All repositories are up to date.
pkg: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
Checking for upgrades (12 candidates): .......... done
Processing candidates (12 candidates): .... done
Checking integrity... done (0 conflicting)
Your packages are up to date.
***DONE***
And here's the proof you caught a FreeBSD pkg version:
> pkg: warning: database version 37 is newer than libpkg(3) version 36, but still compatible
But you've already rolled back and the segfault is gone.
So that's good.
Cheers,
Franco
PS: It's this bug and nobody cares https://github.com/freebsd/pkg/issues/2191
Thank you, Franco. I'll stay with the downgraded pkg for now since it's stable on my box and the libs are compatible.
Once a pkg/curl fix for the HTTPS bug in issue #2191 is available, I'll switch back to the current pkg version again.
No, 2.3.1 is our version. FreeBSD has 2.4.2 and it's broken in that regard.
We may update to 2.4.2 ourselves, but it's not necessary at the moment. And even then: do NOT use the FreeBSD version.
Cheers,
Franco
Thanks for clarification, staying with opnsense pkg