OPNsense Forum

NUT 2.8.5_1: upsc, upscmd, and upsrw segfault after successful query; NUT Diagnostics page remains empty

Environment

• OPNsense 26.1.9-amd64
• NUT package: nut-2.8.5_1
• os-nut package: os-nut-1.9_1
• Platform: FreeBSD 14.3 (OPNsense)
• UPS: Generic USB UPS
• Vendor ID: 0001
• Product ID: 0000
• USB Product String: MEC0003
• Manufacturer String: MEC

Problem Summary

NUT successfully communicates with the UPS and returns valid telemetry, but the NUT client utilities ([tt]upsc[/tt], [tt]upscmd[/tt], and [tt]upsrw[/tt]) consistently segfault after completing their output.

Additionally, the OPNsense NUT Diagnostics page remains empty even though the UPS is operational and data can be queried.

Current Working Configuration

[SKE850]
driver=nutdrv_qx
port=auto
vendorid=0001
productid=0000

Evidence that the Driver Works

The following command successfully retrieves live UPS data:

upsc SKE850

Example output:

battery.charge: 100
battery.voltage: 13.4
device.mfr: Ippon
driver.name: nutdrv_qx
driver.version: 2.8.5
driver.version.data: INNOVATAE 0.01
input.frequency: 60.2
input.voltage: 121.5
output.voltage: 121.8
ups.load: 27
ups.status: OL
ups.type: offline / line interactive

Immediately after printing all values:

Segmentation fault

The same occurs with:

upsc SKE850@localhost
upsc SKE850@127.0.0.1

Other Affected Commands

upscmd -l SKE850

Lists all supported commands successfully and then segfaults.

upsrw SKE850

Lists writable variables successfully and then segfaults.

Even querying a single variable reproduces the issue:

upsc SKE850 battery.charge

Output:

100
Segmentation fault

upsc SKE850 ups.status

Output:

OL
Segmentation fault

Daemon Status

service nut status

Output:

nut is running as pid XXXXX

upsd is listening normally:

sockstat -4 -6 | grep upsd

and shows listeners on TCP/3493.

Kernel Messages

pid XXXXX (upsc), jid 0, uid 0: exited on signal 11 (no core dump - bad address)

This occurs every time [tt]upsc[/tt] is run.

LLDB Backtrace

The crash occurs after all data has already been printed.

frame #0: libthr.so.3
frame #1: libcrypto.so.12`CRYPTO_THREAD_read_lock
frame #2: libcrypto.so.12
frame #3: libcrypto.so.12
frame #4: legacy.so
frame #5: libcrypto.so.12
frame #6: libcrypto.so.12
frame #7: libssl.so.12`SSL_CTX_free
frame #8: libupsclient.so.7`upscli_cleanup
frame #9: upsc

The crash appears to occur during cleanup/freeing of SSL/OpenSSL resources rather than during UPS communication.

Impact

• UPS communication is functional.
• Telemetry is available.
• nutdrv_qx appears healthy.
• NUT client utilities crash on exit.
• OPNsense NUT Diagnostics page remains empty, likely because the helper process exits with SIGSEGV.

Additional Note

The UPS was initially detected as USB device MEC0003 (vendor 0001, product 0000).

After simplifying the generated configuration to only:

[SKE850]
driver=nutdrv_qx
port=auto
vendorid=0001
productid=0000

communication with the UPS became fully functional. The remaining issue appears limited to client-side crashes and the empty Diagnostics page.

Question

Has anyone else observed upsc, upsrw, or upscmd segfaulting under NUT 2.8.5_1 on OPNsense/FreeBSD 14.3, particularly in libupsclient cleanup paths involving SSL_CTX_free() and OpenSSL 3 libraries?

Known problem. Downgrade and lock the NUT package.

https://forum.opnsense.org/index.php?topic=51916.msg267114#msg267114

Thank you for your swift reply. I'm a bit ashamed I didn't find your solution on my own 🫣�