25.7.9: pkg exited on signal 11 after pkg update

[kozistan]

Hi, after upgrading to OPNsense 25.7.9 I started seeing repeated crashes of pkg with signal 11 on my firewall and I am not sure what is going on.

System log (repeating every minute):

Code Select Expand

<13>1 2025-12-06T07:00:05+01:00 fw.sloto.space kernel - - [meta sequenceId="32"] <6>[21705] pid 39394 (pkg), jid 0, uid 0: exited on signal 11 (no core dump - bad address)
<13>1 2025-12-06T07:01:07+01:00 fw.sloto.space kernel - - [meta sequenceId="1"] <6>[21768] pid 1476 (pkg), jid 0, uid 0: exited on signal 11 (no core dump - bad address)
<13>1 2025-12-06T07:02:05+01:00 fw.sloto.space kernel - - [meta sequenceId="2"] <6>[21825] pid 49670 (pkg), jid 0, uid 0: exited on signal 11 (no core dump - bad address)
<13>1 2025-12-06T07:03:05+01:00 fw.sloto.space kernel - - [meta sequenceId="3"] <6>[21885] pid 88108 (pkg), jid 0, uid 0: exited on signal 11 (no core dump - bad address)
pkg update output:

Code Select Expand

Updating OPNsense repository catalogue...
OPNsense repository is up to date.
Updating SunnyValley repository catalogue...
pkg: Failed to fetch https://updates.zenarmor.net/opnsense/FreeBSD:14:amd64/25.7/16d2de42-0612-444d-84cd-9da99e66f1f9/data.pkg: Not found
pkg: Failed to fetch https://updates.zenarmor.net/opnsense/FreeBSD:14:amd64/25.7/16d2de42-0612-444d-84cd-9da99e66f1f9/data.txz: Not found
SunnyValley repository is up to date.
All repositories are up to date.
Child process pid=4711 terminated abnormally: Segmentation fault


Right now the firewall seems to work, but the segmentation fault happens every time pkg update runs and clutters the logs. I am just trying to understand if this is a known issue with 25.7.9 / the new kernel, or something broken on my installation only.

Could you please advise what might be wrong or what additional diagnostics I should provide?

Thank you in advance.

[meyergru]

Using an Intel CPU? See this, point 23.

[kozistan]

Thank you for the tip! I've performed diagnostics following point 23. Here are my findings:

Code Select Expand

PU: 12th Gen Intel Core i5-1235U (Alder Lake)
hw.pci.enable_aspm: 0 (disabled in /boot/loader.conf)
Microcode: no matching update found
I've tried:
Disabled ASPM by adding hw.pci.enable_aspm="0" to /boot/loader.conf → reboot

Cleared pkg cache: rm -rf /var/cache/pkg/*

Ran pkg update -f again and problem persists. The segmentation fault still occurs at exactly the same point:

Code Select Expand

SunnyValley repository update completed. 66 packages processed.
All repositories are up to date.
Child process pid=58709 terminated abnormally: Segmentation fault

This issue appeared only after upgrading to 25.7.9 (worked fine on previous versions)
Opnsense is installed on Vault Pro VP6650 – Intel i5 with X710 NIC's (ixl)

Any advice?

[meyergru]

ASPM is your smallest problem. That is neither the first nor the only thing in point 23. You need to use the os-microcode-intel plugin and the tuneables from the linked posting in point 23 with your Alder Lake CPU.

You also do not need to add anything to any files, just use the web UI to enter the tuneables and reboot afterwards.

[kozistan]

Understood. What I did is set the remaining tunables and reboot, but this did not fix the issue.

Code Select Expand

vm.pmap.pcid_enabled="0"
hw.ibrs_disable="0"
vm.pmap.pti="1"
Then I removed SunnyValley from the active repos and reset the pkg state:

Code Select Expand

mv /usr/local/etc/pkg/repos/SunnyValley.conf /usr/local/etc/pkg/repos/SunnyValley.conf.DISABLED
rm -rf /var/cache/pkg/*
rm -f /var/db/pkg/*.sqlite
After that I reinstalled pkg using pkg-static:

Code Select Expand

/usr/local/sbin/pkg-static install -f pkg   # installed pkg-2.3.1_1
So I downgraded pkg and

Code Select Expand

pkg update -f now runs cleanly and no longer faults.

Does this mean there is something wrong with the pkg 2.4.2 version on this hardware/setup?

[meyergru]

IDK, but I doubt it. Did you install the microcode updates?

[kozistan]

I checked plugin os-cpu-microcode-intel and it was installed from beginning.

And have have the following in /boot/loader.conf:

Code Select Expand

cpu_microcode_load="YES"
cpu_microcode_name="/boot/firmware/intel-ucode.bin"

The output of dmesg | grep -i microcode shows:

Code Select Expand

CPU microcode: no matching update found