NUT 2.8.5_1: upsc, upscmd, and upsrw segfault after successful query; OPNsense N

[RAT]

NUT 2.8.5_1: upsc, upscmd, and upsrw segfault after successful query; NUT Diagnostics page remains empty

Environment

• OPNsense 26.1.9-amd64
• NUT package: nut-2.8.5_1
• os-nut package: os-nut-1.9_1
• Platform: FreeBSD 14.3 (OPNsense)
• UPS: Generic USB UPS
• Vendor ID: 0001
• Product ID: 0000
• USB Product String: MEC0003
• Manufacturer String: MEC

Problem Summary

NUT successfully communicates with the UPS and returns valid telemetry, but the NUT client utilities ([tt]upsc[/tt], [tt]upscmd[/tt], and [tt]upsrw[/tt]) consistently segfault after completing their output.

Additionally, the OPNsense NUT Diagnostics page remains empty even though the UPS is operational and data can be queried.

Current Working Configuration

Code Select Expand

[SKE850]
driver=nutdrv_qx
port=auto
vendorid=0001
productid=0000

Evidence that the Driver Works

The following command successfully retrieves live UPS data:

Code Select Expand

upsc SKE850

Example output:

Code Select Expand

battery.charge: 100
battery.voltage: 13.4
device.mfr: Ippon
driver.name: nutdrv_qx
driver.version: 2.8.5
driver.version.data: INNOVATAE 0.01
input.frequency: 60.2
input.voltage: 121.5
output.voltage: 121.8
ups.load: 27
ups.status: OL
ups.type: offline / line interactive

Immediately after printing all values:

Code Select Expand

Segmentation fault

The same occurs with:

Code Select Expand

upsc SKE850@localhost
upsc SKE850@127.0.0.1

Other Affected Commands

Code Select Expand

upscmd -l SKE850

Lists all supported commands successfully and then segfaults.

Code Select Expand

upsrw SKE850

Lists writable variables successfully and then segfaults.

Even querying a single variable reproduces the issue:

Code Select Expand

upsc SKE850 battery.charge

Output:

Code Select Expand

100
Segmentation fault


Code Select Expand

upsc SKE850 ups.status

Output:

Code Select Expand

OL
Segmentation fault

Daemon Status

Code Select Expand

service nut status

Output:

Code Select Expand

nut is running as pid XXXXX

upsd is listening normally:

Code Select Expand

sockstat -4 -6 | grep upsd

and shows listeners on TCP/3493.

Kernel Messages

Code Select Expand

pid XXXXX (upsc), jid 0, uid 0: exited on signal 11 (no core dump - bad address)

This occurs every time [tt]upsc[/tt] is run.

LLDB Backtrace

The crash occurs after all data has already been printed.

Code Select Expand

frame #0: libthr.so.3
frame #1: libcrypto.so.12`CRYPTO_THREAD_read_lock
frame #2: libcrypto.so.12
frame #3: libcrypto.so.12
frame #4: legacy.so
frame #5: libcrypto.so.12
frame #6: libcrypto.so.12
frame #7: libssl.so.12`SSL_CTX_free
frame #8: libupsclient.so.7`upscli_cleanup
frame #9: upsc

The crash appears to occur during cleanup/freeing of SSL/OpenSSL resources rather than during UPS communication.

Impact

• UPS communication is functional.
• Telemetry is available.
• nutdrv_qx appears healthy.
• NUT client utilities crash on exit.
• OPNsense NUT Diagnostics page remains empty, likely because the helper process exits with SIGSEGV.

Additional Note

The UPS was initially detected as USB device MEC0003 (vendor 0001, product 0000).

After simplifying the generated configuration to only:

Code Select Expand

[SKE850]
driver=nutdrv_qx
port=auto
vendorid=0001
productid=0000

communication with the UPS became fully functional. The remaining issue appears limited to client-side crashes and the empty Diagnostics page.

Question

Has anyone else observed upsc, upsrw, or upscmd segfaulting under NUT 2.8.5_1 on OPNsense/FreeBSD 14.3, particularly in libupsclient cleanup paths involving SSL_CTX_free() and OpenSSL 3 libraries?

[Patrick M. Hausen]

Known problem. Downgrade and lock the NUT package.

https://forum.opnsense.org/index.php?topic=51916.msg267114#msg267114

[RAT]

Thank you for your swift reply. I'm a bit ashamed I didn't find your solution on my own 🫣�