#4148·pwndbg

ktask recovery is flaky (in reality) which kills tests often

Author: k4lizenCreated Sep 9, 2026Updated Sep 11, 2026
Labelsbugkernel

Attached two CI logs which show a ktask command fail: log1.txt, log2.txt .

One thing that might be happening is in

python
    for i in range(pwndbg.aglib.kernel.nproc()):
        task = pwndbg.aglib.kernel.current_task(i)

We only have one CPU core and one task. That task might be getting killed so it might be off the DLL and get_double_linked_list() cannot execute the full loop and returns None.

Another thing that might be happening is that in get_mm_struct we get the tasks from the task list if their mm or active_mm holds a struct mm which has pgd == CR3. This might break if the CPU is idle / doing some kernel work that does not involve a user-space process, so the CR3 holds swapper_pg_dir which is not the mm/active_mm of any task in the task list.