Exim4 segfault on armhf while delivering to Maildir
Vincas Dargis
vindrg at gmail.com
Sat Sep 26 15:21:05 BST 2026
Upgraded Debian 12 -> Debian 13 and started getting SEGV when Exim tries to deliver mail to Maildir.
Sendumg mail works.
Same with original 4.98.2-1+deb13u4 and with backport 4.100-1~bpo13+1.
Here's debug log of delivery attempt (ctr+f SIGSEGV):
Exim version 4.100 uid=0 gid=0 pid=14381 -d=0xfffffffbe70973ff
Support for: Content_Scanning Local_Scan Exim_filter Sieve_filter crypteq Expand_dlfunc iconv() IPv6 PAM Perl GnuTLS
move_frozen_messages TLS_resume DANE DKIM DNSSEC ESMTP_Limits ESMTP_Wellknown Event I18N OCSP PIPECONNECT PRDR PROXY
Queue_Ramp SOCKS SPF SRS TCP_Fast_Open
Lookups (built-in): cdb dbm dbmnz dbmjz dnsdb dsearch ldap ldapdn ldapm ldapauth iplsearch lsearch nwildlsearch
wildlsearch mysql passwd pgsql psl regdom sqlite spf readsock
Authenticators (built-in): cram_md5 cyrus_sasl dovecot external plaintext spa tls
Routers (built-in): accept dnslookup ipliteral iplookup manualroute redirect queryprogram
Transports (built-in): appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Malware: clamd avast sock cmdline
Fixed never_users: 0
Configure owner: 0:0
Size of off_t:8 ptr:4 long:4 int:4
Compiler: GCC [14.2.0]
Library version: Glibc: Compile: 2.41
Runtime: 2.41
Hints DB:
Using sqlite3
Library version: GnuTLS: Compile: 3.8.9
Runtime: 3.8.9
Library version: IDN2: Compile: 2.3.8
Runtime: 2.3.8
Library version: Stringprep: Compile: 1.43
Runtime: 1.43
Library version: PCRE2: Compile: 10.46
Runtime: 10.46 2025-08-27
Module init: "dkim"
Module init: "spf"
spf_compile.c:527 Debug: Parsing macro starting at Please%_see%_http://www.openspf.org/Why?id=%{S}&ip=%{C}&receiver=%{R}
spf_compile.c:1214 Debug: Compiling record v=spf1
spf_compile.c:527 Debug: Parsing macro starting at Please%_see%_http://www.open-spf.org/Why
Library version: spf2: Compile: 1.2.10
Runtime: 1.2.10
Module init: "sieve_filter"
Total 22 built-in lookups
Library version: LDAP: Compile OpenLDAP 2.6.10
Runtime OpenLDAP 20610
Library version: CDB: Exim 4.100 builtin
Library version: dsearch: Exim 4.100 builtin
Library version: DNSDB: Exim 4.100 builtin
Library version: PostgreSQL: Runtime: 17.11
Library version: lsearch: Exim 4.100 builtin
Library version: MySQL: Compile: 110806 11.8.6 [mariadb-11.8]
Runtime: 30409 3.4.9
Library version: passwd: Exim 4.100 builtin
Library version: psl: Exim 4.100 builtin
Library version: SQLite: Compile: 3.46.1
Runtime: 3.46.1
Library version: spf2: Compile: 1.2.10
Runtime: 1.2.10
WHITELIST_D_MACROS: "OUTGOING"
TRUSTED_CONFIG_LIST: "/etc/exim4/trusted_configs"
Local-Scan API: 9.1
changed uid/gid: forcing real = effective
uid 0->0 gid 0->0 pid=14381
auxiliary group list: <none>
seeking password data for user "uucp": cache not available
getpwnam() succeeded uid=10 gid=10
configuration file is /var/lib/exim4/config.autogenerated
log selectors = 0xb18798505464cc22 0x0
cwd=/etc/ld.so.conf.d 4 args: exim4 -d+transport -M 1xASkY-000000001wE-0V64
trusted user
admin user
dropping to exim gid; retaining priv uid
readconf_rest: acl
readconf_rest: routers
seeking password data for user "mail": cache not available
getpwnam() succeeded uid=8 gid=8
readconf_rest: transports
seeking password data for user "vmail": cache not available
getpwnam() succeeded uid=993 gid=993
readconf_rest: retry
readconf_rest: rewrite
readconf_rest: authenticators
set_process_info: 14381 delivering specified messages
set_process_info: 14381 delivering 1xASkY-000000001wE-0V64
Trying spool file /var/spool/exim4//input//1xASkY-000000001wE-0V64-D
reading spool file 1xASkY-000000001wE-0V64-H
user=Debian-exim uid=106 gid=109 sender=
sender_local=0 ident=Debian-exim
Non-recipients:
Empty Tree
---- End of tree ----
recipients_count=1
**** SPOOL_IN - No additional fields
body_linecount=5 message_linecount=11
LOG: MAIN
Unfrozen by forced delivery
DSN: set orcpt: flags: 0x0
Delivery address list:
postmaster at odroid-hc1
EXIM_DBOPEN_MULTI: file </var/spool/exim4/db/retry> dir </var/spool/exim4/db> flags=O_RDWR
returned from EXIM_DBOPEN_MULTI: 0x2394cc0
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Considering: postmaster at odroid-hc1
unique = postmaster at odroid-hc1
checking router retry status
dbfn_read: key=R:odroid-hc1␀
dbfn_read: null return
dbfn_read: key=R:postmaster at odroid-hc1␀
dbfn_read: null return
dbfn_read: key=R:postmaster at odroid-hc1:<>␀
dbfn_read: null return
no domain retry record
no address retry record
postmaster at odroid-hc1: queued for routing
retaining retry hintsdb handle
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
routing postmaster at odroid-hc1
--------> hubbed_hosts router <--------
local_part=postmaster domain=odroid-hc1
checking domains
expand list text
odroid-hc1 in domains?
list element: partial-lsearch;/etc/exim4/hubbed_hosts
search_open: lsearch "/etc/exim4/hubbed_hosts"
search_find: file="/etc/exim4/hubbed_hosts"
key="odroid-hc1" partial=2 affix=*. starflags=0 opts=NULL
LRU list:
;/etc/exim4/hubbed_hosts
End
internal_search_find: file="/etc/exim4/hubbed_hosts"
type=lsearch key="odroid-hc1" opts=NULL
file lookup required for odroid-hc1
in /etc/exim4/hubbed_hosts
creating new cache entry
lookup failed
trying partial match *.odroid-hc1
internal_search_find: file="/etc/exim4/hubbed_hosts"
type=lsearch key="*.odroid-hc1" opts=NULL
file lookup required for *.odroid-hc1
in /etc/exim4/hubbed_hosts
creating new cache entry
lookup failed
odroid-hc1 in domains? no (end of list)
hubbed_hosts router skipped: domains mismatch
--------> dnslookup_relay_to_domains router <--------
local_part=postmaster domain=odroid-hc1
checking domains
odroid-hc1 in domains?
list element: !░+local_domains
start sublist local_domains
╎odroid-hc1 in "@:localhost:odroid-hc1:example.com"?
╎ list element: @
╎ list element: localhost
╎ list element: odroid-hc1
╎ odroid-hc1 in "@:localhost:odroid-hc1:example.com"? yes (matched "odroid-hc1")
end sublist local_domains
data from lookup saved for cache for +local_domains: key 'odroid-hc1' value 'odroid-hc1'
odroid-hc1 in domains? no (matched "! +local_domains")
dnslookup_relay_to_domains router skipped: domains mismatch
--------> dnslookup router <--------
local_part=postmaster domain=odroid-hc1
checking domains
odroid-hc1 in domains?
list element: !░+local_domains
start sublist local_domains
cached yes match for +local_domains
cached lookup data = odroid-hc1
odroid-hc1 in domains? no (matched "! +local_domains" - cached)
dnslookup router skipped: domains mismatch
--------> real_local router <--------
local_part=postmaster domain=odroid-hc1
real_local router skipped: prefix mismatch
--------> system_aliases router <--------
local_part=postmaster domain=odroid-hc1
checking domains
odroid-hc1 in domains?
list element: +local_domains
start sublist local_domains
cached yes match for +local_domains
cached lookup data = odroid-hc1
odroid-hc1 in domains? yes (matched "+local_domains" - cached)
R: system_aliases for postmaster at odroid-hc1
calling system_aliases router
rda_interpret (string): '${lookup{$local_part}lsearch{/etc/aliases}}'
search_open: lsearch "/etc/aliases"
search_find: file="/etc/aliases"
key="postmaster" partial=-1 affix=NULL starflags=0 opts=NULL
LRU list:
;/etc/aliases
;/etc/exim4/hubbed_hosts
End
internal_search_find: file="/etc/aliases"
type=lsearch key="postmaster" opts=NULL
file lookup required for postmaster
in /etc/aliases
creating new cache entry
lookup yielded: root
expanded: 'root'
file is not a filter file
parse_forward_list: root
extract item: root
system_aliases router generated root at odroid-hc1
errors_to=NULL transport=NULL
uid=unset gid=unset home=NULL
routed by system_aliases router
envelope to: postmaster at odroid-hc1
transport: <none>
using cached retry hintsdb handle
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Considering: root at odroid-hc1
unique = root at odroid-hc1
checking router retry status
dbfn_read: key=R:odroid-hc1␀
dbfn_read: null return
dbfn_read: key=R:root at odroid-hc1␀
dbfn_read: null return
dbfn_read: key=R:root at odroid-hc1:<>␀
dbfn_read: null return
no domain retry record
no address retry record
root at odroid-hc1: queued for routing
retaining retry hintsdb handle
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
routing root at odroid-hc1
--------> hubbed_hosts router <--------
local_part=root domain=odroid-hc1
checking domains
expand list text
odroid-hc1 in domains?
list element: partial-lsearch;/etc/exim4/hubbed_hosts
search_open: lsearch "/etc/exim4/hubbed_hosts"
cached open
search_find: file="/etc/exim4/hubbed_hosts"
key="odroid-hc1" partial=2 affix=*. starflags=0 opts=NULL
LRU list:
;/etc/exim4/hubbed_hosts
;/etc/aliases
End
internal_search_find: file="/etc/exim4/hubbed_hosts"
type=lsearch key="odroid-hc1" opts=NULL
cached data used for lookup of odroid-hc1
in /etc/exim4/hubbed_hosts
lookup failed
trying partial match *.odroid-hc1
internal_search_find: file="/etc/exim4/hubbed_hosts"
type=lsearch key="*.odroid-hc1" opts=NULL
cached data used for lookup of *.odroid-hc1
in /etc/exim4/hubbed_hosts
lookup failed
odroid-hc1 in domains? no (end of list)
hubbed_hosts router skipped: domains mismatch
--------> dnslookup_relay_to_domains router <--------
local_part=root domain=odroid-hc1
checking domains
odroid-hc1 in domains?
list element: !░+local_domains
start sublist local_domains
╎odroid-hc1 in "@:localhost:odroid-hc1:example.com"?
╎ list element: @
╎ list element: localhost
╎ list element: odroid-hc1
╎ odroid-hc1 in "@:localhost:odroid-hc1:example.com"? yes (matched "odroid-hc1")
end sublist local_domains
data from lookup saved for cache for +local_domains: key 'odroid-hc1' value 'odroid-hc1'
odroid-hc1 in domains? no (matched "! +local_domains")
dnslookup_relay_to_domains router skipped: domains mismatch
--------> dnslookup router <--------
local_part=root domain=odroid-hc1
checking domains
odroid-hc1 in domains?
list element: !░+local_domains
start sublist local_domains
cached yes match for +local_domains
cached lookup data = odroid-hc1
odroid-hc1 in domains? no (matched "! +local_domains" - cached)
dnslookup router skipped: domains mismatch
--------> real_local router <--------
local_part=root domain=odroid-hc1
real_local router skipped: prefix mismatch
--------> system_aliases router <--------
local_part=root domain=odroid-hc1
checking domains
odroid-hc1 in domains?
list element: +local_domains
start sublist local_domains
cached yes match for +local_domains
cached lookup data = odroid-hc1
odroid-hc1 in domains? yes (matched "+local_domains" - cached)
R: system_aliases for root at odroid-hc1
calling system_aliases router
rda_interpret (string): '${lookup{$local_part}lsearch{/etc/aliases}}'
search_open: lsearch "/etc/aliases"
cached open
search_find: file="/etc/aliases"
key="root" partial=-1 affix=NULL starflags=0 opts=NULL
LRU list:
;/etc/aliases
;/etc/exim4/hubbed_hosts
End
internal_search_find: file="/etc/aliases"
type=lsearch key="root" opts=NULL
file lookup required for root
in /etc/aliases
creating new cache entry
lookup yielded: redacted at example.com
expanded: 'redacted at example.com'
file is not a filter file
parse_forward_list: redacted at example.com
extract item: redacted at example.com
system_aliases router generated redacted at example.com
errors_to=NULL transport=NULL
uid=unset gid=unset home=NULL
routed by system_aliases router
envelope to: root at odroid-hc1
transport: <none>
using cached retry hintsdb handle
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Considering: redacted at example.com
unique = redacted at example.com
checking router retry status
dbfn_read: key=R:example.com␀
dbfn_read: null return
dbfn_read: key=R:redacted at example.com␀
dbfn_read: null return
dbfn_read: key=R:redacted at example.com:<>␀
dbfn_read: null return
no domain retry record
no address retry record
redacted at example.com: queued for routing
retaining retry hintsdb handle
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
routing redacted at example.com
--------> hubbed_hosts router <--------
local_part=redacted domain=example.com
checking domains
expand list text
example.com in domains?
list element: partial-lsearch;/etc/exim4/hubbed_hosts
search_open: lsearch "/etc/exim4/hubbed_hosts"
cached open
search_find: file="/etc/exim4/hubbed_hosts"
key="example.com" partial=2 affix=*. starflags=0 opts=NULL
LRU list:
;/etc/exim4/hubbed_hosts
;/etc/aliases
End
internal_search_find: file="/etc/exim4/hubbed_hosts"
type=lsearch key="example.com" opts=NULL
file lookup required for example.com
in /etc/exim4/hubbed_hosts
creating new cache entry
lookup failed
trying partial match *.example.com
internal_search_find: file="/etc/exim4/hubbed_hosts"
type=lsearch key="*.example.com" opts=NULL
file lookup required for *.example.com
in /etc/exim4/hubbed_hosts
creating new cache entry
lookup failed
example.com in domains? no (end of list)
hubbed_hosts router skipped: domains mismatch
--------> dnslookup_relay_to_domains router <--------
local_part=redacted domain=example.com
checking domains
example.com in domains?
list element: !░+local_domains
start sublist local_domains
╎example.com in "@:localhost:odroid-hc1:example.com"?
╎ list element: @
╎ list element: localhost
╎ list element: odroid-hc1
╎ list element: example.com
╎ example.com in "@:localhost:odroid-hc1:example.com"? yes (matched "example.com")
end sublist local_domains
data from lookup saved for cache for +local_domains: key 'example.com' value 'example.com'
example.com in domains? no (matched "! +local_domains")
dnslookup_relay_to_domains router skipped: domains mismatch
--------> dnslookup router <--------
local_part=redacted domain=example.com
checking domains
example.com in domains?
list element: !░+local_domains
start sublist local_domains
cached yes match for +local_domains
cached lookup data = example.com
example.com in domains? no (matched "! +local_domains" - cached)
dnslookup router skipped: domains mismatch
--------> real_local router <--------
local_part=redacted domain=example.com
real_local router skipped: prefix mismatch
--------> system_aliases router <--------
local_part=redacted domain=example.com
checking domains
example.com in domains?
list element: +local_domains
start sublist local_domains
cached yes match for +local_domains
cached lookup data = example.com
example.com in domains? yes (matched "+local_domains" - cached)
R: system_aliases for redacted at example.com
calling system_aliases router
rda_interpret (string): '${lookup{$local_part}lsearch{/etc/aliases}}'
search_open: lsearch "/etc/aliases"
cached open
search_find: file="/etc/aliases"
key="redacted" partial=-1 affix=NULL starflags=0 opts=NULL
LRU list:
;/etc/aliases
;/etc/exim4/hubbed_hosts
End
internal_search_find: file="/etc/aliases"
type=lsearch key="redacted" opts=NULL
file lookup required for redacted
in /etc/aliases
creating new cache entry
lookup failed
expanded: ''
file is not a filter file
parse_forward_list:
system_aliases router declined for redacted at example.com
--------> userforward router <--------
local_part=redacted domain=example.com
checking domains
example.com in domains?
list element: +local_domains
start sublist local_domains
cached yes match for +local_domains
cached lookup data = example.com
example.com in domains? yes (matched "+local_domains" - cached)
checking for local user
seeking password data for user "redacted": cache not available
getpwnam() returned NULL (user not found)
userforward router skipped: redacted is not a local user
--------> procmail router <--------
local_part=redacted domain=example.com
checking domains
example.com in domains?
list element: +local_domains
start sublist local_domains
cached yes match for +local_domains
cached lookup data = example.com
example.com in domains? yes (matched "+local_domains" - cached)
checking for local user
seeking password data for user "redacted": using cached result
getpwnam() returned NULL (user not found)
procmail router skipped: redacted is not a local user
--------> dovecot_router router <--------
local_part=redacted domain=example.com
checking domains
example.com in domains?
list element: +local_domains
start sublist local_domains
cached yes match for +local_domains
cached lookup data = example.com
example.com in domains? yes (matched "+local_domains" - cached)
checking local_parts
redacted in local_parts?
list element: redacted
redacted in local_parts? yes (matched "redacted")
checking require_files
file check: +/home/vmail/${domain_data}/${local_part_data}/
expanded file: /home/vmail/example.com/redacted/
stat() yielded 0
calling dovecot_router router
dovecot_router router called for redacted at example.com
domain = example.com
set transport 'dovecot_transport'
queued for dovecot_transport transport: local_part = redacted
domain = example.com
errors_to=NULL
domain_data=example.com local_part_data=redacted
routed by dovecot_router router
envelope to: redacted at example.com
transport: dovecot_transport
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
After routing:
Local deliveries:
redacted at example.com
Remote deliveries:
Failed addresses:
Deferred addresses:
search_tidyup called
>>>>>>>>>>>>>>>> Local deliveries >>>>>>>>>>>>>>>>
--------> redacted at example.com <--------
using cached retry hintsdb handle
dbfn_read: key=T:redacted at example.com␀
dbfn_read: size 69 return
retry record exists: age=1m58s (max 1w)
time to retry = 3m2s expired = 0
retaining retry hintsdb handle
search_tidyup called
fresh-exec forking for delivery-local
fresh-exec forked for delivery-local: 14383
postfork: delivery-local
changed uid/gid: local delivery to redacted <redacted at example.com> transport=dovecot_transport
uid 0->993 gid 109->993 pid=14383
auxiliary group list: <none>
home=NULL current=/
set_process_info: 14383 delivering 1xASkY-000000001wE-0V64 to redacted using dovecot_transport
appendfile transport entered
appendfile: mode=600 notify_comsat=0 quota=0 warning=0
directory=/home/vmail/example.com/redacted/Maildir format=maildir
message_prefix=null
message_suffix=null
maildir_use_size_file=no
ensuring maildir directories exist in /home/vmail/example.com/redacted/Maildir
delivering in maildir format in /home/vmail/example.com/redacted/Maildir
LOG: MAIN PANIC
SIGSEGV (fault address: 0x3828)
2026-09-26 17:12:34 1xASkY-000000001wE-0V64 SIGSEGV (fault address: 0x3828)
LOG: MAIN PANIC
failed to read delivery status for redacted at example.com from delivery subprocess
LOG: MAIN PANIC
appendfile transport process returned non-zero status 0x0100: exit code 1
dovecot_transport transport returned DEFER for redacted at example.com
added retry item for T:redacted at example.com: errno=-1 more_errno=0 flags=0
post-process redacted at example.com (DEFER)
LOG: MAIN
== redacted at example.com <postmaster at odroid-hc1> R=dovecot_router T=dovecot_transport defer (error-code not set)
>>>>>>>>>>>>>>>> deliveries are done >>>>>>>>>>>>>>>>
set_process_info: 14381 tidying up after delivering 1xASkY-000000001wE-0V64
Processing retry items
Succeeded addresses:
root at odroid-hc1: no retry items
postmaster at odroid-hc1: no retry items
postmaster at odroid-hc1: no retry items
Failed addresses:
Deferred addresses:
redacted at example.com
using cached retry hintsdb handle
Check retry rule (/var/lib/exim4/config.autogenerated:2052) '*'
╎redacted at example.com in "*"?
╎ list element: *
╎ address match test: subject=redacted at example.com pattern=*
╎ example.com in "*"?
╎ list element: *
╎ example.com in "*"? yes (matched "*")
╎ redacted at example.com in "*"? yes (matched "*")
retry for T:redacted at example.com = * 0 0
dbfn_transaction_start
dbfn_read: key=T:redacted at example.com␀
dbfn_read: size 69 return
failing_interval=119 message_age=1500
Writing retry data for T:redacted at example.com
first failed=1790431836 last try=1790431955 next try=1790432255 expired=0
errno=-1 more_errno=0 unknown error
dbfn_write: key=T:redacted at example.com datalen 69
dbfn_transaction_commit
root at odroid-hc1: no retry items
postmaster at odroid-hc1: no retry items
retaining retry hintsdb handle
end of retry processing
DSN: processing router : system_aliases
DSN: processing successful delivery address: root at odroid-hc1
DSN: Sender_address:
DSN: orcpt: NULL flags: 0x0
DSN: envid: NULL ret: 0
DSN: Final recipient: root at odroid-hc1
DSN: Remote SMTP server supports DSN: UNKNOWN
DSN: not sending DSN success message
DSN: processing router : system_aliases
DSN: processing successful delivery address: postmaster at odroid-hc1
DSN: Sender_address:
DSN: orcpt: NULL flags: 0x0
DSN: envid: NULL ret: 0
DSN: Final recipient: postmaster at odroid-hc1
DSN: Remote SMTP server supports DSN: UNKNOWN
DSN: not sending DSN success message
final close of cached retry db
EXIM_DBCLOSE_MULTI(0x2394cc0)
closed hints database
LOG: MAIN
Frozen
delivery deferred: update_spool=1 header_rewritten=0
Writing spool header file: /var/spool/exim4//input//hdr.1xASkY-000000001wE-0V64
DSN: **** SPOOL_OUT - address: <postmaster at odroid-hc1> errorsto: <NULL> orcpt: <NULL> dsn_flags: 0x0
Renaming spool header file: /var/spool/exim4//input//1xASkY-000000001wE-0V64-H
Size of headers = 441
end delivery of 1xASkY-000000001wE-0V64
changed uid/gid: post-delivery tidying
uid 0->106 gid 109->109 pid=14381
auxiliary group list: <none>
search_tidyup called
search_tidyup called
>>>>>>>>>>>>>>>> Exim pid=14381 (fresh-exec) terminating with rc=0 >>>>>>>>>>>>>>>>
More information about the Pkg-exim4-users
mailing list