Disp VM random shutdown

User Support
1

Q4.3.1, dom0 kernel 7.0.6-1, whonix workstation 18 VM with 6.18.31-1.f41 kernel, boot mode - unrestricted session. I came back and my disposable qube is just no longer there. I was running it for days. Happened on Q4.3.1 before, with other ws-18 disp VMs - but not on Q4.2 ws-17 (before the upgrade). Preload disp qubes feature was enabled (I disabled it now).
You may think that “initial” app inside the disp VM crashed, therefore whole VM was shut down - but I start disp VMs with “Run Terminal”, and its seem unlikely that QTerminal would crash. Although it didn’t happen on Q4.2 & Whonix WS 17, which used different terminal app.
Am I the only one with that problem?
journalctl --reverse logs (lots of lines like dom0 qrexec-policy-daemon[8989]: qrexec: sdwdate-gui.ConnectCheck+: disp2186 -> sys-whonix: allowed to sys-whonix are omitted)

Jun 30 18:16:13 dom0 kernel: audit: type=1105 audit(1782832573.897:1517): pid=1119914 uid=1000 auid=1000 ses=7 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_keyinit,pam_limits,pam_systemd,pam_unix acct="root" exe="/usr/bin/sudo" hostname=>
Jun 30 18:16:13 dom0 audit[1119914]: USER_START pid=1119914 uid=1000 auid=1000 ses=7 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_keyinit,pam_limits,pam_systemd,pam_unix acct="root" exe="/usr/bin/sudo" hostname=dom0 addr=? terminal=/dev/>
Jun 30 18:16:13 dom0 sudo[1119914]: pam_unix(sudo:session): session opened for user root(uid=0) by user(uid=1000)
Jun 30 18:16:13 dom0 kernel: audit: type=1110 audit(1782832573.889:1516): pid=1119914 uid=1000 auid=1000 ses=7 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=dom0 addr=? terminal=/dev/pts/7 res=success'
Jun 30 18:16:13 dom0 audit[1119914]: CRED_REFR pid=1119914 uid=1000 auid=1000 ses=7 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="root" exe="/usr/bin/sudo" hostname=dom0 addr=? terminal=/dev/pts/7 res=success'
Jun 30 18:16:13 dom0 kernel: audit: type=1123 audit(1782832573.888:1515): pid=1119914 uid=1000 auid=1000 ses=7 msg='cwd="/home/user" cmd=6A6F75726E616C63746C202D2D72657665727365 exe="/usr/bin/sudo" terminal=pts/7 res=success'
Jun 30 18:16:13 dom0 audit[1119914]: USER_CMD pid=1119914 uid=1000 auid=1000 ses=7 msg='cwd="/home/user" cmd=6A6F75726E616C63746C202D2D72657665727365 exe="/usr/bin/sudo" terminal=pts/7 res=success'
Jun 30 18:16:13 dom0 sudo[1119914]:     user : TTY=pts/7 ; PWD=/home/user ; USER=root ; COMMAND=/usr/bin/journalctl --reverse
Jun 30 18:16:13 dom0 kernel: audit: type=1101 audit(1782832573.886:1514): pid=1119914 uid=1000 auid=1000 ses=7 msg='op=PAM:accounting grantors=pam_unix acct="user" exe="/usr/bin/sudo" hostname=dom0 addr=? terminal=/dev/pts/7 res=success'
Jun 30 18:16:13 dom0 audit[1119914]: USER_ACCT pid=1119914 uid=1000 auid=1000 ses=7 msg='op=PAM:accounting grantors=pam_unix acct="user" exe="/usr/bin/sudo" hostname=dom0 addr=? terminal=/dev/pts/7 res=success'


Jun 30 18:13:55 dom0 kernel: xen-backend console-5-0: xenbus: device forcefully removed from xenstore

Jun 30 18:14:29 dom0 qubesd[2961]: INFO: vm.disp24: Removing volume kernel: 6.18.31-1.fc41
Jun 30 18:14:29 dom0 qubesd[2961]: INFO: vm.disp24: Removing volume volatile: qubes_dom0/vm-disp24-volatile
Jun 30 18:14:29 dom0 qubesd[2961]: INFO: vm.disp24: Removing volume private: qubes_dom0/vm-disp24-private
Jun 30 18:14:29 dom0 qubesd[2961]: INFO: vm.disp24: Removing volume root: qubes_dom0/vm-disp24-root
Jun 30 18:14:29 dom0 kernel: audit: type=1104 audit(1782832469.315:1511): pid=1118508 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jun 30 18:14:29 dom0 kernel: audit: type=1106 audit(1782832469.315:1510): pid=1118508 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=>
Jun 30 18:14:29 dom0 runuser[1118508]: pam_unix(runuser:session): session closed for user user
Jun 30 18:14:29 dom0 audit[1118508]: CRED_DISP pid=1118508 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jun 30 18:14:29 dom0 audit[1118508]: USER_END pid=1118508 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jun 30 18:14:29 dom0 qrexec-policy-daemon[8989]: qrexec: sdwdate-gui.ConnectCheck+: disp2186 -> sys-whonix: allowed to sys-whonix
Jun 30 18:14:29 dom0 qrexec-policy-daemon[8989]: qrexec: sdwdate-gui.ConnectCheck+: wst-work-0-msg-toxic -> sys-whonix: allowed to sys-whonix
Jun 30 18:14:29 dom0 widget-wrapper[18681]: qubesadmin.exc.QubesVMNotFoundError: No such domain: 'disp24'
Jun 30 18:14:29 dom0 widget-wrapper[18681]:     raise exc_class(format_string, *args)
Jun 30 18:14:29 dom0 widget-wrapper[18681]:   File "/usr/lib/python3.13/site-packages/qubesadmin/base.py", line 130, in _parse_qubesd_response
Jun 30 18:14:29 dom0 widget-wrapper[18681]:            ~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
Jun 30 18:14:29 dom0 widget-wrapper[18681]:     return self._parse_qubesd_response(return_data)
Jun 30 18:14:29 dom0 widget-wrapper[18681]:   File "/usr/lib/python3.13/site-packages/qubesadmin/app.py", line 876, in qubesd_call
Jun 30 18:14:29 dom0 widget-wrapper[18681]:         ^^^^^^^^^^^^^^^
Jun 30 18:14:29 dom0 widget-wrapper[18681]:         payload_stream)
Jun 30 18:14:29 dom0 widget-wrapper[18681]:            ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Jun 30 18:14:29 dom0 widget-wrapper[18681]:     return self.app.qubesd_call(dest, method, arg, payload,
Jun 30 18:14:29 dom0 widget-wrapper[18681]:   File "/usr/lib/python3.13/site-packages/qubesadmin/base.py", line 96, in qubesd_call
Jun 30 18:14:29 dom0 widget-wrapper[18681]:         None)
Jun 30 18:14:29 dom0 widget-wrapper[18681]:         None,
Jun 30 18:14:29 dom0 widget-wrapper[18681]:         self._method_prefix + 'GetAll',
Jun 30 18:14:29 dom0 widget-wrapper[18681]:         self._method_dest,
Jun 30 18:14:29 dom0 widget-wrapper[18681]:     properties_str = self.qubesd_call(
Jun 30 18:14:29 dom0 widget-wrapper[18681]:   File "/usr/lib/python3.13/site-packages/qubesadmin/base.py", line 345, in _fetch_all_properties
Jun 30 18:14:29 dom0 widget-wrapper[18681]:     ~~~~~~~~~~~~~~~~~~~~~~~~~~^^
Jun 30 18:14:29 dom0 widget-wrapper[18681]:     self._fetch_all_properties()
Jun 30 18:14:29 dom0 widget-wrapper[18681]:   File "/usr/lib/python3.13/site-packages/qubesadmin/base.py", line 240, in __getattr__
Jun 30 18:14:29 dom0 widget-wrapper[18681]:     self._vm.devices_denied
Jun 30 18:14:29 dom0 widget-wrapper[18681]:   File "/usr/lib/python3.13/site-packages/qui/devices/backend.py", line 144, in update_denied_devices
Jun 30 18:14:29 dom0 widget-wrapper[18681]:     ~~~~~~~~~~~~~~~~~~~~~~~~~~^^
Jun 30 18:14:29 dom0 widget-wrapper[18681]:     self.update_denied_devices()
Jun 30 18:14:29 dom0 widget-wrapper[18681]:   File "/usr/lib/python3.13/site-packages/qui/devices/backend.py", line 58, in __init__
Jun 30 18:14:29 dom0 widget-wrapper[18681]:     wrapped_vm = backend.VM(vm)
Jun 30 18:14:29 dom0 widget-wrapper[18681]:   File "/usr/lib/python3.13/site-packages/qui/devices/device_widget.py", line 651, in vm_shutdown
Jun 30 18:14:29 dom0 widget-wrapper[18681]:     ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^
Jun 30 18:14:29 dom0 widget-wrapper[18681]:     handler(subject, event, **kwargs)
Jun 30 18:14:29 dom0 widget-wrapper[18681]:   File "/usr/lib/python3.13/site-packages/qubesadmin/events/__init__.py", line 307, in handle
Jun 30 18:14:29 dom0 widget-wrapper[18681]: Traceback (most recent call last):
Jun 30 18:14:29 dom0 widget-wrapper[18681]: Failed to handle event: disp24, domain-shutdown, {}
Jun 30 18:14:29 dom0 qrexec-policy-daemon[8989]: qrexec: sdwdate-gui.ConnectCheck+: wst-work-0-crypto-monero -> sys-whonix: allowed to sys-whonix
Jun 30 18:14:29 dom0 qrexec-policy-daemon[8989]: qrexec: sdwdate-gui.ConnectCheck+: wst-work-0-crypto-monero -> sys-whonix: allowed to sys-whonix
Jun 30 18:14:29 dom0 qrexec-policy-daemon[8989]: qrexec: sdwdate-gui.ConnectCheck+: wst-work-0-msg-toxic -> sys-whonix: allowed to sys-whonix
Jun 30 18:14:29 dom0 qrexec-policy-daemon[8989]: qrexec: sdwdate-gui.ConnectCheck+: wst-work-0-crypto-electrum-4 -> sys-whonix: allowed to sys-whonix
Jun 30 18:14:29 dom0 kernel: audit: type=1130 audit(1782832469.010:1509): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-hostnamed comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jun 30 18:14:29 dom0 audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-hostnamed comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jun 30 18:14:29 dom0 systemd[1]: Started systemd-hostnamed.service - Hostname Service.
Jun 30 18:14:28 dom0 qrexec-policy-daemon[8989]: qrexec: sdwdate-gui.ConnectCheck+: disp2186 -> sys-whonix: allowed to sys-whonix
Jun 30 18:14:28 dom0 qrexec-policy-daemon[8989]: qrexec: sdwdate-gui.ConnectCheck+: disp5388 -> sys-whonix: allowed to sys-whonix
Jun 30 18:14:28 dom0 systemd[1]: Starting systemd-hostnamed.service - Hostname Service...
Jun 30 18:14:28 dom0 kernel: audit: type=1334 audit(1782832468.958:1508): prog-id=120 op=LOAD
Jun 30 18:14:28 dom0 kernel: audit: type=1334 audit(1782832468.958:1507): prog-id=119 op=LOAD
Jun 30 18:14:28 dom0 kernel: audit: type=1334 audit(1782832468.958:1506): prog-id=118 op=LOAD
Jun 30 18:14:28 dom0 audit: BPF prog-id=120 op=LOAD
Jun 30 18:14:28 dom0 audit: BPF prog-id=119 op=LOAD
Jun 30 18:14:28 dom0 audit: BPF prog-id=118 op=LOAD
Jun 30 18:14:28 dom0 kernel: audit: type=1334 audit(1782832468.957:1505): prog-id=116 op=UNLOAD
Jun 30 18:14:28 dom0 kernel: audit: type=1334 audit(1782832468.957:1504): prog-id=117 op=UNLOAD
Jun 30 18:14:28 dom0 audit: BPF prog-id=116 op=UNLOAD
Jun 30 18:14:28 dom0 audit: BPF prog-id=117 op=UNLOAD
Jun 30 18:14:28 dom0 audit[1118508]: USER_START pid=1118508 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jun 30 18:14:28 dom0 kernel: audit: type=1105 audit(1782832468.943:1503): pid=1118508 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=?>
Jun 30 18:14:28 dom0 runuser[1118508]: pam_unix(runuser:session): session opened for user user(uid=1000) by (uid=0)
Jun 30 18:14:28 dom0 kernel: audit: type=1103 audit(1782832468.938:1502): pid=1118508 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jun 30 18:14:28 dom0 audit[1118508]: CRED_ACQ pid=1118508 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jun 30 18:14:28 dom0 qubesd[2961]: INFO: Removing appmenus for 'disp24' in 'dom0'

Jun 30 18:14:28 dom0 systemd-homed[2820]: block device /sys/devices/virtual/block/dm-151 has been removed.
Jun 30 18:14:28 dom0 systemd-homed[2820]: block device /sys/devices/virtual/block/dm-151 has been removed.
Jun 30 18:14:28 dom0 systemd-homed[2820]: block device /sys/devices/virtual/block/dm-181 has been removed.
Jun 30 18:14:28 dom0 systemd-homed[2820]: block device /sys/devices/virtual/block/dm-181 has been removed.

Jun 30 18:14:21 dom0 systemd-homed[2820]: block device /sys/devices/virtual/block/dm-179 has been removed.
Jun 30 18:14:21 dom0 systemd-homed[2820]: block device /sys/devices/virtual/block/dm-179 has been removed.

Jun 30 18:14:21 dom0 systemd-homed[2820]: block device /sys/devices/virtual/block/dm-179 has been removed.
Jun 30 18:14:21 dom0 systemd-homed[2820]: block device /sys/devices/virtual/block/dm-179 has been removed.
2

Preloaded disposables are discarded pre-suspend and are refilled post-resume. Was that the case? See below logs of suspend with preloads refreshing:

$ journalctl --user -f
Broadcast message from user@dom0 on pts/12 (Wed 2026-07-01 09:42:18 CEST):

The system will suspend now!

Jul 01 09:42:19 dom0 widget-wrapper[5831]: Failed to handle event: disp9758, domain-shutdown, {}
Jul 01 09:42:19 dom0 widget-wrapper[5831]: Traceback (most recent call last):
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qubesadmin/events/__init__.py", line 332, in handle
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     handler(subject, event, **kwargs)
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qui/devices/device_widget.py", line 656, in vm_shutdown
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     wrapped_vm = backend.VM(vm)
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qui/devices/backend.py", line 58, in __init__
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     self.update_denied_devices()
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     ~~~~~~~~~~~~~~~~~~~~~~~~~~^^
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qui/devices/backend.py", line 156, in update_denied_devices
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     self._vm.devices_denied
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qubesadmin/base.py", line 252, in __getattr__
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     self._fetch_all_properties()
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     ~~~~~~~~~~~~~~~~~~~~~~~~~~^^
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qubesadmin/base.py", line 361, in _fetch_all_properties
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     properties_str = self.qubesd_call(
Jul 01 09:42:19 dom0 widget-wrapper[5831]:         self._method_dest,
Jul 01 09:42:19 dom0 widget-wrapper[5831]:         self._method_prefix + 'GetAll',
Jul 01 09:42:19 dom0 widget-wrapper[5831]:         None,
Jul 01 09:42:19 dom0 widget-wrapper[5831]:         None)
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qubesadmin/base.py", line 107, in qubesd_call
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     return self.app.qubesd_call(dest, method, arg, payload,
Jul 01 09:42:19 dom0 widget-wrapper[5831]:            ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Jul 01 09:42:19 dom0 widget-wrapper[5831]:         payload_stream)
Jul 01 09:42:19 dom0 widget-wrapper[5831]:         ^^^^^^^^^^^^^^^
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qubesadmin/app.py", line 935, in qubesd_call
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     return self._parse_qubesd_response(return_data)
Jul 01 09:42:19 dom0 widget-wrapper[5831]:            ~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qubesadmin/base.py", line 141, in _parse_qubesd_response
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     raise exc_class(format_string, *args)
Jul 01 09:42:19 dom0 widget-wrapper[5831]: qubesadmin.exc.QubesVMNotFoundError: No such domain: 'disp9758'

$ sudo journalctl -f
Broadcast message from user@dom0 on pts/12 (Wed 2026-07-01 09:42:18 CEST):

The system will suspend now!

Jul 01 09:42:18 dom0 systemd-logind[1794]: The system will suspend now!
Jul 01 09:42:18 dom0 systemd[1]: /usr/lib/systemd/system/qubes-suspend.service:9: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.
Jul 01 09:42:18 dom0 systemd[1]: /usr/lib/systemd/system/qubes-suspend.service:9: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.
Jul 01 09:42:18 dom0 systemd[1]: Starting qubes-suspend.service - Qubes suspend hooks...
Jul 01 09:42:18 dom0 qubesd[789031]: INFO: vm.default-dvm: Removing excess qube(s) from preloaded list because system wants to suspend: 'disp9758'
Jul 01 09:42:18 dom0 qrexec-client[791826]: qrexec: root:QUBESRPC qubes.SuspendPreAll dom0: dom0 -> gray
Jul 01 09:42:18 dom0 kernel: xen-backend console-27-0: xenbus: device forcefully removed from xenstore
Jul 01 09:42:18 dom0 qrexec-client[791836]: qrexec: root:QUBESRPC qubes.SuspendPreAll dom0: dom0 -> orange
Jul 01 09:42:19 dom0 qrexec-client[791837]: qrexec: root:QUBESRPC qubes.SuspendPreAll dom0: dom0 -> sys-firewall
Jul 01 09:42:19 dom0 qrexec-client[791838]: qrexec: root:QUBESRPC qubes.SuspendPreAll dom0: dom0 -> sys-net
Jul 01 09:42:19 dom0 qrexec-client[791842]: qrexec: root:QUBESRPC qubes.SuspendPreAll dom0: dom0 -> yellow
Jul 01 09:42:19 dom0 systemd-homed[1788]: block device /sys/devices/virtual/block/dm-275 has been removed.
Jul 01 09:42:19 dom0 systemd-homed[1788]: block device /sys/devices/virtual/block/dm-275 has been removed.
Jul 01 09:42:19 dom0 systemd-homed[1788]: block device /sys/devices/virtual/block/dm-120 has been removed.
Jul 01 09:42:19 dom0 systemd-homed[1788]: block device /sys/devices/virtual/block/dm-120 has been removed.
Jul 01 09:42:19 dom0 systemd-homed[1788]: block device /sys/devices/virtual/block/dm-119 has been removed.
Jul 01 09:42:19 dom0 systemd-homed[1788]: block device /sys/devices/virtual/block/dm-119 has been removed.
Jul 01 09:42:19 dom0 qrexec-client[791903]: qrexec: root:QUBESRPC qubes.SuspendPre dom0: dom0 -> orange
Jul 01 09:42:19 dom0 qrexec-client[791902]: qrexec: root:QUBESRPC qubes.SuspendPre dom0: dom0 -> gray
Jul 01 09:42:19 dom0 qrexec-client[791905]: qrexec: root:QUBESRPC qubes.SuspendPre dom0: dom0 -> sys-firewall
Jul 01 09:42:19 dom0 qrexec-client[791907]: qrexec: root:QUBESRPC qubes.SuspendPre dom0: dom0 -> sys-net
Jul 01 09:42:19 dom0 qrexec-client[791908]: qrexec: root:QUBESRPC qubes.SuspendPre dom0: dom0 -> yellow
Jul 01 09:42:19 dom0 qubesd[789031]: INFO: Removing appmenus for 'disp9758' in 'dom0'
Jul 01 09:42:19 dom0 widget-wrapper[5831]: Failed to handle event: disp9758, domain-shutdown, {}
Jul 01 09:42:19 dom0 widget-wrapper[5831]: Traceback (most recent call last):
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qubesadmin/events/__init__.py", line 332, in handle
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     handler(subject, event, **kwargs)
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     ~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qui/devices/device_widget.py", line 656, in vm_shutdown
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     wrapped_vm = backend.VM(vm)
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qui/devices/backend.py", line 58, in __init__
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     self.update_denied_devices()
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     ~~~~~~~~~~~~~~~~~~~~~~~~~~^^
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qui/devices/backend.py", line 156, in update_denied_devices
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     self._vm.devices_denied
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qubesadmin/base.py", line 252, in __getattr__
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     self._fetch_all_properties()
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     ~~~~~~~~~~~~~~~~~~~~~~~~~~^^
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qubesadmin/base.py", line 361, in _fetch_all_properties
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     properties_str = self.qubesd_call(
Jul 01 09:42:19 dom0 widget-wrapper[5831]:         self._method_dest,
Jul 01 09:42:19 dom0 widget-wrapper[5831]:         self._method_prefix + 'GetAll',
Jul 01 09:42:19 dom0 widget-wrapper[5831]:         None,
Jul 01 09:42:19 dom0 widget-wrapper[5831]:         None)
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qubesadmin/base.py", line 107, in qubesd_call
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     return self.app.qubesd_call(dest, method, arg, payload,
Jul 01 09:42:19 dom0 widget-wrapper[5831]:            ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Jul 01 09:42:19 dom0 widget-wrapper[5831]:         payload_stream)
Jul 01 09:42:19 dom0 widget-wrapper[5831]:         ^^^^^^^^^^^^^^^
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qubesadmin/app.py", line 935, in qubesd_call
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     return self._parse_qubesd_response(return_data)
Jul 01 09:42:19 dom0 widget-wrapper[5831]:            ~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
Jul 01 09:42:19 dom0 widget-wrapper[5831]:   File "/usr/lib/python3.13/site-packages/qubesadmin/base.py", line 141, in _parse_qubesd_response
Jul 01 09:42:19 dom0 widget-wrapper[5831]:     raise exc_class(format_string, *args)
Jul 01 09:42:19 dom0 widget-wrapper[5831]: qubesadmin.exc.QubesVMNotFoundError: No such domain: 'disp9758'
Jul 01 09:42:19 dom0 audit[791926]: CRED_ACQ pid=791926 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:19 dom0 kernel: kauditd_printk_skb: 2 callbacks suppressed
Jul 01 09:42:19 dom0 kernel: audit: type=1103 audit(1782891739.434:1289): pid=791926 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:19 dom0 runuser[791926]: pam_unix(runuser:session): session opened for user user(uid=1000) by (uid=0)
Jul 01 09:42:19 dom0 kernel: audit: type=1105 audit(1782891739.442:1290): pid=791926 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:19 dom0 audit[791926]: USER_START pid=791926 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:19 dom0 runuser[791926]: pam_unix(runuser:session): session closed for user user
Jul 01 09:42:19 dom0 audit[791926]: USER_END pid=791926 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:19 dom0 audit[791926]: CRED_DISP pid=791926 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:19 dom0 kernel: audit: type=1106 audit(1782891739.892:1291): pid=791926 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:19 dom0 kernel: audit: type=1104 audit(1782891739.892:1292): pid=791926 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:19 dom0 qubesd[789031]: INFO: vm.disp9758: Removing volume root: qubes_dom0/vm-disp9758-root
Jul 01 09:42:19 dom0 qubesd[789031]: INFO: vm.disp9758: Removing volume private: qubes_dom0/vm-disp9758-private
Jul 01 09:42:19 dom0 qubesd[789031]: INFO: vm.disp9758: Removing volume volatile: qubes_dom0/vm-disp9758-volatile
Jul 01 09:42:19 dom0 qubesd[789031]: INFO: vm.disp9758: Removing volume kernel: 6.19.14-1.fc41
Jul 01 09:42:20 dom0 52qubes-pause-vms[791809]: 0
Jul 01 09:42:20 dom0 systemd[1]: Finished qubes-suspend.service - Qubes suspend hooks.
Jul 01 09:42:20 dom0 audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=qubes-suspend comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:20 dom0 kernel: audit: type=1130 audit(1782891740.121:1293): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=qubes-suspend comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:20 dom0 systemd[1]: Reached target sleep.target - Sleep.
Jul 01 09:42:20 dom0 systemd[1]: Starting systemd-suspend.service - System Suspend...
Jul 01 09:42:20 dom0 systemd-sleep[792014]: User sessions remain unfrozen on explicit request ($SYSTEMD_SLEEP_FREEZE_USER_SESSIONS=0).
Jul 01 09:42:20 dom0 systemd-sleep[792014]: This is not recommended, and might result in unexpected behavior, particularly
Jul 01 09:42:20 dom0 systemd-sleep[792014]: in suspend-then-hibernate operations or setups with encrypted home directories.
Jul 01 09:42:20 dom0 systemd-sleep[792014]: Performing sleep operation 'suspend'...
Jul 01 09:42:20 dom0 kernel: PM: suspend entry (s2idle)
Jul 01 09:42:20 dom0 kernel: Filesystems sync: 0.015 seconds
Jul 01 09:42:35 dom0 kernel: Freezing user space processes
Jul 01 09:42:35 dom0 kernel: Freezing user space processes completed (elapsed 0.002 seconds)
Jul 01 09:42:35 dom0 kernel: OOM killer disabled.
Jul 01 09:42:35 dom0 kernel: Freezing remaining freezable tasks
Jul 01 09:42:35 dom0 kernel: Freezing remaining freezable tasks completed (elapsed 0.105 seconds)
Jul 01 09:42:35 dom0 kernel: printk: Suspending console(s) (use no_console_suspend to debug)
Jul 01 09:42:35 dom0 kernel: PM: suspend devices took 0.832 seconds
Jul 01 09:42:35 dom0 kernel: ACPI: EC: interrupt blocked
Jul 01 09:42:35 dom0 kernel: pciback 0000:2f:00.0: xen_pciback: Backend-side device suspend not enabled
Jul 01 09:42:35 dom0 kernel: pciback 0000:2e:00.0: xen_pciback: Backend-side device suspend not enabled
Jul 01 09:42:35 dom0 kernel: pciback 0000:00:0d.2: xen_pciback: Backend-side device suspend not enabled
Jul 01 09:42:35 dom0 kernel: pciback 0000:00:14.3: xen_pciback: Backend-side device suspend not enabled
Jul 01 09:42:35 dom0 kernel: pciback 0000:00:14.0: xen_pciback: Backend-side device suspend not enabled
Jul 01 09:42:35 dom0 kernel: pciback 0000:00:0d.0: xen_pciback: Backend-side device suspend not enabled
Jul 01 09:42:35 dom0 kernel: ACPI: EC: interrupt unblocked
Jul 01 09:42:35 dom0 kernel: pci 0000:00:08.0: Setting to D3hot
Jul 01 09:42:35 dom0 kernel: pci 0000:00:0b.0: Setting to D3hot
Jul 01 09:42:35 dom0 kernel: spd5118 19-0050: PM: dpm_run_callback(): spd5118_resume [spd5118] returns -6
Jul 01 09:42:35 dom0 kernel: spd5118 19-0050: PM: failed to resume async: error -6
Jul 01 09:42:35 dom0 kernel: i915 0000:00:02.0: [drm] GT0: GuC firmware i915/mtl_guc_70.bin version 70.53.0
Jul 01 09:42:35 dom0 kernel: i915 0000:00:02.0: [drm] GT0: GUC: submission enabled
Jul 01 09:42:35 dom0 kernel: i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled
Jul 01 09:42:35 dom0 kernel: i915 0000:00:02.0: [drm] GT0: GUC: RC enabled
Jul 01 09:42:35 dom0 kernel: i915 0000:00:02.0: [drm] GT1: GuC firmware i915/mtl_guc_70.bin version 70.53.0
Jul 01 09:42:35 dom0 kernel: i915 0000:00:02.0: [drm] GT1: HuC firmware i915/mtl_huc_gsc.bin version 8.5.4
Jul 01 09:42:35 dom0 kernel: nvme nvme0: 16/0/0 default/read/poll queues
Jul 01 09:42:35 dom0 kernel: i915 0000:00:02.0: [drm] GT1: GUC: submission enabled
Jul 01 09:42:35 dom0 kernel: i915 0000:00:02.0: [drm] GT1: GUC: SLPC enabled
Jul 01 09:42:35 dom0 kernel: i915 0000:00:02.0: [drm] GT1: GUC: RC enabled
Jul 01 09:42:35 dom0 kernel: PM: resume devices took 0.391 seconds
Jul 01 09:42:35 dom0 kernel: mei_gsc_proxy 0000:00:16.0-0f73db04-97ab-4125-b893-e904ad0d5464: bound 0000:00:02.0 (ops i915_gsc_proxy_component_ops [i915])
Jul 01 09:42:35 dom0 kernel: OOM killer enabled.
Jul 01 09:42:35 dom0 kernel: Restarting tasks: Starting
Jul 01 09:42:35 dom0 kernel: Restarting tasks: Done
Jul 01 09:42:35 dom0 kernel: efivarfs: resyncing variable state
Jul 01 09:42:35 dom0 kernel: efivarfs: finished resyncing variable state
Jul 01 09:42:35 dom0 kernel: random: crng reseeded on system resumption
Jul 01 09:42:35 dom0 kernel: acpi LNXVIDEO:00: Restoring backlight state
Jul 01 09:42:35 dom0 systemd-sleep[792014]: System returned from sleep operation 'suspend'.
Jul 01 09:42:35 dom0 kernel: PM: suspend exit
Jul 01 09:42:35 dom0 systemd[1]: systemd-suspend.service: Deactivated successfully.
Jul 01 09:42:35 dom0 systemd[1]: Finished systemd-suspend.service - System Suspend.
Jul 01 09:42:35 dom0 audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-suspend comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:35 dom0 audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-suspend comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:35 dom0 systemd[1]: Stopped target sleep.target - Sleep.
Jul 01 09:42:35 dom0 systemd[1]: Reached target suspend.target - Suspend.
Jul 01 09:42:35 dom0 kernel: audit: type=1130 audit(1782891755.511:1294): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-suspend comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:35 dom0 kernel: audit: type=1131 audit(1782891755.511:1295): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-suspend comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:35 dom0 systemd-logind[1794]: Operation 'suspend' finished.
Jul 01 09:42:35 dom0 systemd[1]: Stopped target suspend.target - Suspend.
Jul 01 09:42:35 dom0 systemd[1]: Stopping qubes-suspend.service - Qubes suspend hooks...
Jul 01 09:42:35 dom0 qrexec-client[792066]: qrexec: root:QUBESRPC qubes.SuspendPost dom0: dom0 -> gray
Jul 01 09:42:35 dom0 qrexec-client[792067]: qrexec: root:QUBESRPC qubes.SuspendPost dom0: dom0 -> orange
Jul 01 09:42:35 dom0 qrexec-client[792068]: qrexec: root:QUBESRPC qubes.SuspendPost dom0: dom0 -> sys-firewall
Jul 01 09:42:35 dom0 qrexec-client[792069]: qrexec: root:QUBESRPC qubes.SuspendPost dom0: dom0 -> sys-net
Jul 01 09:42:35 dom0 qrexec-client[792070]: qrexec: root:QUBESRPC qubes.SuspendPost dom0: dom0 -> yellow
Jul 01 09:42:36 dom0 qrexec-client[792095]: qrexec: root:QUBESRPC qubes.SuspendPostAll dom0: dom0 -> gray
Jul 01 09:42:36 dom0 qrexec-client[792097]: qrexec: root:QUBESRPC qubes.SuspendPostAll dom0: dom0 -> sys-firewall
Jul 01 09:42:36 dom0 qrexec-client[792096]: qrexec: root:QUBESRPC qubes.SuspendPostAll dom0: dom0 -> orange
Jul 01 09:42:36 dom0 qrexec-client[792098]: qrexec: root:QUBESRPC qubes.SuspendPostAll dom0: dom0 -> sys-net
Jul 01 09:42:36 dom0 qrexec-client[792099]: qrexec: root:QUBESRPC qubes.SuspendPostAll dom0: dom0 -> yellow
Jul 01 09:42:36 dom0 qrexec-policy-daemon[4177]: qrexec: qubes.GetDate+nanoseconds: gray -> @default: allowed to dom0
Jul 01 09:42:36 dom0 qrexec-policy-daemon[4177]: qrexec: qubes.GetDate+nanoseconds: orange -> @default: allowed to dom0
Jul 01 09:42:36 dom0 qrexec-policy-daemon[4177]: qrexec: qubes.GetDate+nanoseconds: yellow -> @default: allowed to dom0
Jul 01 09:42:36 dom0 qrexec-policy-daemon[4177]: qrexec: qubes.GetDate+nanoseconds: sys-firewall -> @default: allowed to dom0
Jul 01 09:42:36 dom0 qrexec-policy-daemon[4177]: qrexec: qubes.GetDate+nanoseconds: sys-net -> @default: allowed to dom0
Jul 01 09:42:36 dom0 qubesd[789031]: INFO: vm.default-dvm: Received preload event 'start' because system resumed
Jul 01 09:42:36 dom0 qubesd[789031]: INFO: vm.default-dvm: Preloading '1' qube(s)
Jul 01 09:42:36 dom0 qubesd[789031]: INFO: vm.disp253: Marking preloaded qube
Jul 01 09:42:36 dom0 qubesd[789031]: INFO: vm.disp253: Creating directory: /var/lib/qubes/appvms/disp253
Jul 01 09:42:36 dom0 qubesd[789031]: INFO: Updating appmenus for 'disp253' in 'dom0'
Jul 01 09:42:36 dom0 qubesd[789031]: INFO: Removing appmenus for 'disp253' in 'dom0'
Jul 01 09:42:36 dom0 qubesd[789031]: INFO: Updating appmenus for 'disp253' in 'dom0'
Jul 01 09:42:36 dom0 audit[792115]: CRED_ACQ pid=792115 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 kernel: audit: type=1103 audit(1782891756.909:1296): pid=792115 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 audit[792116]: CRED_ACQ pid=792116 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 kernel: audit: type=1103 audit(1782891756.912:1297): pid=792116 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 audit[792117]: CRED_ACQ pid=792117 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 kernel: audit: type=1103 audit(1782891756.915:1298): pid=792117 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 runuser[792115]: pam_unix(runuser:session): session opened for user user(uid=1000) by (uid=0)
Jul 01 09:42:36 dom0 audit[792115]: USER_START pid=792115 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 kernel: audit: type=1105 audit(1782891756.920:1299): pid=792115 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 runuser[792116]: pam_unix(runuser:session): session opened for user user(uid=1000) by (uid=0)
Jul 01 09:42:36 dom0 kernel: audit: type=1105 audit(1782891756.922:1300): pid=792116 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 audit[792116]: USER_START pid=792116 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 runuser[792117]: pam_unix(runuser:session): session opened for user user(uid=1000) by (uid=0)
Jul 01 09:42:36 dom0 kernel: audit: type=1105 audit(1782891756.925:1301): pid=792117 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 audit[792117]: USER_START pid=792117 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 52qubes-pause-vms[792064]: 0
Jul 01 09:42:36 dom0 systemd[1]: qubes-suspend.service: Deactivated successfully.
Jul 01 09:42:36 dom0 systemd[1]: Stopped qubes-suspend.service - Qubes suspend hooks.
Jul 01 09:42:36 dom0 audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=qubes-suspend comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:36 dom0 kernel: audit: type=1131 audit(1782891756.935:1302): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=qubes-suspend comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:37 dom0 runuser[792117]: pam_unix(runuser:session): session closed for user user
Jul 01 09:42:37 dom0 audit[792117]: USER_END pid=792117 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:37 dom0 kernel: audit: type=1106 audit(1782891757.350:1303): pid=792117 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:37 dom0 audit[792117]: CRED_DISP pid=792117 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:37 dom0 qubesd[789031]: INFO: vm.disp253: Starting qube disp253
Jul 01 09:42:37 dom0 dmeventd[951]: No longer monitoring thin pool qubes_dom0-vm--pool-tpool.
Jul 01 09:42:37 dom0 dmeventd[951]: Monitoring thin pool qubes_dom0-vm--pool-tpool.
Jul 01 09:42:37 dom0 runuser[792115]: pam_unix(runuser:session): session closed for user user
Jul 01 09:42:37 dom0 audit[792115]: USER_END pid=792115 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:37 dom0 audit[792115]: CRED_DISP pid=792115 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:37 dom0 runuser[792116]: pam_unix(runuser:session): session closed for user user
Jul 01 09:42:37 dom0 audit[792116]: USER_END pid=792116 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:37 dom0 audit[792116]: CRED_DISP pid=792116 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:37 dom0 dmeventd[951]: No longer monitoring thin pool qubes_dom0-vm--pool-tpool.
Jul 01 09:42:37 dom0 dmeventd[951]: Monitoring thin pool qubes_dom0-vm--pool-tpool.
Jul 01 09:42:39 dom0 kernel: loop3: detected capacity change from 0 to 1541088
Jul 01 09:42:39 dom0 qubesd[789031]: INFO: vm.disp253: Setting Qubes DB info for the qube
Jul 01 09:42:39 dom0 qubesd[789031]: INFO: vm.disp253: Starting Qubes DB
Jul 01 09:42:39 dom0 audit[792460]: CRED_ACQ pid=792460 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:39 dom0 runuser[792460]: pam_unix(runuser:session): session opened for user user(uid=1000) by (uid=0)
Jul 01 09:42:39 dom0 audit[792460]: USER_START pid=792460 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:39 dom0 runuser[792460]: pam_unix(runuser:session): session closed for user user
Jul 01 09:42:39 dom0 audit[792460]: USER_END pid=792460 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:39 dom0 audit[792460]: CRED_DISP pid=792460 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:39 dom0 qubesd[789031]: INFO: vm.disp253: Activating qube
Jul 01 09:42:39 dom0 audit[792475]: CRED_ACQ pid=792475 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:39 dom0 runuser[792475]: pam_unix(runuser:session): session opened for user user(uid=1000) by (uid=0)
Jul 01 09:42:39 dom0 audit[792475]: USER_START pid=792475 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:40 dom0 kernel: xen-blkback: backend/vbd/28/51712: using 2 queues, protocol 1 (x86_64-abi) persistent grants
Jul 01 09:42:40 dom0 kernel: xen-blkback: backend/vbd/28/51728: using 2 queues, protocol 1 (x86_64-abi) persistent grants
Jul 01 09:42:40 dom0 kernel: xen-blkback: backend/vbd/28/51744: using 2 queues, protocol 1 (x86_64-abi) persistent grants
Jul 01 09:42:40 dom0 kernel: xen-blkback: backend/vbd/28/51760: using 2 queues, protocol 1 (x86_64-abi) persistent grants





Jul 01 09:42:45 dom0 runuser[792475]: pam_unix(runuser:session): session closed for user user
Jul 01 09:42:45 dom0 audit[792475]: USER_END pid=792475 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:45 dom0 audit[792475]: CRED_DISP pid=792475 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:45 dom0 kernel: kauditd_printk_skb: 11 callbacks suppressed
Jul 01 09:42:45 dom0 kernel: audit: type=1106 audit(1782891765.007:1315): pid=792475 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close grantors=pam_keyinit,pam_limits,pam_unix acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:45 dom0 kernel: audit: type=1104 audit(1782891765.007:1316): pid=792475 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_rootok acct="user" exe="/usr/sbin/runuser" hostname=? addr=? terminal=? res=success'
Jul 01 09:42:45 dom0 qubesd[789031]: INFO: vm.disp253: Preload startup waiting 'qubes.WaitForRunningSystem' with '60' seconds timeout
Jul 01 09:42:45 dom0 qrexec-client[792632]: qrexec: user:QUBESRPC qubes.WaitForRunningSystem dom0: dom0 -> disp253
Jul 01 09:42:45 dom0 qrexec-policy-daemon[4177]: qrexec: qubes.Notifications+: disp253 -> @default: allowed to dom0
Jul 01 09:42:49 dom0 qrexec-policy-daemon[4177]: qrexec: qubes.GetDate+nanoseconds: disp253 -> @default: allowed to dom0
Jul 01 09:42:56 dom0 qubesd[789031]: INFO: vm.disp253: Preload startup completed 'qubes.WaitForRunningSystem'
Jul 01 09:42:56 dom0 qubesd[789031]: INFO: vm.disp253: Setting qube memory to pref mem
Jul 01 09:43:00 dom0 qubesd[789031]: INFO: vm.disp253: Preloading completed
Jul 01 09:43:00 dom0 qubesd[789031]: INFO: vm.disp253: Paused preloaded qube
Jul 01 09:43:06 dom0 systemd[1]: systemd-hostnamed.service: Deactivated successfully.
Jul 01 09:43:06 dom0 kernel: audit: type=1131 audit(1782891786.971:1317): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-hostnamed comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jul 01 09:43:06 dom0 audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=systemd-hostnamed comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jul 01 09:43:07 dom0 audit: BPF prog-id=196 op=UNLOAD
Jul 01 09:43:07 dom0 kernel: audit: type=1334 audit(1782891787.004:1318): prog-id=196 op=UNLOAD

If suspend was not the case. Can you share more logs? Can you look at /var/log/xen/console/guest-disp24.log? Also, I remember someone reporting this issue before preloaded disposables existed:

Can you report more information on Github with the guidance from Marek’s posts there?

1 Like
3

To isolate the issue:

  • test with and without preloaded disposables
  • test with whonix, debian and fedora
  • collect more information on how to reproduce the issue, is it common after a number of days? After iterating over many disposables in the meantime?
1 Like
4

Hello @ben-grande. I never use suspend.
guest-disp24.log (-20260628.gz): https://pastebin.com/raw/NHmehG0i (exceeds characters limit)

whonix, debian and fedora

Started disp VMs with said teplates and swiotlb=2048 systemd.journald.forward_to_console=1 systemd.journald.max_level_console=debug, 1.5Gb ram each and 1G+ of it available, PVH, routed to whonix gateway, will be waiting for them to crash in next few days or weeks. Disp preload OFF.

Can you report more information on Github with the guidance from Marek’s posts there?

In my experience, Github shadowbans posting from Tor IPs and rejects teporary emails. I can get to that later, if I would know how to reliably reproduce the issue or if it simply would happen more often.

5

Catched. Whonix ws 18 disp vm was shut down, fedora and debian are still running, here are detailed logs: https://pastebin.com/raw/b876yD5k
By the way, there were no “heavy usage” and actually no usage at all, unlike the github issue.

6

I have shared this thread in the Qubes’ matrix channel and the Whonix’s developers have seen it. So far, there is not enough information in the kernel trace. I think they will introduce more debugging to get a better error message. I think it is appropriate for you to follow-up with them on the Whonix forum.

7

Pasting it here in case the link expires:

[2026-07-01 20:20:22] [12158.580331] sdwdate[78110]: 2026-07-01 17:20:22 - sdwdate - INFO - Sleeping for 172 minutes, ok.
[2026-07-01 20:20:26] [12162.583277] systemd[1]: Starting man-db.service - Daily man-db regeneration...
[2026-07-01 20:20:27] [12163.094635] systemd[1]: man-db.service: Deactivated successfully.
[2026-07-01 20:20:27] [12163.094757] systemd[1]: Finished man-db.service - Daily man-db regeneration.
[2026-07-01 20:22:51] [12307.609260] sdwdate[78110]: 2026-07-01 17:22:50 - sdwdate - INFO - sclockadj done. Syncing hardware clock.
[2026-07-01 20:22:52] [12307.643663] privleapd[960]: auth_signal_request: INFO: Action run request: Account 'sdwdate' is authorized to run action 'sdwdate-sync-hwclock'
[2026-07-01 20:22:52] [12307.644241] privleapd[960]: handle_signal_message: INFO: Triggered action 'sdwdate-sync-hwclock' for account 'sdwdate'
[2026-07-01 20:22:52] [12307.670254] python3[79934]: pam_unix(privleapd:session): session opened for user root(uid=0) by (uid=0)
[2026-07-01 20:22:52] [12307.670383] python3[79934]: pam_succeed_if(privleapd:session): requirement "uid eq 0" was met by user "root"
[2026-07-01 20:22:52] [12307.670439] python3[79934]: pam_succeed_if(privleapd:session): requirement "uid ne 0" not met by user "root"
[2026-07-01 20:22:52] [12307.673638] python3[79934]: pam_unix(privleapd:session): session closed for user root
[2026-07-01 20:22:52] [12307.673722] python3[79934]: pam_succeed_if(privleapd:session): requirement "uid eq 0" was met by user "root"
[2026-07-01 20:22:52] [12307.673777] python3[79934]: pam_succeed_if(privleapd:session): requirement "uid ne 0" not met by user "root"
[2026-07-01 20:22:52] [12307.681089] privleapd[960]: send_action_results: INFO: Action 'sdwdate-sync-hwclock' requested by account 'sdwdate' completed
[2026-07-01 21:57:27] [17983.281783] Kernel panic - not syncing: kernel: system warned too often (kernel.warn_limit is 1)
[2026-07-01 21:57:27] [17983.281807] CPU: 0 UID: 0 PID: 114797 Comm: qrexec-client-v Not tainted 6.18.31-1.qubes.fc41.x86_64 #1 PREEMPT(full) 
[2026-07-01 21:57:27] [17983.281833] Call Trace:
[2026-07-01 21:57:27] [17983.281841]  <IRQ>
[2026-07-01 21:57:27] [17983.281849]  dump_stack_lvl+0x5d/0x80
[2026-07-01 21:57:27] [17983.281863]  vpanic+0x118/0x310
[2026-07-01 21:57:27] [17983.281876]  panic+0x6b/0x6b
[2026-07-01 21:57:27] [17983.281889]  ? gnttab_handle_deferred+0x2f0/0x320
[2026-07-01 21:57:27] [17983.281905]  check_panic_on_warn.cold+0x1e/0x1e
[2026-07-01 21:57:27] [17983.281920]  __warn.cold+0x9f/0xf1
[2026-07-01 21:57:27] [17983.281932]  ? gnttab_handle_deferred+0x2f0/0x320
[2026-07-01 21:57:27] [17983.281948]  report_bug+0xff/0x140
[2026-07-01 21:57:27] [17983.281962]  ? gnttab_handle_deferred+0x2f0/0x320
[2026-07-01 21:57:27] [17983.281978]  handle_bug+0x19e/0x260
[2026-07-01 21:57:27] [17983.281990]  exc_invalid_op+0x17/0x70
[2026-07-01 21:57:27] [17983.282004]  asm_exc_invalid_op+0x1a/0x20
[2026-07-01 21:57:27] [17983.282015] RIP: 0010:gnttab_handle_deferred+0x2f0/0x320
[2026-07-01 21:57:27] [17983.282031] Code: 82 5b 5d 41 5c 41 5d 41 5e 41 5f e9 1a 75 ea ff e8 85 de ff ff e9 01 ff ff ff 48 8b 05 21 a7 65 02 48 85 c0 0f 84 8c fe ff ff <0f> 0b e9 85 fe ff ff 48 8b 05 12 96 39 01 48 c7 c7 00 04 73 82 48
[2026-07-01 21:57:27] [17983.282073] RSP: 0018:ffffc90000003e30 EFLAGS: 00010086
[2026-07-01 21:57:27] [17983.282088] RAX: ffffffffffffffff RBX: 0000000000000246 RCX: 000000017b050000
[2026-07-01 21:57:27] [17983.282107] RDX: 0000000000000001 RSI: ffffffff834d10d0 RDI: ffffffff836caae4
[2026-07-01 21:57:27] [17983.282126] RBP: 0000000000000000 R08: ffff88806bd52180 R09: 0000000000000000
[2026-07-01 21:57:27] [17983.282146] R10: ffff88806bd52180 R11: ffffea0001515080 R12: 00000000000026c6
[2026-07-01 21:57:27] [17983.282165] R13: 0000000000002710 R14: ffff88806bd52160 R15: dead000000000100
[2026-07-01 21:57:27] [17983.282186]  ? __pfx_gnttab_handle_deferred+0x10/0x10
[2026-07-01 21:57:27] [17983.282201]  ? __pfx_gnttab_handle_deferred+0x10/0x10
[2026-07-01 21:57:27] [17983.282217]  call_timer_fn+0x2a/0x120
[2026-07-01 21:57:27] [17983.282230]  __run_timers+0x1ef/0x280
[2026-07-01 21:57:27] [17983.282243]  run_timer_softirq+0xc3/0x1c0
[2026-07-01 21:57:27] [17983.282256]  ? sched_clock_cpu+0xb/0x30
[2026-07-01 21:57:27] [17983.282269]  handle_softirqs+0xf4/0x340
[2026-07-01 21:57:27] [17983.282282]  ? sched_clock+0x10/0x30
[2026-07-01 21:57:27] [17983.282295]  __irq_exit_rcu+0xc2/0xe0
[2026-07-01 21:57:27] [17983.282307]  sysvec_xen_hvm_callback+0x71/0x90
[2026-07-01 21:57:27] [17983.282322]  </IRQ>
[2026-07-01 21:57:27] [17983.282330]  <TASK>
[2026-07-01 21:57:27] [17983.282338]  asm_sysvec_xen_hvm_callback+0x1a/0x20
[2026-07-01 21:57:27] [17983.282353] RIP: 0010:_raw_spin_unlock_irqrestore+0x1d/0x40
[2026-07-01 21:57:27] [17983.282368] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 e8 52 07 00 00 90 f7 c6 00 02 00 00 74 06 fb 0f 1f 44 00 00 <65> ff 0d 1c d0 d9 01 74 05 e9 e5 22 00 00 e8 80 43 db fe e9 db 22
[2026-07-01 21:57:27] [17983.282410] RSP: 0018:ffffc90005447b38 EFLAGS: 00000206
[2026-07-01 21:57:27] [17983.282424] RAX: 0000000000000001 RBX: ffff88806bd52160 RCX: 0000000000000000
[2026-07-01 21:57:27] [17983.282444] RDX: ffffffff82730430 RSI: 0000000000000286 RDI: ffffffff836caae4
[2026-07-01 21:57:27] [17983.282463] RBP: ffffea0001515080 R08: 0000000000000020 R09: 0000000000000000
[2026-07-01 21:57:27] [17983.282483] R10: ffffc90005447b40 R11: ffffea000126a6c0 R12: 0000000000000cc0
[2026-07-01 21:57:27] [17983.282502] R13: ffff88806bd52fc0 R14: 0000000000000286 R15: 00007b344ff6b000
[2026-07-01 21:57:27] [17983.282526]  ? _raw_spin_unlock_irqrestore+0xe/0x40
[2026-07-01 21:57:27] [17983.282540]  gnttab_add_deferred+0xfc/0x250
[2026-07-01 21:57:27] [17983.282553]  __del_gref+0x9c/0x100 [xen_gntalloc]
[2026-07-01 21:57:27] [17983.282626]  gntalloc_vma_close+0x6b/0xa0 [xen_gntalloc]
[2026-07-01 21:57:27] [17983.282643]  remove_vma+0x2c/0x60
[2026-07-01 21:57:27] [17983.282656]  vms_complete_munmap_vmas+0xd6/0x180
[2026-07-01 21:57:27] [17983.282672]  do_vmi_align_munmap+0x1d8/0x260
[2026-07-01 21:57:27] [17983.282690]  do_vmi_munmap+0xd0/0x170
[2026-07-01 21:57:27] [17983.282702]  __vm_munmap+0xb0/0x170
[2026-07-01 21:57:27] [17983.282716]  __x64_sys_munmap+0x1b/0x30
[2026-07-01 21:57:27] [17983.282729]  do_syscall_64+0x87/0x7e0
[2026-07-01 21:57:27] [17983.282743]  ? syscall_exit_work+0x108/0x140
[2026-07-01 21:57:27] [17983.282759]  ? do_syscall_64+0xbe/0x7e0
[2026-07-01 21:57:27] [17983.282771]  ? do_syscall_64+0xbe/0x7e0
[2026-07-01 21:57:27] [17983.282784]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[2026-07-01 21:57:27] [17983.282799] RIP: 0033:0x7b34500f5717
[2026-07-01 21:57:27] [17983.282812] Code: 73 01 c3 48 8b 0d f9 76 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c9 76 0d 00 f7 d8 64 89 01 48
[2026-07-01 21:57:27] [17983.282854] RSP: 002b:00007ffcb6474ad8 EFLAGS: 00000216 ORIG_RAX: 000000000000000b
[2026-07-01 21:57:27] [17983.282874] RAX: ffffffffffffffda RBX: 000057a484792300 RCX: 00007b34500f5717
[2026-07-01 21:57:27] [17983.282894] RDX: fffffffffffff000 RSI: 0000000000010000 RDI: 00007b344ff6b000
[2026-07-01 21:57:27] [17983.282913] RBP: 000000000000007f R08: 00000000000102e0 R09: 00007b34501ed49a
[2026-07-01 21:57:27] [17983.282932] R10: 000000000000000f R11: 0000000000000216 R12: 0000000000000001
[2026-07-01 21:57:27] [17983.282952] R13: 0000000000000000 R14: 0000000000000004 R15: 0000000000000001
[2026-07-01 21:57:27] [17983.282973]  </TASK>