Technical Tip: The WAD daemon crashed causing a memory corruption after the traffics pass through VIP policy

1. The WAD daemon crashes after upgrading FortiOS to be v7.0.9 build0444.

When configuring VIP settings on a FortiGate unit and the traffic passes through the VIP policy, it causes FortiGate’s memory corruption.

2. Run CLI command and it shows the logs as below.

diagnose debug crashlog read

5073: 2025-06-24 15:39:45 <00716> firmware FortiGate-3200D v7.0.9,build0444b0444,221121 (GA.M) (Release)

5074: 2025-06-24 15:39:45 <00716> application wad

5075: 2025-06-24 15:39:45 <00716> *** signal 11 (Segmentation fault) received ***

5076: 2025-06-24 15:39:45 <00716> AVDB 90.09746(01/17/0023 21:26)

5077: 2025-06-24 15:39:45 <00716> ETDB 90.09746(01/17/0023 21:25)

5078: 2025-06-24 15:39:45 <00716> AVSO 04000000AVEN00701062822209152232

5079: 2025-06-24 15:39:45 <00716> Register dump:

5080: 2025-06-24 15:39:45 <00716> RAX: 00007f5a50cd62f8 RBX: 0000000000000010

5081: 2025-06-24 15:39:45 <00716> RCX: 0000000000000000 RDX: 0000000000000010

5082: 2025-06-24 15:39:45 <00716> R08: 0000000000000000 R09: 0000000000000000

5083: 2025-06-24 15:39:45 <00716> R10: 00007f5a510420a8 R11: 0000000000000246

5084: 2025-06-24 15:39:45 <00716> R12: 00007f5aa9a9a048 R13: 00007f5a50cd6230

5085: 2025-06-24 15:39:45 <00716> R14: 00007f5a51041ea8 R15: 00007f5a510420a8

5086: 2025-06-24 15:39:45 <00716> RSI: 00007f5a50cd6240 RDI: 0000000000000008

5087: 2025-06-24 15:39:45 <00716> RBP: 00007fff0c24b4e0 RSP: 00007fff0c24b4b0

5088: 2025-06-24 15:39:45 <00716> RIP: 0000000001ab07b8 EFLAGS: 0000000000010293

5089: 2025-06-24 15:39:45 <00716> CS: 0033 FS: 0000 GS: 0000

5090: 2025-06-24 15:39:45 <00716> Trap: 000000000000000e Error: 0000000000000004

5091: 2025-06-24 15:39:45 <00716> OldMask: 0000000000000000

5092: 2025-06-24 15:39:45 <00716> CR2: 0000000000000028

5093: 2025-06-24 15:39:45 <00716> stack: 0x7fff0c24b4b0 - 0x7fff0c24b850

5094: 2025-06-24 15:39:45 <00716> Backtrace:

5095: 2025-06-24 15:39:45 <00716> [0x01ab07b8] => /bin/wad 

5096: 2025-06-24 15:39:45 <00716> [0x01aaea63] => /bin/wad 

5097: 2025-06-24 15:39:45 <00716> [0x01aaea63] => /bin/wad 

5098: 2025-06-24 15:39:45 <00716> [0x01bbb850] => /bin/wad 

5099: 2025-06-24 15:39:45 <00716> [0x01bec806] => /bin/wad 

5100: 2025-06-24 15:39:45 <00716> [0x01b661ce] => /bin/wad 

5101: 2025-06-24 15:39:45 <00716> [0x01b664b7] => /bin/wad 

5102: 2025-06-24 15:39:45 <00716> [0x01c06796] => /bin/wad 

5103: 2025-06-24 15:39:45 <00716> [0x0044c697] => /bin/wad 

5104: 2025-06-24 15:39:45 <00716> [0x7f5ac66fddeb] => /usr/lib/x86_64-linux-gnu/libc.so.6 => n/a => ??:0

5105: 2025-06-24 15:39:45 (__libc_start_main+0x000000eb) liboffset 00023deb

5106: 2025-06-24 15:39:45 <00716> [0x00447e1a] => /bin/wad 

5107: 2025-06-24 15:39:45 <00716> fortidev 6.0.1.0005

5108: 2025-06-24 15:39:45 <00716> process=wad type=2 idx=12 av-scanning=no total=64466 free=44989

5109: 2025-06-24 15:39:45 mmu=9015663 mu=6067355 m=3771987 f=3727837 r=0

5110: 2025-06-24 15:39:45 <00716> cur_bank=(nil) curl_tl=0xc1101e0 curl_tm=0x7f5aa9681190

5111: 2025-06-24 15:39:45 <00716> (session info) vf=4 session-id=128024539 app_type=1 dyn_type=0

5112: 2025-06-24 15:39:45 non_tp=0, pol_id=4161, h2=0, src/port=172.24.15.5:47190, dst/port=172.24.15.117

5113: 2025-06-24 15:39:45 :80, usr/grp=(/)

5114: 2025-06-24 15:39:45 [AV Engine <716>] AV Engine version: 6.4.282

5115: 2025-06-24 15:39:45 [AV Engine <716>] Last file info:

5116: 2025-06-24 15:39:45 [AV Engine <716>] filename: , filesize: 0, filebuffer: (nil)

5117: 2025-06-24 15:39:45 [AV Engine <716>] Native script imagebase: 0x7f5aa9af0000

5118: 2025-06-24 15:39:45 [AV Engine <716>] Native script imagesize: 0x9000

5119: 2025-06-24 15:39:45 [AV Engine <716>] AV Engine imagebase: 0x7f5aa8f43000

5120: 2025-06-24 16:39:45 wad crashed 1 times. The latest crash was at 2025-06-24 15:39:45.

For a permanent fix, it is necessary to upgrade the FortiGate firmware version to v7.4.8, v7.6.3, and above.