last executing test programs:

8.877902905s ago: executing program 1 (id=278):
setsockopt$inet_sctp_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, 0x0, 0x0)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000440)=[@in={0x2, 0x4e21, @local}], 0x10)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1)
sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6)
r1 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x1e4011, 0x0)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0)
sendmsg$kcm(r1, 0x0, 0x20000005)
fanotify_init(0x20, 0x40000)
shutdown(r0, 0x1)
r2 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000000c0)={0x0, 0x3, 0x6, @random="cea0300a1672"}, 0x10)
dup2(0xffffffffffffffff, r2)

7.998073066s ago: executing program 1 (id=285):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
listen(r0, 0x0)
syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00\x00\t', 0x14, 0x6, 0xff, @remote, @local, {[], {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x4}}}}}}}, 0x0)
setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000200)=0x8, 0x4)
syz_extract_tcp_res(0x0, 0x1, 0xfd57)
syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0xc2, 0x1ff}}}}}}}, 0x0)

7.95636917s ago: executing program 2 (id=287):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060"], 0xb8}}, 0x0)
r1 = socket$nl_xfrm(0x10, 0x3, 0x6)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e99900000000fedbcb25fc00000000000000000000000000004000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0)
sendmsg$nl_xfrm(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40}, {0x1, 0x0, 0x9}, {0x0, 0x5}}}, 0xb8}}, 0x4000)

7.781945776s ago: executing program 1 (id=288):
setxattr$trusted_overlay_opaque(&(0x7f0000000480)='./cgroup\x00', &(0x7f00000004c0), 0x0, 0x0, 0x2)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r3}, 0x10)
syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r4 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, 0x0, &(0x7f0000000000))
socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000040)=@assoc_value={<r5=>0x0}, &(0x7f00000002c0)=0x8)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r4, 0x84, 0x6, &(0x7f0000000200)={r5, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3f}}}}, &(0x7f0000000300)=0x84)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
socket(0x2d, 0x2, 0x0)
r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0)
ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000000)=0x15)
ioctl$TCSETS(r6, 0x404c4701, 0x0)
setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000580)={r5, 0x3de7}, 0x8)
r7 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_TRIGGER_SCAN(r7, 0x0, 0x0)

7.661141477s ago: executing program 2 (id=289):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000600)={0x2, 0x4e21, @multicast2}, 0x10)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0)
sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x12, 0x0, 0x12)
recvfrom$inet(r0, &(0x7f0000000100)=""/24, 0xfffffffffffffd5b, 0xc9100120, 0x0, 0xfffffffffffffd25)

6.507768112s ago: executing program 1 (id=292):
r0 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'geneve0\x00', <r1=>0x0})
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=@newlink={0x50, 0x10, 0x3, 0x0, 0x0, {0x0, 0x0, 0x0, r1}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @private2}]}]}]}, 0x50}, 0x1, 0x2}, 0x0)

6.288247823s ago: executing program 0 (id=295):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, 0x0, 0x0)
r4 = socket$kcm(0x29, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40d1}, 0x40d8)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x84, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e24, @empty}}, 0x0, 0x3}, 0x90)
getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0)

6.201986401s ago: executing program 1 (id=297):
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5)
prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8)
r4 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r4, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-sse2\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0)
r5 = accept$alg(r4, 0x0, 0x0)
write$binfmt_script(r5, 0x0, 0x0)
recvmmsg(r5, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000001c0)=""/200, 0xc8}], 0x1, 0x0, 0x0, 0x2000000}}], 0x1, 0xcb, 0x0)

6.201762091s ago: executing program 2 (id=298):
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, 0x0, 0x0, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
r2 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r2, &(0x7f0000000040)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-avx2\x00'}, 0x58)
mount$fuse(0x0, 0x0, 0x0, 0x0, 0x0)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440)
r3 = accept4(r2, 0x0, 0x0, 0x0)
sendto$inet6(r3, &(0x7f0000000100), 0xffffffe3, 0x4004840, 0x0, 0xfffffffffffffe1b)

6.123716138s ago: executing program 3 (id=299):
semop(0x0, &(0x7f0000000080)=[{0x0, 0x0, 0x1000}], 0x1)
unshare(0x20040400)
semtimedop(0x0, &(0x7f0000000040)=[{0x1, 0x1, 0x1000}], 0x1, 0x0)
semctl$IPC_RMID(0x0, 0x0, 0x0)

5.913212517s ago: executing program 3 (id=300):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000280)={'wlan0\x00', <r2=>0x0})
sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000680)={0x30, r1, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x30}}, 0x0)

5.138051489s ago: executing program 0 (id=301):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0)
sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)

3.439179314s ago: executing program 1 (id=302):
sched_setaffinity(0x0, 0x0, 0x0)
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=<r0=>0x0)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80782, 0x0)
ioctl$TCXONC(r1, 0x540a, 0x2)
ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000000))
r2 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x6)
fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
ioctl$int_in(r2, 0x5452, &(0x7f0000001080)=0x3)
write(r2, &(0x7f0000000080)='g', 0x1)
ioctl$TCSETS(r2, 0x5402, &(0x7f0000000140)={0x6, 0x3, 0x6, 0x7fff, 0x1a, "ee1dd756f560f25a63b2f119c3439425ea59d8"})

3.353803012s ago: executing program 2 (id=303):
socket$nl_generic(0x10, 0x3, 0x10)
close(0x3)
syz_open_dev$midi(0x0, 0x3, 0x2202)
r0 = syz_io_uring_setup(0x1e1e, &(0x7f0000000380)={0x0, 0x86f7, 0x10100}, 0x0, &(0x7f0000000280)=<r1=>0x0)
syz_io_uring_submit(0x0, r1, 0x0)
r2 = fsopen(0x0, 0x0)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b<M\n\xc0`[\x82\xf6$\xa4\xbe\x1e\xd3\xe4\xd9L\x14\xed\xcf\xcb\x92\xf1\x83\x1a1\xa6\xf3e\xc2F\xc3\x00\xaa\xd5\xfc\x1bR\xa9\x8c\xb4&\x9f\xa2$\x06\x1a\xb0W#\xf4\xde6\x04c\xc0\xeec\xa0l\xd5d\xe5\xcd\xb2\xc10\x97w\x87\xe5\x06\x91W\rr\xf5\x97%\xe8pO\xeb]\xc2\x98C\xffK\xa0\xb3\\\x99{\xcdR\x92\x94\xf7\x1d\x01Q\x1a\xbd\x15b\x15h\xe2!\x00\xb9z)\x19\x00\xee\xd2)[p`\xb3\x03\xa7p\'X\xec\xcdoX\x05\xff\xff/o\xb2\xad\xb8\x89i@\f\xffS&\x8a\xc9\xfez\xc2\x90\xe7F\xa6\xdb\r\x03j,N\xe1lw\n\xad\xe8\xf0\xbd\xa1\x98\xce\xf9\x1eR\x9cc\xc5ke_\xa7\x11\"\x04\xd8.\xa0\x15\x83\xf1\x92\xdby\xe9\xdc@.\xc1g\xc6\fc\xa26\xd8\xdf\xef\xf7\x9c\x1a\xcc\x8am\x8b7\xcf\xc5\xa6\xf4\f\xabj%Y\xa9\xdd\x0e9e\xb5\xec\x99@\xd2\t\n\xb1o', 0x0)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000080)='source', &(0x7f0000000400)='//\xf2/\x06\b\xa30\\\x00\x00\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas\x9d\x14\xe3\v\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7Gl\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\n\x8c<M\n\xc0`[\x82\xf6$\xa4\xbe\x1e\xd3\xe4\xd9L\x14\xed\xcfK\xcc\xeb,\x1a1\xa6\xf3e\xc2F\xc3\x00\xaa\xd5\xfc\x1bR\xa9\x8c\xb4&\x9f\xa2$\x06\x1a\xb0W#\xf4\xde6\x04c\xc0\xeec\xa0l\xd5d\xe5\xcd\xb2\xc10\x97w\x87\xe5\x06\x91W\rr\xf5\x97%\xe8pO\xeb]\xc2\x98C\xffK\xa0\xb3\\\x99{\xcdR\x92\x94\xf7\x1d\x01Q\x1a\xbd\x15b\x15h\xe2!\x00\xb9z)\x19\x00\xee\xd2)[p`\xb3\x03\xa7p\'X\xec\xcdoX\x05\xff\xff/\xd15)\xeatn\xa3\x88\x13i\xb6\x7ft\x95\xd7\x01o\xb2\xad\xb8\x89i@\f\xffS&\x8a\xc9\xfez\xc2\x90\xe7F\xa6\xdb\r\x03j,N\xe1lw\n\xad\xe8\xf0\xbd\xa1\x98\xce\xf9\x1eR\x9cc\xc5ke_\xa7\x11\"\x04\xd8.\xa0\x15\x83\xf1\x94\x00\x00\x00\x00\x00\x00\x00g\xc6\fc\xa26\xd8\xdf\xef\xf7\x9c\x1a\xef\x8am\x8b7\xcf\xc5\xa6\xf4\f\xabj%Y\xa9\xdd\x0e9e\xba\xec\x99@\xd2\t\n\xb1o', 0x0)
io_uring_enter(r0, 0x48e9, 0x0, 0x2, 0x0, 0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0x341040, 0x0)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x0)
r4 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000400), 0x101201, 0x0)
ioctl$IMADDTIMER(r4, 0x80044940, &(0x7f0000000600)=0x14)
ioctl$IMADDTIMER(r4, 0x80044940, &(0x7f0000000080)=0x14)
madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15)
close(r4)
sendmsg$MPTCP_PM_CMD_REMOVE(r3, 0x0, 0x4004001)

3.278075239s ago: executing program 0 (id=304):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendto$inet6(r0, &(0x7f00000002c0)="9e", 0x1, 0x0, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f0000000140)=0x3ff, 0x4)
sendmsg$inet6(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)='h', 0x34000}], 0x1}, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)

3.250390451s ago: executing program 3 (id=305):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x1})
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0})
dup3(r1, r0, 0x0)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0x8, 0x0, &(0x7f0000000200)=[@acquire], 0x0, 0x0, 0x0})
r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0)
read$FUSE(r2, &(0x7f0000006380)={0x2020}, 0x2020)

3.098164125s ago: executing program 3 (id=306):
ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x3, 0x6576, 0xd})
setresgid(0x0, 0xee01, 0xffffffffffffffff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
mount$tmpfs(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x8000, &(0x7f00000024c0)=ANY=[@ANYBLOB='quota'])
r0 = openat(0xffffffffffffff9c, &(0x7f0000004d00)='./file1\x00', 0x250942, 0x1cd)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x3000c003}, 0x80)
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x42, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0)
syz_io_uring_setup(0x88f, 0x0, 0x0, 0x0)
sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="440000000906010200"/19], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
quotactl_fd$Q_GETNEXTQUOTA(r0, 0xffffffff80000901, 0xee00, 0x0)

3.022163623s ago: executing program 2 (id=307):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
setsockopt$bt_BT_POWER(r0, 0x112, 0x9, &(0x7f00000003c0), 0x1)

3.021860893s ago: executing program 0 (id=308):
socket$inet6_tcp(0xa, 0x1, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
socket$key(0xf, 0x3, 0x2)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x26, '\x00', 0x0, 0x2}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r1 = getpid()
sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffd}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
pipe(0x0)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
getsockopt$sock_buf(r4, 0x1, 0x1c, 0x0, 0x0)
r5 = syz_open_dev$radio(&(0x7f0000000000), 0x0, 0x2)
ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205647, &(0x7f0000000200)={0xf020000, 0x1, 0x800, 0xffffffffffffffff, 0x0, &(0x7f00000001c0)={0xa10906, 0xfffffffb, '\x00', @value=0x80000001}})
keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000002040), &(0x7f0000002080)=ANY=[@ANYBLOB="656e633d72617720686173683d7368613235362d67656e657269630000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000"], 0x0, 0x0)

1.845095801s ago: executing program 3 (id=309):
socket$inet_udp(0x2, 0x2, 0x0)
r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x401, 0x0)
ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r0, 0xc0305602, &(0x7f00000005c0)={0x0, 0x9, 0x201d})

1.750139579s ago: executing program 2 (id=310):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000580)={0x17, 0x5, 0x5})

1.645948639s ago: executing program 0 (id=311):
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, 0x0, 0x0)
r1 = getpgrp(0x0)
sched_setaffinity(r1, 0x8, &(0x7f0000000200)=0x1000000000005)
prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r2 = getpid()
sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mq_notify(0xffffffffffffffff, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0)
r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
fchdir(0xffffffffffffffff)
read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x128}, 0x0)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
connect$rose(r0, &(0x7f0000000080)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x1, @null}, 0x1c)
openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0)

12.495868ms ago: executing program 0 (id=312):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0)
sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0)

0s ago: executing program 3 (id=313):
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000180)={'mpc624\x00', [0x4f27, 0x4, 0x2, 0x4, 0x2, 0xcc5, 0xf, 0x7, 0xa, 0xe8aa, 0x2, 0x1, 0xfffffffd, 0x5, 0x6, 0x2, 0x0, 0x1a442, 0x3, 0x40000003, 0x99, 0x4caa7, 0x0, 0x20001e58, 0x81, 0xe6b, 0x3c, 0x8, 0x2, 0x9, 0xfffffff8]})
bpf$TOKEN_CREATE(0x24, &(0x7f0000000040)={0x0, r0}, 0x8)
read(r0, 0x0, 0x0)

kernel console output (not intermixed with test programs):

no interfaces have a carrier
[   70.976863][ T5432] 8021q: adding VLAN 0 to HW filter on device bond0
[   70.991031][ T5432] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting crond: OK
Starting sshd: OK

syzkaller
Warning: Permanently added '10.128.0.254' (ED25519) to the list of known hosts.
syzkaller login: [   98.365513][ T5759] cgroup: Unknown subsys name 'net'
[   98.507279][ T5759] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[  100.412747][ T5759] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[  102.434456][ T5773] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  102.447991][ T5773] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  102.467524][ T5773] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  102.542556][ T5787] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  102.552518][ T5787] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  102.562484][ T5787] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  102.571876][ T5787] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  102.584091][ T5784] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  102.592165][ T5773] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  102.600313][ T5787] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  102.609082][ T5773] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  102.615445][ T5785] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  102.619254][ T5784] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  102.634774][ T5785] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  102.644021][ T5784] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  102.647518][ T5785] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  102.658020][ T5784] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[  102.661679][ T5785] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  102.671617][ T5784] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  102.682311][ T5785] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[  102.693292][ T5785] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  102.702151][ T5785] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  102.712135][ T5785] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[  102.722978][ T5785] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  102.901927][  T966] cfg80211: failed to load regulatory.db
[  103.298793][ T5774] chnl_net:caif_netlink_parms(): no params data found
[  103.394334][ T5775] chnl_net:caif_netlink_parms(): no params data found
[  103.442059][ T5772] chnl_net:caif_netlink_parms(): no params data found
[  103.596502][ T5769] chnl_net:caif_netlink_parms(): no params data found
[  103.672264][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state
[  103.683293][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state
[  103.692822][ T5774] bridge_slave_0: entered allmulticast mode
[  103.704506][ T5774] bridge_slave_0: entered promiscuous mode
[  103.773106][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state
[  103.781356][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state
[  103.790517][ T5774] bridge_slave_1: entered allmulticast mode
[  103.800510][ T5774] bridge_slave_1: entered promiscuous mode
[  103.823991][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state
[  103.834039][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state
[  103.842673][ T5775] bridge_slave_0: entered allmulticast mode
[  103.851837][ T5775] bridge_slave_0: entered promiscuous mode
[  103.861445][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state
[  103.870616][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state
[  103.879486][ T5775] bridge_slave_1: entered allmulticast mode
[  103.889020][ T5775] bridge_slave_1: entered promiscuous mode
[  103.955357][ T5772] bridge0: port 1(bridge_slave_0) entered blocking state
[  103.965631][ T5772] bridge0: port 1(bridge_slave_0) entered disabled state
[  103.973381][ T5772] bridge_slave_0: entered allmulticast mode
[  103.982073][ T5772] bridge_slave_0: entered promiscuous mode
[  104.016219][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  104.027367][ T5772] bridge0: port 2(bridge_slave_1) entered blocking state
[  104.035768][ T5772] bridge0: port 2(bridge_slave_1) entered disabled state
[  104.045312][ T5772] bridge_slave_1: entered allmulticast mode
[  104.053718][ T5772] bridge_slave_1: entered promiscuous mode
[  104.064416][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  104.078496][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  104.106640][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  104.183642][ T5769] bridge0: port 1(bridge_slave_0) entered blocking state
[  104.193588][ T5769] bridge0: port 1(bridge_slave_0) entered disabled state
[  104.203832][ T5769] bridge_slave_0: entered allmulticast mode
[  104.219549][ T5769] bridge_slave_0: entered promiscuous mode
[  104.264435][ T5774] team0: Port device team_slave_0 added
[  104.294593][ T5772] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  104.323674][ T5769] bridge0: port 2(bridge_slave_1) entered blocking state
[  104.332380][ T5769] bridge0: port 2(bridge_slave_1) entered disabled state
[  104.340719][ T5769] bridge_slave_1: entered allmulticast mode
[  104.349901][ T5769] bridge_slave_1: entered promiscuous mode
[  104.361044][ T5774] team0: Port device team_slave_1 added
[  104.374157][ T5772] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  104.404859][ T5775] team0: Port device team_slave_0 added
[  104.469546][ T5775] team0: Port device team_slave_1 added
[  104.483000][ T5772] team0: Port device team_slave_0 added
[  104.505953][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0
[  104.514356][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  104.544138][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  104.583734][ T5772] team0: Port device team_slave_1 added
[  104.615081][ T5769] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  104.627351][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1
[  104.636476][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  104.667490][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  104.708589][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_0
[  104.715715][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  104.748027][ T5785] Bluetooth: hci1: command tx timeout
[  104.753042][ T5772] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  104.774749][ T5769] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  104.795153][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0
[  104.802931][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  104.807957][ T5785] Bluetooth: hci3: command tx timeout
[  104.831482][ T5784] Bluetooth: hci0: command tx timeout
[  104.837566][ T5082] Bluetooth: hci2: command tx timeout
[  104.849304][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  104.865688][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1
[  104.873651][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  104.906136][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  104.919428][ T5772] batman_adv: batadv0: Adding interface: batadv_slave_1
[  104.926867][ T5772] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  104.958275][ T5772] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  105.064926][ T5774] hsr_slave_0: entered promiscuous mode
[  105.072219][ T5774] hsr_slave_1: entered promiscuous mode
[  105.112961][ T5769] team0: Port device team_slave_0 added
[  105.122862][ T5769] team0: Port device team_slave_1 added
[  105.151195][ T5775] hsr_slave_0: entered promiscuous mode
[  105.163851][ T5775] hsr_slave_1: entered promiscuous mode
[  105.172028][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  105.181956][ T5775] Cannot create hsr debugfs directory
[  105.193294][ T5772] hsr_slave_0: entered promiscuous mode
[  105.201110][ T5772] hsr_slave_1: entered promiscuous mode
[  105.208538][ T5772] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  105.216524][ T5772] Cannot create hsr debugfs directory
[  105.319368][ T5769] batman_adv: batadv0: Adding interface: batadv_slave_0
[  105.326815][ T5769] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  105.357570][ T5769] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  105.433936][ T5769] batman_adv: batadv0: Adding interface: batadv_slave_1
[  105.441764][ T5769] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  105.473272][ T5769] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  105.707813][ T5769] hsr_slave_0: entered promiscuous mode
[  105.715510][ T5769] hsr_slave_1: entered promiscuous mode
[  105.724838][ T5769] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  105.733573][ T5769] Cannot create hsr debugfs directory
[  105.967066][ T5774] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  105.985343][ T5774] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  105.999233][ T5774] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  106.012254][ T5774] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  106.130281][ T5772] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  106.147364][ T5772] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  106.167160][ T5772] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  106.202598][ T5772] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  106.290855][ T5775] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  106.305342][ T5775] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  106.325051][ T5775] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  106.337765][ T5775] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  106.497164][ T5769] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  106.515295][ T5769] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  106.540837][ T5769] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  106.555389][ T5769] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  106.606134][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0
[  106.698346][ T5774] 8021q: adding VLAN 0 to HW filter on device team0
[  106.729004][ T5772] 8021q: adding VLAN 0 to HW filter on device bond0
[  106.762013][ T3440] bridge0: port 1(bridge_slave_0) entered blocking state
[  106.770700][ T3440] bridge0: port 1(bridge_slave_0) entered forwarding state
[  106.805912][ T3440] bridge0: port 2(bridge_slave_1) entered blocking state
[  106.816288][ T3440] bridge0: port 2(bridge_slave_1) entered forwarding state
[  106.825357][ T5785] Bluetooth: hci1: command tx timeout
[  106.848881][ T5772] 8021q: adding VLAN 0 to HW filter on device team0
[  106.888076][ T5785] Bluetooth: hci3: command tx timeout
[  106.894847][ T5785] Bluetooth: hci2: command tx timeout
[  106.903945][ T5082] Bluetooth: hci0: command tx timeout
[  106.930648][ T3440] bridge0: port 1(bridge_slave_0) entered blocking state
[  106.940555][ T3440] bridge0: port 1(bridge_slave_0) entered forwarding state
[  106.983029][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0
[  106.999082][ T3440] bridge0: port 2(bridge_slave_1) entered blocking state
[  107.009838][ T3440] bridge0: port 2(bridge_slave_1) entered forwarding state
[  107.045806][ T5774] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  107.183722][ T5775] 8021q: adding VLAN 0 to HW filter on device team0
[  107.225818][   T42] bridge0: port 1(bridge_slave_0) entered blocking state
[  107.235876][   T42] bridge0: port 1(bridge_slave_0) entered forwarding state
[  107.274719][   T48] bridge0: port 2(bridge_slave_1) entered blocking state
[  107.284813][   T48] bridge0: port 2(bridge_slave_1) entered forwarding state
[  107.316526][ T5769] 8021q: adding VLAN 0 to HW filter on device bond0
[  107.415258][ T5769] 8021q: adding VLAN 0 to HW filter on device team0
[  107.453820][   T42] bridge0: port 1(bridge_slave_0) entered blocking state
[  107.461899][   T42] bridge0: port 1(bridge_slave_0) entered forwarding state
[  107.504441][   T42] bridge0: port 2(bridge_slave_1) entered blocking state
[  107.512005][   T42] bridge0: port 2(bridge_slave_1) entered forwarding state
[  107.666712][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0
[  107.684830][ T5769] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  107.855246][ T5772] 8021q: adding VLAN 0 to HW filter on device batadv0
[  108.026481][ T5774] veth0_vlan: entered promiscuous mode
[  108.085647][ T5774] veth1_vlan: entered promiscuous mode
[  108.173029][ T5772] veth0_vlan: entered promiscuous mode
[  108.226809][ T5774] veth0_macvtap: entered promiscuous mode
[  108.264021][ T5774] veth1_macvtap: entered promiscuous mode
[  108.325457][ T5772] veth1_vlan: entered promiscuous mode
[  108.376316][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0
[  108.405783][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0
[  108.443318][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1
[  108.483142][ T5774] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  108.498079][ T5774] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  108.513350][ T5774] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  108.524703][ T5774] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  108.543774][ T5769] 8021q: adding VLAN 0 to HW filter on device batadv0
[  108.636737][ T5772] veth0_macvtap: entered promiscuous mode
[  108.669734][ T5772] veth1_macvtap: entered promiscuous mode
[  108.703867][ T5775] veth0_vlan: entered promiscuous mode
[  108.795204][ T5775] veth1_vlan: entered promiscuous mode
[  108.823015][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  108.842158][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  108.856673][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_0
[  108.887752][ T5784] Bluetooth: hci1: command tx timeout
[  108.913334][ T5772] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  108.929792][ T5772] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  108.945810][ T5772] batman_adv: batadv0: Interface activated: batadv_slave_1
[  108.969831][ T5784] Bluetooth: hci2: command tx timeout
[  108.977111][ T5784] Bluetooth: hci0: command tx timeout
[  108.981846][ T5785] Bluetooth: hci3: command tx timeout
[  108.991821][ T5769] veth0_vlan: entered promiscuous mode
[  109.001993][   T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  109.012381][   T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  109.058284][ T5772] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  109.079358][ T5772] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  109.095509][ T5772] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  109.107285][ T5772] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  109.139833][ T5769] veth1_vlan: entered promiscuous mode
[  109.173826][ T2985] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  109.185595][ T2985] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  109.242077][ T5775] veth0_macvtap: entered promiscuous mode
[  109.303328][ T5775] veth1_macvtap: entered promiscuous mode
[  109.394283][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  109.410146][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  109.426359][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  109.441757][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  109.459174][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0
[  109.514201][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  109.531684][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  109.544346][ T5775] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  109.577555][ T5775] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  109.609575][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1
[  109.627840][ T5769] veth0_macvtap: entered promiscuous mode
[  109.639928][   T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  109.674043][   T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  109.693434][ T5769] veth1_macvtap: entered promiscuous mode
[  109.723786][ T5775] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  109.744090][ T5775] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  109.757547][ T5775] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  109.775372][ T5775] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  109.831700][   T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  109.841682][   T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  109.924715][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  109.951494][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  109.965623][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  109.980393][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  109.992899][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  110.006617][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  110.029609][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_0
[  110.045118][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  110.049536][ T5778] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[  110.066462][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  110.091441][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  110.103167][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  110.115866][ T5769] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  110.127834][ T5769] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  110.146084][ T5769] batman_adv: batadv0: Interface activated: batadv_slave_1
[  110.184947][ T5769] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  110.200385][ T5769] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  110.210886][ T5769] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  110.222804][ T5769] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  110.278171][   T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.288508][ T5778] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  110.304596][ T5778] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  110.317507][   T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.322872][ T5778] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  110.355760][ T5778] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  110.373886][ T5778] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  110.426864][ T5778] usb 4-1: config 0 descriptor??
[  110.619962][ T3440] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.663950][    T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!!
[  110.689574][    T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!!
[  110.747881][    T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!!
[  110.795530][    T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!!
[  110.807220][    T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!!
[  110.883978][ T3440] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.896200][    T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!!
[  110.971500][ T5785] Bluetooth: hci1: command tx timeout
[  111.017110][    T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!!
[  111.048857][ T5784] Bluetooth: hci2: command tx timeout
[  111.055705][ T5082] Bluetooth: hci0: command tx timeout
[  111.068881][ T5785] Bluetooth: hci3: command tx timeout
[  111.117148][    T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!!
[  111.380562][    T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!!
[  111.409867][    T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!!
[  111.908016][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  112.116791][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  112.356434][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  112.599686][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  112.835461][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  112.978166][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  113.025993][   T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  113.110250][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  113.164565][   T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  113.237845][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  113.245709][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  113.267226][ T5868] DRBG: could not allocate CTR cipher TFM handle: ctr(aes)
[  113.350616][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  113.439266][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  113.461826][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  113.478976][   T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  113.507849][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  113.515648][   T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  113.548949][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  113.578117][ T5778] plantronics 0003:047F:FFFF.0001: unknown main item tag 0x0
[  113.606448][ T5778] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving
[  113.702764][ T5778] plantronics 0003:047F:FFFF.0001: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0
[  113.820491][ T5778] usb 4-1: USB disconnect, device number 2
[  114.035490][ T5887] fido_id[5887]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory
[  114.267124][ T5778] usb 4-1: new high-speed USB device number 3 using dummy_hcd
[  114.381840][ T5898] netlink: 32 bytes leftover after parsing attributes in process `syz.1.9'.
[  114.397590][ T5898] netlink: 24 bytes leftover after parsing attributes in process `syz.1.9'.
[  114.517423][ T5778] usb 4-1: Using ep0 maxpacket: 32
[  114.648706][ T5778] usb 4-1: config 0 has an invalid interface number: 89 but max is 0
[  114.879244][ T5778] usb 4-1: config 0 has no interface number 0
[  114.970488][ T5778] usb 4-1: config 0 interface 89 has no altsetting 0
[  115.048326][ T5778] usb 4-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e
[  115.117153][ T5778] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  115.201106][ T5778] usb 4-1: Product: syz
[  115.205619][ T5778] usb 4-1: Manufacturer: syz
[  115.253230][ T5778] usb 4-1: SerialNumber: syz
[  115.305323][ T5778] usb 4-1: config 0 descriptor??
[  115.362420][ T5778] em28xx 4-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89)
[  115.469041][ T5778] em28xx 4-1:0.89: Video interface 89 found: bulk
[  115.838435][ T5761] usb 3-1: new full-speed USB device number 2 using dummy_hcd
[  116.126068][ T5909] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[  116.276704][ T5761] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  116.292273][ T5761] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2
[  116.313766][ T5761] usb 3-1: config 1 has no interface number 0
[  116.322796][ T5761] usb 3-1: config 1 interface 1 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1
[  116.404220][ T5761] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40
[  116.435599][ T5761] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  116.458348][ T5761] usb 3-1: Product: syz
[  116.462662][ T5761] usb 3-1: Manufacturer: syz
[  116.476828][ T5761] usb 3-1: SerialNumber: syz
[  116.498428][ T5761] usb 3-1: selecting invalid altsetting 1
[  116.567740][ T5778] em28xx 4-1:0.89: unknown em28xx chip ID (0)
[  116.915308][ T5761] cdc_ncm 3-1:1.1: failed GET_NTB_PARAMETERS
[  116.927703][   T27] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[  116.937518][ T5761] cdc_ncm 3-1:1.1: bind() failure
[  116.964844][ T5761] usb 3-1: USB disconnect, device number 2
[  117.005220][ T5778] em28xx 4-1:0.89: reading from i2c device at 0xa0 failed (error=-5)
[  117.016460][ T5778] em28xx 4-1:0.89: board has no eeprom
[  117.152659][   T27] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  117.177034][   T27] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  117.192722][   T27] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  117.216078][   T27] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  117.232306][   T27] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  117.252114][   T27] usb 1-1: config 0 descriptor??
[  118.088762][   T27] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0
[  118.178199][   T27] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0
[  118.245807][   T27] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0
[  118.303474][ T5778] em28xx 4-1:0.89: Identified as Terratec Grabby (card=67)
[  118.315776][ T5778] em28xx 4-1:0.89: analog set to bulk mode.
[  118.335960][   T27] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0
[  118.355684][ T5878] em28xx 4-1:0.89: Registering V4L2 extension
[  118.365812][   T27] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0
[  118.393933][   T27] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0
[  118.411166][   T27] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0
[  118.427823][   T27] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0
[  118.442615][ T5778] usb 4-1: USB disconnect, device number 3
[  118.446632][   T27] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0
[  118.458885][   T27] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0
[  118.468308][   T27] plantronics 0003:047F:FFFF.0002: unknown main item tag 0x0
[  118.489946][   T27] plantronics 0003:047F:FFFF.0002: No inputs registered, leaving
[  118.531640][   T27] plantronics 0003:047F:FFFF.0002: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0
[  118.552810][ T5778] em28xx 4-1:0.89: Disconnecting em28xx
[  118.663187][ T5878] em28xx 4-1:0.89: Config register raw data: 0xffffffed
[  118.931590][   T27] usb 1-1: USB disconnect, device number 2
[  119.460543][ T5878] em28xx 4-1:0.89: AC97 chip type couldn't be determined
[  119.468399][ T5878] em28xx 4-1:0.89: No AC97 audio processor
[  119.525374][ T5878] usb 4-1: Decoder not found
[  119.543574][ T5878] em28xx 4-1:0.89: failed to create media graph
[  119.550906][ T5878] em28xx 4-1:0.89: V4L2 device video103 deregistered
[  119.569336][ T5878] em28xx 4-1:0.89: Registering snapshot button...
[  120.404946][ T5878] input: em28xx snapshot button as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.89/input/input5
[  120.421741][ T5945] netlink: 32 bytes leftover after parsing attributes in process `syz.2.19'.
[  120.448293][ T5878] em28xx 4-1:0.89: Remote control support is not available for this card.
[  120.460608][ T5778] em28xx 4-1:0.89: Closing input extension
[  120.471260][ T5778] em28xx 4-1:0.89: Deregistering snapshot button
[  120.482441][ T5936] fido_id[5936]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory
[  120.497704][ T5945] netlink: 24 bytes leftover after parsing attributes in process `syz.2.19'.
[  120.643113][ T5778] em28xx 4-1:0.89: Freeing device
[  121.893630][ T5973] mmap: syz.1.30 (5973) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst.
[  123.639977][ T5980] netlink: 32 bytes leftover after parsing attributes in process `syz.0.34'.
[  123.654884][ T5980] netlink: 24 bytes leftover after parsing attributes in process `syz.0.34'.
[  123.727616][ T5984] netlink: 'syz.1.35': attribute type 12 has an invalid length.
[  125.526929][    C1] sched: RT throttling activated
[  125.888208][ T6005] netlink: 'syz.2.43': attribute type 10 has an invalid length.
[  125.945154][ T6005] netlink: 40 bytes leftover after parsing attributes in process `syz.2.43'.
[  126.071244][ T6005] team0: Port device geneve0 added
[  126.104569][ T6005] syz.2.43 (6005) used greatest stack depth: 20680 bytes left
[  126.174642][ T6010] netlink: 32 bytes leftover after parsing attributes in process `syz.3.45'.
[  126.190882][ T6010] netlink: 24 bytes leftover after parsing attributes in process `syz.3.45'.
[  129.386454][ T6045] Zero length message leads to an empty skb
[  129.808661][ T6056] 8021q: adding VLAN 0 to HW filter on device bond0
[  129.896481][ T6056] bond0: (slave rose0): Enslaving as an active interface with an up link
[  131.733076][ T6088] ALSA: mixer_oss: invalid OSS volume ''
[  132.097361][    C1] vcan0: j1939_tp_rxtimer: 0xffff888024904c00: rx timeout, send abort
[  132.608221][    C1] vcan0: j1939_tp_rxtimer: 0xffff888024904c00: abort rx timeout. Force session deactivation
[  133.377322][ T5776] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[  133.776333][ T1289] ieee802154 phy0 wpan0: encryption failed: -22
[  133.786737][ T1289] ieee802154 phy1 wpan1: encryption failed: -22
[  134.144452][ T5776] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  134.193285][ T5776] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  134.234053][ T5776] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  134.344563][ T5776] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  134.393142][ T5776] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  134.468409][ T5776] usb 1-1: config 0 descriptor??
[  134.501915][ T5776] usb 1-1: can't set config #0, error -71
[  134.556427][ T5776] usb 1-1: USB disconnect, device number 3
[  135.497058][   T27] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[  136.413465][   T27] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00
[  136.457017][   T27] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  136.466233][   T27] usb 2-1: Product: syz
[  136.504848][   T27] usb 2-1: Manufacturer: syz
[  136.517246][   T27] usb 2-1: SerialNumber: syz
[  136.846723][ T5785] Bluetooth: hci0: unexpected event 0x01 length: 245 > 1
[  137.821974][   T27] rtl8150 2-1:1.0: couldn't reset the device
[  137.885076][   T27] rtl8150: probe of 2-1:1.0 failed with error -5
[  137.985692][   T27] usb 2-1: USB disconnect, device number 2
[  138.056444][ T6145] =======================================================
[  138.056444][ T6145] WARNING: The mand mount option has been deprecated and
[  138.056444][ T6145]          and is ignored by this kernel. Remove the mand
[  138.056444][ T6145]          option from the mount to silence this warning.
[  138.056444][ T6145] =======================================================
[  141.067128][ T6186] Can't find a SQUASHFS superblock on nullb0
[  143.456512][ T6199] netdevsim netdevsim3 netdevsim0: entered promiscuous mode
[  145.971407][ T6215] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[  146.567629][ T5778] usb 4-1: new high-speed USB device number 4 using dummy_hcd
[  146.987886][ T5778] usb 4-1: Using ep0 maxpacket: 8
[  147.221858][ T5778] usb 4-1: config index 0 descriptor too short (expected 301, got 45)
[  147.403945][ T5778] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  147.575876][ T5778] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  147.748052][ T5778] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  147.897192][ T5778] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  147.991010][ T5778] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23
[  148.048302][ T5778] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  148.192253][ T6250] IPv6: sit1: Disabled Multicast RS
[  148.368072][ T5778] usb 4-1: GET_CAPABILITIES returned 0
[  148.379590][ T5778] usbtmc 4-1:16.0: can't read capabilities
[  148.484013][ T6254] 9pnet: Limiting 'msize' to 1048576 as this is the maximum supported by transport fd
[  148.564925][ T5761] usb 4-1: USB disconnect, device number 4
[  148.821636][ T6265] overlayfs: missing 'lowerdir'
[  150.457855][   T27] usb 4-1: new high-speed USB device number 5 using dummy_hcd
[  150.534320][ T6290] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[  150.640174][ T5785] Bluetooth: Wrong link type (-57)
[  150.877167][   T27] usb 4-1: New USB device found, idVendor=05d1, idProduct=2021, bcdDevice=31.00
[  151.240514][   T27] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  151.281814][   T27] usb 4-1: Product: syz
[  151.286171][   T27] usb 4-1: Manufacturer: syz
[  151.298884][   T27] usb 4-1: SerialNumber: syz
[  151.333346][   T27] usb 4-1: config 0 descriptor??
[  151.347714][ T5878] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[  151.367688][   T27] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected
[  151.386634][   T27] usb 4-1: Detected FT4232HP
[  151.507115][ T5778] usb 1-1: new high-speed USB device number 4 using dummy_hcd
[  151.557037][ T5878] usb 3-1: Using ep0 maxpacket: 32
[  151.570290][ T5878] usb 3-1: config 113 has an invalid interface number: 97 but max is 0
[  151.626986][ T5878] usb 3-1: config 113 has no interface number 0
[  151.646972][ T5878] usb 3-1: too many endpoints for config 113 interface 97 altsetting 109: 101, using maximum allowed: 30
[  151.686564][ T5878] usb 3-1: config 113 interface 97 altsetting 109 has 0 endpoint descriptors, different from the interface descriptor's value: 101
[  151.723575][ T5878] usb 3-1: config 113 interface 97 has no altsetting 0
[  151.769072][ T5778] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32
[  151.799043][   T27] ftdi_sio ttyUSB0: Unable to write latency timer: -71
[  151.823421][ T5878] usb 3-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice=b8.a2
[  151.824490][   T27] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0
[  151.840122][ T5778] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config
[  151.862188][ T5878] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  151.877777][ T5878] usb 3-1: Product: syz
[  151.884396][ T5778] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66
[  151.895304][ T5878] usb 3-1: Manufacturer: syz
[  151.901269][ T5878] usb 3-1: SerialNumber: syz
[  151.906523][ T5778] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9
[  151.956442][ T5778] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024
[  151.975072][ T5778] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40
[  151.999177][   T27] usb 4-1: USB disconnect, device number 5
[  152.008750][ T5778] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0
[  152.019231][ T5778] usb 1-1: Product: syz
[  152.031142][   T27] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0
[  152.041428][ T5778] usb 1-1: Manufacturer: syz
[  152.085339][ T5778] cdc_wdm 1-1:1.0: skipping garbage
[  152.092262][   T27] ftdi_sio 4-1:0.0: device disconnected
[  152.097652][ T5778] cdc_wdm 1-1:1.0: skipping garbage
[  152.122389][ T5778] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device
[  152.129572][ T5778] cdc_wdm 1-1:1.0: Unknown control protocol
[  152.166467][ T5878] usb 3-1: USB disconnect, device number 3
[  152.454438][ T6294] netlink: 16 bytes leftover after parsing attributes in process `syz.3.124'.
[  154.736617][   T27] usb 1-1: USB disconnect, device number 4
[  158.207888][ T6319] syzkaller1: entered promiscuous mode
[  158.213921][ T6319] syzkaller1: entered allmulticast mode
[  160.408099][ T6354] capability: warning: `syz.0.133' uses 32-bit capabilities (legacy support in use)
[  164.149852][ T6355] syz.0.133 (6355): drop_caches: 2
[  164.267028][ T5867] usb 3-1: new high-speed USB device number 4 using dummy_hcd
[  164.368180][ T5778] usb 4-1: new high-speed USB device number 6 using dummy_hcd
[  164.477966][ T5867] usb 3-1: Using ep0 maxpacket: 32
[  164.491312][ T5867] usb 3-1: config 0 has an invalid interface number: 12 but max is 0
[  164.500661][ T5867] usb 3-1: config 0 has no interface number 0
[  164.512716][ T5867] usb 3-1: config 0 interface 12 has no altsetting 0
[  164.524101][ T5867] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40
[  164.535556][ T5867] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  164.545221][ T5867] usb 3-1: Product: syz
[  164.549931][ T5867] usb 3-1: Manufacturer: syz
[  164.554746][ T5867] usb 3-1: SerialNumber: syz
[  164.564982][ T5867] usb 3-1: config 0 descriptor??
[  164.582466][ T5778] usb 4-1: config 0 has an invalid interface number: 11 but max is 0
[  164.597828][ T5778] usb 4-1: config 0 has no interface number 0
[  164.604644][ T5778] usb 4-1: config 0 interface 11 altsetting 253 bulk endpoint 0x7 has invalid maxpacket 1024
[  164.621766][ T5778] usb 4-1: config 0 interface 11 has no altsetting 0
[  164.630553][ T5778] usb 4-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b
[  164.662268][ T5778] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  164.696689][ T5778] usb 4-1: config 0 descriptor??
[  164.716646][ T6377] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22
[  164.742320][ T5778] keyspan 4-1:0.11: Keyspan 2 port adapter converter detected
[  164.758348][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 87
[  164.780098][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 81
[  164.794115][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 82
[  164.802806][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 1
[  164.835610][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 2
[  164.844292][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 85
[  164.857164][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 5
[  164.880781][ T5778] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB0
[  164.916403][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 83
[  164.949668][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 84
[  164.984367][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 3
[  164.999048][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 4
[  165.009943][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 86
[  165.020728][ T5778] keyspan 4-1:0.11: found no endpoint descriptor for endpoint 6
[  165.043736][ T5778] usb 4-1: Keyspan 2 port adapter converter now attached to ttyUSB1
[  165.074218][ T5778] usb 4-1: USB disconnect, device number 6
[  165.096231][ T5778] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0
[  165.125526][ T5778] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1
[  165.144710][ T5778] keyspan 4-1:0.11: device disconnected
[  165.621799][ T6406] netlink: 4 bytes leftover after parsing attributes in process `syz.0.155'.
[  166.498037][ T5878] usb 4-1: new high-speed USB device number 7 using dummy_hcd
[  167.336595][ T5867] f81534 3-1:0.12: f81534_get_register: reg: 1003 failed: -71
[  167.344642][ T5867] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71
[  167.353984][ T5867] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71
[  167.362300][ T5867] f81534: probe of 3-1:0.12 failed with error -71
[  167.375440][ T5867] usb 3-1: USB disconnect, device number 4
[  167.421675][ T5878] usb 4-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47
[  167.461515][ T5878] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  167.487232][ T5878] usb 4-1: config 0 descriptor??
[  167.508623][ T5878] gspca_main: STV06xx-2.14.0 probing 046d:0870
[  167.771568][ T6427] netlink: 8 bytes leftover after parsing attributes in process `syz.0.163'.
[  167.947032][ T5867] usb 2-1: new full-speed USB device number 3 using dummy_hcd
[  167.973624][ T6432] netlink: 224 bytes leftover after parsing attributes in process `syz.2.165'.
[  168.149869][ T5867] usb 2-1: config 0 has an invalid interface number: 1 but max is 0
[  168.162099][ T5867] usb 2-1: config 0 has no interface number 0
[  168.170616][ T5867] usb 2-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e
[  168.187565][ T5867] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  168.205516][ T5867] usb 2-1: config 0 descriptor??
[  168.226149][ T5867] usb 2-1: selecting invalid altsetting 1
[  168.246599][ T5867] dvb_ttusb_budget: ttusb_init_controller: error
[  168.256188][ T5867] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB)
[  168.450586][ T5867] DVB: Unable to find symbol cx22700_attach()
[  168.534318][ T5878] usb 4-1: USB disconnect, device number 7
[  168.619521][ T5867] DVB: Unable to find symbol tda10046_attach()
[  168.632833][ T5867] dvb_ttusb_budget: no frontend driver found for device [0b48:1005]
[  168.655995][ T5867] usb 2-1: USB disconnect, device number 3
[  183.383241][ T6552] nvme_fabrics: missing parameter 'transport=%s'
[  183.497038][ T6552] nvme_fabrics: missing parameter 'nqn=%s'
[  184.809359][ T5785] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0
[  184.818201][ T5785] Bluetooth: hci2: Injecting HCI hardware error event
[  184.827648][ T5082] Bluetooth: hci2: hardware error 0x00
[  186.704984][ T6583] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[  187.080646][ T5082] Bluetooth: hci2: Opcode 0x0c03 failed: -110
[  189.444201][ T6642] random: crng reseeded on system resumption
[  191.290430][ T6652] netlink: 36 bytes leftover after parsing attributes in process `syz.0.236'.
[  194.227552][ T5761] usb 2-1: new full-speed USB device number 4 using dummy_hcd
[  194.482772][ T5761] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  194.495566][ T5761] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  194.506782][ T5761] usb 2-1: New USB device found, idVendor=1e7d, idProduct=3138, bcdDevice= 0.00
[  194.516105][ T5761] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  194.583699][ T5761] usb 2-1: config 0 descriptor??
[  195.054221][ T1289] ieee802154 phy0 wpan0: encryption failed: -22
[  195.060642][ T1289] ieee802154 phy1 wpan1: encryption failed: -22
[  195.069528][ T5761] ryos 0003:1E7D:3138.0003: invalid report_count 15677
[  195.127343][ T5761] ryos 0003:1E7D:3138.0003: item 0 2 1 9 parsing failed
[  195.135262][ T5761] ryos 0003:1E7D:3138.0003: parse failed
[  195.157513][ T5761] ryos: probe of 0003:1E7D:3138.0003 failed with error -22
[  195.266189][ T5867] usb 2-1: USB disconnect, device number 4
[  195.507594][ T5761] usb 4-1: new full-speed USB device number 8 using dummy_hcd
[  195.721514][ T5761] usb 4-1: config index 0 descriptor too short (expected 1051, got 27)
[  195.735655][ T5761] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0
[  195.762846][ T5761] usb 4-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice=7d.f9
[  195.781967][ T5761] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  195.791424][ T5761] usb 4-1: Product: syz
[  195.797387][ T5761] usb 4-1: Manufacturer: syz
[  195.819989][ T5761] usb 4-1: SerialNumber: syz
[  195.829557][ T5761] usb 4-1: config 0 descriptor??
[  195.940909][ T6710] tipc: Started in network mode
[  195.946275][ T6710] tipc: Node identity aaaaaaaaaa34, cluster identity 4711
[  195.956378][ T6710] tipc: Enabled bearer <eth:macvlan0>, priority 10
[  195.997519][    T8] usb 3-1: new high-speed USB device number 5 using dummy_hcd
[  196.182366][ T5776] usb 4-1: USB disconnect, device number 8
[  196.253207][    T8] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  196.441565][    T8] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2
[  196.600903][    T8] usb 3-1: New USB device found, idVendor=05dc, idProduct=0001, bcdDevice= 0.00
[  196.730864][    T8] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  196.866931][    T8] usb 3-1: Product: syz
[  196.871532][    T8] usb 3-1: Manufacturer: syz
[  196.936064][    T8] usb 3-1: SerialNumber: syz
[  196.949470][ T5776] tipc: Node number set to 10398378
[  196.953356][ T6715] loop3: detected capacity change from 0 to 7
[  196.969673][    T8] usb 3-1: config 0 descriptor??
[  196.977176][ T6715] Dev loop3: unable to read RDB block 7
[  196.983210][ T6715]  loop3: unable to read partition table
[  196.989310][ T6715] loop3: partition table beyond EOD, truncated
[  196.995543][ T6715] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5)
[  197.010725][    T8] ums-jumpshot 3-1:0.0: USB Mass Storage device detected
[  197.044265][    T8] ums-jumpshot 3-1:0.0: Quirks match for vid 05dc pid 0001: 2
[  197.677050][    T8] usb 3-1: USB disconnect, device number 5
[  198.626256][ T6741] syz.1.264[6741]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
[  199.390932][ T6755] process 'syz.3.267' launched '/dev/fd/8' with NULL argv: empty string added
[  200.680299][ T2957] bridge0: port 2(bridge_slave_1) entered disabled state
[  200.846591][ T6771] netlink: 12 bytes leftover after parsing attributes in process `syz.3.272'.
[  200.857799][ T6771] netlink: 'syz.3.272': attribute type 18 has an invalid length.
[  200.878647][ T6771] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0
[  200.887986][ T6771] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0
[  200.896783][ T6771] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0
[  200.905653][ T6771] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0
[  200.920050][ T6771] vxlan0: entered promiscuous mode
[  202.950073][ T6801] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies.
[  204.498971][ T6824] Driver unsupported XDP return value 0 on prog  (id 36) dev N/A, expect packet loss!
[  210.953635][ T6873] general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN
[  210.965567][ T6873] KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
[  210.974317][ T6873] CPU: 0 PID: 6873 Comm: syz.3.313 Not tainted syzkaller #0
[  210.981737][ T6873] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  210.991954][ T6873] RIP: 0010:pcl818_ai_cancel+0x69/0x3f0
[  210.997580][ T6873] Code: 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 19 5f df f9 48 8b 03 48 89 04 24 49 83 c4 28 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 f8 5e df f9 4d 8b 24 24 48 83 c3
[  211.017333][ T6873] RSP: 0018:ffffc9001a55fa80 EFLAGS: 00010206
[  211.023567][ T6873] RAX: 0000000000000005 RBX: ffff8880264fad80 RCX: 0000000000080000
[  211.031866][ T6873] RDX: ffffc9000d34c000 RSI: 00000000000007c4 RDI: 00000000000007c5
[  211.040767][ T6873] RBP: 0000000000000001 R08: ffff88814c5b012f R09: 1ffff110298b6025
[  211.048897][ T6873] R10: dffffc0000000000 R11: ffffed10298b6026 R12: 0000000000000028
[  211.057099][ T6873] R13: dffffc0000000000 R14: ffff88814c5b0000 R15: dffffc0000000000
[  211.065226][ T6873] FS:  00007f0ee396b6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
[  211.074382][ T6873] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  211.081016][ T6873] CR2: 0000001b2d823ffc CR3: 00000000753de000 CR4: 00000000003526f0
[  211.089042][ T6873] Call Trace:
[  211.092373][ T6873]  <TASK>
[  211.095401][ T6873]  pcl818_detach+0x66/0xd0
[  211.099898][ T6873]  comedi_device_detach_locked+0x172/0x710
[  211.105770][ T6873]  comedi_unlocked_ioctl+0xccc/0xfe0
[  211.111300][ T6873]  ? comedi_poll+0x8c0/0x8c0
[  211.115980][ T6873]  ? __fget_files+0x28/0x4d0
[  211.120634][ T6873]  ? bpf_lsm_file_ioctl+0x9/0x10
[  211.125613][ T6873]  ? security_file_ioctl+0x80/0xa0
[  211.130786][ T6873]  ? comedi_poll+0x8c0/0x8c0
[  211.135431][ T6873]  __se_sys_ioctl+0xfd/0x170
[  211.140196][ T6873]  do_syscall_64+0x55/0xb0
[  211.144752][ T6873]  ? clear_bhb_loop+0x40/0x90
[  211.149528][ T6873]  ? clear_bhb_loop+0x40/0x90
[  211.154271][ T6873]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  211.160226][ T6873] RIP: 0033:0x7f0ee2b8f749
[  211.164695][ T6873] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  211.184355][ T6873] RSP: 002b:00007f0ee396b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  211.192854][ T6873] RAX: ffffffffffffffda RBX: 00007f0ee2de5fa0 RCX: 00007f0ee2b8f749
[  211.200878][ T6873] RDX: 0000000000000000 RSI: 0000000040946400 RDI: 0000000000000003
[  211.209149][ T6873] RBP: 00007f0ee2c13f91 R08: 0000000000000000 R09: 0000000000000000
[  211.217162][ T6873] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  211.225192][ T6873] R13: 00007f0ee2de6038 R14: 00007f0ee2de5fa0 R15: 00007fff5bfd1198
[  211.233400][ T6873]  </TASK>
[  211.236468][ T6873] Modules linked in:
[  211.255363][ T6873] ---[ end trace 0000000000000000 ]---
[  211.262995][ T6873] RIP: 0010:pcl818_ai_cancel+0x69/0x3f0
[  211.269400][ T6873] Code: 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 19 5f df f9 48 8b 03 48 89 04 24 49 83 c4 28 4c 89 e0 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 e7 e8 f8 5e df f9 4d 8b 24 24 48 83 c3
[  211.291132][ T6873] RSP: 0018:ffffc9001a55fa80 EFLAGS: 00010206
[  211.308537][ T6873] RAX: 0000000000000005 RBX: ffff8880264fad80 RCX: 0000000000080000
[  211.339240][ T6873] RDX: ffffc9000d34c000 RSI: 00000000000007c4 RDI: 00000000000007c5
[  211.350905][ T6873] RBP: 0000000000000001 R08: ffff88814c5b012f R09: 1ffff110298b6025
[  211.362139][ T6873] R10: dffffc0000000000 R11: ffffed10298b6026 R12: 0000000000000028
[  211.372138][ T6873] R13: dffffc0000000000 R14: ffff88814c5b0000 R15: dffffc0000000000
[  211.380982][ T6873] FS:  00007f0ee396b6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
[  211.392123][ T6873] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  211.399391][ T6873] CR2: 00007f7e8f3b7198 CR3: 00000000753de000 CR4: 00000000003506f0
[  211.409442][ T6873] Kernel panic - not syncing: Fatal exception
[  211.416127][ T6873] Kernel Offset: disabled
[  211.420603][ T6873] Rebooting in 86400 seconds..