last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.1.182' (ED25519) to the list of known hosts.
[ 68.812219][ T5809] cgroup: Unknown subsys name 'net'
[ 68.947515][ T5809] cgroup: Unknown subsys name 'cpuset'
[ 68.956592][ T5809] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 70.366779][ T5809] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 71.328889][ T1298] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.335363][ T1298] ieee802154 phy1 wpan1: encryption failed: -22
[ 72.303704][ T5825] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 72.323883][ T5831] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 72.330547][ T5836] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 72.338259][ T5831] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 72.339240][ T5836] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 72.346326][ T5831] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 72.360641][ T5831] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 72.360696][ T5836] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 72.368135][ T5831] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 72.375730][ T5836] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 72.384368][ T5831] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 72.390629][ T5836] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 72.396742][ T5831] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 72.403800][ T5836] ==================================================================
[ 72.410179][ T5831] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 72.417537][ T5836] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 72.417564][ T5836] Read of size 2 at addr ffff88805c56f2b8 by task kworker/u9:6/5836
[ 72.417579][ T5836]
[ 72.425840][ T5831] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[ 72.431952][ T5836] CPU: 1 UID: 0 PID: 5836 Comm: kworker/u9:6 Not tainted syzkaller #0 PREEMPT(full)
[ 72.431975][ T5836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 72.431987][ T5836] Workqueue: hci3 hci_cmd_work
[ 72.432020][ T5836] Call Trace:
[ 72.432029][ T5836]
[ 72.432037][ T5836] dump_stack_lvl+0x189/0x250
[ 72.432061][ T5836] ? __virt_addr_valid+0x1c8/0x5c0
[ 72.432077][ T5836] ? rcu_is_watching+0x15/0xb0
[ 72.432092][ T5836] ? __pfx_dump_stack_lvl+0x10/0x10
[ 72.432113][ T5836] ? rcu_is_watching+0x15/0xb0
[ 72.432127][ T5836] ? lock_release+0x4b/0x3d0
[ 72.432146][ T5836] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 72.432163][ T5836] ? __virt_addr_valid+0x1c8/0x5c0
[ 72.432179][ T5836] ? __virt_addr_valid+0x4a5/0x5c0
[ 72.432196][ T5836] print_report+0xca/0x240
[ 72.432215][ T5836] ? hci_cmd_work+0x5d0/0x7b0
[ 72.432233][ T5836] kasan_report+0x118/0x150
[ 72.432253][ T5836] ? hci_cmd_work+0x5d0/0x7b0
[ 72.432274][ T5836] hci_cmd_work+0x5d0/0x7b0
[ 72.432293][ T5836] ? process_one_work+0x868/0x15e0
[ 72.432311][ T5836] process_one_work+0x93a/0x15e0
[ 72.432329][ T5836] ? __lock_acquire+0xab9/0xd20
[ 72.432356][ T5836] ? __pfx_process_one_work+0x10/0x10
[ 72.432378][ T5836] ? assign_work+0x3a1/0x410
[ 72.432398][ T5836] worker_thread+0x9b0/0xee0
[ 72.432427][ T5836] kthread+0x711/0x8a0
[ 72.432443][ T5836] ? __pfx_worker_thread+0x10/0x10
[ 72.432462][ T5836] ? __pfx_kthread+0x10/0x10
[ 72.432477][ T5836] ? _raw_spin_unlock_irq+0x23/0x50
[ 72.432492][ T5836] ? lockdep_hardirqs_on+0x9c/0x150
[ 72.432509][ T5836] ? __pfx_kthread+0x10/0x10
[ 72.432523][ T5836] ret_from_fork+0x599/0xb30
[ 72.432543][ T5836] ? __pfx_ret_from_fork+0x10/0x10
[ 72.432565][ T5836] ? __switch_to_asm+0x39/0x70
[ 72.432580][ T5836] ? __switch_to_asm+0x33/0x70
[ 72.432594][ T5836] ? __pfx_kthread+0x10/0x10
[ 72.432609][ T5836] ret_from_fork_asm+0x1a/0x30
[ 72.432631][ T5836]
[ 72.432637][ T5836]
[ 72.446553][ T52] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 72.449161][ T5836] Allocated by task 5825:
[ 72.459693][ T52] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 72.468646][ T5836] kasan_save_track+0x3e/0x80
[ 72.468670][ T5836] __kasan_slab_alloc+0x6c/0x80
[ 72.468684][ T5836] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 72.468698][ T5836] __alloc_skb+0x112/0x2d0
[ 72.468717][ T5836] hci_cmd_sync_alloc+0x3d/0x3b0
[ 72.681397][ T5836] __hci_cmd_sync_sk+0x1a7/0xc70
[ 72.686323][ T5836] hci_dev_open_sync+0x163e/0x2dc0
[ 72.691416][ T5836] hci_power_on+0x1b4/0x720
[ 72.695909][ T5836] process_one_work+0x93a/0x15e0
[ 72.700840][ T5836] worker_thread+0x9b0/0xee0
[ 72.705416][ T5836] kthread+0x711/0x8a0
[ 72.709473][ T5836] ret_from_fork+0x599/0xb30
[ 72.714052][ T5836] ret_from_fork_asm+0x1a/0x30
[ 72.718804][ T5836]
[ 72.721115][ T5836] Freed by task 5834:
[ 72.725072][ T5836] kasan_save_track+0x3e/0x80
[ 72.729738][ T5836] kasan_save_free_info+0x46/0x50
[ 72.734746][ T5836] __kasan_slab_free+0x5c/0x80
[ 72.739553][ T5836] kmem_cache_free+0x197/0x640
[ 72.744301][ T5836] vhci_read+0x49a/0x5b0
[ 72.748525][ T5836] vfs_read+0x200/0xa30
[ 72.752663][ T5836] ksys_read+0x145/0x250
[ 72.756886][ T5836] do_syscall_64+0xfa/0xfa0
[ 72.761374][ T5836] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 72.767248][ T5836]
[ 72.769554][ T5836] The buggy address belongs to the object at ffff88805c56f280
[ 72.769554][ T5836] which belongs to the cache skbuff_head_cache of size 240
[ 72.784106][ T5836] The buggy address is located 56 bytes inside of
[ 72.784106][ T5836] freed 240-byte region [ffff88805c56f280, ffff88805c56f370)
[ 72.797805][ T5836]
[ 72.800112][ T5836] The buggy address belongs to the physical page:
[ 72.806519][ T5836] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5c56f
[ 72.815272][ T5836] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 72.822377][ T5836] page_type: f5(slab)
[ 72.826351][ T5836] raw: 00fff00000000000 ffff88801dee5a00 dead000000000122 0000000000000000
[ 72.834920][ T5836] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000
[ 72.843485][ T5836] page dumped because: kasan: bad access detected
[ 72.849891][ T5836] page_owner tracks the page as allocated
[ 72.855592][ T5836] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5836, tgid 5836 (kworker/u9:6), ts 72390586798, free_ts 20268806232
[ 72.875035][ T5836] post_alloc_hook+0x240/0x2a0
[ 72.879792][ T5836] get_page_from_freelist+0x2365/0x2440
[ 72.885321][ T5836] __alloc_frozen_pages_noprof+0x181/0x370
[ 72.891107][ T5836] alloc_pages_mpol+0x232/0x4a0
[ 72.895937][ T5836] allocate_slab+0x86/0x3b0
[ 72.900421][ T5836] ___slab_alloc+0xf56/0x1990
[ 72.905082][ T5836] __slab_alloc+0x65/0x100
[ 72.909481][ T5836] kmem_cache_alloc_noprof+0x40f/0x700
[ 72.914917][ T5836] skb_clone+0x212/0x3a0
[ 72.919139][ T5836] hci_event_packet+0x1a6/0x1260
[ 72.924144][ T5836] hci_rx_work+0x45d/0xfc0
[ 72.928542][ T5836] process_one_work+0x93a/0x15e0
[ 72.933461][ T5836] worker_thread+0x9b0/0xee0
[ 72.938032][ T5836] kthread+0x711/0x8a0
[ 72.942083][ T5836] ret_from_fork+0x599/0xb30
[ 72.946650][ T5836] ret_from_fork_asm+0x1a/0x30
[ 72.951394][ T5836] page last free pid 1 tgid 1 stack trace:
[ 72.957174][ T5836] __free_frozen_pages+0xbc8/0xd30
[ 72.962265][ T5836] free_contig_range+0x1bd/0x4a0
[ 72.967181][ T5836] destroy_args+0x69/0x660
[ 72.971580][ T5836] debug_vm_pgtable+0x38f/0x3a0
[ 72.976409][ T5836] do_one_initcall+0x1fb/0x870
[ 72.981152][ T5836] do_initcall_level+0x104/0x190
[ 72.986081][ T5836] do_initcalls+0x59/0xa0
[ 72.990391][ T5836] kernel_init_freeable+0x334/0x4b0
[ 72.995569][ T5836] kernel_init+0x1d/0x1d0
[ 72.999887][ T5836] ret_from_fork+0x599/0xb30
[ 73.004458][ T5836] ret_from_fork_asm+0x1a/0x30
[ 73.009200][ T5836]
[ 73.011502][ T5836] Memory state around the buggy address:
[ 73.017107][ T5836] ffff88805c56f180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.025145][ T5836] ffff88805c56f200: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 73.033197][ T5836] >ffff88805c56f280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 73.041252][ T5836] ^
[ 73.047135][ T5836] ffff88805c56f300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 73.055178][ T5836] ffff88805c56f380: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 73.063219][ T5836] ==================================================================
[ 73.071723][ T5838] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[ 73.078885][ T5838] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 73.086412][ T5836] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 73.093642][ T5836] CPU: 1 UID: 0 PID: 5836 Comm: kworker/u9:6 Not tainted syzkaller #0 PREEMPT(full)
[ 73.103084][ T5836] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 73.113133][ T5836] Workqueue: hci3 hci_cmd_work
[ 73.117928][ T5836] Call Trace:
[ 73.121199][ T5836]
[ 73.124118][ T5836] dump_stack_lvl+0x99/0x250
[ 73.128710][ T5836] ? __asan_memcpy+0x40/0x70
[ 73.133298][ T5836] ? __pfx_dump_stack_lvl+0x10/0x10
[ 73.138497][ T5836] ? __pfx__printk+0x10/0x10
[ 73.143077][ T5836] vpanic+0x237/0x6d0
[ 73.147045][ T5836] ? __pfx_vpanic+0x10/0x10
[ 73.151535][ T5836] ? preempt_schedule+0xae/0xc0
[ 73.156369][ T5836] ? __pfx_preempt_schedule+0x10/0x10
[ 73.161726][ T5836] panic+0xb9/0xc0
[ 73.165454][ T5836] ? __pfx_panic+0x10/0x10
[ 73.169851][ T5836] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 73.175728][ T5836] ? is_module_address+0x17/0xf0
[ 73.180648][ T5836] ? hci_cmd_work+0x5d0/0x7b0
[ 73.185305][ T5836] check_panic_on_warn+0x89/0xb0
[ 73.190225][ T5836] ? hci_cmd_work+0x5d0/0x7b0
[ 73.194884][ T5836] end_report+0x6f/0x160
[ 73.199114][ T5836] kasan_report+0x129/0x150
[ 73.203599][ T5836] ? hci_cmd_work+0x5d0/0x7b0
[ 73.208263][ T5836] hci_cmd_work+0x5d0/0x7b0
[ 73.212753][ T5836] ? process_one_work+0x868/0x15e0
[ 73.217849][ T5836] process_one_work+0x93a/0x15e0
[ 73.222774][ T5836] ? __lock_acquire+0xab9/0xd20
[ 73.227619][ T5836] ? __pfx_process_one_work+0x10/0x10
[ 73.232991][ T5836] ? assign_work+0x3a1/0x410
[ 73.237617][ T5836] worker_thread+0x9b0/0xee0
[ 73.242206][ T5836] kthread+0x711/0x8a0
[ 73.246271][ T5836] ? __pfx_worker_thread+0x10/0x10
[ 73.251372][ T5836] ? __pfx_kthread+0x10/0x10
[ 73.255951][ T5836] ? _raw_spin_unlock_irq+0x23/0x50
[ 73.261137][ T5836] ? lockdep_hardirqs_on+0x9c/0x150
[ 73.266323][ T5836] ? __pfx_kthread+0x10/0x10
[ 73.270908][ T5836] ret_from_fork+0x599/0xb30
[ 73.275486][ T5836] ? __pfx_ret_from_fork+0x10/0x10
[ 73.280584][ T5836] ? __switch_to_asm+0x39/0x70
[ 73.285325][ T5836] ? __switch_to_asm+0x33/0x70
[ 73.290069][ T5836] ? __pfx_kthread+0x10/0x10
[ 73.294643][ T5836] ret_from_fork_asm+0x1a/0x30
[ 73.299401][ T5836]
[ 73.302804][ T5836] Kernel Offset: disabled
[ 73.307232][ T5836] Rebooting in 86400 seconds..