program: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) pselect6(0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)={0x0, 0x989680}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000b00)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELSET={0x20, 0xb, 0xa, 0x201, 0x0, 0x0, {0x5, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x68}, 0x1, 0x0, 0x0, 0x4000}, 0x14) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000080)={'veth0_vlan\x00'}) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10104}, [@IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x0) syz_mount_image$bcachefs(&(0x7f0000000200), &(0x7f0000005900)='./file2\x00', 0x1000081, &(0x7f0000000040)=ANY=[@ANYRESOCT], 0xfe, 0x59c9, &(0x7f0000010cc0)="$eJzs3X+MHNWdIPBX3T0zPTP+MTawOBDGg8G7LGziMb9EktXGu7cbVsAiR6yymHMCAx6zTmxj2WYBwy5mD3IgIEpWWe2SXelIRNBBnAgJLsFBIfw4m0tIEJccOhF0SY7kj5wIhxXAh6JcZjXT9drdNV1TPT09xobPR/ZU1+vq73v16nVNfV/XzAQAAADeFfbftuPgxSf82Xf/fvzNm//8m1tuCYPlqfJq3GAoXV7/drWQ+VTKrPdVlk0ts+Pi92588OcjV/3Jdx4a+PJb+zacvPFHf3rMVY998oK99/zLk28sfOS3LxfVE8fT6YfWk1eTEKrfOvCPn9737PGTZUkIoZwM7Q5hSbL0ySVJJsTor0MIG+rtbH7y4TfP2ji5vOXOvqbyxZkgxvs7X/8Mz1XTcbbr4HVnhB//8bpbv7/8a1/t2fPK7kObJNWG8RTCoisaX9+Txo91xNG2LL44Xa4NIQw0vO68gjaf0s6OhRBW5ayfmC570+VgQZz4/IrMevZ8kF2PejLLgYL6GrqqI3nt6HS7Igsy69mT0VzltTOWL0mX30iXp88yfjn+T0IpCZV68zcnh8ZIaDhuSUimjmW1vl5q2uek4Vin60ltvSeulzLPl3sy+zVVbzrQyknSXB63y5TH03ElLT+58VzdwiU55e9Jl9X0jfpWXA/ZBzWD0x7U92tKbNeBGdpyOJRy3lixvH4M04MxmJYNJkunvWaihfjcvnV3rSyvf2r/UE47koeSNH7SUfxd31uy4BNfuePaZXnxryil8Usdxf/Jhc+9dtkdX/pCbvzPxvjljuKf+fjAqxc+fduK3P45EPun0lH8sZefuXv5sVfuyW3/vTF+taP4a/Y+17fw4ONP5LZ/NPZPf0fxX/rQR372wAuPvpIbP8T4Ax3FX79322f6hg+elhv/idg/g52Nn9f3nPvi8PAvRvLiPx/jL+wo/v277/ngfYvvvCD3+K6N/TPUUfyLTn3s1gUHHz0p79yZ3Nut75wA707HpNdYt6frneaZc9WQL/zzSKV2zbcg/b+wmxVlTNazaB7jAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDudNwZ/+38//2xoVcr6Xpf+uClUm0Zy3tDSPpDCDt2jm3fuWnr1SOfvOba7VvHNo+M7RwZ37pz+w0jZ//ByPbxbZvHbph8dvR9Z9VetzQktWVy0rS6JyYmJkpDzWWxvn936p4frzzv//wyhNHjfjhcyW3/qnu23Hdsi68ZyZqJD2+59uIfnvPFdL+G0nYN5bQrtGpX+tpw4OenhTD6OzO165mX/ujbTQ2aKji0f6lSXxq0Lxlo2Y56q9P2xP6qbNy0eXy0uH/LOf3772985dcbr//cb2r9W83djzb7t3/NxObSP6276P//0021giP1uBf1d9yL2L7Yf9W0vxel+7UoZ78qOft12/efeCGccMcbu8No5fXl0+su2q+edAD0JO9pq95Yw0CypKm8mm4fj3h83aqdW7at2nHDrvdt2jJ29fjV41s/sPrs1eeOnnPuOaum9nxVF/b/Ww37H+v/3Tb3//CMp8V/s/sb8Wt746moXUX9Mdmu4v5obFHe+2/gkk9//gP3PH1xraBonMet6+eTdDkweZxXh4bxNr2vWu1XUT+EEEZa9cNrb1wQjv+fm24tOg81HpnGrxnJmolnV/zqi+f967I/rBV0dJ4PIfzfS39z3z+0e55vbFCH5/l6qw+1Z6q/qunxOFL7ty+U0/0abNmu1c8+3XPX/l/+bb19vb3h+rGdO7evrn1dkLZ0QXJiy3ZlS+N+LZ/6Wg5pt4T6MG0xXif1hFr7sufPuHm2VwfT5waTpZlneqf2Kys+u2/dXSvL65/an9fTyUO1GvvDwtoyeW/OlpszLyzXG9yq/tmMj2T3kTM+hs//10c+9sjXz542Ps6sfc3br75Q746W4/5rL9z/+S9/7j9+vXv7df4fPTf0q//11ytrBUfLeaXe6rQ9SeN55cwQit5/y0Pr/ch9/5Va70/R+y9bz6HtW8cbyawPhnLO+7X1+yU+d+bjA69e+PRtK3Lfrwfafb/e1LRWLni/Hinjp+i8MX/vr6aBkqyZ+M7tx+x+8ua1J9QKisZ1fetW4/qsNvKPnP369mUvDl8z8h/+x6z3a1HLzZI1Ew/+wcOX/2hszd/VCo6U415N+7ea07/1Vse8s7F/33/VNZs31MqP3OvfdFmQ/8RTyY4bdn1qbPPm8e072tuvdq+3Yj3ZXu70+2k8uy0t2K/StP2avwft9Fe777fY/g0d91fz+20wJB19X9j1vSULPvGVO64dmvaqtKIrJm6uxS91FP8nFz732mV3fOkLufE/W0rbX+ko/tjLz9y9/Ngr9+TGvzdJ41c7ir9m73N9Cw8+/kRu/NHY/v6O4r/0oY/87IEXHn0lN36I8Qc76//X95z74vDwL3LjP5+k9UxeI4Xw8JtnbaytJ6Enfb/FdvQ0tStk15PMeimzXm5cL9XmWusVlJOkuTxul5af3NCWVv4qpzxehVWX1ZZvxfWQfTBz+ZGm1HDub1VedJ0KAPBOFz//j9eg8fP/8fRCKX+mAQ4pysMaH7fKw5blxI152KH5nN6m55elMePr4zzg8PvD6OTylpHahf4s5jnLjc9l5zljPaed0hyj03nOovn3FZn1+D6tzZdXGvLQ1PS8phLamH+fXs/M8++Z3S+eHx+5fVqzRhrmrbLHryedMWt1v0OmvZXJCHnjIzsvFu/nGF4U1k7V1+b4yN5HE49D9j6aWM8JmRNnp/fRzHV8xGbPMD6mmlz8+cb04xdm6N9Dx691tOzxm8Xxrk5un//57MzzPu1+Pjt/84Zx3mq+5w1n/XlYf/p0W5+HvcPmJavtxm93XvIwzBv2N9Y723nDWB73o9LmfOLHcsq7NZ8YTxexXQdmaMvhYD4ReKeK+X/8HjGZ/09egP+/zHZF16HZq8YYL/c+oXLr9hTlHdPv0xvo6Dph/d5tn+kbPnha7nXOE+3e97OtaW2g4L6fon5cmVkv7MecCZqifC9bT1G/Z+/LGAwLO+r3+3ff88H7Ft95QW6/r619Iy3u9883rS1s2e/lemvkCznxO88XprR7/9w7LF9oO36X72OoTDu+bc6fvW33MaQ3PnWSj/S0kY/8ZU75bPORgWkP6vs15ajLR3oOb7sAgKNHzP/rn5+l+f9PM9sV5a2nZ9ZjvNy8Nef6JC9v/Yt0eX1m+8H0Jypme11+0amP3brg4KMn5eYt97abh/7nprWhgvx/rnlzbh6xtjv3i+fmEfU8a255Ym7763ni3PL03Pj1PH1ueXRu/9Tz6LnNA+TGr88DzDrPjUP8CMlz53e+bq4/D3DE5tHpj8/O1+d6l+SUzzaPHpz2oL5fU+TRAABvr5j/15OENP9/OrPdXK/bc/OCLl23Z38fSD3+84crr5x73vfTabcDd+/z3+K8db7z+vmelzjaP/+d73mh+Z0nkxen6yH7oEZeDADAkSDm//GHyfLz/w7zk75afpKbv9XzkyM/P28Z/zDk5+fLz2efn/e0F/9wfW799s9/dZD/x59plP9PI/8/vO0CAKA7Yv4ff+wx/v6//5quZ39v/cx5el9unvJuyNODPH0qT+9vFf8oub/87c/T53YfQPE8W20eYGJ0+jYzxX/X3AeQMwDMAzSXmwcAADi69ExlStN/zv7j6TL7c/Z5P5d/WfP2rVK/GVXSF125c/v4+OXXbtswtnP88q3XbBjfcfl12zft3Dm+tbbdXPPG3LwlzRt7QiXtj9bbZfO2xenvQ1ic8/sQstvHsCdOPZj++xCy1fYX/B6BQ8evvfbmHb/SDNu3Gh+Z410Y/69yto/qx/+qvz7z8o07Lt+0ddPOTWObN+0ab95uMmsdmMXfzYzdMqu/m5n5Mk1p9n+/s6kdYXforB2lae3oSfsj7++zJ5l2LElbsiTv7x/ktPu7//0f/ubUid88EMLoceX3zqn/kjUT/+XS8b/Yuf+H2ybbX5qx/fUt03YV/b3S7PZxfyqbr9mx84yN11y7NfsXJTsT5zNK9fV5ms9I3/7lNu9TWJ9TPtv5ifK0B0emtucnAABoEj//j9ez8fPDz6UXULG8/Tx9bp8fZ69x/1PMk0fby9Ozf5esKU9v8dledvu4v+3m6dU55unZ+ovy9Fbbt8rT8/LuvPh/mbP9bLU/TuZ2n0fufM4V7Y2T7N8zKJrPyW4/23GSzHGcZOsvGiettm81TvKOe178j+Zsn6f98TC3+3KqOflxvC+naDz8fma9aDxkt29rPDzQsP0cx0O2/qLx0Gr7VuMh7/jmxb84Z/t2NY+PyYExNS7GL7/umu2fathuvv/+xdzbN79//6NT7bd/fn8+q0vt7wkh5LR/fu8r61L7Z+j/ud1Xltv+5+c2E9Z+++f377t06rDN16Y3mxXdf1Y0j7sup3y287h1vTNUdgQwjwtvn5j/x497Yv5/Z7rs9sdAR//fSZvp+1zPnL/PHf2/x67ldUxfXhVxg3avY96t3897pz04Mvl+DgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANCevsqyqeX+23YcvPiEP/vu34+/efOff3PLLb9344M/H7nqT77z0MCX39q34eSNP/rTY6567JMX7L3nX558Y+Ejv325MPBQbXF6uloNIXk1CaH6rQP/+Ol9zx4/WZaEEMrJ0O4QliRLn1ySZCKM/jqEsKHezuYnH37zrI2Ty1vu7GsqX5wJkt2vMFiO7WlqZ7i+cI84ClXTcbbr4HVnhB//8bpbv7/8a1/t2fPK7kObJNWG8RTCoisaX98TQuhP/0+Ko21ZfHG6XBtCGGh43XkF7Tqlzfavylk/MV32psvBgjjx+RWZ9VJmu+x61JNZDhTUN1d57eh0uyILMuvZk9Fc5bUzli9pOJah4bzZrnL8n4RSEir15m9OmuPG45aEZOpYVuvrpfqxDen+Z9aTzHops17uyezXVL3pQCsnSXN53C5THk/HlbT85MZzdQuX5JS/J11W0zfqW3E9ZB/UDE57UN+vKbFdB2ZoS4Pe9jabvVLDOahVef3ApwdjMC0bTJZOe81EC/G5fevuWlle/9T+oZx2JA8lafyko/i7vrdkwSe+cse1y/LiX1FK45c6iv+TC5977bI7vvSF3PifjfHLHcU/8/GBVy98+rYVuf1zIPZPpaP4Yy8/c/fyY6/ck9v+e2P8akfx1+ztyYmcxh+N/dPfUfyXPvSRnz3wwqOv5PZPiPEHOoq/fu+2z/QNHzwtN/4TsX8GOxs/r+8598Xh4V+M5MV/PsZf2FH8+3ff88H7Ft95Qe7xXRv7Z6ij+Bed+titCw4+elLeuTO5t1vfOQHenY5Jr7FuT9cL8syGk25znjlXDfnCP49Uatd8C9L/C7tZUcZkPYvmMT4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO9MP7jp7I9f+uGPrqskISQ520y0EJ8r965ZM9JBvWMvP3P38mOv3NNYtqyDOAAAAECxmIeX6iXVsCxcl/SHE1tuH+cIToxrSXN5dg6h/9CWXYlT6lKcchtxbn2wOE6lS+3p6VKc3i7F6etSnGpBnGpoL07/jHFKbbRnwdRyYM5xalsOdinOgi7FWdilOIu6FGdxl+IMzRin/XG4pEtxlnYpzjFdinNsl+Ic16U4v9OlOMd3KU52Tnm243BhuuUJeXGmHpQL41SScu2bV9J6Pj3Wc1LrehaGNusZTMr1J2aqJztnP9v96W+znlMyryvNsp5qm/X87hzrSdqs5/fnWE+poJ44bq/Pti/WE9faHP835MfpnU2cXV1qz41dinNTl+L8bZfi/F2X4tycjdM/uzgA7Yr5/6F8byj0Vf4wDKRnnOwsQMx3l099nf79Lu+EFOO9N1PeWxQvm6hn4i2fbfuyEwiZeCsy5T1N8Sr1fGSGeNXGeCszTxbub3ZCIdO+0zPlfUXxshMLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADCPfnDT2R+/9MMfXReSMPmvpYkW4nPl3jVrRjqod9+6u1aW1z+1v7Gsr9JBIAAAAKBQzMN76iXV0FdZHfqS3qbtquk8QDVdLw/VlsOLwtrJZTJSmlofSJbM+LpK+rpVO7dsW7Xjhl3v27Rl7Orxq8e3fmD12avPHT3n3HNWbdy0eXy09jWEvky8MNQcL4QwNf2w44ZdnxrbvHl8+45aYbb9y9J2LEvXk/R1w+8Po5PLW9L2Ly1of2laffP3oPDgAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/Grt2GunnWfwC/7iQnyc62f/NnT1lpT0MfRtWhbT2TTsdyg+Bga0sPA0mmx1Fci8PTtWztqDOuBbfZoggbhVLpm0odbg7f7MENcQ8UKrNa8NQi29C90BfKptNu9IV2RM45uXOSNGlO42i3+vm8yJ1zXb/r+uW6Xxz43gkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcJ5N1kbHK+Wx6nAUQtSjpt5FMpfOxnFpgL5ffmHr93Mjp5a3juUyA2wEAAAA9JXk8KHmSD7kMumQDtdO/7U4tEyE2dwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD875msjY5XymPVS6MQoh419S6SuXQ2jksD9H3z3ac+89rIyF9ax4oD7AMAAAD0l+TwVHMkH4phSRiKrm2rS54NzO9Y31mX7LNwjnWdzw561S2ZY911c6z7WJ+6dY3rjgAAAAAffUn+zzRHCiGXubxn/u+X65O6RR116cZ1kN8KAAAAAP+dJP/nmiPFkMsUm3l9rnl/cUddsr7f9/bJ+mU91vf7Pn9t4+p7egAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD46JisjY5XymPVdBRC1KOm3kUyl87GcWmAvqteHP7bbYcfXtw6lssMsBEAAADQV5LDZ6N3PuQyw2EoXDqd+0duOfDMF595bjSEMBPzs9mwY8O2bfeumnlN6lYePTz0vSNvf+uMupUzrxfsgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAdmsjY6XimPVS+JQoh61NS7SObS2TguDdD3jc994U9PnHj+rdax4gD7AAAAAP0lOXw2++dDMWRDNlw9/Vdr1p+S6ljf65kBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcPG47xsPfH3DxMTGe73xxhtvmm8u9H8mAADgg7YoRKF+jq5Zf6E/NQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8GEwWRsdr5THqvkohKhHTb2LZC6djePSAH3jF47lLj/14sutY8UB9gEAAAD6S3L4bPbPh2IYCkPhqum/uj0TmM7/hfP4IQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAPlcna6HilPFa9PAoh6lFT7yKZS2fjuDRA38d37f/soXnfvbV1LJcZYCMAAACgrySHZ5sj+ZDLfDzkwoKhrguidOPa/blALixoFG5tWzY853W1tnXpOa/b3fFBM43TzKzLJ/sVZq7NdaUz15Va1hVDs32pbV3Ym2w0p/vS9V4CAADAeZLk/1xzpBBymVxLzv1xW31BzgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAepisjY5XymPVKAoh6lFT7yKZS2fjuDRA3wd+/f+XfeUne7a3jhUH2AcAAADoL8nhs9k/H4phYfi/sHD5P6dyfqG9Pqn7e+X0ocf+8eflIay4+vhIpuf+v3zj5pc6X+o7U835emPDeWHh9HOGqEe/X/32sfuX1k8/EcKKq9ILzq1fhyiuP1vZuHbbkeNbz3prAAAA4KKR5P+h5kgh5DL3TOX/6Tzemf+T5H1O+X/e/bt+dmXjtZHIO1akCo1+qR79Pr/0qT8uW/3Xt6fy/9n6fWr/5kNXtjWcGQmh/u+WXy5Ecb28efu64zccTCWnnumf7uif3JcvffOtf23a8ejpmf75kG+Mz89063/ma4dL4vpEal91zfv7au39Mz3O//BvXj7xi/l73pvq/+6i4Wb/685y/rP3H779kb037j+8rr1/CKHUrf87790arvn93Q91nn+4Y+PWO9/62iGK60cXnzy4+kDxpvb+UUf/5P7/9MTje3/06HeeS/onvxVZvmSu/VMd/V/dfcWuV3aun9/eP9Xj/C/d8drIltK3f9d5/rsGPv+T1z995+sb4gc7pwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4uk7XR8Up5rJqKQoh61NS7SObS2TguDdD3zduOvXPHnh/+oHWsOMA+AAAAQH9JDp/N/vlQDNmQDcPTuf/Zysa1244c3xoKM7NR45qZ2HLftk9s2rL9nrsu0CcHAAAA5irJ/5nmSCHkMkvDUCP/lzdvX3f8hoOpJP+nkvy/6e6JjStCs+7V3VfsemXn+vnN5wQhTP8sID9V9+nZultuPlY4+YevLetat2q27ujikwdXHyjelNSF1rqVofl84snrn77z9Q3xg83P11r3ya9umWg8nkj2Hb79kb037j+8rnmOxnW4sW9SN5HaV13z/r5aUpduXPONcwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZ5qsjY5XymPVkA4h6lFT7yKZS2fjuDRA3zVLf/7QZaeeX9g6lssMsBEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAfduBAAAAAAADI/7URqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrBfN6F1VH0cgM+5N3lzm5u0SfuCUTFNq6LUhUVBRDcqKtKKFFxVilRbuxAFQUSpC1NpxVIVN4LVTREV1CgFBRuLpVVS8au4caGCQnUhlGJAG4oLlSTn3N5MM16dVEF9HhjOPWdmfvOfOSeTewEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4B+lp2topj284/6pW8654aNH7zrxyE3v3Lvtoodf/W5k03Uf7u196eTE5hVbvrx+2ab9d68Z3/38oZ/63/rlaMfgh2abVanbCCEejyE03p185rGJj8+aHoshhHocGA1hMC49NBgLCat/DiFsbtU5d+ebJy7fMt1u29UzZ3xJIaR4X6FZz/XMGphbL/8ujbTOtk49eEn4+tr12z9d/sbr3WPHRk8dEhtt6ymExRvbz+8OISxK27S82obyyaldF0LobTvvyg51nf8H67+0pH9uav+X2maHnLx/ZaFfKxxX7Gfdhba3w/UWqqyOqsd10lfoF19GC1VWZx4fTO3bqV31J/PreYuhFkNXq/x74qk1EtrmLYY4M5eNVr/WmtuQ7r/Qj4V+rdCvdxfua+a6aaHVY5w7no8rjOfXcVcaX9H+rp7HrSXjZ6e2kf5QT+Z+KH6Y1TztQ+u+ZuS6Jn+nlr9Dre0dNN94a+LTZDTTWDMuPe2cX+eR902sf+LC+ob3Dg+U1BH3xpQfK+Vv/WSw7/bXdj4wVJa/sZbya5Xyv1l75Ifbdr7wXGn+0zm/Xin/sgO9x9e+v2Nl6fOZzM+nq1L+HUc/eHL5/+8cK61/T85vVMq/ZvxIT//UgYOl9a/Oz2dRpfyvrr7x21c+33esND/k/N5K+RvG73uqZ3jq4tL8g/n5NKutnx/HrvhiePj7kbL8z3J+f6X8l0d3X/Xikl1rSud3XX4+A5Xyb75g//a+qX3nlb07454z9Z8T4L9pWfqO9XjqV/2duVBtvxeeHema/c7Xl7b+M3mhgunrLP4L8wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA39iBAxIAAAAAQf9ftyNQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgqAAD//3faHGw=") [ 71.652452][ T4674] Bluetooth: hci0: command tx timeout [ 71.726147][ T5326] vlan0: entered promiscuous mode [ 71.855731][ T5326] loop0: detected capacity change from 0 to 32768 [ 71.880099][ T5326] bcachefs (/dev/loop0): error reading default superblock: checksum error, type none: got should be [ 71.990195][ T5326] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=ro,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names,read_only [ 71.997376][ T5326] bcachefs (loop0): recovering from clean shutdown, journal seq 10 [ 72.000499][ T5326] bcachefs (loop0): Doing compatible version upgrade from 1.7: mi_btree_bitmap to 1.25: extent_flags [ 72.000499][ T5326] running recovery passes: check_allocations,check_extents_to_backpointers,check_inodes [ 72.016888][ T5326] invalid bkey in btree_node btree=extents level=0: u64s 7 type inline_data 536870912:8:U32_MAX len 4096 ver 0: datalen 16: 73797a6b616c6c657273000000000000 [ 72.016910][ T5326] size greater than offset (4096 > 8): delete?, fixing [ 72.026381][ T5326] bcachefs (loop0): flagging btree extents lost data [ 72.029190][ T5326] bcachefs (loop0): running explicit recovery pass check_topology (2), currently at recovery_pass_empty (0) [ 72.033731][ T5326] bcachefs (loop0): running explicit recovery pass check_lrus (14), currently at recovery_pass_empty (0) [ 72.037783][ T5326] bcachefs (loop0): running explicit recovery pass check_backpointers_to_extents (16), currently at recovery_pass_empty (0) [ 72.042564][ T5326] bcachefs (loop0): running explicit recovery pass scan_for_btree_nodes (1), currently at recovery_pass_empty (0) [ 72.049722][ T5326] error reading btree root btree=extents level=0: btree_node_read_error, fixing [ 72.054483][ T5326] invalid bkey in btree_node btree=inodes level=0: u64s 16 type inode_v3 0:4096:4294967281 len 0 ver 0: (unpack error) [ 72.054497][ T5326] invalid variable length fields: delete?, fixing [ 72.061763][ T5326] invalid bkey in btree_node btree=inodes level=0: u64s 18 type inode_v3 0:4098:U32_MAX len 0 ver 0: (unpack error) [ 72.061774][ T5326] invalid variable length fields: delete?, fixing [ 72.073767][ T5326] invalid bkey in btree_node btree=alloc level=0: u64s 15 type alloc_v4 0:29:0 len 0 ver 0: [ 72.073782][ T5326] gen 0 oldest_gen 0 data_type btree [ 72.073789][ T5326] journal_seq_nonempty 936748722493063169 [ 72.073795][ T5326] journal_seq_empty 0 [ 72.073802][ T5326] need_discard 0 [ 72.073808][ T5326] need_inc_gen 0 [ 72.073813][ T5326] dirty_sectors 256 [ 72.073819][ T5326] stripe_sectors 0 [ 72.073830][ T5326] cached_sectors 0 [ 72.073833][ T5326] stripe 0 [ 72.073837][ T5326] stripe_redundancy 0 [ 72.073840][ T5326] io_time[READ] 1 [ 72.073844][ T5326] io_time[WRITE] 1 [ 72.073848][ T5326] fragmentation 0 [ 72.073851][ T5326] bp_start 8 [ 72.073855][ T5326] [ 72.073858][ T5326] invalid backpointers_start: delete?, fixing [ 72.109201][ T5326] bcachefs (loop0): error validating btree node on loop0 at btree subvolumes level 0/0 [ 72.109221][ T5326] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 5b940 written 0 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0 [ 72.109230][ T5326] node offset 0/0: got wrong btree node: got [ 72.109237][ T5326] btree=subvolumes level=0 seq c0bef60d07ceb940 1 [ 72.109244][ T5326] min: POS_MIN [ 72.109250][ T5326] max: SPOS_MAX [ 72.125454][ T5326] bcachefs (loop0): flagging btree subvolumes lost data [ 72.132676][ T5326] error reading btree root btree=subvolumes level=0: btree_node_read_error, fixing [ 72.145980][ T5326] bcachefs (loop0): scan_for_btree_nodes... [ 72.149001][ T5337] invalid bkey in btree_node btree=extents level=0: u64s 7 type inline_data 536870912:8:U32_MAX len 4096 ver 0: datalen 16: 73797a6b616c6c657273000000000000 [ 72.149022][ T5337] size greater than offset (4096 > 8): delete?, fixing [ 72.163932][ T5326] bcachefs (loop0): btree node scan found 2 nodes after overwrites [ 72.166969][ T5326] done [ 72.169047][ T5326] bcachefs (loop0): check_topology... [ 72.169801][ T5326] bcachefs (loop0): btree root extents unreadable, must recover from scan [ 72.175116][ T5326] no nodes found for btree extents, shutting down [ 72.177903][ T5326] bcachefs (loop0): inconsistency detected - emergency read only at journal seq 10 [ 72.181497][ T5326] bcachefs (loop0): bch2_fs_recovery(): error fsck_errors_not_fixed [ 72.184840][ T5326] bcachefs (loop0): bch2_fs_start(): error starting filesystem fsck_errors_not_fixed [ 72.188385][ T5326] bcachefs (loop0): shutting down [ 72.206408][ T5326] bcachefs (loop0): shutdown complete [ 72.210010][ T57] ================================================================== [ 72.213019][ T57] BUG: KASAN: slab-use-after-free in percpu_ref_put+0xda/0x250 [ 72.215812][ T57] Read of size 8 at addr ffff88801afe20b0 by task kworker/u4:4/57 [ 72.218572][ T57] [ 72.219493][ T57] CPU: 0 UID: 0 PID: 57 Comm: kworker/u4:4 Not tainted 6.14.0-syzkaller-10167-g93d52288679e #0 PREEMPT(full) [ 72.219506][ T57] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 72.219514][ T57] Workqueue: loop0 loop_workfn [ 72.219527][ T57] Call Trace: [ 72.219533][ T57] [ 72.219537][ T57] dump_stack_lvl+0x241/0x360 [ 72.219554][ T57] ? __pfx_dump_stack_lvl+0x10/0x10 [ 72.219567][ T57] ? __virt_addr_valid+0x183/0x530 [ 72.219580][ T57] ? rcu_is_watching+0x15/0xb0 [ 72.219592][ T57] ? __virt_addr_valid+0x183/0x530 [ 72.219604][ T57] ? lock_release+0x4e/0x3e0 [ 72.219614][ T57] ? __virt_addr_valid+0x183/0x530 [ 72.219626][ T57] ? __virt_addr_valid+0x183/0x530 [ 72.219638][ T57] print_report+0x16e/0x5b0 [ 72.219652][ T57] ? __virt_addr_valid+0x183/0x530 [ 72.219663][ T57] ? __virt_addr_valid+0x183/0x530 [ 72.219675][ T57] ? __virt_addr_valid+0x45f/0x530 [ 72.219687][ T57] ? __phys_addr+0xba/0x170 [ 72.219699][ T57] ? percpu_ref_put+0xda/0x250 [ 72.219709][ T57] kasan_report+0x143/0x180 [ 72.219723][ T57] ? percpu_ref_put+0xda/0x250 [ 72.219733][ T57] ? percpu_ref_put+0x1f/0x250 [ 72.219743][ T57] percpu_ref_put+0xda/0x250 [ 72.219754][ T57] blk_update_request+0x5e5/0x1160 [ 72.219770][ T57] blk_mq_end_request+0x3e/0x70 [ 72.219789][ T57] loop_process_work+0x1bdf/0x21d0 [ 72.219803][ T57] ? __pfx_loop_process_work+0x10/0x10 [ 72.219816][ T57] ? do_raw_spin_lock+0x151/0x370 [ 72.219830][ T57] ? do_raw_spin_unlock+0x58/0x8b0 [ 72.219843][ T57] ? look_up_lock_class+0x7b/0x170 [ 72.219890][ T57] ? register_lock_class+0x54/0x330 [ 72.219900][ T57] ? __lock_acquire+0xad5/0xd80 [ 72.219912][ T57] ? process_scheduled_works+0x9cb/0x18e0 [ 72.219923][ T57] process_scheduled_works+0xac3/0x18e0 [ 72.219938][ T57] ? __pfx_process_scheduled_works+0x10/0x10 [ 72.219950][ T57] ? assign_work+0x367/0x3d0 [ 72.219961][ T57] worker_thread+0x870/0xd50 [ 72.219974][ T57] ? __kthread_parkme+0x1a8/0x200 [ 72.219985][ T57] ? __pfx_worker_thread+0x10/0x10 [ 72.219996][ T57] kthread+0x7b7/0x940 [ 72.220009][ T57] ? __pfx_worker_thread+0x10/0x10 [ 72.220020][ T57] ? __pfx_kthread+0x10/0x10 [ 72.220031][ T57] ? __pfx_kthread+0x10/0x10 [ 72.220045][ T57] ? __pfx_kthread+0x10/0x10 [ 72.220057][ T57] ? __pfx_kthread+0x10/0x10 [ 72.220069][ T57] ? _raw_spin_unlock_irq+0x23/0x50 [ 72.220080][ T57] ? lockdep_hardirqs_on+0x9d/0x150 [ 72.220091][ T57] ? __pfx_kthread+0x10/0x10 [ 72.220103][ T57] ret_from_fork+0x4b/0x80 [ 72.220114][ T57] ? __pfx_kthread+0x10/0x10 [ 72.220126][ T57] ret_from_fork_asm+0x1a/0x30 [ 72.220137][ T57] [ 72.220141][ T57] [ 72.320408][ T57] Allocated by task 5326: [ 72.322071][ T57] kasan_save_track+0x3f/0x80 [ 72.323938][ T57] __kasan_kmalloc+0x9d/0xb0 [ 72.325832][ T57] __kmalloc_cache_noprof+0x236/0x370 [ 72.327894][ T57] __bch2_dev_alloc+0x57/0xa60 [ 72.329708][ T57] bch2_dev_alloc+0xd6/0x180 [ 72.331457][ T57] bch2_fs_open+0x315f/0x32a0 [ 72.333356][ T57] bch2_fs_get_tree+0x77b/0x18d0 [ 72.335238][ T57] vfs_get_tree+0x90/0x2b0 [ 72.336958][ T57] do_new_mount+0x2cf/0xb70 [ 72.338730][ T57] __se_sys_mount+0x38c/0x400 [ 72.340601][ T57] do_syscall_64+0xf3/0x230 [ 72.342272][ T57] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.344475][ T57] [ 72.345422][ T57] Freed by task 5326: [ 72.346937][ T57] kasan_save_track+0x3f/0x80 [ 72.348870][ T57] kasan_save_free_info+0x40/0x50 [ 72.350788][ T57] __kasan_slab_free+0x59/0x70 [ 72.352645][ T57] kfree+0x198/0x430 [ 72.354159][ T57] kobject_put+0x22f/0x480 [ 72.355824][ T57] bch2_fs_free+0x27b/0x3c0 [ 72.357610][ T57] deactivate_locked_super+0xc4/0x130 [ 72.359597][ T57] bch2_fs_get_tree+0xd41/0x18d0 [ 72.361539][ T57] vfs_get_tree+0x90/0x2b0 [ 72.363281][ T57] do_new_mount+0x2cf/0xb70 [ 72.365044][ T57] __se_sys_mount+0x38c/0x400 [ 72.366830][ T57] do_syscall_64+0xf3/0x230 [ 72.368584][ T57] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 72.370723][ T57] [ 72.371585][ T57] The buggy address belongs to the object at ffff88801afe2000 [ 72.371585][ T57] which belongs to the cache kmalloc-4k of size 4096 [ 72.376520][ T57] The buggy address is located 176 bytes inside of [ 72.376520][ T57] freed 4096-byte region [ffff88801afe2000, ffff88801afe3000) [ 72.381211][ T57] [ 72.382154][ T57] The buggy address belongs to the physical page: [ 72.384584][ T57] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1afe0 [ 72.387958][ T57] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 72.391154][ T57] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 72.394089][ T57] page_type: f5(slab) [ 72.395619][ T57] raw: 00fff00000000040 ffff88801b042140 0000000000000000 dead000000000001 [ 72.398972][ T57] raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 72.402249][ T57] head: 00fff00000000040 ffff88801b042140 0000000000000000 dead000000000001 [ 72.405510][ T57] head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 [ 72.409086][ T57] head: 00fff00000000003 ffffea00006bf801 ffffffffffffffff 0000000000000000 [ 72.412584][ T57] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 72.415907][ T57] page dumped because: kasan: bad access detected [ 72.418460][ T57] page_owner tracks the page as allocated [ 72.420660][ T57] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8158164403, free_ts 0 [ 72.427909][ T57] post_alloc_hook+0x1f4/0x240 [ 72.429640][ T57] get_page_from_freelist+0x3695/0x37e0 [ 72.431680][ T57] __alloc_frozen_pages_noprof+0x2c5/0x7b0 [ 72.433863][ T57] alloc_pages_mpol+0x339/0x690 [ 72.435633][ T57] allocate_slab+0x8f/0x3a0 [ 72.437343][ T57] ___slab_alloc+0xc3b/0x1500 [ 72.439107][ T57] __slab_alloc+0x58/0xa0 [ 72.440739][ T57] __kmalloc_cache_noprof+0x26a/0x370 [ 72.442787][ T57] kobject_uevent_env+0x28b/0x8e0 [ 72.444781][ T57] driver_register+0x2d6/0x320 [ 72.446619][ T57] acpi_ac_init+0x7a/0xb0 [ 72.448341][ T57] do_one_initcall+0x24a/0x940 [ 72.450198][ T57] do_initcall_level+0x157/0x210 [ 72.452024][ T57] do_initcalls+0x71/0xd0 [ 72.453676][ T57] kernel_init_freeable+0x432/0x5d0 [ 72.455675][ T57] kernel_init+0x1d/0x2b0 [ 72.457253][ T57] page_owner free stack trace missing [ 72.459260][ T57] [ 72.460190][ T57] Memory state around the buggy address: [ 72.462315][ T57] ffff88801afe1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 72.465363][ T57] ffff88801afe2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.468445][ T57] >ffff88801afe2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.471210][ T57] ^ [ 72.473177][ T57] ffff88801afe2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.475930][ T57] ffff88801afe2180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.478912][ T57] ================================================================== [ 72.491809][ T57] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 72.494647][ T57] CPU: 0 UID: 0 PID: 57 Comm: kworker/u4:4 Not tainted 6.14.0-syzkaller-10167-g93d52288679e #0 PREEMPT(full) [ 72.498931][ T57] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 72.502801][ T57] Workqueue: loop0 loop_workfn [ 72.504687][ T57] Call Trace: [ 72.506000][ T57] [ 72.507135][ T57] dump_stack_lvl+0x241/0x360 [ 72.509061][ T57] ? __pfx_dump_stack_lvl+0x10/0x10 [ 72.511133][ T57] ? __pfx__printk+0x10/0x10 [ 72.512938][ T57] ? vscnprintf+0x5d/0x90 [ 72.514594][ T57] panic+0x349/0x880 [ 72.516156][ T57] ? check_panic_on_warn+0x21/0xb0 [ 72.518203][ T57] ? __pfx_panic+0x10/0x10 [ 72.519968][ T57] ? _raw_spin_unlock_irqrestore+0x134/0x140 [ 72.522365][ T57] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 72.524805][ T57] ? print_report+0x519/0x5b0 [ 72.526689][ T57] check_panic_on_warn+0x86/0xb0 [ 72.528728][ T57] ? percpu_ref_put+0xda/0x250 [ 72.530637][ T57] end_report+0x77/0x160 [ 72.532296][ T57] kasan_report+0x154/0x180 [ 72.534154][ T57] ? percpu_ref_put+0xda/0x250 [ 72.536071][ T57] ? percpu_ref_put+0x1f/0x250 [ 72.537956][ T57] percpu_ref_put+0xda/0x250 [ 72.539798][ T57] blk_update_request+0x5e5/0x1160 [ 72.541891][ T57] blk_mq_end_request+0x3e/0x70 [ 72.543772][ T57] loop_process_work+0x1bdf/0x21d0 [ 72.545813][ T57] ? __pfx_loop_process_work+0x10/0x10 [ 72.548050][ T57] ? do_raw_spin_lock+0x151/0x370 [ 72.550092][ T57] ? do_raw_spin_unlock+0x58/0x8b0 [ 72.552156][ T57] ? look_up_lock_class+0x7b/0x170 [ 72.554271][ T57] ? register_lock_class+0x54/0x330 [ 72.556446][ T57] ? __lock_acquire+0xad5/0xd80 [ 72.558376][ T57] ? process_scheduled_works+0x9cb/0x18e0 [ 72.560666][ T57] process_scheduled_works+0xac3/0x18e0 [ 72.562860][ T57] ? __pfx_process_scheduled_works+0x10/0x10 [ 72.565165][ T57] ? assign_work+0x367/0x3d0 [ 72.566834][ T57] worker_thread+0x870/0xd50 [ 72.568672][ T57] ? __kthread_parkme+0x1a8/0x200 [ 72.570644][ T57] ? __pfx_worker_thread+0x10/0x10 [ 72.572642][ T57] kthread+0x7b7/0x940 [ 72.574201][ T57] ? __pfx_worker_thread+0x10/0x10 [ 72.576017][ T57] ? __pfx_kthread+0x10/0x10 [ 72.577754][ T57] ? __pfx_kthread+0x10/0x10 [ 72.579466][ T57] ? __pfx_kthread+0x10/0x10 [ 72.581226][ T57] ? __pfx_kthread+0x10/0x10 [ 72.582967][ T57] ? _raw_spin_unlock_irq+0x23/0x50 [ 72.585086][ T57] ? lockdep_hardirqs_on+0x9d/0x150 [ 72.587173][ T57] ? __pfx_kthread+0x10/0x10 [ 72.589134][ T57] ret_from_fork+0x4b/0x80 [ 72.590994][ T57] ? __pfx_kthread+0x10/0x10 [ 72.592972][ T57] ret_from_fork_asm+0x1a/0x30 [ 72.594940][ T57] [ 72.596481][ T57] Kernel Offset: disabled [ 72.598133][ T57] Rebooting in 86400 seconds..