program:
r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi1\x00', 0x2180, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'pcl812\x00', [0x2f00, 0xfffffffe, 0xd09a, 0x4002, 0xa9, 0xfffffffb, 0xffffffff, 0x80002f, 0x7, 0x4, 0xc, 0x1, 0x4, 0x4, 0xfffffff7, 0x5, 0xffdfffa7, 0x40000009, 0x830, 0x30000, 0x3ff, 0x9, 0x800, 0xe2df, 0x2, 0x1, 0x9, 0x3, 0x4, 0x5, 0x40070f]})
[ 86.319956][ T5324] Bluetooth: hci0: command tx timeout
[ 86.402021][ T5348] ------------[ cut here ]------------
[ 86.404457][ T5348] UBSAN: shift-out-of-bounds in drivers/comedi/drivers/pcl812.c:1152:10
[ 86.407882][ T5348] shift exponent -2 is negative
[ 86.441306][ T5348] CPU: 0 UID: 0 PID: 5348 Comm: syz.0.0 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full)
[ 86.441326][ T5348] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 86.441334][ T5348] Call Trace:
[ 86.441340][ T5348]
[ 86.441345][ T5348] dump_stack_lvl+0x189/0x250
[ 86.441447][ T5348] ? __pfx_dump_stack_lvl+0x10/0x10
[ 86.441461][ T5348] ? __pfx__printk+0x10/0x10
[ 86.441485][ T5348] ubsan_epilogue+0xa/0x40
[ 86.441503][ T5348] __ubsan_handle_shift_out_of_bounds+0x386/0x410
[ 86.441562][ T5348] pcl812_attach+0x1b9e/0x2300
[ 86.441626][ T5348] comedi_device_attach+0x520/0x670
[ 86.441644][ T5348] comedi_unlocked_ioctl+0x686/0xf40
[ 86.441678][ T5348] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 86.441714][ T5348] ? __lock_acquire+0xab9/0xd20
[ 86.441740][ T5348] ? __fget_files+0x2a/0x420
[ 86.441757][ T5348] ? __fget_files+0x2a/0x420
[ 86.441771][ T5348] ? __fget_files+0x3a0/0x420
[ 86.441787][ T5348] ? __fget_files+0x2a/0x420
[ 86.441803][ T5348] ? bpf_lsm_file_ioctl+0x9/0x20
[ 86.441815][ T5348] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 86.441830][ T5348] __se_sys_ioctl+0xfc/0x170
[ 86.441844][ T5348] do_syscall_64+0xfa/0x3b0
[ 86.441885][ T5348] ? lockdep_hardirqs_on+0x9c/0x150
[ 86.441904][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.441915][ T5348] ? clear_bhb_loop+0x60/0xb0
[ 86.441932][ T5348] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.441943][ T5348] RIP: 0033:0x7fc2a378e929
[ 86.441955][ T5348] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 86.441965][ T5348] RSP: 002b:00007fc2a4605038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 86.441978][ T5348] RAX: ffffffffffffffda RBX: 00007fc2a39b5fa0 RCX: 00007fc2a378e929
[ 86.441987][ T5348] RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003
[ 86.441995][ T5348] RBP: 00007fc2a3810ca1 R08: 0000000000000000 R09: 0000000000000000
[ 86.442002][ T5348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.442009][ T5348] R13: 0000000000000000 R14: 00007fc2a39b5fa0 R15: 00007ffd1f29e078
[ 86.442029][ T5348]
[ 86.442033][ T5348] ---[ end trace ]---
[ 86.576741][ T9] cfg80211: failed to load regulatory.db
[ 86.586221][ T5348] Kernel panic - not syncing: UBSAN: panic_on_warn set ...
[ 86.589493][ T5348] CPU: 0 UID: 0 PID: 5348 Comm: syz.0.0 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(full)
[ 86.594559][ T5348] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[ 86.599044][ T5348] Call Trace:
[ 86.600573][ T5348]
[ 86.601938][ T5348] dump_stack_lvl+0x99/0x250
[ 86.604052][ T5348] ? __asan_memcpy+0x40/0x70
[ 86.605989][ T5348] ? __pfx_dump_stack_lvl+0x10/0x10
[ 86.608310][ T5348] ? __pfx__printk+0x10/0x10
[ 86.610392][ T5348] panic+0x2db/0x790
[ 86.612242][ T5348] ? __pfx_panic+0x10/0x10
[ 86.614345][ T5348] ? _printk+0xcf/0x120
[ 86.616128][ T5348] ? __pfx__printk+0x10/0x10
[ 86.618121][ T5348] check_panic_on_warn+0x89/0xb0
[ 86.620243][ T5348] __ubsan_handle_shift_out_of_bounds+0x386/0x410
[ 86.623078][ T5348] pcl812_attach+0x1b9e/0x2300
[ 86.625274][ T5348] comedi_device_attach+0x520/0x670
[ 86.627665][ T5348] comedi_unlocked_ioctl+0x686/0xf40
[ 86.629918][ T5348] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 86.632336][ T5348] ? __lock_acquire+0xab9/0xd20
[ 86.634508][ T5348] ? __fget_files+0x2a/0x420
[ 86.636481][ T5348] ? __fget_files+0x2a/0x420
[ 86.638255][ T5348] ? __fget_files+0x3a0/0x420
[ 86.639995][ T5348] ? __fget_files+0x2a/0x420
[ 86.641858][ T5348] ? bpf_lsm_file_ioctl+0x9/0x20
[ 86.644015][ T5348] ? __pfx_comedi_unlocked_ioctl+0x10/0x10
[ 86.647051][ T5348] __se_sys_ioctl+0xfc/0x170
[ 86.648977][ T5348] do_syscall_64+0xfa/0x3b0
[ 86.650817][ T5348] ? lockdep_hardirqs_on+0x9c/0x150
[ 86.653088][ T5348] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.655672][ T5348] ? clear_bhb_loop+0x60/0xb0
[ 86.657662][ T5348] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.660134][ T5348] RIP: 0033:0x7fc2a378e929
[ 86.661914][ T5348] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[ 86.669542][ T5348] RSP: 002b:00007fc2a4605038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 86.673144][ T5348] RAX: ffffffffffffffda RBX: 00007fc2a39b5fa0 RCX: 00007fc2a378e929
[ 86.676361][ T5348] RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003
[ 86.680005][ T5348] RBP: 00007fc2a3810ca1 R08: 0000000000000000 R09: 0000000000000000
[ 86.682808][ T5348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.685960][ T5348] R13: 0000000000000000 R14: 00007fc2a39b5fa0 R15: 00007ffd1f29e078
[ 86.689267][ T5348]
[ 86.691001][ T5348] Kernel Offset: disabled
[ 86.692875][ T5348] Rebooting in 86400 seconds..