program: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x800}, 0xe) sendmmsg(r0, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000600)="5c0658", 0x3}], 0x1}}], 0x2, 0x0) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_disconn_complete={{0x5, 0x4}, {0x0, 0xc8, 0x9}}}, 0x7) syz_mount_image$bcachefs(&(0x7f0000000180), &(0x7f0000000540)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x800000, &(0x7f00000001c0)=ANY=[@ANYBLOB="6e6f6578636c2c646973636172642c6e6f7265636f766572792c6673636b2c7265636f76658ce1e8553c61b059f309b30e72795f706173735f6c6173743d7265636f6e7374727563745f736e617073686f74732c6e6f7265636f766572792c6669785f6572726f72733d61736b2c6a6f75726e616c5f7472616e73616374696f6e5f6e616d65732c73686172645f696e6f64655f00006d626572732c6669785f737c4d0dc2d383bb4d2d68cd733c44c6ec73f92d88accde62a054be07694aee6d16c116c55e520db0a1941cbdd5eceea"], 0x1, 0x59d0, &(0x7f000000ba00)="$eJzs3X2QHOV5IPC3Z2a1X1ppJSDIYFaLgIRAbK34OmynYiUX2ykglChSDuKwYUErIlsSKkkEECSIHPig+CicsivByR/EhanDVnxUwdnIlDGYE5yNTXH2UVeYsrnD/sNXmENlQEfZPu/VzPQ7u9M7vT07Oysk+P1K2p7u6Xnep7vf6ennndmdAAAAwLvCU7fsOHD+MR/57t9NvHnjn31jy01hsFxb3hdXGE6n175dGXIw9VZW1KbZfvF713/5Z6NX/Ml3Hhz40lv7Nhy/8Ud/esQVj37qnL33/NMTbww9/NuXi+LG/nTK1HzyahJC3zf3f/4z+545urqs2vPKyfDuEJYly59YlmRCjP0qhLChkWfznQ+9efrG6vSm23ubli/NBNHf392qx7nasXYduObU8JM/Xn/z91d+9V979ryye2qVpG9afwphyWXTH98TQuhP/1fF3rYiPjidrgshDE173NkFeZ3QZv6rc+aPTaeL0ulgQZx4/6rMfCmzXnY+6slMBwram6+8PDpdr8jizHz2ZDRfeXnG5cvS6dfT6SlzjF9unE9DKQmVRvqbk6k+EqYdtyQktWPZ15gvNY5tSLc/M59k5kuZ+XJPZrtq7aYdrZwkzcvjepnl8XRcSZcfP/1c3cKFOcvfk0770ifqW3E+ZG/UDc640diumpjX/llyORhK085BrZY3Dnx6MAbT+waT5TMeM9lCvG/f+jv6Z8sjeTBJ4ye1Nucaf9f3li3+5Fduu3pFXvzLSmn8X092Ev+lc5997eLbvviF3Ph3x/jljvI/7bGBV8998pZVrY5FLf7+uH8qHcUff/npO1ceefme3PzvjfH7Ooq/du+zvUMHHns8J3xIxuL+6e8o/osf+uhPH3j+kVeGcx7zn0KMP9BR/Ev2brurd+TAydn4jfwfj/tnsKP4L72+56wXRkZ+PpoX/7kYf6ij+PfvvueD9y29/Zzc47su7p/hjuKfd+KjNy8+8MhxeefO5N5uvXICvDsdkV5j3ZrOd1pnzte0euEfRyv168DF6f+hbjaUueCptrOkemMy70oIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAObuqFP/68f+18eHX62k873pjRdL9WlcviiEpD+EsGPn+Padm7ZeOfqpq67evnV88+j4ztGJrTu3Xzd6xh+Mbp/Ytnn8uuq9Y+87PYTQE8LykNQevzw5bkbbvZOTk6Xh5mWxvX974p6fnHT2//5FCGNH/XCkkpv/6nu23Hdki58ZydrJD2+5+vwfnvkv6XYNp3kNt8hrcnJyMuTk9X8u+s19f7//ZyeHMPY7s+X19It/9K2mhGoLpuKkSr2hnlBvMtAyj0bWaT5xf1U2bto8MTb7/q0+vpyzHf/u+ld+tfHaz/6mvn/7crejzf3bv3Zyc+kf1p/3//7hhvqCorzeruNetL/jVsT84v7rS/f3knS7luRsVyVnu275/uPPf/OY297YHcYqr6+c2XbRdvWkHaAneU9b7cYWBpJlTcv70vXjEY+PW71zy7bVO67b9b5NW8avnLhyYusH1pyx5qyxM886c3Vty1d3eftj+7/b5vYfnP609K93fz3+bK8/FeVVtD+qeRXvj+kZ5T3/Bi78zOc+cM+T59cXFPXzuHbp15P1vNI8B6rHeU2Y1t9m7qtW21W0H0IIo632w2tvnBOO/h+bbi46D00/MtN/ZiRrJ59Z9ct/OfufV/xhfcFBOc9PT6jD83wj66l8avurLz0ek4fo/u0N5XS7BlvmteaZJ3vueOoXf9PIb9GicO34zp3b19R/Lk4zXZwc2zKv7NK4XStrP8sh3S2h0U1b9NdQuxSp55c9f8bVs3t1ML1vMFne2JzeaduVFVfat/6Ok8qXfPupvD2dPFhvsT8M1afJe3PW3Jx5YLmRcKv2D9XnX1H/GPnYPz/88Ye/dsaM/nFa/WfRdiU52/XV5+//3Jc++x++1r3t+tgfPTv8yx//1Un1BYfLeaWRdZpPMv28cloIU8+/1vtoZWi9HbnPv1Lr7Sl6/mXbmVq/dbzRzPxgKGefrw2zPV9Pe2zg1XOfvGVV7vN1f7vP1xua5soFz9dDpf9kn19JpTmPhXt+NXWUZO3kd249YvcTN647pr6gqF831m7Vr09vo/7I2a5vXfzCyFWj//6/d++88eU/eOjSH42v/dv6gs6Pe8ylO8e9L92/fTn7t5F1rDun79/3X3HV5g315Yfu9W86Lah/4qlkx3W7Pj2+efPE9h3tbVe7r6exnexe7vT1NJ7dlhdsV2nGdi3cjen7qzzP51vMf0PH+6v5+TYYko5eF3Z9b9niT37ltquHZzwqbeiyUhq/1FH8l8599rWLb/viF3Lj3x3jVzqKP/7y03euPPLyPbnx703S+H0dxV+799neoQOPPZ4bfyzm399R/Bc/9NGfPvD8I6/kxg8x/mBn+//1PWe9MDLy89z4zyVpO9VrpBAeevP0jfX5JPSkz7eYR09TXiE7n2TmS5n58vT5Un2stdFAOUmal8f10uXHT8ullb/MWR6vwvpW1KdvxfmQvTH78kNNadq5v9XyoutUAIB3uvj+f7wGje//T6QXSvkjDTBlvnXYipy4sQ6bGs9Z1HT/ijR+fHwcBxx5fxirTm8arV/oz/V9hPh8yI5zxnZOPqE5RqfjnEXvf63KzMe86uPllWl1aGpmXVMJbYy/z2xn9vH3zOYXj4+P3jojrdHGuFV5ej6j9fYHau8ctfq8QybfSjVCXv/IjovFz3OMLAnrau212T+yn6OJxyH7OZrYzjGZE2enn6OZb/+Iac/SP2opF7+/MfP4hVn2b0864pnXf7LHb2r9wuPdV12/xfuzDbOdb9p9f7YL44YtT2kHb9xwYd8PMy6ZEz99gh3q44ZxedyOSpvjiR/PWd6t8cR4uoh57Z8ll4PBeCLwThXr//gaUa3/qxfg/zezXtF1aPaqMcbL/ZxQuXU+RXXHzM/pDXT0On7J3m139Y4cODn3Oufxdj/3s61pbqDgcz9F+/GkzHzhfswZoCmq97LtFO337OcyBsNQR/v9/t33fPC+pbefk7vf19VfSIv3++ea5oYK9vthUC+0jq9eeFfUCws9fva21SPpB58Wqh75i5zlc61HBmbcaGxXzWFXj/Qc3LwAgMNHrP8b75+l9f//jCuk1xFFdespmfkYL7duzbk+yatb/zydXptZfzD9jYq5Xjefd+KjNy8+8MhxuXXLve3Wof+xaW64sA7Nq5v7Z6zf36Juzq0j1nXn8+K5dUSjzppfnZibf6NOnF+dnhu/VqcnrevocnH8WEfn7p9GHT2/cYDc+I1xgMO9zi0Yr8s0FmfbHa97x9bR6a/PVuvoH1/Q/Tr6wpzlc62jB2fcaGxXjToaAODtFev/eBkX6/8nM+vN93323LqgS9ft2b8H0oj/3MGoKxe47vs383//t7huXei6fqHHJQ73unh+n6coHhda2HGyQ6EuDgvw/nLbdXHaaHNdPJWJuhgAgENBrP/70/n8+n9+9Umr+q2nqT45jOvzLnw+W33eLP56yKFTnx/u41+HdP3/kXC41/9xPmRv1HVe/x/cv8Ci/gcAeGeL9X/8tcf49//+Szqf/bv16vSc+O/SOj3ep07vVp3e/XG24HMAb+84QP/U+j4HAADA26GnVinN/D37T6TT7O/Z5/1e/sU567erkl4eX75z+8TEpVdv2zC+c+LSrVdtmNhx6TXbN+3cObG1vt5868bcuiWtG3tCJd0frdfL1m1L0/fllub8PYTs+jHssbUbM/8eQrbZ/oK/IzB1/NrLN+/4lWZZv1X/yDveefH/Mmf9qHH8r/ir0y7duOPSTVs37dw0vnnTronm9apV68Acvjcz7pY5fV/q0y/urnaZ2q3at2ZmlOb+/Z0d5tH0Y8YfFy5V93eSe/yreSSZPJalmSzL+/6DnLy/+9/+/q9PnPzNAyGMHVV+71zzbg65dvI/XzTx5zuf+uG2av6lWfNvrJnmVfR9pdn14/ZUNl+1Y+epG6+6emv2GyU7E8czSo35BRrPSJ/+5TbHJy7JWT7XzymUZ9w4NLU9PgEAQJP4/n+8no3vH342vYCKy9uv0+f3/nFunT7WXp2e/V6yojo9u37c3nbr9L551unZ9ovq9Fbrt6rT8+ruvPh/kbP+XLXfT+b3OY/cfnJZe/0k+30GRf0ku/5c+0kyz36Sbb+on7Rav1U/yTvuefEvyFk/T/v9YX6fy8ntD3e31x9+PzNf1B+y68+1P5Tm2R+y7Rf1h1brt+oP2ePbWxD//Mz6c9XcP6odo9YvJi695qrtn5623kJ//8X881vY7//oVPv5L+znvhY+/4X9XNnC5z+/z5Xl5v/c/EbC2s9/Yb/fpVMHbbw2/bBZ0efPisZx1+csn+s47qIZNw5NxnHh7RPr//h2T6z/b0+n3X4b6PD/njTfY9Yyfpe+x6zoOsbr+SyNHQK8ngMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC0p7eyojZ96pYdB84/5iPf/buJN2/8s29suen3rv/yz0av+JPvPDjwpbf2bTh+44/+9IgrHv3UOXvv+acn3hh6+LcvFwYerv2snJLO9oWQvJqE0PfN/Z//zL5njq4uS0II5WR4dwjLkuVPLEsyEcZ+FULY0Miz+c6H3jx9Y3V60+29TcuXZoJktysMlmM+0/MM4drCLeIw1Jf2s10Hrjk1/OSP19/8/ZVf/deePa/snlol6QvhrsnJyY312SWXTX98TwihP/1fFXvbivjgdLouhDAw7XFnF+R1Qpv5r86ZPzadLkqngwVx4v2rMvOlzHrZ+agnMx0oaG++8vLodL0iizPz2ZPRfOXlGZcvS6dfT6enzDF+Of5PQikJlUb6m5OpPhJCpXHckpDUjmVfY77UOLYh3f7MfJKZL2Xmyz2Z7aq1m3a0cpI0L4/rZZbH03ElXX789HN1CxfmLH9POu1Ln6hvxfmQvVE3OONGY7tqYl77Z8nlYChNOwe1Wt448OnBGEyXDSbLZzxmsoV43771d5xUvuTbTw3n5JE8mKTxk47i7/ressWf/MptV6/Ii39ZKY1f6ij+S+c++9rFt33xC7nx747xyx3FP+2xgVfPffKWVbn7Z3/cP5WO4o+//PSdK4+8fE9u/vfG+H0dxV+799neoQOPPZ6b/1jcP/0dxX/xQx/96QPPP/JKbvwQ4w90FP+Svdvu6h05cHJu/Mfj/hnsrP+8vuesF0ZGfj6aF/+5GH+o7fif75+Kf//uez5439Lbz8k9vuvi/hnuKP/zTnz05sUHHjku79yZ3NutV06Ad6cj0musW9P5gjqzMW6RrTPna1q98I+jlfo13+L0/1A3G8qotrNkAeMDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDO9IMbzvjERR++YH0lCSHJWWeyhXhfedHataMdtDv+8tN3rjzy8j3Tl63oIA4AAABQLNbhpcaSvrAiXJP0h2Nbrh/HCI6Nc0nz8uwYQoyTHSPoNE6pS3HKXYpT6VKcni7FWdSlOL1ditMXmnd2Nk5faC9O/yz5VKq9os18BlrHSQ9j+3EGZ8lnLnEWdynOUJfiLOlSnKVdijM8a5z2++GyLsVZ3qU4R3QpzpFdinNUl+L8TpfiHN2lONkx5bn2w6F0zWPy4tRulAvjVJJy445W4+lHp+0cN892BgvaGSp6PW6znf422zkh87jSHNvpa7Od351nO0mb7fz+PNspFbQT++212fxiO3Euv52mS5vrOo9TE/PZ1aU413cpzg1divM3XYrzt12Kc+M84wC0K9b/U/XecOit/GEYSM842VGAWO+urP2c+XqXd0KK8d6bWb6oKF62UM/EWznX/LIDCJl4qzLLe5riVRr1yCzx+qbHOylzZ+H2ZgcUMvmdklneWxQvO7AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvoBzec8YmLPnzB+pCE6r+WJluI95UXrV072kG7+9bfcVL5km8/NX1Zb6WDQAAAAEChWIf3NJb0hd7KmtCbLGpary8dB+hL58vD9enIkrCuOk1GS7X5gWTZrI+rpI9bvXPLttU7rtv1vk1bxq+cuHJi6wfWnLHmrLEzzzpz9cZNmyfG6j9D6G0Vb+nU/NoQasMPO67b9enxzZsntu+oL8/mvyLNY0U6n6SPG3l/GKtOb0rzX16Qf2lGewt3o/joAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPx/du0uRK6zfAD4e2ZmZ6bb5p/9k35MQ7MZ8lGiFk3iVlIt3QOChTYJWQoyU11LtAkWN01okxLr2AZsa4IitARCJBdGYrG1eNMPW8R+EIjUasCNQdqivdALpdVKWnKhKSPZmTNfmcmsk9B89Pe7OOfM8z7v+5z3LCw8ZwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPlzTlbHJ0vhEeTgKIeqRU+0iGUtn47g4QN0vv7DlB7nR48taY/MGWAcAAADoL+nDhxqRfMhl0iEdrp75tCi0DIRm3w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHz0TFfGJkvjE+VLoxCiHjnVLpKxdDaOiwPUfeu9pz7z+ujo31pjhQHWAQAAAPpL+vBUI5IPhbA4DEVXt+Ul7wbmd8zvzEvWWTDLvM53B73yFs8y79pZ5n2sT97a+nl7AAAAgAtf0v9nGpGRkMvM6dn/9+vrk7yFHXnp+nmQ3woAAAAAZybp/3ONSCHkMoVGvz7bfn9RR14yv9/39sn8pc3QJa3j/b7PX1M/+54eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4c05WxydL4RDkdhRD1yKlWq6nmZU0yls7GcXGAuitfHP7HrQcfXtQay2UGWAgAAADoK+nDm613PuQyw2EoXDrT7I/evO+ZLz7z3FgIodbmZ7Nh+/qtW+9ZWTsmeSteOzj0/UPvfPuUvBW14znbIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcNZMV8YmS+MT5UuiEKIeOdUukrF0No6LA9R983Nf+MsTR59/uzVWGGAdAAAAoL+kD2/2/vlQCNmQDVfOfGrt9U9Kdczv9c4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuHjc+837v7F+amrDPS7O0kXGU/2oX+RDCOfBbZzZxbn+zwQAAJxtC0MUqv+jq9ad67sGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADOB9OVscnS+EQ5H4UQ9cipdpGMpbNxXBygbvzC4dyc4y++3BorDLAOAAAA0F/Shzd7/3wohKEwFK6Y+dTtncBM/z/yId4kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcF6ZroxNlsYnynOiEKIeOdUukrF0No6LPVfP9xx5fMfezx6Y+71bWmO5zEBbAAAAAPpI+vBsI5IPuczHQy5cU/881T4hStfP3d8LNOdtaZs2POt5lbZ56VnP21k7fTWZmanvpjYveRORHqmdG/OKOzueSCYUW+YVQqN8sW1e2N02a06f+wwAAABwDiX9f64RGQm5TK6lz/1pW/6IPhcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6GG6MjZZGp8oR1EIUY+cahfJWDobx8UB6t7/2/+/7Cs/27WtNVYYYB0AAACgv6QPb/b++VAIC8L/hQUzfX8Yac9P8v5ZOnHgsX/9dVkIy688MprpXPZHycWv37zppc5DCKn27FQIc+v1oh71fvP7x+5bUj3xRAjLr0hfc0q9cPp67UvG1WdLG9ZsPXRkS5+HAwAAABeJpP8fakRGQi5zd8/+P+m8+/T/DTMN+Nz7dvzi8vqx3pF3zEiN1OuletT7/JKn/rx01d/fOdn/n67ep/ZuOnB5W8FapEMUV8c3bVt75Pr9qWTXtfrpjvrJc/nSt97+98btj56o1c+HfD0+P9Ot/qnHDpfE1anUnvLqD/ZU2utneuz/4d+9fPRX83e9f7L+ewuHG/WvPc3+T19/+LZHdt+w9+Da9vohhGK3+u++f0u46o93PdS5/+GOhVuffOuxQxT/p7ro2P5V+wo3ttePOuonz//nRx/f/ZNHv/tcUj/5rciyxbOtn2qvX31157wdrzy4bn57/VSP/b90++ujm4vf+UPn/u9sWzXT8y5O2X/1yeuevuON9fEDnUMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXl+nK2GRpfKKcikKIeuRUu0jG0tk4Lg5Q961bD797+64f/7A1VhhgHQAAAKC/pA9v9v75UAjZkA3DM33/s6UNa7YeOrIljNRGo/o5M7X53q2f2Lh52913nqM7BwAAAGYr6f8zjchIyGWWhKF6/z++advaI9fvTyX9fyrp/zfeNbVheWjkvbpz3o5XHlw3v/GeIISZnwXkT+Z9upl3802HR4796etLu+atbOa9tujY/lX7CjcmeaE1b0VovJ948rqn73hjffxA4/5a8z75tc1T9dcTybrDtz2y+4a9B9c29lE/D9fXTfKmUnvKqz/YU0ny0vVzvr7v7obO9M8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABe06crYZGl8ohzSIUQ9cqpdJGPpbBwXB6i7eskvH7rs+PMLWmO5zAALAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP9lBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCvv1FyJVFccB/JyZ3Xbc2dVdDdqK1tWKwh6Sgoh6qagIjRB6MiQszYcoCCIKe2gNjcSKXoKsF4kKqi2Egtwk0WKN/kkvPVRQYD0EIi2Um/TQxs6cO85e5zZ1taD8fGA4+ztz7/f+7r1n7uwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwH9KX89IYzy47cGZ28676ZPH7zn22C3v3b/lkkdf/2Fsww0f7+5/5fjUxmWbvr5xyYa9966a3PnigV8G3/n9cNfgR5rDilTWQohHYwi196efe2Lq03Pm5mIIoRqHxkMYjosPDMdcwsrfQggbW33Of/PtY1dumhu37OibN78oF5I/r1CvZv00Dc3vl/+XWlpnm2cevix8e/3arZ8vfevN3okj4yc2ibW29RTCwvXt+/eGEBak15xstY1kO6dxTQihv22/q7v0deFf7P/ygvr8NJ6VxnqXnOz95bm6ktsuX2d6c2PzXH+dnZ3tcuCSivoou103A7k6/zA6VUV9ZvPDaXw3jSv+Zn41e8VQiaGn1f598cQaCW1rNIbYuJe1Vl1p3duQzj9Xx1xdydXV3tx5NY6bFlo1xvnz2Xa5+exx3JPml7U/qzu4vWD+3DTW0gf1eFaH/B9N9ZP+aJ1XQ9bX9J/08m+otD2DOs23bny6GfU0V4+LT9pntoPsvam1T11cXffBwaGCPuLumPJjqfzNnw0P3PnG9odGivLXV1J+pVT+d6sP/XTH9pdeKMx/Nsuvlsq/Yl//0dUfblteeH2ms+vTUyr/rsMfPb307LsnOt3rRv6uLL9WKv+6yUN9gzP79hf2vzK7PgtK5X9z7c3fv/blniOF+SHL7y+Vv27ygWf6RmcuLczf3/wo1BsrtMT6+Xniqq9GR38cK8r/Irv+gx3yY9f8V8d3XvPyoh2rCtfnmuz6DJXq/9aL9m4dmNlzQdGzM+46Xd+cAGemJel/rCdTXfZ35qlq+73w/FhP8xtoIL0GT+eBcuaOs/AfzAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+YAcOSAAAAAAE/X/djkABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCpAAAA//+ioSi3") r1 = openat$drirender128(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(r3, r2, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r1, 0xc01064c2, &(0x7f00000002c0)={0x0, 0x0, r4}) r5 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r5, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000038c0), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000001440)={'\x00', 0x2}) ioctl$TUNSETLINK(r6, 0x400454cd, 0x301) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r5, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r5, 0xc03864bc, &(0x7f0000000540)={0x0, 0x1, &(0x7f0000000440)=[r7], &(0x7f0000000580)=[0xd], &(0x7f0000000580), 0x0}) r8 = syz_open_dev$dri(&(0x7f0000000000), 0x2, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r8, 0xc04064a0, &(0x7f0000000300)={0x0, &(0x7f0000000240)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r8, 0xc06864a1, &(0x7f0000000140)={0x0, 0x0, r9, 0x0}) ioctl$DRM_IOCTL_MODE_DIRTYFB(r8, 0xc01864b1, &(0x7f0000000080)={r10, 0x2, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000080)={&(0x7f0000000040)=[r7, r10], 0x2, 0x80000}) [ 75.227934][ T5318] syz.0.0 (5318) used greatest stack depth: 19416 bytes left [ 75.003605][ T4667] Bluetooth: hci0: command tx timeout [ 75.428145][ T5318] loop0: detected capacity change from 0 to 32768 [ 75.666458][ T5318] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,compression=lz4,fsck,fix_errors=ask,norecovery,noexcl [ 75.666476][ T5318] allowing incompatible features above 0.0: (unknown version) [ 75.666483][ T5318] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 75.687236][ T5318] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0 [ 75.693408][ T5318] bcachefs (loop0): invalid bkey in superblock btree=snapshots level=1: u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ebb8d5a9e3463bdb written 16 min_key U64_MAX:0:0 durability: 0 ptr: 0:32:10 gen 0 cached unwritten [ 75.693451][ T5318] pointer spans multiple buckets (10 + 256 > 256), deleting [ 75.708209][ T5318] bcachefs (loop0): recovering from clean shutdown, journal seq 10 [ 75.712041][ T5318] bcachefs (loop0): Doing compatible version upgrade from 1.7: mi_btree_bitmap to 1.28: inode_has_case_insensitive [ 75.712041][ T5318] running recovery passes: check_allocations,check_extents_to_backpointers,check_inodes [ 75.724452][ T5318] bcachefs (loop0): invalid btree id 251 (max 63), fix? [ 75.797263][ T5318] bcachefs (loop0): bcachefs (loop0): error validating btree node at btree xattrs level 0/0 [ 75.797290][ T5318] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 2285c34bed0abe32 written 7 min_key POS_MIN durability: 1 ptr: 0:31:0 gen 0 [ 75.797301][ T5318] loop0 node offset 0/7 bset u64s 0: bset past end of btree node (offset 0 len 8 but written 7), fix? [ 75.814754][ T5318] bcachefs (loop0): bcachefs (loop0): error validating btree node at btree xattrs level 0/0 [ 75.814768][ T5318] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 2285c34bed0abe32 written 7 min_key POS_MIN durability: 1 ptr: 0:31:0 gen 0 [ 75.814778][ T5318] loop0 node offset 0/7 bset u64s 0: bset past end of btree node (offset 0 len 8 but written 7), fix? [ 75.814785][ T5318] Unable to continue, halting [ 75.839143][ T5318] bcachefs (loop0): btree node read error at btree xattrs level 0/0 [ 75.839186][ T5318] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 2285c34bed0abe32 written 7 min_key POS_MIN durability: 1 ptr: 0:31:0 gen 0 [ 75.839195][ T5318] running recovery pass check_topology (2), currently at recovery_pass_empty (0) [ 75.839203][ T5318] running recovery pass check_lrus (14), currently at recovery_pass_empty (0) [ 75.839211][ T5318] running recovery pass check_backpointers_to_extents (16), currently at recovery_pass_empty (0) [ 75.839218][ T5318] running recovery pass check_topology (2), currently at recovery_pass_empty (0) [ 75.839225][ T5318] running recovery pass scan_for_btree_nodes (1), currently at recovery_pass_empty (0) [ 75.839233][ T5318] ret fsck_errors_not_fixed [ 75.878484][ T5318] bcachefs (loop0): error reading btree root btree=xattrs level=0: btree_node_read_error, fixing [ 75.885332][ T5318] bcachefs (loop0): bcachefs (loop0): error validating btree node at btree alloc level 0/0 [ 75.885345][ T5318] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 75.885353][ T5318] node offset 8/24 bset u64s 375 bset byte offset 184: keys out of order: u64s 11 type alloc_v4 0:32:0 len 0 ver 0 > u64s 11 type alloc_v4 0:2:0 len 0 ver 0, fixing [ 75.910470][ T5318] bcachefs (loop0): bcachefs (loop0): error validating btree node at btree lru level 0/0 [ 75.910485][ T5318] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 28f61e078e70b95c written 16 min_key POS_MIN durability: 1 ptr: 0:28:0 gen 0 [ 75.910494][ T5318] node offset 0/16 bset u64s 0: bset version 19 older than superblock version_min 24, fix? [ 75.926705][ T5318] bcachefs (loop0): bcachefs (loop0): error validating btree node at btree lru level 0/0 [ 75.926718][ T5318] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 28f61e078e70b95c written 16 min_key POS_MIN durability: 1 ptr: 0:28:0 gen 0 [ 75.926728][ T5318] node offset 0/16 bset u64s 0: bset version 19 older than superblock version_min 24, fix? [ 75.926736][ T5318] Unable to continue, halting [ 75.945563][ T5318] bcachefs (loop0): error reading btree root btree=lru level=0: btree_node_read_error, fixing [ 75.952643][ T5318] bcachefs (loop0): bcachefs (loop0): error validating btree node at btree freespace level 0/0 [ 75.952658][ T5318] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq e81e1ed936acf3df written 32 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0 [ 75.952668][ T5318] node offset 24/32 bset u64s 24 bset byte offset 168: bad k->u64s 0 (min 3 max 253), fix? [ 75.969413][ T5318] bcachefs (loop0): bcachefs (loop0): error validating btree node at btree freespace level 0/0 [ 75.969428][ T5318] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq e81e1ed936acf3df written 32 min_key POS_MIN durability: 1 ptr: 0:29:0 gen 0 [ 75.969436][ T5318] node offset 24/32 bset u64s 24 bset byte offset 168: bad k->u64s 0 (min 3 max 253), fix? [ 75.969443][ T5318] Unable to continue, halting [ 75.990374][ T5318] bcachefs (loop0): error reading btree root btree=freespace level=0: btree_node_read_error, fixing [ 75.996512][ T5318] bcachefs (loop0): error validating btree node at btree backpointers level 0/0 [ 75.996526][ T5318] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 4a8b0fa43a9980a6 written 24 min_key POS_MIN durability: 1 ptr: 0:37:0 gen 0 [ 75.996534][ T5318] loop0 node offset 0/24 bset u64s 0: invalid bkey format: field 2 too large: 4294967295 + 2251799813685248 > 4294967295 [ 75.996546][ T5318] u64s 3 fields 64:0, 64:0, 32:2251799813685248, 0:0, 0:0, 0:0, btree topology error: [ 76.019422][ T5318] bcachefs (loop0): btree node read error at btree backpointers level 0/0 [ 76.019436][ T5318] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 4a8b0fa43a9980a6 written 24 min_key POS_MIN durability: 1 ptr: 0:37:0 gen 0 [ 76.019446][ T5318] flagging btree backpointers lost data [ 76.019452][ T5318] running recovery pass check_btree_backpointers (15), currently at recovery_pass_empty (0) [ 76.019460][ T5318] ret btree_node_read_validate_error [ 76.055575][ T5318] bcachefs (loop0): error reading btree root btree=backpointers level=0: btree_node_read_error, fixing [ 76.069178][ T5318] ------------[ cut here ]------------ [ 76.072791][ T5318] UBSAN: shift-out-of-bounds in fs/bcachefs/btree_cache.c:212:18 [ 76.076211][ T5318] shift exponent 251 is too large for 64-bit type 'unsigned long long' [ 76.079826][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller-00049-gb4911fb0b060 #0 PREEMPT(full) [ 76.079842][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 76.079853][ T5318] Call Trace: [ 76.079862][ T5318] [ 76.079867][ T5318] dump_stack_lvl+0x189/0x250 [ 76.079961][ T5318] ? __pfx_dump_stack_lvl+0x10/0x10 [ 76.079977][ T5318] ? __pfx__printk+0x10/0x10 [ 76.079998][ T5318] ubsan_epilogue+0xa/0x40 [ 76.080011][ T5318] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [ 76.080070][ T5318] __bch2_btree_node_hash_insert+0x184d/0x1ab0 [ 76.080097][ T5318] ? __bch2_btree_node_hash_insert+0x200/0x1ab0 [ 76.080118][ T5318] ? __pfx___bch2_btree_node_hash_insert+0x10/0x10 [ 76.080142][ T5318] bch2_btree_node_hash_insert+0x7e/0xc0 [ 76.080160][ T5318] bch2_btree_root_read+0x59e/0x760 [ 76.080179][ T5318] ? __pfx_bch2_btree_root_read+0x10/0x10 [ 76.080203][ T5318] ? bch2_current_has_btree_trans+0x169/0x1a0 [ 76.080219][ T5318] read_btree_roots+0x2c6/0x840 [ 76.080241][ T5318] ? __pfx_read_btree_roots+0x10/0x10 [ 76.080266][ T5318] bch2_fs_recovery+0x261f/0x3a50 [ 76.080281][ T5318] ? check_noncircular+0xe0/0x160 [ 76.080304][ T5318] ? __pfx_bch2_fs_recovery+0x10/0x10 [ 76.080329][ T5318] ? __lock_acquire+0xab9/0xd20 [ 76.080374][ T5318] ? __lock_acquire+0xab9/0xd20 [ 76.080397][ T5318] ? __lock_acquire+0xab9/0xd20 [ 76.080429][ T5318] ? bch2_fs_start+0x9fe/0xd90 [ 76.080443][ T5318] ? up_write+0x1c4/0x420 [ 76.080453][ T5318] ? bch2_fs_start+0x5c4/0xd90 [ 76.080469][ T5318] bch2_fs_start+0xa99/0xd90 [ 76.080479][ T5318] ? bch2_fs_start+0x5c4/0xd90 [ 76.080493][ T5318] ? __pfx_bch2_fs_start+0x10/0x10 [ 76.080518][ T5318] ? sget+0x267/0x620 [ 76.080539][ T5318] bch2_fs_get_tree+0xafc/0x14f0 [ 76.080572][ T5318] ? __pfx_bch2_fs_get_tree+0x10/0x10 [ 76.080601][ T5318] ? aa_get_newest_label+0xf7/0x5d0 [ 76.080615][ T5318] ? vfs_parse_monolithic_sep+0x2df/0x310 [ 76.080637][ T5318] ? apparmor_capable+0x137/0x1b0 [ 76.080656][ T5318] vfs_get_tree+0x92/0x2b0 [ 76.080669][ T5318] do_new_mount+0x24a/0xa40 [ 76.080687][ T5318] __se_sys_mount+0x317/0x410 [ 76.080703][ T5318] ? __pfx___se_sys_mount+0x10/0x10 [ 76.080725][ T5318] ? do_syscall_64+0xbe/0x3b0 [ 76.080772][ T5318] ? __x64_sys_mount+0x20/0xc0 [ 76.080788][ T5318] do_syscall_64+0xfa/0x3b0 [ 76.080803][ T5318] ? lockdep_hardirqs_on+0x9c/0x150 [ 76.080819][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.080829][ T5318] ? clear_bhb_loop+0x60/0xb0 [ 76.080844][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.080855][ T5318] RIP: 0033:0x7f91aaf900ca [ 76.080866][ T5318] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 76.080876][ T5318] RSP: 002b:00007f91abe93e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 76.080888][ T5318] RAX: ffffffffffffffda RBX: 00007f91abe93ef0 RCX: 00007f91aaf900ca [ 76.080894][ T5318] RDX: 0000200000000180 RSI: 0000200000000540 RDI: 00007f91abe93eb0 [ 76.080901][ T5318] RBP: 0000200000000180 R08: 00007f91abe93ef0 R09: 0000000000800000 [ 76.080908][ T5318] R10: 0000000000800000 R11: 0000000000000246 R12: 0000200000000540 [ 76.080916][ T5318] R13: 00007f91abe93eb0 R14: 00000000000059d0 R15: 00002000000001c0 [ 76.080935][ T5318] [ 76.080939][ T5318] ---[ end trace ]--- [ 76.246137][ T5318] Kernel panic - not syncing: UBSAN: panic_on_warn set ... [ 76.249379][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted 6.16.0-rc4-syzkaller-00049-gb4911fb0b060 #0 PREEMPT(full) [ 76.254344][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 76.258974][ T5318] Call Trace: [ 76.260371][ T5318] [ 76.261644][ T5318] dump_stack_lvl+0x99/0x250 [ 76.263740][ T5318] ? __asan_memcpy+0x40/0x70 [ 76.265786][ T5318] ? __pfx_dump_stack_lvl+0x10/0x10 [ 76.268115][ T5318] ? __pfx__printk+0x10/0x10 [ 76.270195][ T5318] panic+0x2db/0x790 [ 76.272328][ T5318] ? __pfx_panic+0x10/0x10 [ 76.274393][ T5318] ? _printk+0xcf/0x120 [ 76.276267][ T5318] ? __pfx__printk+0x10/0x10 [ 76.278417][ T5318] check_panic_on_warn+0x89/0xb0 [ 76.280685][ T5318] __ubsan_handle_shift_out_of_bounds+0x386/0x410 [ 76.283529][ T5318] __bch2_btree_node_hash_insert+0x184d/0x1ab0 [ 76.286299][ T5318] ? __bch2_btree_node_hash_insert+0x200/0x1ab0 [ 76.289094][ T5318] ? __pfx___bch2_btree_node_hash_insert+0x10/0x10 [ 76.291954][ T5318] bch2_btree_node_hash_insert+0x7e/0xc0 [ 76.294458][ T5318] bch2_btree_root_read+0x59e/0x760 [ 76.296781][ T5318] ? __pfx_bch2_btree_root_read+0x10/0x10 [ 76.299321][ T5318] ? bch2_current_has_btree_trans+0x169/0x1a0 [ 76.302085][ T5318] read_btree_roots+0x2c6/0x840 [ 76.304437][ T5318] ? __pfx_read_btree_roots+0x10/0x10 [ 76.306922][ T5318] bch2_fs_recovery+0x261f/0x3a50 [ 76.309241][ T5318] ? check_noncircular+0xe0/0x160 [ 76.311523][ T5318] ? __pfx_bch2_fs_recovery+0x10/0x10 [ 76.314698][ T5318] ? __lock_acquire+0xab9/0xd20 [ 76.318353][ T5318] ? __lock_acquire+0xab9/0xd20 [ 76.320527][ T5318] ? __lock_acquire+0xab9/0xd20 [ 76.322795][ T5318] ? bch2_fs_start+0x9fe/0xd90 [ 76.324934][ T5318] ? up_write+0x1c4/0x420 [ 76.327009][ T5318] ? bch2_fs_start+0x5c4/0xd90 [ 76.329197][ T5318] bch2_fs_start+0xa99/0xd90 [ 76.331377][ T5318] ? bch2_fs_start+0x5c4/0xd90 [ 76.333484][ T5318] ? __pfx_bch2_fs_start+0x10/0x10 [ 76.335692][ T5318] ? sget+0x267/0x620 [ 76.337492][ T5318] bch2_fs_get_tree+0xafc/0x14f0 [ 76.339739][ T5318] ? __pfx_bch2_fs_get_tree+0x10/0x10 [ 76.342092][ T5318] ? aa_get_newest_label+0xf7/0x5d0 [ 76.344391][ T5318] ? vfs_parse_monolithic_sep+0x2df/0x310 [ 76.346888][ T5318] ? apparmor_capable+0x137/0x1b0 [ 76.349176][ T5318] vfs_get_tree+0x92/0x2b0 [ 76.351026][ T5318] do_new_mount+0x24a/0xa40 [ 76.353065][ T5318] __se_sys_mount+0x317/0x410 [ 76.355067][ T5318] ? __pfx___se_sys_mount+0x10/0x10 [ 76.357333][ T5318] ? do_syscall_64+0xbe/0x3b0 [ 76.359469][ T5318] ? __x64_sys_mount+0x20/0xc0 [ 76.361683][ T5318] do_syscall_64+0xfa/0x3b0 [ 76.363864][ T5318] ? lockdep_hardirqs_on+0x9c/0x150 [ 76.366333][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.369113][ T5318] ? clear_bhb_loop+0x60/0xb0 [ 76.371198][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.373849][ T5318] RIP: 0033:0x7f91aaf900ca [ 76.375764][ T5318] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 76.384057][ T5318] RSP: 002b:00007f91abe93e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 76.387645][ T5318] RAX: ffffffffffffffda RBX: 00007f91abe93ef0 RCX: 00007f91aaf900ca [ 76.391038][ T5318] RDX: 0000200000000180 RSI: 0000200000000540 RDI: 00007f91abe93eb0 [ 76.394658][ T5318] RBP: 0000200000000180 R08: 00007f91abe93ef0 R09: 0000000000800000 [ 76.398194][ T5318] R10: 0000000000800000 R11: 0000000000000246 R12: 0000200000000540 [ 76.402162][ T5318] R13: 00007f91abe93eb0 R14: 00000000000059d0 R15: 00002000000001c0 [ 76.405744][ T5318] [ 76.407549][ T5318] Kernel Offset: disabled [ 76.409564][ T5318] Rebooting in 86400 seconds..