program: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt(r1, 0xff, 0x1, 0x0, &(0x7f0000000040)) r2 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r2, 0xc0045627, &(0x7f00000001c0)=0x2) r3 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000400)={0xf0f020}) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f00000002c0)={0x1, @pix_mp={0x8, 0x9, 0x20493859, 0x8, 0xa, [{0x1, 0x8001}, {0x0, 0x8}, {0x3, 0x4}, {0x87, 0x7fff}, {0x9, 0x5bd030cf}, {0x8, 0x273b}, {0xffff08f6, 0x6}, {0xe, 0x3}], 0x0, 0x1, 0x6, 0x0, 0x3}}) ioctl$vim2m_VIDIOC_S_FMT(r3, 0xc0d05605, &(0x7f0000000580)={0x1, @raw_data="f2da0cd84b1634164bc92be5f98472bbf8b915222a1b38f0253f081e68b476a7ae40109434cfd92c482d0bd83de1017056653257babc0cb7e241187a276f37e5e6fa67931b06fa704d323a51c083b4ca4ade14267e04c227e1d1f057ab17f6db778caf98687470396db9619c248ef81990465a5b139ad4a1fc25b75b8c4df2eb6fedec57987cf155cda2108df0d8d1710eaf3bcc31c10648692f28a5f2e7714122b2b2ca45b5f8f79179a8a5f80b9fba1bf31d6f3c41f96b9768e17b1faf3d8ebae0d744564f8287"}) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a80)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x801, 0x0, 0x0, {0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x3, 0x0, 0x0, {0x3}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x9c}}, 0x0) syz_mount_image$bcachefs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x1, &(0x7f0000000100)=ANY=[], 0x0, 0x5983, &(0x7f0000009180)="$eJzs3W2QXFXdIPBzu3synZm8TAJIBJkMgSiCmglvhS+l0fWtAKlYWErYKAxkgtEkpJIgEFCCCy4UYKGlpagf0EJq0WhRBatESuRlE1ZRitWltpBa3UU/+BTykBLIQ1k+zlMzfU+n507fuT09PSEvv18lc/uevv0/5557+vb9n+6ZDgAAABwWdt+4Ze95x3zgV18cfuW6D/9sw/WhtzxWXo0b9KXLq16rFjKTSpn17sqisWV2XLzpmh/8eeDS9/3y3p7vv7przfFrf//+Iy598DNn77zj24+8PPf+fz5XVE8cTyfvW09eSEKo/nzP17+064mjR8uSEEI56dsewoJk4SMLkkyIwb+HENbU2zn+zvteOW3t6PL6W7rHlc/PBDHeD2/VdJxt23vlKeEP7111w28W//hHXTue375vk6TaMJ5CmHdx4+O7Qgiz0/+j4mhbFB+cLleGEHoaHndWQbtOaLH9y3LWj02Xs9Jlb26EOePuX5LZPns+yK5HXZllT0G7G7qqLXntaHe7InMy69mT0XTltTOWL0iXP02XJ08xfjn+T0IpCZV689cn+8ZIaDhuSUjGjmW1vl4at89Jw7FO15PMeimzXu7K7NdYvelAKyfJ+PK4XaY8no4rafnxjefqJs7PKX99uqymT9RX43rI3qjpnXCjvl9jYrv2TNKWHNeNjIxM/VE5SjlPrFheP4bpwehNy3qThRMeM9JEvG/XqluXllc/ursvpx3JvUkaP2kr/rZfL5jzqR/efMWivPgXl9L4pbbi//GcJ1+88ObvfSs3/u0xfrmt+Kc+1PPCOY/duCS3f/bE/qm0FX/oucdvW3zkJTty239njF9tK/6KnU92z9370MO57R+M/TO7rfjPvvODf7rn6Qeez40fYvyetuKv3rnpy939e0/Kjf9w7J/e9sbPSzvOfKa//y8DefGfivHnthX/7u13vOOu+becnXt8V8b+6Wsr/rknPnjDnL0PHJd37kzu7NQrJ8Dh6Yj0GuumdL3dPHO6GvKFbw5Uatd8c9L/cztZUcZoPfNmMD4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAh6ejTvmfH/r/H+97oZKud6c3ni3VlrF8VgjJ7BDClq1Dm7eu23jZwGcuv2LzxqH1A0NbB4Y3bt189cDpbxnYPLxp/dDVo/cOvvW02uMWhqS2TI6bUPfIyMhIqW98WazvP5244w9Lz/qXv4YweNTv+iu57V92x4a7jmzyMyNZMfKeDVec97szvpvuV1/arr6cdoWcdv3rBf+466t7/nxSCIOvm6xdjz/77l+Ma9BYwb44qVJ3qDWoO+lp2o56q9P2xP6qrF23fniwuH/LOfvxn695/u9rr/rKP2r9W83djxb7d/aKkfWlb6w699+/cW2t4EA97kX9Hfciti/2XzXt73npfs3L2a9Kzn7d+JuHn/75MTe/vD0MVl5aPLHuov3qSgdAV/L6luqNNfQkC8aVV9Pt4xGPj1u2dcOmZVuu3vbWdRuGLhu+bHjj25efvvzMwTPOPGPZ2J4v6/D+x/rf2OL+75/xNP9z238af7Y2noraVdQfo+0q7o/GFuU9/3rO/9LX3n7HY+fVCorGedy6fj5Jlz2jx3l5aBhvE/uq2X4V9UMIYaBZP7z48tnh6P+z7oai81DjkWn8mZGsGHliyd++e9Z3Fr2rVrBfzvONDWrzPF9v9b72jPVXNT0eB2r/dodyul+9Tdu1/InHum7d/dfP19s3a1a4amjr1s3Laz/npC2dkxyb1jB+wB2biRn3a/HYz3JIuyXUH9VkvI7qCrX2Zc+fcfNsr/am9/UmCzP3zBrbr6x4765Vty4tr350d15PJ/fWapwd5taWyRtytlyfeWC53uBm9U9lfCTbD5zx0f+h79z/8ft/cvqE8XFq7WfefnWHenc0Hfc/fvrur33/K//1J53brw+9+8m+v/3fTy+tFRws55V6q9P2JI3nlVNDmPD8y1gcmu9H7vOv1Hx/ip5/2Xr2bd883kBmvTeUc56vzZ8v8b5TH+p54ZzHblyS+3zd0+rz9dpxa+WC5+uBMn6Kzhsz9/waN1CSFSO/vOmI7Y9ct/KYWkHRuK5v3Wxcn9ZC/pGzX7+48Jn+ywf+y/9utl+VlvYrZPbrB2+576LfD634Qq3gQDnu1bR/qzn9W291zDsb+/dtl16+fk2t/MC9/k2XBflPPJVsuXrbZ4fWrx/evKW1/Wr1eivWk+3ldl9P49ltYcF+lSbs18zdaKW/Wn2+xfavabu/xj/fekPS1uvCtl8vmPOpH958Rd+ER6UVXVxK45faiv/Hc5588cKbv/et3Pi3x/iVtuIPPff4bYuPvGRHbvw7kzR+ta34K3Y+2T1370MP58YfjO2f3Vb8Z9/5wT/d8/QDz/eF9AIyGz/E+L3t9f9LO858pr//L7ntfypJ6xm9RgrhvldOW1tbT0JX+nyL7ega166QXU8y66XMerlxvVSba61XUE7zoXp53C4tP76hLc18Iqc8XoVVF9WWr8b1kL0xefmBptRw7m9WXnSdCgBwqIvv/8dr0Pj+/3B6oZQ/0wD7FOVhjbeb5WGLcuLGPGzffM6scfcvSmPGx8d5wP63hcHR5fUDtQv9qc5zxudDdp4z1nPSCeNjtDvPWTT/viSzHttVmy+vNOShqYl5TSW0MP8+sZ7J598zu188Pz5w04RmDTTMW2WPX1c6Y9bs8w6Z9lZGI+SNj+y8WPw8R/+8sHKsvhbHR/ZzNPE4ZD9HE+s5JnPibPdzNNMdH7HZk4yPsSYXv78x8fiFSfp33/FrHi17/KZwvKuj2+e/Pzv5vE+r788e/POGM/t+mHnJnPjpE+xAnzeM5XE/Ki3OJ348p7xT84nxdBHbtWeStuwP5hOBQ1XM/+NrxGj+P3oB/m+Z7YquQ7NXjTFe7ueEmr6rV5x3TPycXk9br+Ord276cnf/3pNyr3MebvVzP5vGrfUUfO6nqB+XZtYL+zFngqYo38vWU9Tv2c9l9Ia5bfX73dvveMdd8285O7ffV9ZeSIv7/Wvj1uYW9Lt8ISe+fOGAyBem+zmGovmz1ywfST/4NFP5yMdyyqeaj/RMuFHfrzEHXT7StX/bBQAcPGL+X3//LM3//19mu6K89eTMeoyXm7fmXJ/k5a0fSZdXZbbvTX+jYqrXzeee+OANc/Y+cFxu3nJnq3nofxu31leYh04vb87NI1Z25vPiuXlEPc+aXp6Y2/56nji9PD03fj1Pn14ends/9Tx6evMAufHr8wBTznPjED9A8tyZna87ZPPo9NdnZyqPPj+nfKp5dO+EG/X9GpOfR8+apHVhxWR3tkMeDQAcrmL+X08S0vz/scx2071uz8sLwvYYf3rX7dm/BxLF6/be9PNZM5dXznTeN9N560zn9TM9L3Gwv/870/NCMztPdgDlxeXO5cWDudnf/suL9y95MQDAoS3m/7PT9fz8f3r5SW7+Vs9PZvJ935F9+yE/Hx9ffr5f3rfOjd+h960L578On/z/EHtffP+S/wMAHNpi/h9/7TH+/b//ka5n/279zH8+2/voTePL0w+TPH2m59nMA5gHKGYeAADg0NI1lilN/D37T6bL7O/Z5/1e/oU527eqMvY79iFcsnXz8PBFV2xaM7R1+KKNl68Z3nLRlZvXbd06vLG23bTyxu4Hns/NW9K8sStU0v5ovl02b5uf/j2E+Tl/DyG7fQx77NiNiX8PIVvt7IK/I7Dv+LXW3rzjV5pk+2bjI+9458X/RM72Uf34X/rpUy9au+WidRvXbV03tH7dtuHx241mrT1T+N7M2C1T+t7MzI8JSlP//s7OtKM0oR1daX/kfT97kmnHgrQlC/K+/yCn3b/6X1/93Ikj/7gnhMGjym+YVv8lK0b++wXDH9m6+3ebRttfmrT99S3TdhV9X2l2+7g/lfWXb9l6ytrLr9iY/UbJ9sT5jFJ9fYbmM9Knf7nF+YnVOeVTnZ8oT7hxYGp5fgIAgHHi+//xeja+f/iV9AIqljfJ00uhaZ4+vfePc/P0wdby9Oz3khXl6dnt4/62mqdXp5mnZ+svytObbd8sT8/Lu/Pifyxn+6lqfT5nep/zyB0nF7c2TrLfZ1A0TrLbT3WcJNMcJ9n6i8ZJs+2bjZO8454X/6M52+dpfTxM73M5uePh9tbGw5sz60XjIbt9S+Phrw3bT3M8ZOsvGg/Ntm82HvKOb17883K2b9X48TE6MMbGxfBFV16++bMN2830919Mv30z+/0f7Wq9/TP7ua+Zb//Mfq5s5ts/vc+V5bb/qenNhLXe/pn9fpd27bf52vTDZkWfPyuax12VU976PG5tT+t1T/pnVV975nHhtRPz//h2T8z/b0mXnX4b6OD/nrTJXue6pv06d/B//n5mr2MOv9fzGq/nAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIeW7sqiseXuG7fsPe+YD/zqi8OvXPfhn224/k3X/ODPA5e+75f39nz/1V1rjl/7+/cfcemDnzl75x3ffuTluff/87nCwH21xcnpajWE5IUkhOrP93z9S7ueOHq0LAkhlJO+7SEsSBY+siDJRBj8ewhhTb2d4++875XT1o4ur7+le1x5Nkh2v0JvObZnXDvDVYV7xEGomo6JbXuvPCX84b2rbvjN4h//qGvH89v3bZJUG8ZTCPMubnx8Vwhhdvp/VBxti+KD0+XKEEJPw+POym3RyHWjP09osf3LctaPTZez0mVvQZx4/5LMeimzXXY96sosewrqm668drS7XZE5mfXseWS68toZyxeky5+my5OnGL8c/yehlIRKvfnrk31jJDQctyQkY8eyWl8v1Y9tSPc/s55k1kuZ9XJXZr/G6k0HWjlJxpfH7TLl8XRcScuPbzxXN3F+Tvnr02U1faK+GtdD9kZN74Qb9f0aE9u1Z5K2NJjV2mZTV2o4BzUrrx/49GD0pmW9ycIJjxlpIt63a9WtS8urH93dl9OO5N4kjZ+0FX/brxfM+dQPb75iUV78i0tp/FJb8f94zpMvXnjz976VG//2GL/cVvxTH+p54ZzHblyS2z97Yv9U2oo/9Nzjty0+8pIdue2/M8avthV/xc4nu+fufejh3PYPxv6Z3Vb8Z9/5wT/d8/QDz+fGDzF+T1vxV+/c9OXu/r0n5cZ/OPZPb3vj56UdZz7T3/+Xgbz4T8X4c3PjN6sjlt+9/Y533DX/lrNzj+/K2D99bbX/3BMfvGHO3geOyzt3Jnd26pUT4PB0RHqNdVO63m6eOV0nh/oEyTcHKrVrvjnp/7mdrChjtJ55MxgfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBD02+vPf2TF7zno6sqSQhJzjYjTcT7yrNWrGin3qHnHr9t8ZGX7GgsW9ROIAAAAKBQzMNL9ZJqWBSuTGaHY5tuH+cIjo1ryfjy7BzC7H1bdiROqUNxyh2KU+lQnK4OxZnVoTjdHYpTLYhTDa3FmT1pnFLL7enpUJzeDsWZ06E4czsUZ16H4szvUJy+SeO0Pg4XdCjOwg7FOaJDcY7sUJyjOhTndR2Kc3SH4mTnlKc6DuemWx7TLE668fbRV5OCOJWkXL8jzqF/oGFmPdZzXF57x24U19PbpJ5GsZ6BadYzu8V6Tsg8rjTFeqot1vPGnHq6WqwnabGeN09zf0oF9cRxe1W2fbGeuNbi+L+6Q3G2dSjONR2Kc22H4ny+Q3G+0KE4100zDkCrYv6/L9/rC92Vd4We9IyTnQWI+e7isZ8TX+/yTkgx3hsy5bOK4mUT9Uy8xVNtX3YCIRNvSaa8a1y8Sj0fmSRetTHe0sydhfubnVDItO/kTHl3UbzsxAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzKDfXnv6Jy94z0dXhSSM/mtqpIl4X3nWihUDbdS7a9WtS8urH93dWNZdaSMQAAAAUCjm4V31kmroriwP3cmscdtV03mAarpe7qst++eFlaPLZKA0tt6TLJj0cZX0ccu2bti0bMvV2966bsPQZcOXDW98+/LTl585eMaZZyxbu2798GDtZwjdBfFCCGPTD1uu3vbZofXrhzdvqRVm278ofdyidD1JH9f/tjA4urw+bf/CgvpKE+rr6I2R+bVqGvYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/YNf+QuSq7jiAnzszOzOuptnivzGYzZA/krbSJulaYivuhUIFTYKLUGZstxJqQqUbEzSR1E41ULUJLQUlEFLykpJKtdKXqFVK/UMgxaYGumkoKq0P7UOLtpYoeSiRKdmdOztzd2ZnnUqT6OfzMHfmnN85v3vmYeF7ZwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADh/TNZGxiujY9XBKISoS029g2Qum4/jch99v/78th8Xhk+vbB0r5PrYCAAAAOgpyeEDzZFiKOSyIRuumvq0NLRMhJncDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfPxM1kbGK6Nj1YujEKIuNfUOkrlsPo7LffR9892nvvDa8PDfW8dKqZp8H/sCAAAAsyU5PNMcKYZSWBYGoqva6qIQDp+9LkqtT9cl+yyeZ1362UG3umXzrLtmnnWf6lG3oXHdGQAAAODCl+T/XHNkKBRyCzrl/ym9cn1StyRVl21c+/lfAQAAAOB/k+T/QnOkFAq5UjOvzzfvL03VJet7/W6frF/RZX2v3/PXN65+pwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAC8dkbWS8MjpWzUYhRF1q6h0kc9l8HJf76LvmhcF/3nLk4aWtY4VcHxsBAAAAPSU5fCZ6F0MhNxgGwsVTuX/4pgNPf/XpZ0dCCNMxP58POzdu337PmunXpG71sSMDPzr69vdm1a2efj1nBwQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD40k7WR8croWPWiKISoS029g2Qum4/jch993/jSV/76xMnn3modK/WxDwAAANBbksNnsn8xlEI+5MMVU59as/5ZmdT6bs8MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgI+Oe79z/7c3Tkxsuufj92YgnBe34Y035+Obc/2XCQAA+LAtCVGof0BX3nqu7xoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgfTNZGxiujY9ViFELUpabeQTKXzcdxuY++8fPHCwtOv/BS61ipj30AAACA3pIcPpP9i6EUBsJAuHzqU6dnAlP5f+j/eJMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAeWWyNjJeGR2rLohCiLrU1DtI5rL5OC730ffxXfu/eGjhD29uHSvk+tgIAAAA6CnJ4fnmSDEUcp8OhXB14/NE+4Io27h2fi4ws25b27LBea+rta3Lznvd7tTJco3TTK8rJvsNTV+b68qz15Vb1pVCs325bV3Y27ZqQY/7DAAAAHAOJfm/0BwZCoVcoSXn/rytfkjOBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC6mKyNjFdGx6pRFELUpabeQTKXzcdxuY++9//+k5d84xd7drSOlVI1hT72BQAAAGZLcvhM9i+GUlgcPhEWT+X+MNRen9T9q3Lm0GP//tvKEFZdcWI413X/375x44vplxAy7UWZEBY2+kWz+k3v/bs/PHbf8vqZJ0JYdXn26ln9cnP3a98yrj9T2bR++9ET2+b4YqIzc0wCAADAhSXJ/wPNkaFQyN3dmv/bfoZPgvYHyv8L79v1q8sar41EnlqRGWr0y6Tyf1L35eVP/WXF2n+8fTb/z9Xvc/u3HLqsreH0SEoU10e37Nhw4rqDmeTU0/2zqf7J9/K17771n807Hz0z3b8Yio3xRblO/We/plwU1ycy+6rr3t9Xa++f63L+h1996eRvFu1572z/d5cMNvtfM8f55+4/eNsje6/ff2RDe/8QQrlT/3feuzlc+ae7HkqffzC1ces33/qaEsX1Y0tPHVx7oHRDe/8o1T/5/n958vG9P3v0B88m/ZP/FVm5bL79M6n+r+y+dNfLD4Zd7f0zXc7/4u2vDW8tf/+P6fPf2ff5n7z28B2vb4wfmPr8aroAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgo2KyNjJeGR2rZqIQoi419Q6SuWw+jst99H3zluPv3L7npz9pHSv1sQ8AAADQW5LDZ7J/MZRCPuTD4FTuf6ayaf32oye2haHp2ahxzU1svXf7ZzZv3XH3nefozgEAAID5SvJ/rjkyFAq55WGgkf9Ht+zYcOK6g5kk/2eS/L/5rolNq0Kz7pXdl+56+cFbFzWfE4Qw9W8BxbN1n5+pu+nG40On/vytFR3r1szUHVt66uDaA6UbkrrQWrc6NJ9PPHnt4Tte3xg/0Ly/1rrPfnPrROPxRLLv4G2P7L1+/5ENzXM0roONfZO6icy+6rr399WSumzjWmycGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYbbI2Ml4ZHauGbAhRl5p6B8lcNh/H5T76rlv+64cuOf3c4taxQq6PjQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgv+zAgQAAAAAAkP9rI1RVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhv/5CpKriOICfMzPbjju7uqtBVrSuVhT2kBRE1EN/qAiNEHoyJCzNhygIIgp7aA2NxIpegqwXiQqqLQSD3CTRYo3+SS89VFBgPQQiLZSL9FAxM+eOM9e97naNoPh8YDjzO3Pu9557z92zMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMB/Sn9taas9vP2RmTsvuPWzp+4/8eTtHzy09bIn3vppbOPNn+4ZeP3k1Kblm7+9ZcnG/Q+sntz1yqHfht774+icwY+3m5WprIcQj8cQ6h9Ov/j01OfnNftiCKEah8dDGImLD43EXMKq30MImzrz7P1wbxq9dWd/T/+iXEj+ukKjms2nbbh3vvy/1NNztmXmsSvC9zet2/blsnff6Zs4Nn5qSGyO2Xvi6s3tcuGG7uP7QggL0qspe9qWZgendm0IYaDruGvnmNfF85z/lQX1hak9J7WNOXKyz1fk6kpuXL7O9OXagTnO11Gb78D5zeOM425YWO5kIYTBXJ3fjM5W0fVk/SOpfT+1K/9m/lBzL23tp6ESQ60z/QfjqWckdK1bDLG1lvVOXemsbUjXn6tjrq7k6mpf7rpa500PWjXG3v5sXK4/245rqX959149i7sK+s9PbT39oZ7M6pB/09Y47U3nulqyeU2fYS7/hkrXHjRbf2fh02I0Ul8jLj7tmD9nkX02te7ZS6vrPzo83HtIZ4njnpjyY6n8LV+MDN7z9o5HlxZcZ9xQSfmVUvk/rDnyy907Xn25MP+FLL9aKv+qAwPH13y8fcVwUf50dn9qpfLvPfrJc8vOvW+icP67s/x6qfwbJ4/0D80cOFg4/1XZ/VlQKv+762/78c2v9x0rzA9Z/kCp/PWTDz/fPzpzeWH+wez+NMo9P79OXPPN6OjPY0X5X2X5Q6Xy3xjfdd1ri3auLlzftdn9GS6Vf8cl+7cNzuy7qGjvjLvn+x8WgNksSd+xnkl12d+ZZ6vr98JLY7X2d77B9Br6J0+U0zxP+V9dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPzFDhzIAAAAAAjzt86j/QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVwUAAP//t/UlDg==") [ 85.353506][ T5329] loop0: detected capacity change from 0 to 32768 [ 85.360592][ T5303] Bluetooth: hci0: command tx timeout [ 85.386416][ T5329] bcachefs (/dev/loop0): error reading default superblock: checksum error, type none: got should be [ 85.515191][ T5329] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names,read_only [ 85.515211][ T5329] allowing incompatible features above 0.0: (unknown version) [ 85.515220][ T5329] features: lz4,new_siphash,inline_data,new_extent_overwrite,btree_ptr_v2,new_varint,journal_no_flush,alloc_v2,extents_across_btree_nodes [ 85.590997][ T5329] bcachefs (loop0): Using encoding defined by superblock: utf8-12.1.0 [ 85.595495][ T5329] bcachefs (loop0): recovering from clean shutdown, journal seq 10 [ 85.599130][ T5329] bcachefs (loop0): Doing compatible version upgrade from 1.7: mi_btree_bitmap to 1.28: inode_has_case_insensitive [ 85.599130][ T5329] running recovery passes: check_allocations,check_extents_to_backpointers,check_inodes [ 85.630724][ T5329] bcachefs (loop0): invalid bkey in btree_node btree=freespace level=0: u64s 5 type set 0:26:0 len 3003121665 ver 0 [ 85.630765][ T5329] size greater than offset (3003121665 > 26), deleting [ 85.643420][ T5329] bcachefs (loop0): error reading btree root btree=freespace level=0: btree_node_read_error, fixing [ 85.650704][ T5329] bcachefs (loop0): btree node read error at btree backpointers level 0/0 [ 85.650734][ T5329] u64s 11 type btree_ptr_v2 POS_MAX len 0 ver 0: seq 4a8b0fa43a9980a6 written 24 min_key POS_MIN durability: 1 ptr: 0:37:0 gen 0 [ 85.650743][ T5329] loop0 node offset 0/24 bset u64s 0: incorrect max key SPOS_MAX [ 85.650751][ T5329] flagging btree backpointers lost data [ 85.650756][ T5329] running recovery pass check_btree_backpointers (15), currently at recovery_pass_empty (0) [ 85.650762][ T5329] ret btree_node_read_validate_error [ 85.677297][ T5329] bcachefs (loop0): error reading btree root btree=backpointers level=0: btree_node_read_error, fixing [ 85.687369][ T5329] bcachefs (loop0): check_topology... done [ 85.693871][ T5329] bcachefs (loop0): accounting_read... done [ 85.701860][ T5329] bcachefs (loop0): alloc_read... done [ 85.705309][ T5329] bcachefs (loop0): snapshots_read... done [ 85.708870][ T5329] bcachefs (loop0): check_allocations... [ 85.712623][ T5329] bcachefs (loop0): btree ptr not marked in member info btree allocated bitmap [ 85.712648][ T5329] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0, fixing [ 85.730826][ T5329] bcachefs (loop0): bucket 0:26 gen 128 data type btree: ptr gen 0 too stale [ 85.730838][ T5329] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0, fixing [ 85.741698][ T5329] bcachefs (loop0): bucket 0:26 data type btree stale dirty ptr: 0 < 128 [ 85.741717][ T5329] while marking u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0, fixing [ 85.756103][ T5329] bcachefs (loop0): btree ptr not marked in member info btree allocated bitmap [ 85.756118][ T5329] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0, fixing [ 85.768767][ T5329] bcachefs (loop0): btree ptr not marked in member info btree allocated bitmap [ 85.768778][ T5329] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0, fixing [ 85.781515][ T5329] bcachefs (loop0): btree ptr not marked in member info btree allocated bitmap [ 85.781525][ T5329] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq c0bef60d07ceb940 written 16 min_key POS_MIN durability: 1 ptr: 0:35:0 gen 0, fixing [ 85.794691][ T5329] bcachefs (loop0): btree ptr not marked in member info btree allocated bitmap [ 85.794705][ T5329] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ebb8d5a9e3463bdb written 16 min_key POS_MIN durability: 1 ptr: 0:32:0 gen 0, fixing [ 85.806700][ T5329] bcachefs (loop0): bucket 0:29 gen 0 has wrong data_type: got btree, should be need_discard, fixing [ 85.813209][ T5329] bcachefs (loop0): bucket 0:29 gen 0 data type need_discard has wrong dirty_sectors: got 256, should be 0, fixing [ 85.820624][ T5329] bcachefs (loop0): bucket 0:37 gen 0 has wrong data_type: got btree, should be need_discard, fixing [ 85.825984][ T5329] bcachefs (loop0): bucket 0:37 gen 0 data type need_discard has wrong dirty_sectors: got 256, should be 0, fixing [ 85.832436][ T5329] bcachefs (loop0): bucket 0:38 gen 0 has wrong data_type: got free, should be btree, fixing [ 85.836823][ T5329] bcachefs (loop0): bucket 0:38 gen 0 data type btree has wrong dirty_sectors: got 0, should be 256, fixing [ 85.845434][ T5329] done [ 85.849077][ T5329] bcachefs (loop0): going read-write [ 85.883723][ T1096] ================================================================== [ 85.887705][ T1096] BUG: KASAN: slab-out-of-bounds in __bch2_alloc_to_v4+0x7b/0x8b0 [ 85.891434][ T1096] Read of size 64 at addr ffff8880546516a8 by task kworker/u4:9/1096 [ 85.895022][ T1096] [ 85.896036][ T1096] CPU: 0 UID: 0 PID: 1096 Comm: kworker/u4:9 Not tainted 6.16.0-rc4-syzkaller-00049-gb4911fb0b060 #0 PREEMPT(full) [ 85.896049][ T1096] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.896058][ T1096] Workqueue: btree_update btree_interior_update_work [ 85.896074][ T1096] Call Trace: [ 85.896082][ T1096] [ 85.896088][ T1096] dump_stack_lvl+0x189/0x250 [ 85.896106][ T1096] ? __virt_addr_valid+0x1c8/0x5c0 [ 85.896116][ T1096] ? rcu_is_watching+0x15/0xb0 [ 85.896129][ T1096] ? __kasan_check_byte+0x12/0x40 [ 85.896139][ T1096] ? __pfx_dump_stack_lvl+0x10/0x10 [ 85.896152][ T1096] ? rcu_is_watching+0x15/0xb0 [ 85.896165][ T1096] ? lock_release+0x4b/0x3e0 [ 85.896179][ T1096] ? __virt_addr_valid+0x1c8/0x5c0 [ 85.896187][ T1096] ? __virt_addr_valid+0x4a5/0x5c0 [ 85.896196][ T1096] print_report+0xd2/0x2b0 [ 85.896210][ T1096] ? __bch2_alloc_to_v4+0x7b/0x8b0 [ 85.896220][ T1096] kasan_report+0x118/0x150 [ 85.896229][ T1096] ? __bch2_alloc_to_v4+0x7b/0x8b0 [ 85.896240][ T1096] kasan_check_range+0x2b0/0x2c0 [ 85.896250][ T1096] ? __bch2_alloc_to_v4+0x7b/0x8b0 [ 85.896260][ T1096] __asan_memcpy+0x29/0x70 [ 85.896274][ T1096] __bch2_alloc_to_v4+0x7b/0x8b0 [ 85.896284][ T1096] ? bch2_dev_tryget_noerror+0x1e/0x340 [ 85.896293][ T1096] ? bch2_dev_tryget_noerror+0x1e/0x340 [ 85.896301][ T1096] ? bch2_dev_tryget_noerror+0x1e/0x340 [ 85.896313][ T1096] bch2_trigger_alloc+0x323/0x4090 [ 85.896324][ T1096] ? bch2_btree_path_peek_slot+0x3f4/0xfe0 [ 85.896334][ T1096] ? bch2_journal_keys_peek_slot+0x100/0x190 [ 85.896348][ T1096] ? __pfx_bch2_journal_keys_peek_slot+0x10/0x10 [ 85.896361][ T1096] ? __pfx_bch2_trigger_alloc+0x10/0x10 [ 85.896371][ T1096] ? __bch2_btree_node_relock+0x18a/0x990 [ 85.896386][ T1096] ? verify_update_old_key+0x34f/0x790 [ 85.896400][ T1096] ? __pfx_verify_update_old_key+0x10/0x10 [ 85.896413][ T1096] ? __bch2_trans_commit+0x421/0x8870 [ 85.896423][ T1096] ? __pfx_bch2_trigger_alloc+0x10/0x10 [ 85.896434][ T1096] __bch2_trans_commit+0xa84/0x8870 [ 85.896447][ T1096] ? bch2_bkey_sectors_need_rebalance+0x70b/0xee0 [ 85.896463][ T1096] ? bch2_trigger_extent+0x764/0x960 [ 85.896482][ T1096] ? btree_interior_update_work+0x1082/0x27d0 [ 85.896492][ T1096] ? __pfx___bch2_trans_commit+0x10/0x10 [ 85.896508][ T1096] ? __bch2_trans_subbuf_alloc+0x2d9/0x590 [ 85.896520][ T1096] ? btree_interior_update_work+0xe71/0x27d0 [ 85.896532][ T1096] btree_interior_update_work+0x1082/0x27d0 [ 85.896549][ T1096] ? __pfx_btree_interior_update_work+0x10/0x10 [ 85.896562][ T1096] ? _raw_spin_unlock_irq+0x23/0x50 [ 85.896627][ T1096] ? process_scheduled_works+0x9ef/0x17b0 [ 85.896641][ T1096] ? process_scheduled_works+0x9ef/0x17b0 [ 85.896654][ T1096] process_scheduled_works+0xade/0x17b0 [ 85.896673][ T1096] ? __pfx_process_scheduled_works+0x10/0x10 [ 85.896690][ T1096] worker_thread+0x8a0/0xda0 [ 85.896705][ T1096] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 85.896719][ T1096] ? __kthread_parkme+0x7b/0x200 [ 85.896730][ T1096] kthread+0x70e/0x8a0 [ 85.896739][ T1096] ? __pfx_worker_thread+0x10/0x10 [ 85.896748][ T1096] ? __pfx_kthread+0x10/0x10 [ 85.896755][ T1096] ? _raw_spin_unlock_irq+0x23/0x50 [ 85.896763][ T1096] ? lockdep_hardirqs_on+0x9c/0x150 [ 85.896775][ T1096] ? __pfx_kthread+0x10/0x10 [ 85.896784][ T1096] ret_from_fork+0x3fc/0x770 [ 85.896798][ T1096] ? __pfx_ret_from_fork+0x10/0x10 [ 85.896812][ T1096] ? __pfx_kthread+0x10/0x10 [ 85.896823][ T1096] ret_from_fork_asm+0x1a/0x30 [ 85.896837][ T1096] [ 85.896841][ T1096] [ 86.057314][ T1096] Allocated by task 5329: [ 86.059296][ T1096] kasan_save_track+0x3e/0x80 [ 86.061634][ T1096] __kasan_kmalloc+0x93/0xb0 [ 86.063724][ T1096] __kmalloc_noprof+0x27a/0x4f0 [ 86.065946][ T1096] bch2_journal_key_insert+0x50/0x140 [ 86.068289][ T1096] do_bch2_trans_commit_to_journal_replay+0x127/0xd70 [ 86.071217][ T1096] __bch2_trans_commit+0x1b67/0x8870 [ 86.073379][ T1096] bch2_check_allocations+0x2ee0/0x57b0 [ 86.075872][ T1096] __bch2_run_recovery_passes+0x392/0x1010 [ 86.078474][ T1096] bch2_run_recovery_passes+0x184/0x210 [ 86.080966][ T1096] bch2_fs_recovery+0x2690/0x3a50 [ 86.083262][ T1096] bch2_fs_start+0xa99/0xd90 [ 86.085337][ T1096] bch2_fs_get_tree+0xafc/0x14f0 [ 86.087355][ T1096] vfs_get_tree+0x92/0x2b0 [ 86.089342][ T1096] do_new_mount+0x24a/0xa40 [ 86.091554][ T1096] __se_sys_mount+0x317/0x410 [ 86.093693][ T1096] do_syscall_64+0xfa/0x3b0 [ 86.096143][ T1096] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.099052][ T1096] [ 86.100417][ T1096] The buggy address belongs to the object at ffff888054651680 [ 86.100417][ T1096] which belongs to the cache kmalloc-96 of size 96 [ 86.107005][ T1096] The buggy address is located 40 bytes inside of [ 86.107005][ T1096] allocated 88-byte region [ffff888054651680, ffff8880546516d8) [ 86.113249][ T1096] [ 86.114206][ T1096] The buggy address belongs to the physical page: [ 86.116757][ T1096] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x54651 [ 86.120119][ T1096] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 86.123060][ T1096] page_type: f5(slab) [ 86.125024][ T1096] raw: 04fff00000000000 ffff88801a441280 dead000000000100 dead000000000122 [ 86.129090][ T1096] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 86.132957][ T1096] page dumped because: kasan: bad access detected [ 86.135856][ T1096] page_owner tracks the page as allocated [ 86.138169][ T1096] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 15, tgid 15 (ksoftirqd/0), ts 85772971309, free_ts 0 [ 86.145740][ T1096] post_alloc_hook+0x240/0x2a0 [ 86.147829][ T1096] get_page_from_freelist+0x21e4/0x22c0 [ 86.150248][ T1096] __alloc_frozen_pages_noprof+0x181/0x370 [ 86.152945][ T1096] alloc_pages_mpol+0x232/0x4a0 [ 86.155218][ T1096] allocate_slab+0x8a/0x3b0 [ 86.157763][ T1096] ___slab_alloc+0xbfc/0x1480 [ 86.160981][ T1096] __kmalloc_noprof+0x305/0x4f0 [ 86.164485][ T1096] cfg80211_inform_single_bss_data+0x905/0x1ac0 [ 86.168473][ T1096] cfg80211_inform_bss_data+0x1fb/0x3b20 [ 86.171364][ T1096] cfg80211_inform_bss_frame_data+0x3d7/0x730 [ 86.174131][ T1096] ieee80211_bss_info_update+0x746/0x9e0 [ 86.176690][ T1096] ieee80211_scan_rx+0x593/0xa20 [ 86.178959][ T1096] ieee80211_rx_list+0x22fc/0x2d80 [ 86.181347][ T1096] ieee80211_rx_napi+0x1a8/0x3d0 [ 86.183701][ T1096] ieee80211_handle_queued_frames+0xe8/0x1f0 [ 86.186649][ T1096] tasklet_action_common+0x369/0x580 [ 86.189179][ T1096] page_owner free stack trace missing [ 86.191842][ T1096] [ 86.192984][ T1096] Memory state around the buggy address: [ 86.195695][ T1096] ffff888054651580: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 86.199351][ T1096] ffff888054651600: 00 00 00 00 00 00 00 00 00 00 03 fc fc fc fc fc [ 86.202652][ T1096] >ffff888054651680: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 86.206274][ T1096] ^ [ 86.209275][ T1096] ffff888054651700: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 86.212793][ T1096] ffff888054651780: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 86.216063][ T1096] ================================================================== [ 86.220537][ T5329] bcachefs (loop0): journal_replay... [ 86.238973][ T1096] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 86.245538][ T1096] CPU: 0 UID: 0 PID: 1096 Comm: kworker/u4:9 Not tainted 6.16.0-rc4-syzkaller-00049-gb4911fb0b060 #0 PREEMPT(full) [ 86.250408][ T1096] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 86.254844][ T1096] Workqueue: btree_update btree_interior_update_work [ 86.257789][ T1096] Call Trace: [ 86.259355][ T1096] [ 86.260782][ T1096] dump_stack_lvl+0x99/0x250 [ 86.262997][ T1096] ? __asan_memcpy+0x40/0x70 [ 86.265147][ T1096] ? __pfx_dump_stack_lvl+0x10/0x10 [ 86.267579][ T1096] ? __pfx__printk+0x10/0x10 [ 86.269783][ T1096] panic+0x2db/0x790 [ 86.271721][ T1096] ? __pfx_panic+0x10/0x10 [ 86.274097][ T1096] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 86.277006][ T1096] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 86.279940][ T1096] ? print_memory_metadata+0x314/0x400 [ 86.282203][ T1096] ? __bch2_alloc_to_v4+0x7b/0x8b0 [ 86.284675][ T1096] check_panic_on_warn+0x89/0xb0 [ 86.287095][ T1096] ? __bch2_alloc_to_v4+0x7b/0x8b0 [ 86.289651][ T1096] end_report+0x78/0x160 [ 86.291743][ T1096] kasan_report+0x129/0x150 [ 86.293896][ T1096] ? __bch2_alloc_to_v4+0x7b/0x8b0 [ 86.296281][ T1096] kasan_check_range+0x2b0/0x2c0 [ 86.298696][ T1096] ? __bch2_alloc_to_v4+0x7b/0x8b0 [ 86.300975][ T1096] __asan_memcpy+0x29/0x70 [ 86.302948][ T1096] __bch2_alloc_to_v4+0x7b/0x8b0 [ 86.305487][ T1096] ? bch2_dev_tryget_noerror+0x1e/0x340 [ 86.308507][ T1096] ? bch2_dev_tryget_noerror+0x1e/0x340 [ 86.311408][ T1096] ? bch2_dev_tryget_noerror+0x1e/0x340 [ 86.314101][ T1096] bch2_trigger_alloc+0x323/0x4090 [ 86.316582][ T1096] ? bch2_btree_path_peek_slot+0x3f4/0xfe0 [ 86.319357][ T1096] ? bch2_journal_keys_peek_slot+0x100/0x190 [ 86.322196][ T1096] ? __pfx_bch2_journal_keys_peek_slot+0x10/0x10 [ 86.324990][ T1096] ? __pfx_bch2_trigger_alloc+0x10/0x10 [ 86.327604][ T1096] ? __bch2_btree_node_relock+0x18a/0x990 [ 86.330519][ T1096] ? verify_update_old_key+0x34f/0x790 [ 86.333723][ T1096] ? __pfx_verify_update_old_key+0x10/0x10 [ 86.336831][ T1096] ? __bch2_trans_commit+0x421/0x8870 [ 86.339147][ T1096] ? __pfx_bch2_trigger_alloc+0x10/0x10 [ 86.341714][ T1096] __bch2_trans_commit+0xa84/0x8870 [ 86.344153][ T1096] ? bch2_bkey_sectors_need_rebalance+0x70b/0xee0 [ 86.346963][ T1096] ? bch2_trigger_extent+0x764/0x960 [ 86.349161][ T1096] ? btree_interior_update_work+0x1082/0x27d0 [ 86.351806][ T1096] ? __pfx___bch2_trans_commit+0x10/0x10 [ 86.354591][ T1096] ? __bch2_trans_subbuf_alloc+0x2d9/0x590 [ 86.357566][ T1096] ? btree_interior_update_work+0xe71/0x27d0 [ 86.360404][ T1096] btree_interior_update_work+0x1082/0x27d0 [ 86.362996][ T1096] ? __pfx_btree_interior_update_work+0x10/0x10 [ 86.365745][ T1096] ? _raw_spin_unlock_irq+0x23/0x50 [ 86.367962][ T1096] ? process_scheduled_works+0x9ef/0x17b0 [ 86.370646][ T1096] ? process_scheduled_works+0x9ef/0x17b0 [ 86.373355][ T1096] process_scheduled_works+0xade/0x17b0 [ 86.375860][ T1096] ? __pfx_process_scheduled_works+0x10/0x10 [ 86.378534][ T1096] worker_thread+0x8a0/0xda0 [ 86.380749][ T1096] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 86.383885][ T1096] ? __kthread_parkme+0x7b/0x200 [ 86.386194][ T1096] kthread+0x70e/0x8a0 [ 86.388019][ T1096] ? __pfx_worker_thread+0x10/0x10 [ 86.390544][ T1096] ? __pfx_kthread+0x10/0x10 [ 86.392589][ T1096] ? _raw_spin_unlock_irq+0x23/0x50 [ 86.395074][ T1096] ? lockdep_hardirqs_on+0x9c/0x150 [ 86.397233][ T1096] ? __pfx_kthread+0x10/0x10 [ 86.399312][ T1096] ret_from_fork+0x3fc/0x770 [ 86.401432][ T1096] ? __pfx_ret_from_fork+0x10/0x10 [ 86.403726][ T1096] ? __pfx_kthread+0x10/0x10 [ 86.405791][ T1096] ret_from_fork_asm+0x1a/0x30 [ 86.407678][ T1096] [ 86.409381][ T1096] Kernel Offset: disabled [ 86.411341][ T1096] Rebooting in 86400 seconds..