last executing test programs:

13.2815615s ago: executing program 0 (id=7):
r0 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406d0422c200000000000109022d0001010000000904000002030000000921110100012223000905810340000a00000905020340000a0000"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x17d78400}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022230000000600ff0900a10185020901150026ff0075089508810209029512910209039503b102c0"], &(0x7f0000000080)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x23}}}}, &(0x7f0000000200)={0x2c, &(0x7f0000000600)={0x40, 0x2}, &(0x7f0000000280)={0x0, 0xa, 0x1}, &(0x7f00000002a0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000240)={0x20, 0x1, 0x4, "02000000"}, &(0x7f00000002c0)={0x20, 0x3, 0x1, 0x1}})
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022230000000600ff0900a10185020901150026ff0075089508810209029512910209039503b102c0"], &(0x7f0000000080)={0x0, 0x21, 0x9, {0x9, 0x21, 0x111, 0x0, 0x1, {0x22, 0x23}}}}, &(0x7f0000000200)={0x2c, &(0x7f0000000600)={0x40, 0x2}, &(0x7f0000000280)={0x0, 0xa, 0x1}, &(0x7f00000002a0)={0x0, 0x8, 0x1, 0x1}, &(0x7f0000000240)={0x20, 0x1, 0x4, "02000000"}, &(0x7f00000002c0)={0x20, 0x3, 0x1, 0x1}})
syz_open_dev$hidraw(&(0x7f0000000500), 0x0, 0x0)
syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000400)="020000000000000000")
syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000400)="020000000000000000")
syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000400)="020000000000000000")
syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000400)="020000000000000000")
syz_usb_ep_write(r0, 0x81, 0x9, &(0x7f0000000400)="020000000000000000")

12.416097897s ago: executing program 1 (id=2):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000100)={0x2, 0x1bd, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000300)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000200)='./cifs\x00', &(0x7f0000000400)='cifs\x00', 0x0, &(0x7f0000000500)='vers=1.0,user=root,pass=root\x00')

11.43736905s ago: executing program 5 (id=6):
syz_usb_connect(0x0, 0x49, &(0x7f0000000000)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x40, 0x644, 0x8047, 0x100, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x37, 0x4, 0x1, 0x0, 0x80, 0xfa, "", [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1}}, {{0x9, 0x4, 0x1, 0x0, 0x0, 0x1, 0x1}}, {{0x9, 0x4, 0x2, 0x0, 0x0, 0x1, 0x1}}, {{0x9, 0x4, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x100, 0xa}}]}}]}}]}}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0)
r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x1, 0x0)
r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x0)
r3 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x3, 0x0)
r4 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x4, 0x0)
r5 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x5, 0x0)
ioctl(r0, 0xc4c85513, &(0x7f0000000200)="1b0000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff00000000000000")
ioctl(r1, 0xc4c85513, &(0x7f0000000200))
ioctl(r2, 0xc4c85513, &(0x7f0000000200))
ioctl(r3, 0xc4c85513, &(0x7f0000000200))
ioctl(r4, 0xc4c85513, &(0x7f0000000200))
ioctl(r5, 0xc4c85513, &(0x7f0000000200))

11.327076851s ago: executing program 2 (id=10):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/kernel/mm/transparent_hugepage/hugepages-2048kB/stats/anon_fault_alloc\x00', 0x0, 0x0)
read(r0, &(0x7f0000000100)=""/100, 0x64)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/kernel/mm/transparent_hugepage/hugepages-16kB/stats/anon_fault_alloc\x00', 0x0, 0x0)
read(r1, &(0x7f0000000200)=""/100, 0x64)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/kernel/mm/transparent_hugepage/hugepages-64kB/stats/anon_fault_alloc\x00', 0x0, 0x0)
read(r2, &(0x7f0000000300)=""/100, 0x64)

10.968127086s ago: executing program 1 (id=12):
syz_mount_image$ocfs2(&(0x7f0000004740), &(0x7f0000004780)='./file0\x00', 0x0, &(0x7f00000047c0)={[{@heartbeat_none}]}, 0x0, 0x4705, &(0x7f0000004800)="$eJzs222IHGcBB/BnNqe5pMn1XtImafqySQQPLceln6r1QzyrNpo2L9pWU+Xcu1wvp3u3592uFgxSgyAKghIEFV+oCqVfakEM9EstQsEXpFUoFUXrF5FCFfxg0AZ6sjszuZ25vc7mNmlp+/tBMjcvzzPP3n/nmX3m2Ssl6qfmlstzy+XKQrk2ff/yLeXP1aqN+ZlQepW81uenO1ciJ9m/do687wMfueeWEP5w7GsfWllZWQlNg6GjA20/n//36en2ZaqUK9Ost3NtsT82Hnnp5295pSOKnAgh7FjTrqZNIYSP/SKEzSGEoWTbcLLcEkLYFkKIQgiP/uZfP+7vpQltzt77wnPHzhzed2bi8ceeuTB7dN0DoxC+W9198+z8i/s33fb8Oy7T6QEA4BV98PiRu4+OHwhPRmHgXN/az+s7k2X6+fjOt33qrof7Vvev0J1Nr2KoAAAAkLM6/h+MXu4wX5fOrKVTgk88cOLup6LV/Qa2r2+H7jpy+/vHDyTzv9Ga/bcmm/753k2tOdT8vG9+/ncoV77z/O/qeR7+6rO/XHjrxtufti8972CISmOZ9VJpbCyEYxPx+q5oa6laW66/8/5aY+Hkxs/7RpHNP569z7wLkgn9bvMfztVfNP+/+xOf/9mWvl5ewUjIv2ub6+W1b2U6yOa/fl/+ky9FXeU/kitXlP8dT28//6vNvbyC/Bm5FNn84wtxX/sB5bgDaOb/zb7i/Hfk6i/K//sT5x49sYHv/zT7mcGo2db+TA/wcrJ9na8wkZPNPw4i03Umv8j1rv//5fK/Jld/Uf531v7xu7/1cP9fr/8fneilzjePbP5xEOXMEavX/1Cp+Pq/Nld/Uf6/PfXnZz/Z0716bf7N9o+6/3clm39yI852nq3fZLf9/85c/UX57xq576G5DbT7w1uSdg5EYaTtW6fnmrewgdX56taQprl7cQMneRPI5h//1jKXzkC8aF3/g8X9/65c/UX5P7Tn6+853dP3fzv3/+P6/65k89/S2nYp+b+Uy393rv6i/H94+u9/ue8y9//N9YPy70o2/61r9q8+/yl1Nf67Lle+6PnPvuGnHvlrD+P/tH3pedPnP+lziNEofv5DZ9n8r1r3uG7v/3ty5Yqu/2/95/mn9/fS/0f9ngD0IJv/tnhjhwFgt/lfn6u/KP8v3PPlj/9pA+O/1ie+/jT/tvH/5nj7Uf1/V7L5b483Zv4Y6sHW/637f7Q29//m8r8hV39R/hcOjfV95TLf/5vtH83/IRodZfMfWPe4Zv6/7+L+f2OuXFH+X9z70xdv7unzfwjjxvobls3/6nWPa13//cX535QrV5T/d77x6yce7KH9b++hLPn843t95nJKPpt3O/4v5+ovyv9Ho+fP7r8C479b3f+7ks0/njW/lPzz4/+9ufqL8v/ekR8s9V2B5z93yB8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGBDhpPlYIhKY5n1UmlsLISRZH1X2BpNVU5OTlVr059ZDmFHsr0chqPZam2qUp2cW6idnJmsVKu16RCuSfbvCP3RcrVWn5yvLF57sa4t0amZylJ9aqZSDyHsTLZfH7andU3N1ecri61j0zJXRZXPNmr1ylhjeWYp7L64fVu6fXap1li87mJdV5dqS4unKguTJ+eW3j0+Pj4e9lxs81A080B9ZqEetzbe2yyTlh2M2l5Ma/cNbef7dK2xtFCptrbf2FamWpuuVNvK3NR2vvpSY2G6Up+ZrNZm0/OV28q2vbbW7r3JvtEwlHl9adm8g8ny9kPHP3r88IE1+8tRNu+FxvzM+PbO7wkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3rievO1d3w4h9MVrpRDCwfSHKPmXcfbeF547dubwvjMTjz/2zIXZo52OAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPg/O3AgAAAAAADk/9oIVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVdi5n5cqujgOwGfG974WSClthFwGhojoTsKCfhFJ5TWyZZvWQa0SMigKDCNaFgRBULuoIGgVVP4FUQuXrapNLVoYRFAxOpOXO8INL3TMeR4Yzgxz75kvDNw7cz6HAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwPpxdsdiV9Ze2rV5aevuD6EzP/d/CGE0Wd7/vLcj9IQQvn6ZOR1WaQs9Tf2/mZwbL181+b23f/zh9dFk7fUX3y2u2x2SdKjheGeSpkNDa+9/o7oz+Gx6MAkhjV0IUSyMPTlTCyF0xC6EKH5+nL+Y/b7/F7sQouj/cLcru/+12IUQxdbdn/pq+TMe1XO+fmGw8b+/1SN4G4/orENvT155l7qplfcyf/9P8s37YDXMnjjy/nnsIohmdm7qaOwaAACAv+tci/w/bFnev385CT3d5dz/W1P+39vU/+r5/4p722+MzbQVQmwrjU1mx8P72ulz4zs1cPX265rxnqqS/1eb/L/a5P/VJv+vNvl/tcn/ybyS/1fS45t7Fl/ELoJo5P8AAFA9h45PTNWHR7KX/00/Ost5fV/e1vM8/cGt6YFHDeNG8sN/2+FjEwcODo/k9708ILiy/kO6dPZ7Pt+juS1MNs27aLX+Q+/ThflrneVP1P9w/kZRX3Fd6z8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwC92556GQTAKw+h3WxG10apowsJPgg80MCIAKcxoQAcTBmAgBBQwkHOWe5NneQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACe71/ldfH9pTHSa41IU9ll1/45nmY/c98Oy/vsceNWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANnbgQAYAAABAmL91Hu0HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACApwIAAP//robLPA==")
umount2(&(0x7f0000004780)='./file0\x00', 0x2)

10.667637881s ago: executing program 2 (id=13):
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800000000"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002214000000050c0901a1010a810115002501750195018102c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002214000000050c0901a1010a810115002501750195018102c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002214000000050c0901a1010a810115002501750195018102c0"], 0x0}, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002214000000050c0901a1010a810115002501750195018102c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)

9.456896899s ago: executing program 3 (id=14):
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x1ff)
mount(&(0x7f0000000640)=@filename='proc\x00', &(0x7f0000000680)='./proc\x00', &(0x7f00000006c0)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-2 -3 +4\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='tcp 2049\n', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r2, &(0x7f0000000740)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./nfsd/nfsv4leasetime\x00', 0x2, 0x0)
write(r3, &(0x7f00000007c0)='1\n', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0)
write(r4, &(0x7f0000000240)='1\n', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0)
write(r5, &(0x7f00000002c0)='nfsd 127.0.0.1 2147483647 testdomain\n', 0x25) (async)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r6, &(0x7f0000000340)='testdomain / 2147483647 8194 0 0 0\n', 0x23) (async)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.fh/channel\x00', 0x2, 0x0)
write(r7, &(0x7f00000003c0)='testdomain 1 \\x00000000 2147483647 /\n', 0x25) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000440)='127.0.0.1:/\x00', &(0x7f0000000480)='./mnt\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1\x00'])
openat(0xffffffffffffff9c, &(0x7f0000000540)='./mnt/file1\x00', 0x42, 0x1ff)
rename(&(0x7f0000000580)='./mnt/file1\x00', &(0x7f00000005c0)='./mnt/file2\x00')

9.035858344s ago: executing program 0 (id=16):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/devices/pcspkr/driver_override\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='usbip-vudc\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/usbip-vudc/bind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='pcspkr\x00', 0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0x1ff)
symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00')
symlinkat(&(0x7f0000000400)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/fs/h\x00')
symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00')
symlinkat(&(0x7f0000000500)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/ss/h\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000580)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0x1ff)
symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00')
symlinkat(&(0x7f0000000640)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/usb_gadget/g1/functions/uvc.0/control/class/ss/h\x00')
symlinkat(&(0x7f00000006c0)='./config/usb_gadget/g1/functions/uvc.0\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/uvc.0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000740)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0)
write(r2, &(0x7f0000000780)='pcspkr\x00', 0x6)
r3 = syz_open_dev$video(&(0x7f0000000800), 0x0, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r3, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r4 = syz_open_dev$video(&(0x7f0000000800), 0x1, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r4, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})
r5 = syz_open_dev$video(&(0x7f0000000800), 0x2, 0x0)
ioctl$VIDIOC_ENUM_FRAMESIZES(r5, 0xc02c564a, &(0x7f0000000840)={0x0, 0x56595559})

8.408040498s ago: executing program 5 (id=17):
r0 = syz_mount_image$jfs(&(0x7f0000005dc0), &(0x7f0000005e00)='./file0\x00', 0x0, &(0x7f0000000040), 0x0, 0x5db5, &(0x7f0000005e80)="$eJzs3UuPFNfZB/CnL9Nz4TWMLL2WhbIYY+dCMDBcDLnb3iRSVpEiNlmBxmMLBScRkCi2UBhrFvkGUbJIlOyzyifIHj6EF1kGCZKNV6moZs6BmqKHHgLT1TPn95OaqqdOVfcp/n2druoTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAED88Ps/PteLiKu/SguWI/4vBhH9iMW6XomIxZXlvP4wIl6PreZ4rV59PqLefuufYxEXI+L+0YiHj+6s1YvP77Ef/z7y/8f++dcfnP7933537+QfT73dbv/T+j/u/eRuui0AAADguVRVVfXSx/zj6fN9v+tOAQBTkV//qyQvV6vVarVaffjqpmq8u80iIjaa29TvGe6OuzIAYHZtxBddd4EOyb9ow4g40nUngJnmuPvD6eGjO2u9lG+v+Xqwst2ejwXZkf9G7/H5HbtNJ2kfYzKt+9dmDOLVXfqzOKU+zJKcf7+d/9Xt9lFab7/zn5bd8h9tn/pUnJz/oJ1/y+HJvz82/1Ll/IfPlf9A/gAAAAAAMMPy3/+XO/7+d/7Fd2VPnvX978qU+gAAAAAAAAAAL9uLjv/3mPH/AAAAYGbVn9Vrfz76ZNlun7Hr5Vd6Ea+01gcKk06WWeq6HwAAAAAAAAAAAABQkuH2MbxXehFzEfHK0lJVVfWlqV0/rxfd/qArff+hZF0/yQMAwLb7R1vn8vciFiLiSvqtv7mlpaWqWlhcqpaqxfn8fnY0v1AtNj7X5mm9bH60hzfEw1FVX9lCY7umSZ+XJ7W3r6++rVE12EPHpqPDwAEgIrZfjR56RTpkqupYdP0uh4PB4//w8fhnL7q+nwIAAAD7r6qqqpd+zvt4+s6/33WnAICpyK//7e8F1Gq1Wq1WH766qRrvbrOIiI3mNvV7hrvjrgwAmF0b8UXXXaBD8i/aMCJe77oTwEzrdd0B9sXDR3fWeinfXvP1II3vno8F2ZH/Rm9ru7z9uOkk7WNMpnX/2oxBvLpLf16bUh9mSc6/387/6nb7KK233/lPy2751/u53EF/upbzH7Tzbzk8+ffH5l+qnP/wufIfyB8AAAAAAGZY/vv/su9/8y4DAAAAAAAAwIHz8NGdtXzea/7+/0tj1nP+5+GU8+/Jv0g5/34r/6+11hs05h+8/yT/fz26s/ajP3x+PE/3mv98numle1Yv3SN66ZZ6wzR9kb172ubcYFTf0lyvPximY36quQ/jetyI9VjdsW4//X88aT+3o73u6dyO9vM72odPtV/Y0T6XfnegWsztZ2Itfh434oOt9rptfsL+L0xorya05/wHHv9FyvkPG5c6/6XU3mtNaw8+6z/1uG9Ox93Oe7+9d391/3dnos0YPN63pnr/TnTQn63/kyOj+OWt9Ztnfn3t9u2b5yJNdiw9H2nykuX859Ll8fP/m9vt+Xm/+Xh98NnoufOfFZsx3DX/Nxvz9f6enHLfupDzH6VLzv+D1D7+8X+Q89/98X+qg/4AAAAAAAAAAAAAAADAs1RVtXWK6HsRcSmd/9PVuZkAwHTl1/8qycvVarVarVYfvrqpGu/dZhERf29uU79n+M24KwMAZtl/IuLzrjtBZ+RfsPx7f/X0ra47A0zVrU8+/em1GzfWb97quicAAAAAAAAAwP8qj/+50hj/+a2IWG6tt2P81/dj5UXH/xzmmccDjL7kgb53sdkfDfqN4cbfiGeP/30inj3+93DC7c1NaB9NaJ+f0L4woX3siR4NOf83GuOd1/kfbw2/XsL4r+0x70uQ8z/RuD/X+X+1tV4z/+ovBzn//o78z97++Bdnb33y6enrH1/7aP2j9Z9dXF29dOHyO6uXV89+eP3Gevq3wx7vr5x/HvvacaBlyfnnzOVflpz/l1Mt/7Lk/L+SavmXJeef3+/Jvyw5//zZR/5lyfmfTLX8y5Lz/3qq5V+WnP+pVMu/LDn/t1Mt/7Lk/E+nWv5lyfmfSbX8y5LzP5tq+Zcl55+/4ZJ/WXL++cgG+Zcl538+1fIvS87/QqrlX5ac/8VUy78sOf93Ui3/suT8L6Va/mXJ+V9OtfzLkvP/RqrlX5ac/zdTLf+y5Py/lWr5lyXn/+1Uy78sOf/vpFr+Zcn5fzfV8i9Lzv97qZZ/WXL+76Za/mV58vv/ZsyYMZNnun5mAgAAAAAAAAAAAADapnE4cdf7CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8lx04EAAAAAAA8n9thKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqirswIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYedeY+Q66/uBn13v2muHy/4hBP9DgLVjgkmW7Poe0xrMraQJaSkktKUX49prx8S3eu3cFClGoU2kRm2k8iK8KAQaqXlTEQGqUpUiV2oFEkjkFa3UNqRKqCJKWkP7AirCVjPz/B7PjPfmM46ZOefzkeKfd/bMzDNnnpnd7zrfBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDduvfOPDhUFEXjv+Yf40XxisbfV0+MNz7c8I6f9woBAACAXr3U/PPsq/MFu5dxpbZjvv6mb39lbm5urnjme297/afn5vInJopifFVRND8XXrjlbza0H5M8UIwNDbd9PLzE3a9Y4vMjS3x+dInPr1zi86uW+PzYEp8/7wScZ3Xr5zHNG9vQ/Ot465QWlxejzc9tmOdaDwytGh6On+U0DTWvMzd6oDhUHC5miumO41vHDjWP/+q6xn3dWMR9Dbfd11WNHfLD+/bFGobSOd7QcV/nbjO8+O5i4kc/vG/fhz7z7JXzzSVPQ8fttda5cX1jnZ9Kl7TWOlSsyuck1jncts6r5nlOVnSsc6h5vcbfu9d5dpnrXHFumZdU93M+Vgw3//508zyNtP9YL5+nq9JlP766KIrT55bdfcx591UMF2s6Lhk+9/yMtXZk4zYaW+k1xcgF7dN1y9injbl/Q+c+7X5NxPO/Ll1vZIE1tD9NL35y5XnP+4Xu09B41Au9Vrr34MV+rfTLHox98XTzQT807x7ckB7/fdcsvAfn3Tvz7MH8uNv24Pql9uDwyhXNNecnYah5nXN7cFPH8Sua9zTUnC9cs/genDp55PjU7D33vv3Qkb0HZw7OHN06Pb19y45t0zumpw4cOjyT/ix5tvvfmmI4vwbWp3MXr4G3dh3bvlXnPn/xXodji7wOx7uOvdivw5HuBzd0aV6Q5+/p1mvj1sZJH3t4uFjgNdZ8fq7t/XWYH3fb63Ck7XU479eUeV6HI8t4HTaOOX7t8r5nGWn7b741vFxfC8bb9mD39yPde/Bifz/SL3twLO2Lf7l24a8FV6X1PjR5od+PrDhvD+aHm957Gpfk7/fHbmiO+fbllY1PXLayODU7c+L6u/eePHliU5HGJfHatr3SvV/XtD2m4rz9OnzB+3X3g9/81pXzXD6eztXY2xt/jC34XDWO2Xr94s9V86vb/Oez49LNRRoX2aU+n/N9NW+cz5wlFzmfjWM+NdX79+I5l7a9/44u8P4buf9nzfvZkG/qgRWjI63X74p8dkY73o87n6qR5nvXUPO+z04t7/14NP13qd+PL1/k/Xht17EX+/14tPvBxfvx0FI/7ehN9/M5lvbJ4enF348bx6zdfKF7cmTR9+Or0xxK5/9tKSnkXNS2dxbat/m+RkZG0+MaiXvo3KdbOo4fTdmscV9PbC63Tzde3bqtFfnRnXOp9ulE17EXe5/m96uF9unQUj99K6f7+RxL++LyLYvv08YxZ7b2/t65Ov7a9t65cqk9OLpiZWPNo3kTtt7v51bHHry+2FccKw4X+5ufXdncT0PN+5rctrw9uDL9d6nfK9cusgc3dh17sfdg/jq20N4bGjn/wV8E3c/nWNoXj25bfA82jnnfjov7vevGdEk+pu171+6fry30M68ru07Ty/kzr8Y6/37H4j+bbRxz+IYLzZmLn6fr0iWXzXOeul+/C72m9heX5jytTev8wQ0Ln6fGehrHfHrnMvfT7qIovnzz7ubPe9O/r3zp1He+0vHvLrtbn3tq57nbOu+7jvn+3efLN+8+8083/eRCHiMA/e1nzT83rGl9rWv7l6nl/Ps/AAAAMBAi9w+nmcn/AAAAUBmR++P/Cs/kfwAAAKiMyP0jaWY1yf8P/evr7vjp/UVu5s8l8fk4Dcefax0XHdfH0scTc+c0Ln/P4//wzY/dv7z7Hi6K4qc3/fO8xz/0XKyr5ZG0zonvdl5+nrXfXdb9f/y2c8e1dwDH0+3H4+neBl/9r+ea15vY2ZpnbjrTnB8+/dADjc+f3dn6OLqTL/x367g/S2Xe3Qf+ruP6G59p3d+GZxZ/XHG9L35w9c1v+Oi5+4vrDa1/VfNhPPrO1u3G77155L2t48+m4xZa/9/+0RNfbBx/91vmX//9w/Ov/4V0u8+n+ZOXWpe3n9PGx3G9P0jrj/uL613/ha/Nu/4nP9A6/sn0vDyWZvf63/0nb3yp/XzF+uN+dj/bul7c//Rf/XvzenF7cfvd6x9713Md56P79s98qXU7u+78nxXtx8flcT953z3b+Tw3bqd9v4Un/vBMx3ku/q11vb/uWn/c3vFn51//dV3rPL5pTfP6C1XGPzvz/LyPN9az+y+f7ng8T34/nb/33NK83bEfp/2YPv+/j7Rur/u3JTz9/c73kzj+sfHW6zJub6pr/Y90rf/0mxvnbun13/ij1vqffNfXO5+P/2itY/eLrbnU+g9+7tsd1//8d1rPx4m7Jo8emz11KDrU4+l3/xz/Xuv2Vo2tXnPZK175qlen98ruj/ccO3n7zImJ6YnpopgYwF+J93Kv/wtp/mdrnL7Yt39fURR3tX1du/b9rf1XvOnsH7/5xsdvj+P+8X2tyx++ufV1663puEfS5afT8x2389nPtL4e9rr+uJ+FZl7vMp36xoPbl3VgevyPrrui+SobOtO6uPv9qqx4nT/7us7X/TO3tuZT6bzOpd/MvP6KbzSP677/+N0ID3+k9fqO7+Ti+r2u/y/S833L863bj9vN603fx3xtbef7Yzw/T93f9ZsGxlu/xeN0ev8oTrc+H0fF91QPn73iQpa5oNl7ZqcOHzp66u6pkzOzJ6dm77l3z5Fjp46e3NP83Zx7PrHU9c+9vtc0X9/7Z7ZvLZqv9mOt8TL7ea//+G379u+Yvmb/zIG9pw6cvO34zImD+2Zn983sn71m74EDM3ctdf1D+3dt2rxzy47NkwcP7d91w86dW3ZOHjp6rLGM1qKWsH36jsmjJ/Y0rzK7a+vOTdu2bZ2ePHJs/8yuHdPTk6eWun7za9Nk49p3Tp6YObz35KEjM5Ozh+6d2bVp5/btm5f87X5Hjh+YnZg6cero1KnZmRNTrccycbJ5ceNr31LXh4bZz62e9+vUUPrufdN12/PvZ214/JML3lTrkK5fIPqD9LtovvXnf7ptOR9H7h9NM6tJ/gcAAIA6iNy/Ms1M/gcAAIDKiNy/Ks1M/gcAAIDKiNw/lmZWk/yv/6//r/+v/x/0//X/y9D/1/8vQ/9f/38Q1q//r/9P7/qt/x+5f3VR1DL/AwAAQB1E7l+TZib/AwAAQGVE7r8szUz+BwAAgMqI3P+KNLOa5H/9f/1//X/9/6D/r/9fhv6//n8Z+v/6/4Owfv1//X9612/9/8j9r0wzq0n+BwAAgDqI3P+qNDP5HwAAACojcv+r08zkfwAAAKiMyP3jaWY1yf/6//r/+v/6/0H/X/+/DP1//f8y9P/1/wdh/fr/+v/0rt/6/5H7/1+aWU3yPwAAANRB5P7XpJnJ/wAAAFAZkftfm2Ym/wMAAEBlRO6/PM2sJvlf/1//X/9f/z/o/+v/l6H/r/9fhv6//v8grF//X/+f3vVb/z9y/+vSzGqS/wEAAKAOIvdfkWYm/wMAAEBlRO5/fZqZ/A8AAACVEbl/bZpZTfK//r/+v/6//n/Q/9f/L0P/X/+/DP1//f9BWL/+v/4/veu3/n/k/v+fZlaT/A8AAAB1ELn/yjQz+R8AAAAqI3L/G9LM5H8AAACojMj9V6WZ1ST/6//r/+v/6/8H/X/9/zL0//X/y9D/1/8fhPXr/+v/07t+6/9H7n9jmllN8j8AAADUQeT+N6WZyf8AAABQGZH735xmJv8DAABAZUTun0gzq0n+1//X/9f/1/8P+v/6/2Xo/+v/l6H/r/8/COvX/9f/p3f91v+P3L8uzawm+R8AAADqIHL/+jQz+R8AAAAqI3L/1Wlm8j8AAABURuT+DWlmNcn/+v/6//r/+v9B/1//vwz9f/3/MvT/9f8HYf36//r/9K7f+v+R+9+SZlaT/A8AAAB1ELn/mjQz+R8AAAAqI3L/W9PM5H8AAACojMj9G9PMapL/9f/1//X/9f+D/r/+fxn6//r/Zej/6/8Pwvr1//X/6V2/9f8j978tzawm+R8AAADqIHL/tWlm8j8AAABURuT+69LM5H8AAACojMj9k2lmNcn/+v/6//r/+v9B/1//vwz9f/3/MvT/9f8HYf36//r/9K7f+v+R+9+eZlaT/A8AAAB1ELn/+jQz+R8AAAAqI3L/VJqZ/A8AAACVEbl/Os2sJvlf/1//X/9f/z/o/+v/l6H/r/9fhv6//v8grF//X/+f3vVb/z9y/6Y0s5rkfwAAAKiDyP2b08zkfwAAAKiMyP1b0szkfwAAAKiMyP1b08xqkv/1//X/9f/1/4P+v/5/Gfr/+v9l6P/r/w/C+vX/9f/pXb/1/yP3b0szq0n+BwAAgDqI3L89zUz+BwAAgMqI3L8jzUz+BwAAgMqI3H9DmllN8r/+v/6//r/+f9D/1/8vQ/9f/78M/X/9/0FYv/6//j+967f+f+T+nWlmNcn/AAAAUAeR+9+RZib/AwAAQGVE7v+FNDP5HwAAACojcv8vppnVJP/r/+v/6//r/wf9f/3/MvT/9f/L0P/X/x+E9ev/6//Tu37r/0fu35VmVpP8DwAAAHUQuf+daWbyPwAAAFRG5P53pZnJ/wAAAFAZkft3p5nVJP/r/+v/6//r/wf9f/3/MvT/9f/L0P/X/x+E9ev/6//Tu37r/0fuf3eaWU3yPwAAANRB5P73pJnJ/wAAAFAZkfvfm2Ym/wMAAEBlRO5/X5pZTfK//r/+v/6//n/Q/9f/L0P/X/+/DP1//f9BWL/+v/4/veu3/n/k/venmdUk/wMAAEAdRO7/pTQz+R8AAAAqI3L/B9LM5H8AAACojMj9N6aZ1ST/6//r/+v/6/8H/X/9/zL0//X/y9D/1/8fhPXr/+v/07t+6/9H7v/lNLOa5H8AAACog8j9N6WZyf8AAABQGZH7b04zk/8BAACgMiL3fzDNrCb5X/9f/1//X/8/6P/r/5eh/6//X4b+v/7/IKxf/1//n971W/8/cv8taWY1yf8AAABQB5H7fyXNTP4HAACAyojc/6tpZvI/AAAAVEbk/g+lmdUk/+v/6//r/+v/B/1//f8y9P/1/8vQ/9f/H4T16//r/9O7fuv/R+7/tTSzmuR/AAAAqIPI/R9OM5P/AQAAoDIi938kzUz+BwAAgMqI3H9rmllN8r/+v/6//r/+f9D/1/8vQ/9f/78M/X/9/0FYv/6//j+967f+f+T+29LMapL/AQAAoA4i9380zUz+BwAAgMqI3P/raWbyPwAAAFRG5P7fSDOrSf7X/9f/1//X/w/6//r/Zej/6/+Xof+v/z8I69f/1/+nd/3W/4/c/5tpZjXJ/wAAAFAHkfs/lmYm/wMAAEBlRO7/rTQz+R8AAAAqI3L/b6eZ1ST/6//r/+v/6/8H/X/9/zL0//X/y9D/1/8fhPXr/+v/07t+6/9H7v+dNLOa5H8AAACog8j9v5tmJv8DAABAZUTu35NmJv8DAABAZUTu/3iaWU3yv/6//r/+v/5/0P/X/y9D/1//vwz9f/3/QVi//r/+P73rt/5/5P69aWY1yf8AAABQB5H7fy/NTP4HAACAyojcvy/NTP4HAACAyojcvz/NrCb5X/9f/1//X/8/6P/r/5eh/6//X4b+v/7/IKxf/1//n971W/8/cv9MmllN8j8AAADUQeT+A2lm8j8AAABURuT+g2lm8j8AAABURuT+29PMapL/9f/1//X/9f+D/r/+fxn6//r/Zej/6/8Pwvr1//X/6V2/9f8j9x9KM6tJ/gcAAIA6iNz/iTQz+R8AAAAqI3L/HWlm8j8AAABURuT+w2lmNcn/+v/6//r/+v9B/1//vwz9f/3/MvT/9f8HYf36//r/9K7f+v+R+4+kmdUk/wMAAEAdRO4/mmYm/wMAAEBlRO4/lmYm/wMAAEBlRO4/nmZWk/yv/6//r/+v/x/0//X/y9D/1/8vQ/9f/38Q1q//r/9P7/qt/x+5//fTzGqS/wEAAKAOIvefSDOT/wEAAKAyIvfPppnJ/wAAAFAZkftPppnVJP/r/+v/6//r/wf9f/3/MvT/9f/L0P/X/x+E9ev/6//Tu37r/0fuP5VmVpP8DwAAAHUQuf/ONDP5H/6PfXtWAGDboTD82Ne2bdu2bdu+xzaL02TlAfY0Mzvf16RNu4ofAABgG9n9T6rb7H8AAADYRnb/k+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+59Stw3Z/wAAADBBdv9T6zb7HwAAALaR3f+0us3+BwAAgG1k9z+9bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/GXXbkP0PAAAAE2T3P7Nus/8BAABgG9n9z6rb7H8AAADYRnb/s+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+59Ttw3Z/wAAADBBdv9z6zb7HwAAALaR3f+8us3+BwAAgG1k9z+/bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/BXXbkP0PAAAAE2T3v7Bus/8BAABgG9n9L6rb7H8AAADYRnb/i+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+19Stw3Z/wAAADBBdv9L6zb7HwAAALaR3f+yus3+BwAAgG1k97+8bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/FXXbkP0PAAAAE2T3v7Jus/8BAABgG9n9r6rb7H8AAADYRnb/q+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+19Ttw3Z/wAAADBBdv9r6zb7HwAAALaR3f+6us3+BwAAgG1k97++bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/DXXbkP0PAAAAE2T3v7Fus/8BAABgG9n9b6rb7H8AAADYRnb/m+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+99Stw3Z/wAAADBBdv9b6zb7HwAAALaR3f+2us3+BwAAgG1k97+9bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/HXXbkP0PAAAAE2T3v7Nus/8BAABgG9n976rb7H8AAADYRnb/u+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+99Ttw3Z/wAAADBBdv976zb7HwAAALaR3f++us3+BwAAgG1k97+/bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/A3XbkP0PAAAAE2T3f7Bus/8BAABgG9n9H6rb7H8AAADYRnb/h+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+z9Stw3Z/wAAADBBdv9H6zb7HwAAALaR3f+xus3+BwAAgG1k93+8bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/E3XbkP0PAAAAE2T3f7Jus/8BAABgG9n9n6rb7H8AAADYRnb/p+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+z9Ttw3Z/wAAADBBdv9n6zb7HwAAALaR3f+5us3+BwAAgG1k93++bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/C3XbkP0PAAAAE2T3f7Fus/8BAABgG9n9X6rb7H8AAADYRnb/l+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+79Stw3Z/wAAADBBdv9X6zb7HwAAALaR3f+1us3+BwAAgG1k93+9bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/G3XbkP0PAAAAE2T3f7Nus/8BAABgG9n936rb7H8AAADYRnb/t+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+79Ttw3Z/wAAADBBdv936zb7HwAAALaR3f+9us3+BwAAgG1k93+/bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/B3XbkP0PAAAAE2T3/7Bus/8BAABgG9n9P6rb7H8AAADYRnb/j+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+39Stw3Z/wAAADBBdv9P6zb7HwAAALaR3f+zus3+BwAAgG1k9/+8bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/F3XbkP0PAAAAE2T3/7Jus/8BAABgG9n9v6rb7H8AAADYRnb/r+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+39Ttw3Z/wAAADBBdv9v6zb7HwAAALaR3f+7us3+BwAAgG1k9/++bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/D3XbkP0PAAAAE2T3/7Fus/8BAABgG9n9f6rb7H8AAADYRnb/n+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+/9Stw3Z/wAAADBBdv9f6zb7HwAAALaR3f+3us3+BwAAgG1k9/+9bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/H3XbkP0PAAAAE2T3/7Nus/8BAABgG9n9/6rb7H8AAADYRnb/v+u2Iftf/6//1//r/0P/r/9fof/X/6/Q/+v/r/C//l//z3Fn6/+z+/9Ttw3Z/wAAADBBdv9/6zb7HwAAALaR3f+/us3+BwAAgG1k9/+/bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/hrptyP4HAACACbL7b6zb7H8AAADYRnb/TXWb/Q8AAADbyO6/uW4bsv/1//p//b/+P/T/+v8V+n/9/wr9v/7/Cv/r//X/HHe2/j+7/5a6bcj+BwAAgAmy+2+t2+x/AAAA2EZ2/211m/0PAAAA28juv71uG7L/9f/6f/2//j/0//r/Ffp//f8K/b/+/wr/6//1/xx3tv4/u/+Oum3I/gcAAIAJsvvvrNvsfwAAANhGdv9ddZv9DwAAANvI7r+7bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/nrptyP4HAACACbL7763b7H8AAADYRnb/fXWb/Q8AAADbyO6/v24bsv/1//p//b/+P/T/+v8V+n/9/wr9v/7/Cv/r//X/HHe2/j+7/4G6bcj+BwAAgAmy+x+s2+x/AAAA2EZ2/0N1m/0PAAAA28juf7huG7L/9f/6f/2//j/0//r/Ffp//f8K/b/+/wr/6//1/xx3tv4/u/+Rum3I/gcAAIAJsvsfrdvsfwAAANhGdv9jdZv9DwAAANvI7n+8bhuy//X/+n/9v/4/9P/6/xX6f/3/Cv2//v8K/+v/9f8cd7b+P7v/iQAAAP//xTxxVA==")
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0/test_file\x00', 0x42, 0x1ff)
mmap(&(0x7f0000000000/0x100000)=nil, 0x100000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
writev(r1, &(0x7f0000001000)=[{&(0x7f0000000000), 0x100000}, {&(0x7f0000000000), 0x100000}, {&(0x7f0000000000), 0x100000}, {&(0x7f0000000000), 0x100000}, {&(0x7f0000000000), 0x100000}, {&(0x7f0000000000), 0x100000}, {&(0x7f0000000000), 0x100000}, {&(0x7f0000000000), 0x100000}], 0x8)
fsync(r1)
unlinkat(0xffffffffffffff9c, &(0x7f0000000300)='./file0/test_file\x00', 0x0)
close(r1)
close(r0)
umount2(&(0x7f0000000400)='./file0\x00', 0x0)

8.093084562s ago: executing program 1 (id=18):
syz_usb_connect(0x3, 0x34, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040601632090001000000010902220001010080fa0904000000ff0000000904000101ff00000007058201000401"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x0)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x1, 0x1, 0x1})
ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000240)=0x1)

7.904089537s ago: executing program 4 (id=19):
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000000)={0xb, {'syz0\x00', 'syz1\x00', 'syz0\x00', 0x33, 0x5, 0x46d, 0xb012, 0x0, 0x0, "0600ff0901a10185100901150026ff007508950681000901910085110901951381000901910085120901953f810009019100c0"}}, 0x14b)
read(r0, &(0x7f0000001000), 0x111c)
read(r0, &(0x7f0000002000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000200)={0xc, {0x7, "10ff001002005a"}}, 0xd)
read(r0, &(0x7f0000003000), 0x111c)
write$UHID_INPUT2(r0, &(0x7f0000000300)={0xc, {0x14, "11ff00000100"/20}}, 0x1a)
read(r0, &(0x7f0000004000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000400)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000005000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000500)={0xc, {0x14, "11ff00000200"/20}}, 0x1a) (async)
read(r0, &(0x7f0000006000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000600)={0xc, {0x14, "11ff00000100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000007000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000700)={0xc, {0x14, "11ff0100"/20}}, 0x1a) (async)
read(r0, &(0x7f0000008000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000800)={0xc, {0x14, "11ff00000300"/20}}, 0x1a) (async)
read(r0, &(0x7f0000009000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000900)={0xc, {0x14, "11ff0300"/20}}, 0x1a) (async)
read(r0, &(0x7f000000a000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000a00)={0xc, {0x14, "11ff03100800"/20}}, 0x1a) (async)
read(r0, &(0x7f000000b000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000b00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000c000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000c00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000d000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000d00)={0xc, {0x14, "11ff042000"/20}}, 0x1a) (async)
read(r0, &(0x7f000000e000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000e00)={0xc, {0x14, "11ff00000400"/20}}, 0x1a) (async)
read(r0, &(0x7f000000f000), 0x111c) (async)
write$UHID_INPUT2(r0, &(0x7f0000000f00)={0xc, {0x14, "11ff04100800"/20}}, 0x1a) (async)

7.823355149s ago: executing program 0 (id=20):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000b00)='-2 -3 +4\n\x00', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000900)='tcp 2049\n\x00', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000300)='1\n\x00', 0x2) (async)
nanosleep(&(0x7f0000000c00)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./nfs_mnt\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='127.0.0.1:/\x00', &(0x7f0000000400)='./nfs_mnt\x00', &(0x7f0000000600)='nfs4\x00', 0x0, &(0x7f0000000700)='addr=127.0.0.1,clientaddr=127.0.0.1,vers=4.2\x00')
openat(0xffffffffffffff9c, &(0x7f0000000d00)='./nfs_mnt/file\x00', 0x42, 0x1ff)
chmod(&(0x7f0000000d00)='./nfs_mnt/file\x00', 0x1ff)

6.999873258s ago: executing program 2 (id=21):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./proc/net/afs/sysname\x00', 0x2, 0x0)
write(r0, &(0x7f0000000080)='syz\n\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000a0)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r1, &(0x7f00000000c0)='add foosyz 127.0.0.1\n\x00', 0x15)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000200)=@cell={0x25, '', 'syz0', '.readonly'}, &(0x7f0000000000)='./file0\x00', &(0x7f00000000e0), 0x0, &(0x7f0000000300)={[{@dyn}]})
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/foosyz\x00', 0x0, 0x0)

6.943012771s ago: executing program 4 (id=22):
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./sys\x00', &(0x7f0000000350)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/module/9pnet/parameters/debug\x00', 0x2, 0x0)
write(r0, &(0x7f00000003c0)='65535\x00', 0x5)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r1=>0x0, <r2=>0x0})
write(r1, &(0x7f0000000100)="1500000065ffff0020000008003950323030302e4c1400000069010080000000000100000000000000a0000000190200ff3f00000000000080000000000100000000000000ff41000000000000000000000200000000000000000000000000000000100000000000000010000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000160000006f0300010080000000000200000000000000a0000000190400ff3f00000000000080000000000200000000000000ff41000000000000000000000200000000000000000000000000000000100000000000000010000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000070000004b050007000000790600", 0x18d)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount$9p_fd(0x0, &(0x7f0000000200)='./mnt\x00', &(0x7f0000000400), 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESDEC=r2, @ANYBLOB=',wfdno=', @ANYRESDEC=r2, @ANYBLOB=',version=9p2000.L\x00'])
unlinkat(0xffffffffffffff9c, &(0x7f0000000600)='./mnt/dir\x00', 0x200)

6.849619984s ago: executing program 3 (id=23):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu/syz0\x00', 0x1ff)
rmdir(&(0x7f0000000080)='./cgroup.cpu/syz0\x00')
nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0)
nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0)
nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0)
nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0)
nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0)
nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0)
nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0)
nanosleep(&(0x7f0000000000)={0x0, 0x1dcd6500}, 0x0)

6.54089974s ago: executing program 4 (id=24):
r0 = syz_mount_image$jfs(&(0x7f0000005e00), &(0x7f0000005e40)='./file0\x00', 0x0, &(0x7f0000000080), 0x0, 0x5dcc, &(0x7f0000005ec0)="$eJzs3U1vHVf9B/Df3Cc/9N/W6qLqP0LITctDKc1jCYECbRewYMMCZYsSuW4VkQJKAkqriLjyhgUvAoTEEiGWrHgBXbBlxwsgUoIE6opBY5+TjCfXuQ6O79g+n4/kzPzmzPieyfc+embuCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgvv+9H56tIuLyL9KClYj/i2HEIGKpqVcjYml1Ja8/ioiXYqs5XoyI8UJEs/3WP89HvBkRnz4Xce/+7bVm8bk99uO7f/zb7370zA/++ofx6X//6ebwrd3Wu3Xr1//685397TMAAACUpq7rukof80+kz/eDvjsFAMxFfv2vk7xcrVar1Wr18avb6unutIuI2Ghv07xncDgeAI6Yjfis7y7QI/kXbRQRz/TdCeBQq/ruAAfi3v3ba1XKt2q/Hqxut+dzQXbkv1E9uL5jt+ks3XNM5nX/2oxhvLBLf5bm1IfDJOc/6OZ/ebt9ktY76PznZbf8J9uXPhUn5z/s5t9xfPIfTM2/VDn/0RPlP5Q/AAAAAAAcYvnv/ys9H/9d2P+u7Mnjjv+uzqkPAAAAAAAAAPC07Xf8vweM/wcAAACHVvNZvfGb5x4u2+272Jrll6qIZzvrA4VJF8ss990PAAAAAAAAAAAAACjJaPsc3ktVxDginl1eruu6+Wnr1k9qv9sfdaXvP5Ss7yd5AADY9ulznWv5q4jFiLiUvutvvLy8XNeLS8v1cr20kN/PThYW66XW59o8bZYtTPbwhng0qZtfttjarm3W5+VZ7d3f19zWpB7uoWPz0WPgABAR269G97wiHTN1/Xz0/S6Ho8Hj//jx+Gcv+r6fAgAAAAevruu6Sl/nfSId8x/03SkAYC7y63/3uIBarVar1erjV7fV091pFxGx0d6mec9gOH4AOGI24rO+u0CP5F+0UUS81HcngEOt6rsDHIh792+vVSnfqv16kMZ3z+eC7Mh/o9raLm8/bTpL9xyTed2/NmMYL+zSnxfn1IfDJOc/6OZ/ebt9ktY76PznZbf8m/1c6aE/fcv5D7v5dxyf/AdT8y9Vzn/0RPkP5Q8AAAAAAIdY/vv/iuO/eZcBAAAAAAAA4Mi5d//2Wr7uNR///9yU9Vz/eTzl/Cv5FynnP+jk/+XOesPW/N13H+b/z/u3135/8x//n6d7zX8hz1TpnlWle0SVbqkapel+9u5Rm+PhpLmlcTUYjtI5P/X4/bga12I9zuxYd5D+Px62n93R3vR0vKP93I720SPt53e0j9P3DtRLuf1UrMVP41q8t9XetC3M2P/FGe31jPac/9Djv0g5/1Hrp8l/ObVXnWnj7ieDRx737em023nn6ud/debgd2emzRg+2Le2Zv9O9tCfrf+TZybx8xvr10/dunLz5vWzkSY7lp6LNHnKcv7j9PPg+f+V7fb8vN9+vN79ZPLE+R8WmzHaNf9XWvPN/r425771Iec/ST85//dS+/TH/1HOf/fH/+s99AcAAAAAAAAAAAAAAAAep67rrUtE34mIC+n6n76uzQQA5iu//tdJXq5Wq9Vqtfr41W31dG+3i4j4S3ub5j3DL6f9MgDgMPtPRPy9707QG/kXLH/fXzN9te/OAHN146OPf3zl2rX16zf67gkAAAAAAAAA8L/K43+utsZ/fjUiVjrr7Rj/9d1Y3e/4n6M882CA0ac80PcuNgeT4aA13PjL8fjxv0/G48f/Hs24vfGM9smM9oUZ7Ysz2qde6NGS83+5Nd55k/+JzvDrJYz/2h3zvgQ5/5Ot+3OT/5c667Xzr397lPMf7Mj/9M0Pf3b6xkcfv3H1wysfrH+w/pPzZ8+eOX/hwsWLF0+/f/Xa+pntf3vs8cHK+eexr50HWpacf85c/mXJ+X8h1fIvS87/i6mWf1ly/vn9nvzLkvPPn33kX5ac/2upln9Zcv5fSbX8y5Lzfz3V8i9Lzv+rqZZ/WXL+b6Ra/mXJ+Z9KtfzLkvM/nWr5lyXnn49wyb8sOf98ZoP8y5LzP5dq+Zcl538+1fIvS87/zVTLvyw5/6+lWv5lyflfSLX8y5Lz/3qq5V+WnP/FVMu/LDn/b6Ra/mXJ+X8z1fIvS87/rVTLvyw5/2+lWv5lyfl/O9XyL0vO/zupln9Zcv5vp1r+ZXn4/f9mzJgxk2f6fmYCAAAAAAAAAAAAALrmcTpx3/sIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP9lBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCjtwIAAAAAAA5P/aCFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVXYubcYuer7DuBn17v22tycQKihhqyNY4xZ2PUFX9K6cQghFJKm3NLQC7brXZtNfMO7ToAi2RFJgxRHjapU5aVtEqGWlypWlYe0ohEPVas+lfYhfalSVcoDqkhEIlVqq5aN5sz//9+Z8dk5azw4M+d8PhL+eWfOzP/MmTOz+13zHQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABoteEjM18eyrKs8V/+x9osu7rx99Xja/PLPvjz3kMAAADgcv1//udb16UL9i/jRi3b/MOt//SdhYWFhezTK/5o9OsLC+mK8SwbXZVl+XXRhf94Yqh1m+CFbGxouOXr4ZLlV5RcP1Jy/WjJ9StLrl9Vcv1YyfUXHYCLrG7+Pia/s035X9c2D2l2QzaaX7ep4FYvDK0aHo6/y8kN5bdZGD2SzWbHsplsqm375rZD+favbmis9UAW1xpuWWt94wz5yfOH4z4MhWO8qW2txfuMfvThbPynP3n+8J/Pv3lT0Sw9DG3319zPLRsb+/nFcElzX4eyVemYxP0cbtnP9QXPyYq2/RzKb9f4e+d+vrXM/VyxuJtXVOdzPpYN539/PT9OI62/1kvHaX247L9vy7Ls3OJud25z0VrZcLam7ZLhxednrHlGNu6jcSq9Nxu5pPN0wzLO08ac3tR+nna+JuLzvyHcbmSJfWh9mn70hZUXPe+Xep5GjUe91Gul8xzs9WulX87BeF68nj/oFwvPwU3h8T+/eelzsPDcKTgH0+NuOQc3lp2DwytX5PucnoSh/DaL5+C2tu1X5CsN5fONzd3Pwcn546cm55597q7Z44eOzhydObFj27apHbt27dmzZ/LI7LGZqeaf7/Bo97812XB6DWwMxy6+Bm7v2Lb1VF34Zu9eh2NdXodrO7bt9etwpPPBDV2ZF+TF53TztfFY46CPnR/OlniN5c/P1st/HabH3fI6HGl5HRZ+Tyl4HY4s43XY2ObU1uX9zDLS8l/RPrxb3wvWtpyDnT+PdJ6Dvf55pF/OwbFwXvzb1qW/F6wP+/vixKX+PLLionMwPdzw3tO4JP28P7YnH0Xn5c2NK65amZ2Zmzl99zOH5udPb8vCuCKubzlXOs/XNS2PKbvofB2+5PN1/+ytL95ccPnacKzG7mr8Mbbkc9XYZufd3Z+r/Ltb8fFsu3R7FkaPXenjWfTdvHE8U5bscjwb23xx8vJ/Fk+5tOX9d3SJ99+Y+99urpfu6oUVoyPN1++KdHRG296P25+qkfy9ayhf+63J5b0fj4b/rvT78Q1d3o/XdWzb6/fj0c4HF9+Ph8p+23F5Op/PsXCeHJvq/n7c2Gbd9ks9J0e6vh/fFuZQOP53hKSQclHLubPUeZvWGhkZDY9rJK7Qfp7uaNt+NGSzxlqvbH9n5+mW25r3tSI9ukVX6jwd79i21+dper9a6jwdKvvt2zvT+XyOhfPihh3dz9PGNq/tvPz3ztXxry3vnSvLzsHRFSsb+zyaTsLm+/3C6ngO3p0dzk5mx7Lp/NqV+fk0lK81cc/yzsGV4b8r/V65rss5uKVj216fg+n72FLn3tDIxQ++Bzqfz7FwXrx0T/dzsLHNfbt7+7PrlnBJ2qblZ9fO368t9TuvmzsO07v5O6/Gfv7d7u6/m21sc2zPpebM7sfpznDJVQXHqfP1u9Rrajq7MsdpXdjPN/csfZwa+9PY5ut7l3k+7c+y7OzT9+a/7w3/vvJXZ77/nbZ/dyn6N52zT9/742uO/P2l7D8Ag+/t5ljT/F7X8i9Ty/n3fwAAAGAgxNw/HGYi/wMAAEBlxNwf/6/wRP4HAACAyoi5fyTMpCb5f919b86+fTZLzfyFIF6fDsODze1ix3UqfD2+sKhx+b0vz/zX35xd3trDWZb934O/V7j9ugfjfjWNh/288NH2yy++4dllrX/w8cXtWvvr3wj3Hx/Pck+DogruVJZlr1731Xyd8SfO5/O1Bw/m85FzL77Q2Oatvc2v4+3fuL65/Z+E8u/+I4fabv9GOA4/DHPqoeLjEW/37fN3rN/9qcX14u2GNl6bP+yXnmzeb/ycnK+90Nw+Huel9v9vv/LKtxvbP/OB4v0/O1y8/6+E+305zP+5pbl963PQ+Dre7kth/+N68XZ3f+t7hft/4cvN7U/d39zuYJhx/S3h6033vznberyeGTrU9riyjzW3i+tPff8P8uvj/cX779z/sQPn245H5/nx2r8072eyY/t4eVwn+uuO9Rv303p+xvVf+f2Dbce5bP0Lj7xxS+N+O9e/s2O7U09vzddfvL/2T2z60y99tXC9uD/7//JU2+PZ/3B4HYf1X3oynI/h+v+90Ly/zk9XOPhw+/tP3P4ba8+2PZ7ogZ8217/woaP5XDW2es1VV19z7bn3N45dlr3+aPP+ytY/+mcn2/b/mzc2j0e8Pnb0O9dfSlz/9OcnTpycOzM73XJU88/O+Xhzf+L+XhfeWzu/PnBy/qmZ0+NT41NZNl7dj9B7x74V5o+b49yl3n7r4+H5vPmPX12z+Z+/Ei//18eal59/qPl96/aw3dfC5WvD83e567+04cb89T30WvPrth57D6zf9J97lrVhePydPxfE8/3U+57Kj0Pjuvz7RnxdX+b+/2C6eT/fDcd1IXwy88YbF9dr3T5+NsL5R5uv98s+fuFtLj6vfxGe70/8sHn/cb/i4/1B+Dnme+va3+/i+fHds8Od959/ise58H6SnWteH7eKx/v8WzcW7l78HJLs3E3513+Y7uemS3qYS5l7dm7y2OyJM89Mzs/MzU/OPfvcgeMnz5yYP5B/lueBz5TdfvH9aU3+/jQ9s2tnlr9bnWyOd9nPe/9PPX54evfU5umZI4fOHJl//NTM6aOH5+YOz0zPbT505MjM58tuPzu9b9v2vTt2b584Oju9b8/evTv2TsyeONnYjeZOldg19dmJE6cP5DeZ27dz77Z77tk5NXH85PTMvt1TUxNnym6ff2+aaNz6cxOnZ44dmp89PjMxN/vczL5te3ft2l76aYDHTx2ZG588febE5Jm5mdOTzccyPp9f3PjeV3Z7qmnu35s/z3Yaan4QX/bJO3elz2dtePkLS95Vc5OODxB9M3wWzT++59Se5Xwdc/9omElN8j8AAADUQcz9K8NM5H8AAACojJj7V4WZyP8AAABQGTH3j4WZ1CT/6//r/+v/6//r/xevr/8/mPT/u9P/L6H/r/+v/6//T0/1W/8/5v7VWVbL/A8AAAB1EHP/mjAT+R8AAAAqI+b+q8JM5H8AAACojJj7rw4zqUn+1//X/9f/1//X/y9eX/9/MOn/d6f/X0L/X/9f/1//n57qt/5/zP3XhJnUJP8DAABAHcTcf22YifwPAAAAlRFz/3VhJvI/AAAAVEbM/WvDTGqS//X/9f/1//X/9f+L19f/H0z6/93p/5fQ/9f/1//X/6en+q3/H3P/e8JMapL/AQAAoA5i7n9vmIn8DwAAAJURc//1YSbyPwAAAFRGzP03hJnUJP/r/+v/6//r/+v/F6+v/z+Y9P+70/8vof+v/6//r/9PT/Vb/z/m/veFmdQk/wMAAEAdxNx/Y5iJ/A8AAACVEXP/L4SZyP8AAABQGTH3rwszqUn+1//X/9f/1//X/y9eX/9/MOn/d6f/X0L/X/9f/1//n57qt/5/zP03hZnUJP8DAABAHcTcf3OYifwPAAAAlRFz/y+Gmcj/AAAAUBkx968PM6lJ/tf/1//X/9f/1/8vXl//fzDp/3en/19C/1//X/9f/5+e6rf+f8z9t4SZ1CT/AwAAQB3E3H9rmIn8DwAAAJURc//7w0zkfwAAAKiMmPvHw0xqkv/1//X/9f/1//X/i9fX/x9M+v/d6f+X0P/X/9f/1/+np/qt/x9z/4Ywk5rkfwAAAKiDmPs3hpnI/wAAAFAZMfffFmYi/wMAAEBlxNy/KcykJvlf/1//X/9f/1//v3h9/f/BpP/fnf5/Cf1//X/9f/1/eqrf+v8x938gzKQm+R8AAADqIOb+zWEm8j8AAABURsz9t4eZyP8AAABQGTH3bwkzqUn+1//X/9f/1//X/y9eX/9/MOn/d6f/X0L/X/9f/1//n57qt/5/zP13hJnUJP8DAABAHcTcvzXMRP4HAACAyoi5/84wE/kfAAAAKiPm/okwk5rkf/1//X/9f/1//f/i9fX/B5P+f3f6/yX0//X/9f/1/+mpfuv/x9x/V5hJTfI/AAAA1EHM/XeHmcj/AAAAUBkx90+Gmcj/AAAAUBkx90+FmdQk/+v/6//r/+v/6/8Xr6//P5j0/7vT/y+h/6//r/+v/09P9Vv/P+b+bWEmNcn/AAAAUAcx928PM5H/AQAAoDJi7t8RZiL/AwAAQGXE3L8zzKQm+V//X/9f/1//X/+/eH39/8Gk/9+d/n8J/X/9f/1//X96qt/6/zH33xNmUpP8DwAAAHUQc/+uMBP5HwAAACoj5v7dYSbyPwAAAFRGzP17wkxqkv/1//X/9f/1//X/i9fX/x9M+v/d6f+X0P/X/9f/1/+np/qt/x9z/94wk5rkfwAAAKiDmPs/GGYi/wMAAEBlxNz/S2Em8j8AAABURsz9vxxmUpP8r/+v/6//r/+v/1+8vv7/YNL/707/v4T+v/6//r/+Pz3Vb/3/mPv3hZnUJP8DAABAHcTc/ythJvI/AAAAVEbM/R8KM5H/AQAAoDJi7t8fZlKT/K//r/+v/6//r/9fvL7+/2DS/+9O/7+E/r/+v/6//j891W/9/5j7PxxmUpP8DwAAAHUQc/+9YSbyPwAAAFRGzP0fCTOR/wEAAKAyYu6/L8ykJvlf/1//X/9f/1//v3h9/f/BpP/fnf5/Cf1//X/9f/1/eqrf+v8x9380zKQm+R8AAADqIOb++8NM5H8AAACojJj7PxZmIv8DAABAZcTc/0CYSU3yv/6//r/+v/6//n/x+vr/g0n/vzv9/xL6//r/+v/6//RUv/X/Y+7/1TCTmuR/AAAAqIOY+x8MM5H/AQAAoDJi7n8ozET+BwAAgMqIuf/jYSY1yf/6//r/+v/6//r/xevr/w8m/f/u9P9L6P/r/+v/6//TU/3W/4+5/xNhJjXJ/wAAAFAHMff/WpiJ/A8AAACVEXP/J8NM5H8AAACojJj7fz3MpCb5X/9f/1//X/9f/794ff3/waT/353+fwn9f/1//X/9f3qq3/r/Mfc/HGZSk/wPAAAAdRBz/yNhJvI/AAAAVEbM/Y+Gmcj/AAAAUBkx9z8WZlKT/K//r/+v/6//r/9fvL7+/2DS/+9O/7+E/r/+v/6//j891W/9/5j7Hw8zqUn+BwAAgDqIuf9TYSbyPwAAAFRGzP2/EWYi/wMAAEBlxNz/6TCTmuR//X/9f/1//X/9/+L19f8Hk/5/d/r/JfT/9f/1//X/6al+6//H3P9EmElN8j8AAADUQcz9vxlmIv8DAABAZcTc/1thJvI/AAAAVEbM/b8dZlKT/K//r/+v/6//r/9fvL7+/2DS/+9O/7+E/r/+v/6//j891W/9/5j7fyfMpCb5HwAAAOog5v4nw0zkfwAAAKiMmPsPhJnI/wAAAFAZMfcfDDOpSf7X/9f/1//X/9f/L15f/38w6f93p/9fQv9f/1//X/+fnuq3/n/M/YfCTGqS/wEAAKAOYu7/3TAT+R8AAAAqI+b+w2Em8j8AAABURsz902EmNcn/+v/6//r/+v/6/8Xr6/8PJv3/7vT/S+j/6//r/+v/01P91v+PuX8mzKQm+R8AAADqIOb+I2Em8j8AAABURsz9R8NM5H8AAACojJj7nwozqUn+1//X/9f/1//X/y9eX/9/MOn/d6f/X0L/X/9f/1//n57qt/5/zP2zYSY1yf8AAABQBzH3fybMRP4HAACAyoi5/7NhJvI/AAAAVEbM/cfCTGqS//X/9f/1//X/9f+L19f/H0z6/93p/5fQ/9f/1//X/6en+q3/H3P/8TCTmuR/AAAAqIOY+0+Emcj/AAAAUBkx958MM5H/AQAAoDJi7j8VZlKT/K//r/+v/6//r/9fvL7+/2DS/+9O/7+E/r/+v/6//j891W/9/5j7nw4zqUn+BwAAgDqIuf90mIn8DwAAAJURc/9cmIn8DwAAAJURc/98mElN8r/+v/6//r/+v/5/8fr6/4NJ/787/f8S+v/6//r/+v/0VL/1/2PuPxNmUpP8DwAAAHUQc//nwkzkfwB+xr49qwGw7mAYvexj27Zt27Ztn22bxW6SVPPMNFPMn6zVpEz9FS8AAG3k7n9S3GL/AwAAQBu5+58ctwzZ//p//b/+X/+v/9/+r/9fk/5/n/7/gP5f/6//1/9zqqv1/7n7nxK3DNn/AAAAMEHu/qfGLfY/AAAAtJG7/2lxi/0PAAAAbeTuf3rcMmT/6//1//p//b/+f/u//n9N+v99+v8D+n/9v/5f/8+prtb/5+5/RtwyZP8DAADABLn7nxm32P8AAADQRu7+Z8Ut9j8AAAC0kbv/2XHLkP2v/9f/6//1//r/7f/6/zXp//fp/w/o//X/+n/9P6e6Wv+fu/85ccuQ/Q8AAAAT5O5/btxi/wMAAEAbufufF7fY/wAAANBG7v7nxy1D9r/+X/+v/9f/6/+3/+v/16T/36f/P6D/1//r//X/nOpq/X/u/hfELUP2PwAAAEyQu/+FcYv9DwAAAG3k7n9R3GL/AwAAQBu5+18ctwzZ//p//b/+X/+v/9/+r/9fk/5/n/7/gP5f/6//1/9zqqv1/7n7XxK3DNn/AAAAMEHu/pfGLfY/AAAAtJG7/2Vxi/0PAAAAbeTuf3ncMmT/6//1//p//b/+f/u//n9N+v99+v8D+n/9v/5f/8+prtb/5+5/RdwyZP8DAADABLn7Xxm32P8AAADQRu7+V8Ut9j8AAAC0kbv/1XHLkP2v/9f/6//1//r/7f/6/zXp//fp/w/o//X/+n/9P6e6Wv+fu/81ccuQ/Q8AAAAT5O5/bdxi/wMAAEAbuftfF7fY/wAAANBG7v7Xxy1D9r/+X/+v/9f/6/+3/+v/16T/36f/P6D/1//r//X/nOpq/X/u/jfELUP2PwAAAEyQu/+NcYv9DwAAAG3k7n9T3GL/AwAAQBu5+98ctwzZ//p//b/+X/+v/9/+r/9fk/5/n/7/gP5f/6//1/9zqqv1/7n73xK3DNn/AAAAMEHu/rfGLfY/AAAAtJG7/21xi/0PAAAAbeTuf3vcMmT/6//1//p//b/+f/u//n9N+v99+v8D+n/9v/5f/8+prtb/5+5/R9wyZP8DAADABLn73xm32P8AAADQRu7+d8Ut9j8AAAC0kbv/3XHLkP2v/9f/6//1//r/7f/6/zXp//fp/w/o//X/+n/9P6e6Wv+fu/89ccuQ/Q8AAAAT5O5/b9xi/wMAAEAbufvfF7fY/wAAANBG7v73xy1D9r/+X/+v/9f/6/+3/+v/16T/36f/P6D/1//r//X/nOpq/X/u/g/ELUP2PwAAAEyQu/+DcYv9DwAAAG3k7v9Q3GL/AwAAQBu5+z8ctwzZ//p//b/+X/+v/9/+r/9fk/5/n/7/gP5f/6//1/9zqqv1/7n7PxK3DNn/AAAAMEHu/o/GLfY/AAAAtJG7/2Nxi/0PAAAAbeTu/3jcMmT/6//1//p//b/+f/u//n9N+v99+v8D+n/9v/5f/8+prtb/5+7/RNwyZP8DAADABLn7Pxm32P8AAADQRu7+T8Ut9j8AAAC0kbv/03HLkP2v/9f/6//1//r/7f/6/zXp//fp/w/o//X/+n/9P6e6Wv+fu/8zccuQ/Q8AAAAT5O7/bNxi/wMAAEAbufs/F7fY/wAAANBG7v7Pxy1D9r/+X/+v/9f/6/+3/+v/16T/36f/P6D/1//r//X/nOpq/X/u/i/ELUP2PwAAAEyQu/+LcYv9DwAAAG3k7v9S3GL/AwAAQBu5+78ctwzZ//p//b/+X/+v/9/+r/9fk/5/n/7/gP5f/6//1/9zqqv1/7n7vxK3DNn/AAAAMEHu/q/GLfY/AAAAtJG7/2txi/0PAAAAbeTu/3rcMmT/6//1//p//b/+f/u//n9N+v99+v8D+n/9v/5f/8+prtb/5+7/RtwyZP8DAADABLn7vxm32P8AAADQRu7+b8Ut9j8AAAC0kbv/23HLkP2v/9f/6//1//r/7f/6/zXp//fp/w/o//X/+n/9P6e6Wv+fu/87ccuQ/Q8AAAAT5O7/btxi/wMAAEAbufu/F7fY/wAAANBG7v7vxy1D9r/+X/+v/9f/6/+3/+v/16T/36f/P6D/1//r//X/nOpq/X/u/h/ELUP2PwAAAEyQu/+HcYv9DwAAAG3k7v9R3GL/AwAAQBu5+38ctwzZ//p//b/+X/+v/9/+r/9fk/5/n/7/gP5f/6//1/9zqqv1/7n7fxK3DNn/AAAAMEHu/p/GLfY/AAAAtJG7/2dxi/0PAAAAbeTu/3ncMmT/6//1//p//b/+f/u//n9N+v99+v8D+n/9v/5f/8+prtb/5+7/RdwyZP8DAADABLn7fxm32P8AAADQRu7+X8Ut9j8AAAC0kbv/13HLkP2v/9f/6//1//r/7f/6/zXp//fp/w/o//X/+n/9P6e6Wv+fu/83ccuQ/Q8AAAAT5O7/bdxi/wMAAEAbuft/F7fY/wAAANBG7v7fxy1D9r/+X/+v/9f/6/+3/+v/16T/36f/P6D/1//r//X/nOpq/X/u/j/ELUP2PwAAAEyQu/+PcYv9DwAAAG3k7v9T3GL/AwAAQBu5+/8ctwzZ//p//b/+X/+v/9/+r/9fk/5/n/7/gP5f/6//1/9zqqv1/7n7/xK3DNn/AAAAMEHu/r/GLfY/AAAAtJG7/29xi/0PAAAAbeTu/3vcMmT/6//1//p//b/+f/u//n9N+v99+v8D+n/9v/5f/8+prtb/5+7/R9wyZP8DAADABLn7/xm32P8AAADQRu7+f8Ut9j8AAAC0kbv/33HLkP2v/9f/6//1//r/7f/6/zXp//fp/w/o//X/+n/9P6e6Wv+fu/8/ccuQ/Q8AAAAT5O7/b9xi/wMAAEAbufv/F7fY/wAAANBG7v7/xy1D9r/+X/+v/9f/6/+3/+v/16T/36f/P6D/1//r//X/nOpq/X/u/hviliH7HwAAACbI3X9j3GL/AwAAQBu5+2+KW+x/AAAAaCN3/81xy5D9r//X/+v/9f/6/+3/+v816f/36f8P6P/1//p//T+nulr/n7v/lrhlyP4HAACACXL33xq32P8AAADQRu7+2+IW+x8AAADayN1/e9wyZP/r//X/+n/9v/5/+7/+f036/336/wP6f/2//l//z6mu1v/n7r8jbhmy/wEAAGCC3P13xi32PwAAALSRu/+uuMX+BwAAgDZy998dtwzZ//p//b/+X/+v/9/+r/9fk/5/n/7/gP5f/6//1/9zqqv1/7n774lbhux/AAAAmCB3/71xi/0PAAAAbeTuvy9usf8BAACgjdz998ctQ/a//l//r//X/+v/t//r/9ek/9+n/z+g/9f/6//1/5zqav1/7v4H4pYh+x8AAAAmyN3/YNxi/wMAAEAbufsfilvsfwAAAGgjd//DccuQ/a//1//r//X/+v/t//r/Nen/9+n/D+j/9f/6f/0/p7pa/5+7/5G4Zcj+BwAAgAly9z8at9j/AAAA0Ebu/sfiFvsfAAAA2sjd/3jcMmT/6//1//p//b/+f/u//n9N+v99+v8D+n/9v/5f/8+prtb/5+5/IgAA///Dtn2t")
r1 = openat(r0, &(0x7f0000006000)='file1\x00', 0x42, 0x1ff)
syz_io_uring_setup(0x1, &(0x7f0000000000), &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000200)=<r3=>0x0, &(0x7f0000000300)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000400)=@IORING_OP_FALLOCATE={0x11, 0x0, 0x0, @fd=r1, 0x0, 0x0, 0x1000})
mount(0x0, &(0x7f0000005e40)='./file0\x00', 0x0, 0x21, 0x0)

6.531413716s ago: executing program 2 (id=25):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='+4\x00', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000140)='tcp 2049\x00', 0x8)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f00000001c0)='1\x00', 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000240)=@filename='127.0.0.1:/\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000280)='nfs4\x00', 0x0, &(0x7f00000002c0)='addr=127.0.0.1,nolock\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mnt/file\x00', 0x42, 0x1ff)
fchmod(r3, 0x1ff)

6.342292944s ago: executing program 5 (id=26):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'syz_tun\x00', &(0x7f0000000280)=@ethtool_ringparam={0x11, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x80}})
ioctl(r0, 0x8946, &(0x7f0000000080)="65746830000000000000000000000000800200000000007f")

5.856195833s ago: executing program 4 (id=27):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0)
write(r0, &(0x7f0000000040)='add syz0 127.0.0.1\n', 0x13)
close(r0)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1b5b, @loopback}}, 0x24)
listen(r1, 0xa)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x10, 0x110, 0xe}], 0x28}, 0x0)
r2 = syz_io_uring_setup(0x10, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000001100)=<r3=>0x0, &(0x7f0000001108)=<r4=>0x0, &(0x7f0000001110)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x0, r1, 0x0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000500)=""/1024, 0x400}], 0x1}})
syz_io_uring_submit(r3, r4, r5, &(0x7f0000001300)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r1, 0x0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000900)="ff00"/1048, 0x418}], 0x1, &(0x7f0000000a00)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}})
io_uring_enter(r2, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff)
mount$afs(&(0x7f0000000d00)=@cell={0x23, 'syz0:', 'syz0'}, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0)

5.36512589s ago: executing program 4 (id=28):
syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ffffff406d04000900000102030109021b0001010080fa0904000001ff000000090581010002010000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = syz_open_dev$video(&(0x7f0000000100), 0x1, 0x2)
ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000200)={0x1, 0x1, 0x1})
ioctl$VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000400)=@mmap={0x0, 0x1})
ioctl$VIDIOC_STREAMON(r0, 0x40045612, &(0x7f0000000500)=0x1)

5.302622906s ago: executing program 0 (id=29):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
rmdir(&(0x7f0000000080)='./config/vkms\x00')

4.965813552s ago: executing program 5 (id=30):
r0 = syz_usb_connect(0x0, 0x43, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040402020b10000000000010902310002010080320904000000ffffff00080b0101ffffff000904010002ffffff000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000200)={0x40, 0xd, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100))
syz_usb_control_io(r0, 0x0, &(0x7f0000000100))
syz_usb_control_io(r0, 0x0, &(0x7f0000000100))
syz_usb_control_io(r0, 0x0, &(0x7f0000000100))
syz_usb_control_io(r0, 0x0, &(0x7f0000000100))
syz_usb_control_io(r0, 0x0, &(0x7f0000000100))
syz_usb_control_io(r0, 0x0, &(0x7f0000000100))
syz_usb_control_io(r0, 0x0, &(0x7f0000000100))
syz_usb_control_io(r0, 0x0, &(0x7f0000000100))

4.825674646s ago: executing program 2 (id=31):
r0 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000080)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0)
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x10, &(0x7f0000000000)=@ready={0x0, 0x0, 0x8, 'BBBB'})
syz_usb_ep_write$ath9k_ep2(r0, 0x83, 0x12, &(0x7f0000000200)=@conn_svc_rsp={0x0, 0x0, 0xa, 'BBBB', {0x2, 0x100, 0x0, 0x1, 0x100}})
nanosleep(&(0x7f0000000300)={0x5}, 0x0)

4.67919928s ago: executing program 1 (id=32):
r0 = syz_usb_connect(0x0, 0x2b, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040501d4d610000000000010902190001010080fa0904000001ff00000007050202000200"], 0x0)
syz_usb_control_io(r0, &(0x7f0000000500)={0x2c, &(0x7f0000000600)=ANY=[@ANYBLOB="0003020000000203"], 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)={0xc, &(0x7f0000000200)=ANY=[@ANYBLOB="40011e0000004d61501d0100000000000000000050000000500000005000000050000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async)
nanosleep(&(0x7f0000000300)={0x3}, 0x0)
r1 = syz_open_dev$dri(&(0x7f0000000400), 0x0, 0x0)
ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f})
ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20})
ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21})
ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x22})
r2 = syz_open_dev$dri(&(0x7f0000000400), 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f})
ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20})
ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21})
ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x22})

4.342900238s ago: executing program 0 (id=33):
syz_usb_connect(0x3, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd0c39000101020301010902200001010080fa0904000002ffffff000705010200020007058102000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x2}, 0x0)
r0 = syz_open_dev$I2C(&(0x7f0000000180), 0x6, 0x0)
ioctl$I2C_RDWR(r0, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1})
r1 = syz_open_dev$I2C(&(0x7f0000000180), 0x7, 0x0)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1})
r2 = syz_open_dev$I2C(&(0x7f0000000180), 0x8, 0x0)
ioctl$I2C_RDWR(r2, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1})
r3 = syz_open_dev$I2C(&(0x7f0000000180), 0x9, 0x0)
ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1})
r4 = syz_open_dev$I2C(&(0x7f0000000180), 0xa, 0x0)
ioctl$I2C_RDWR(r4, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1})
r5 = syz_open_dev$I2C(&(0x7f0000000180), 0xb, 0x0)
ioctl$I2C_RDWR(r5, 0x707, &(0x7f0000000200)={&(0x7f0000000240)=[{0x0, 0x0, 0x1, &(0x7f0000000280)='\x00'}], 0x1})

4.141366367s ago: executing program 3 (id=34):
syz_mount_image$ext4(&(0x7f0000000680)='ext4\x00', &(0x7f00000006c0)='./file0\x00', 0x0, &(0x7f0000000700), 0x1, 0x676, &(0x7f0000000740)="$eJzs3UtsXFcZB/DvXj/IY8COkgXpBkMWRUKxPXFcBQRqi1jw6AJEF1SqBFYycayMkxC7VWyMaAMSjwVCXdAFUlVY0FJAWBTUIkBYPFYgVIlKqAgiYAWVqqK2YoU06Ixn7KG+rp36cSvu7yddz7nnzOR84+Q/917lHjuAyhpJX/KI4xExnEUM9Yz1R2dwZPV5SxPLF9KWRav18RezyCJiZmL5Qvf5WefxcOfFZyLil++POPHFjfPOLSxenGo2G1c7+2Pzs1fG5hYWT87MTk03phuXTtVvq58Zr09Ont619/rnH99/9PbDH/7J95997IfXvnXxb1ncEbXOWO/72C0jMbL2PenVn0XctduTlaSv8+9koOxCuGlfuO/sl9Pf39GIOBERR2Io+jqpv+Ud9740FNf+stlr//WrR/65n7UCu6/1uYgWUEllf/4AAAAAAAAAAAAAAAAAAADrWq3M+n+oqLI/fwAAAAAAAAAAAAAAAAAAgI1mJpYvdLf9mvOPP9uvmYAiL9wZEf2r+V/qbKsj/THSfjwQAxFx6OUsPW1NFhEf3eHcK3dEjMT7Hp7/xD3fSVt0Pod2+McC2/TAgxHx1qLjf9bO/3AcaO8dejn/n/zn6bWdx9R//XXMffy5lP+Z7/X2yT/sn53k/2s9+X/odcx98hsp/1//UW+f/EM1LP267AqAsnzo6bIrgGprn/+P9/dvdv6/E1e2GP/PXDr/f/HdvX3O/6EaHv9M2RUAZfnpD8quACjLV/9QdgVQbSt3puv/ov//y9fu/4mC+39qEfGpHc49+fN0/f/2o719rv9h/3Tv/1vacP/fev77Nrn/79FtztH69/Sxov5jT6X8P3qte/9f2tL83XsBgb31woMRtxTmP1vLf1aQ/zwilrc5x9Jv750t6j96d8r/4/fLP5Sj9c2IW6M4/12pNTY/e2VsbmHx5Mzs1HRjunHpVP22+pnx+uTk6bHzM83G+OrXwjnqD13/fFH/87en/A9dl38oRzr+H9ok/1ud/69sc45PfmX4Y0X9p+9J+f/AxGvnP39+MLs7lRCDnZ5rU/PzV+sRg9ldG/tP3ex3AKqjm5FuhlL+33nita//i87/D0bEM9ucc/HqU98t6n/ksZT/bz/h+A/lSPk/t8Xxvyj/qe+v25zjvS/9vnB50JN/Svn/+2flHwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIA3qjwiapHlo2vtPB8djTgcEcfiUN68PDf/rvOX77t0Lo1FDMdA3v1N/0Or+1nar7fb6/unXrU/ERFHIuJLfQfb+6NnLzfPlf3moaJqETee/PTZwbLrAAAAAAAAAAAAAAAAAAAA1h1+1fr/f/Strv8H/n/VIm48+5unf5Har/SVXQ2wn1L+n3hl9iMh/1A58g/VJf9QXfIP1SX/UF3yD9Ul/1Bd8g/VJf9QXfIP1dWbfwAAAAAAAAAAAAAAAAAAAAAAAABgbx1528pzWUQ88J6D7S0Z7IwNlFoZsNfysgsASuNHf0N19ZddAFAa1/hAtsX4gc0GVrZ6JQAAAAAAAAAAAACwW249bv0/VJX1/1Bd1v9DdVn/D9XlGh+w/h8AAAAAAAAAAAAA3vhq7S3LRztrgWuR56OjEW+OiOEYyM7PNBvjEfGWiPhd38Cb0n697KKBHalF3PjgM8ceLrsOAAAAAAAAAAAAAAAAAABg3dzC4sWpZrNxVUNDQ2OtUfYnEwAAAAAAAAAAAAAAAAAAVM/6ot+yKwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA8qz//v+9a5T9HgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBm/TcAAP//7HpP/g==")
syz_open_dev$loop(&(0x7f0000000000), 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff)

3.622039662s ago: executing program 3 (id=35):
syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff040140861246200001000000010902200001010080fa0904000002ff0401000705810200020007050202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r0)
sendmsg$NFC_CMD_DEV_UP(r0, &(0x7f0000000200)={&(0x7f0000000240), 0xc, &(0x7f0000000280)={&(0x7f0000000300)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, 0x2}]}, 0x1c}}, 0x0) (async)

2.732221988s ago: executing program 4 (id=36):
r0 = syz_usb_connect(0x0, 0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040840508000201000000010902200001010080fa09040000020806f4000705810200020007050202000200"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x84, &(0x7f0000000140)={0xc0, 0x98, 0x2, "1400"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, &(0x7f0000000240)={0xc0, 0x98, 0x2, "1400"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000300)={0x84, &(0x7f0000000340)={0xc0, 0x98, 0x2, "1400"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000400)={0x84, &(0x7f0000000440)={0xc0, 0x9a, 0x4, '\x00s\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_ep_read(r0, 0x2, 0x9, &(0x7f0000000500)=""/9)
nanosleep(&(0x7f0000000600)={0x1}, 0x0)
r1 = syz_open_dev$sg(&(0x7f0000000700), 0x0, 0x0)
ioctl$SG_IO(r1, 0x2285, &(0x7f0000000800)={0x53, 0xfffffffffffffffe, 0xa, 0x0, @buffer={0x0, 0x200, &(0x7f0000000900)=""/512}, &(0x7f0000000a00)="2a00ffffffff00000100", &(0x7f0000000b00)=""/32, 0x3e8, 0x0, 0x0, 0x0})

1.806537236s ago: executing program 5 (id=37):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='devtmpfs\x00', &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
syz_usb_connect(0x0, 0x47, &(0x7f0000000100)=ANY=[@ANYBLOB="12010002ff0000405e04750700010102000109023500010100a0320904000005ff0000000705810200020007058202000200070583020002000705840200020007058602000200"], 0x0)
nanosleep(&(0x7f0000000200)={0x1}, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0)
ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000000100"/20)
ioctl(r0, 0xc0405610, &(0x7f0000000500)="0100"/64)
ioctl(r0, 0xc0145608, &(0x7f0000000b00)="00000000010000000100"/20)
ioctl(r0, 0xc0145608, &(0x7f0000000600)="03000000010000000400"/20)
ioctl(r0, 0xc058560f, &(0x7f0000000700)="0000000001000000002c0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000400000000000000002c0100"/88)
ioctl(r0, 0xc058560f, &(0x7f0000000800)="0000000001000000002c0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000500000000000000002c0100"/88)
ioctl(r0, 0xc058560f, &(0x7f0000000900)="0000000001000000002c0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000600000000000000002c0100"/88)
ioctl(r0, 0xc058560f, &(0x7f0000000a00)="0000000001000000002c0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000700000000000000002c0100"/88)
ioctl(r0, 0xc0145608, &(0x7f0000000b00)="00000000010000000400"/20)

1.510493007s ago: executing program 1 (id=38):
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/vhci\x00', 0x2, 0x0)
write(r0, &(0x7f0000000180)="ff00", 0x2)
write(r0, &(0x7f00000001c0)="040e0401030c00", 0x7)
write(r0, &(0x7f0000000200)="040e0c010310000000000060000000", 0xf)
write(r0, &(0x7f0000000240)="040e0c010110000b00000b00000000", 0xf)
write(r0, &(0x7f0000000280)="040e0a01091000aaaaaaaa10", 0xd)
write(r0, &(0x7f00000002c0)="040e0c010320000010000000000000", 0xf)
write(r0, &(0x7f0000000300)="040e0701022000000101", 0xa)
write(r0, &(0x7f0000000340)="040e0c011c20000000000000000000", 0xf)
write(r0, &(0x7f0000000380)="040e05010f200001", 0x8)
write(r0, &(0x7f00000003c0)="040e05012a200001", 0x8)
write(r0, &(0x7f0000000400)="040e0c012f20000001000100010001", 0xf)
write(r0, &(0x7f0000000440)="040e05013b200001", 0x8)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0x0, 0x3}, 0x6)
write(r1, &(0x7f0000000480)="5400000012000100"/24, 0x18)

1.212284397s ago: executing program 2 (id=39):
r0 = syz_usb_connect(0x2, 0xab, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ef020140000000000001000000010902a1000201008032080b00020e03000009040000000e0100000d240100012700006cdc020101112402010102000000000000000002000009240302010100010009040100000e0200000e240101470081000200000001001b240401015955593200001000800000aa00389b711001000000001e240501008002e00100000000000000000060090015160500011516050009040101010e02000007058105000401"], &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000500)={0x84, &(0x7f0000000600)=ANY=[@ANYBLOB="20811a00"/36], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r1 = syz_open_dev$video(&(0x7f0000000100), 0x0, 0x0)
ioctl$VIDIOC_TRY_FMT(r1, 0xc0cc5640, &(0x7f0000000200)={0x1, @pix={0x280, 0x1e0, 0x56595559, 0x1}})

761.458163ms ago: executing program 0 (id=40):
syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040e91700000000000000010902120001010080fa0904000000ff000000"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/dri/0/VGA-1/edid_override\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/dri/1/VGA-1/edid_override\x00', 0x2, 0x0)
write(r0, &(0x7f0000000400)="00ffffffffffff0004430000000000000000010480000000010000000000000000000000000001010101010101010101010101010101000000fd00000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002a", 0x80)
write(r1, &(0x7f0000000400)="00ffffffffffff0004430000000000000000010480000000010000000000000000000000000001010101010101010101010101010101000000fd00000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002a", 0x80)
r2 = syz_open_dev$dri(&(0x7f0000000500), 0x0, 0x2)
r3 = syz_open_dev$dri(&(0x7f0000000540), 0x1, 0x2)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)=[<r4=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)=[<r5=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r2, 0xc05064a7, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4})
ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r3, 0xc05064a7, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5})

334.742656ms ago: executing program 3 (id=41):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/fs/cifs/open_files\x00', 0x0, 0x0)
r1 = syz_io_uring_setup(0xf00, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000140)=<r2=>0x0, &(0x7f0000000180)=<r3=>0x0, &(0x7f00000001c0)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_TIMEOUT={0xb, 0x4, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x0, 0x5f5e100}})
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000340)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r0, 0x0, &(0x7f0000000500)=""/256, 0x100, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r1, 0x2, 0x0, 0x0, 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345\x00')

0s ago: executing program 3 (id=42):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000b00)='-2 -3 +4\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000300)='tcp 2049\n', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000500)='8\n', 0x2) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./nfs4\x00', 0x1ff)
mount$nfs4(&(0x7f0000000700)='127.0.0.1:/\x00', &(0x7f0000000600)='./nfs4\x00', &(0x7f0000000800), 0x0, &(0x7f0000000900)={[{'addr=127.0.0.1'}, {'vers=4'}]})

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.1.32' (ED25519) to the list of known hosts.
[   91.356168][   T24] cfg80211: failed to load regulatory.db
[   94.343440][ T5607] cgroup: Unknown subsys name 'net'
[   94.486111][ T5607] cgroup: Unknown subsys name 'cpuset'
[   94.497267][ T5607] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   96.328177][ T5607] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   99.095580][ T5635] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   99.108594][ T5638] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[   99.131325][ T5636] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   99.133520][ T5640] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   99.139628][ T5636] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   99.149855][ T5640] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   99.164209][ T5636] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   99.164519][ T5640] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   99.173217][ T5636] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   99.179276][ T5640] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   99.189452][ T5636] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[   99.200857][ T5640] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   99.203611][ T5636] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   99.209819][ T5640] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   99.217512][ T5636] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[   99.222448][ T5644] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   99.231331][ T5636] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   99.238182][ T5640] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   99.248022][ T5636] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   99.252809][ T5644] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[   99.264952][ T5640] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   99.269186][ T5645] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   99.274057][ T5640] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[   99.281191][ T5636] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   99.297300][ T5645] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   99.308166][ T5647] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   99.318120][ T5636] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   99.326285][ T5645] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   99.338231][ T4937] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   99.349722][ T4937] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  101.431402][ T5630] Bluetooth: hci1: command tx timeout
[  101.437346][ T5645] Bluetooth: hci4: command tx timeout
[  101.437383][ T5638] Bluetooth: hci2: command tx timeout
[  101.444109][ T5630] Bluetooth: hci0: command tx timeout
[  101.449345][ T5641] Bluetooth: hci5: command tx timeout
[  101.455420][ T5645] Bluetooth: hci3: command tx timeout
[  102.081173][ T5625] bridge0: port 1(bridge_slave_0) entered blocking state
[  102.089948][ T5625] bridge0: port 1(bridge_slave_0) entered disabled state
[  102.097479][ T5625] bridge_slave_0: entered allmulticast mode
[  102.105688][ T5625] bridge_slave_0: entered promiscuous mode
[  102.189813][ T5625] bridge0: port 2(bridge_slave_1) entered blocking state
[  102.197252][ T5625] bridge0: port 2(bridge_slave_1) entered disabled state
[  102.205027][ T5625] bridge_slave_1: entered allmulticast mode
[  102.213049][ T5625] bridge_slave_1: entered promiscuous mode
[  102.269003][ T5628] bridge0: port 1(bridge_slave_0) entered blocking state
[  102.276465][ T5628] bridge0: port 1(bridge_slave_0) entered disabled state
[  102.283832][ T5628] bridge_slave_0: entered allmulticast mode
[  102.291884][ T5628] bridge_slave_0: entered promiscuous mode
[  102.346311][ T5628] bridge0: port 2(bridge_slave_1) entered blocking state
[  102.353875][ T5628] bridge0: port 2(bridge_slave_1) entered disabled state
[  102.361361][ T5628] bridge_slave_1: entered allmulticast mode
[  102.369714][ T5628] bridge_slave_1: entered promiscuous mode
[  102.449292][ T5625] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  102.511861][ T5625] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  102.521237][ T5631] bridge0: port 1(bridge_slave_0) entered blocking state
[  102.528832][ T5631] bridge0: port 1(bridge_slave_0) entered disabled state
[  102.536195][ T5631] bridge_slave_0: entered allmulticast mode
[  102.544374][ T5631] bridge_slave_0: entered promiscuous mode
[  102.596024][ T5628] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  102.619413][ T5631] bridge0: port 2(bridge_slave_1) entered blocking state
[  102.626840][ T5631] bridge0: port 2(bridge_slave_1) entered disabled state
[  102.634787][ T5631] bridge_slave_1: entered allmulticast mode
[  102.642998][ T5631] bridge_slave_1: entered promiscuous mode
[  102.695407][ T5628] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  102.732885][ T5629] bridge0: port 1(bridge_slave_0) entered blocking state
[  102.740891][ T5629] bridge0: port 1(bridge_slave_0) entered disabled state
[  102.748314][ T5629] bridge_slave_0: entered allmulticast mode
[  102.756684][ T5629] bridge_slave_0: entered promiscuous mode
[  102.766292][ T5626] bridge0: port 1(bridge_slave_0) entered blocking state
[  102.773504][ T5626] bridge0: port 1(bridge_slave_0) entered disabled state
[  102.780994][ T5626] bridge_slave_0: entered allmulticast mode
[  102.788865][ T5626] bridge_slave_0: entered promiscuous mode
[  102.797617][ T5627] bridge0: port 1(bridge_slave_0) entered blocking state
[  102.804909][ T5627] bridge0: port 1(bridge_slave_0) entered disabled state
[  102.812911][ T5627] bridge_slave_0: entered allmulticast mode
[  102.821461][ T5627] bridge_slave_0: entered promiscuous mode
[  102.846929][ T5625] team0: Port device team_slave_0 added
[  102.866173][ T5629] bridge0: port 2(bridge_slave_1) entered blocking state
[  102.873952][ T5629] bridge0: port 2(bridge_slave_1) entered disabled state
[  102.881851][ T5629] bridge_slave_1: entered allmulticast mode
[  102.889808][ T5629] bridge_slave_1: entered promiscuous mode
[  102.897469][ T5626] bridge0: port 2(bridge_slave_1) entered blocking state
[  102.905479][ T5626] bridge0: port 2(bridge_slave_1) entered disabled state
[  102.912968][ T5626] bridge_slave_1: entered allmulticast mode
[  102.921368][ T5626] bridge_slave_1: entered promiscuous mode
[  102.928668][ T5627] bridge0: port 2(bridge_slave_1) entered blocking state
[  102.936527][ T5627] bridge0: port 2(bridge_slave_1) entered disabled state
[  102.944478][ T5627] bridge_slave_1: entered allmulticast mode
[  102.953694][ T5627] bridge_slave_1: entered promiscuous mode
[  102.977898][ T5625] team0: Port device team_slave_1 added
[  102.986845][ T5631] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  103.041605][ T5628] team0: Port device team_slave_0 added
[  103.064098][ T5631] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  103.120830][ T5628] team0: Port device team_slave_1 added
[  103.156644][ T5629] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  103.169604][ T5626] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  103.184273][ T5627] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  103.209500][ T5625] batman_adv: batadv0: Adding interface: batadv_slave_0
[  103.216893][ T5625] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  103.242941][ T5625] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  103.273076][ T5629] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  103.285299][ T5626] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  103.311528][ T5627] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  103.336885][ T5625] batman_adv: batadv0: Adding interface: batadv_slave_1
[  103.344218][ T5625] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  103.370473][ T5625] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  103.384473][ T5631] team0: Port device team_slave_0 added
[  103.445772][ T5628] batman_adv: batadv0: Adding interface: batadv_slave_0
[  103.452890][ T5628] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  103.478891][ T5628] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  103.501843][ T5631] team0: Port device team_slave_1 added
[  103.511648][ T5645] Bluetooth: hci3: command tx timeout
[  103.517095][ T5630] Bluetooth: hci0: command tx timeout
[  103.522577][ T5636] Bluetooth: hci2: command tx timeout
[  103.522604][ T5638] Bluetooth: hci5: command tx timeout
[  103.527988][ T5636] Bluetooth: hci4: command tx timeout
[  103.533598][ T5641] Bluetooth: hci1: command tx timeout
[  103.546627][ T5626] team0: Port device team_slave_0 added
[  103.565095][ T5627] team0: Port device team_slave_0 added
[  103.571648][ T5628] batman_adv: batadv0: Adding interface: batadv_slave_1
[  103.578627][ T5628] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  103.605978][ T5628] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  103.635192][ T5629] team0: Port device team_slave_0 added
[  103.643868][ T5629] team0: Port device team_slave_1 added
[  103.651587][ T5626] team0: Port device team_slave_1 added
[  103.672959][ T5627] team0: Port device team_slave_1 added
[  103.771713][ T5631] batman_adv: batadv0: Adding interface: batadv_slave_0
[  103.779267][ T5631] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  103.805447][ T5631] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  103.832271][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_0
[  103.839289][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  103.865740][ T5626] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  103.912352][ T5625] hsr_slave_0: entered promiscuous mode
[  103.919639][ T5625] hsr_slave_1: entered promiscuous mode
[  103.927846][ T5631] batman_adv: batadv0: Adding interface: batadv_slave_1
[  103.934954][ T5631] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  103.961030][ T5631] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  103.973007][ T5629] batman_adv: batadv0: Adding interface: batadv_slave_0
[  103.980140][ T5629] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  104.006859][ T5629] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  104.019061][ T5626] batman_adv: batadv0: Adding interface: batadv_slave_1
[  104.028417][ T5626] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  104.084760][ T5626] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  104.106372][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_0
[  104.118069][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  104.146109][ T5627] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  104.181951][ T5629] batman_adv: batadv0: Adding interface: batadv_slave_1
[  104.189175][ T5629] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  104.216130][ T5629] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  104.239933][ T5627] batman_adv: batadv0: Adding interface: batadv_slave_1
[  104.247094][ T5627] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  104.274192][ T5627] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  104.294694][ T5628] hsr_slave_0: entered promiscuous mode
[  104.303630][ T5628] hsr_slave_1: entered promiscuous mode
[  104.310155][ T5628] debugfs: 'hsr0' already exists in 'hsr'
[  104.316492][ T5628] Cannot create hsr debugfs directory
[  104.365661][ T5631] hsr_slave_0: entered promiscuous mode
[  104.372542][ T5631] hsr_slave_1: entered promiscuous mode
[  104.378977][ T5631] debugfs: 'hsr0' already exists in 'hsr'
[  104.384838][ T5631] Cannot create hsr debugfs directory
[  104.559728][ T5626] hsr_slave_0: entered promiscuous mode
[  104.567051][ T5626] hsr_slave_1: entered promiscuous mode
[  104.573508][ T5626] debugfs: 'hsr0' already exists in 'hsr'
[  104.579264][ T5626] Cannot create hsr debugfs directory
[  104.591637][ T5629] hsr_slave_0: entered promiscuous mode
[  104.598239][ T5629] hsr_slave_1: entered promiscuous mode
[  104.605139][ T5629] debugfs: 'hsr0' already exists in 'hsr'
[  104.611056][ T5629] Cannot create hsr debugfs directory
[  104.696438][ T5627] hsr_slave_0: entered promiscuous mode
[  104.703234][ T5627] hsr_slave_1: entered promiscuous mode
[  104.709466][ T5627] debugfs: 'hsr0' already exists in 'hsr'
[  104.715483][ T5627] Cannot create hsr debugfs directory
[  105.433950][ T5625] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  105.454606][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  105.463152][ T5625] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  105.475609][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  105.484238][ T5625] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  105.495026][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  105.504355][ T5625] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  105.515867][ T5625] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  105.591571][ T5638] Bluetooth: hci4: command tx timeout
[  105.597600][ T4937] Bluetooth: hci3: command tx timeout
[  105.597653][ T5630] Bluetooth: hci5: command tx timeout
[  105.604226][ T4937] Bluetooth: hci1: command tx timeout
[  105.609187][ T5636] Bluetooth: hci2: command tx timeout
[  105.614557][ T5641] Bluetooth: hci0: command tx timeout
[  105.638962][ T5631] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  105.655435][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  105.668669][ T5631] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  105.682056][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  105.690242][ T5631] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  105.702255][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  105.728405][ T5631] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  105.743090][ T5631] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  105.859201][ T5626] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  105.871422][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  105.880193][ T5626] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  105.892176][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  105.901717][ T5626] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  105.914732][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  105.923643][ T5626] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  105.934261][ T5626] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  106.085288][ T5625] 8021q: adding VLAN 0 to HW filter on device bond0
[  106.116322][ T5629] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  106.128911][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  106.145601][ T5629] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  106.156550][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  106.176315][ T5629] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  106.191918][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  106.208305][ T5625] 8021q: adding VLAN 0 to HW filter on device team0
[  106.238508][ T5629] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  106.249882][ T5629] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  106.284410][ T1166] bridge0: port 1(bridge_slave_0) entered blocking state
[  106.292512][ T1166] bridge0: port 1(bridge_slave_0) entered forwarding state
[  106.335706][   T12] bridge0: port 2(bridge_slave_1) entered blocking state
[  106.342964][   T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[  106.413880][ T5631] 8021q: adding VLAN 0 to HW filter on device bond0
[  106.433575][ T5627] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  106.447757][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  106.459004][ T5627] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  106.473075][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  106.483787][ T5627] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  106.494952][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  106.503346][ T5627] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  106.516607][ T5627] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  106.647865][ T5628] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  106.662698][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  106.688749][ T5631] 8021q: adding VLAN 0 to HW filter on device team0
[  106.696254][ T5628] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  106.709540][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  106.735273][ T5628] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  106.746284][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  106.772550][ T5628] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  106.786996][ T5628] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  106.821486][   T12] bridge0: port 1(bridge_slave_0) entered blocking state
[  106.828651][   T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[  106.847363][ T5626] 8021q: adding VLAN 0 to HW filter on device bond0
[  106.859989][  T973] bridge0: port 2(bridge_slave_1) entered blocking state
[  106.867166][  T973] bridge0: port 2(bridge_slave_1) entered forwarding state
[  107.017777][ T5626] 8021q: adding VLAN 0 to HW filter on device team0
[  107.071188][   T13] bridge0: port 1(bridge_slave_0) entered blocking state
[  107.078396][   T13] bridge0: port 1(bridge_slave_0) entered forwarding state
[  107.143627][   T12] bridge0: port 2(bridge_slave_1) entered blocking state
[  107.150936][   T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[  107.238089][ T5629] 8021q: adding VLAN 0 to HW filter on device bond0
[  107.317605][ T5627] 8021q: adding VLAN 0 to HW filter on device bond0
[  107.362468][ T5629] 8021q: adding VLAN 0 to HW filter on device team0
[  107.440348][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[  107.447845][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[  107.490337][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[  107.497853][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[  107.538167][ T5627] 8021q: adding VLAN 0 to HW filter on device team0
[  107.583463][ T5628] 8021q: adding VLAN 0 to HW filter on device bond0
[  107.618574][  T139] bridge0: port 1(bridge_slave_0) entered blocking state
[  107.625831][  T139] bridge0: port 1(bridge_slave_0) entered forwarding state
[  107.674008][ T5630] Bluetooth: hci5: command tx timeout
[  107.675083][ T5638] Bluetooth: hci3: command tx timeout
[  107.679475][ T5630] Bluetooth: hci4: command tx timeout
[  107.685470][ T4937] Bluetooth: hci1: command tx timeout
[  107.691909][ T5636] Bluetooth: hci2: command tx timeout
[  107.696068][ T5641] Bluetooth: hci0: command tx timeout
[  107.722576][  T139] bridge0: port 2(bridge_slave_1) entered blocking state
[  107.729797][  T139] bridge0: port 2(bridge_slave_1) entered forwarding state
[  107.856042][ T5628] 8021q: adding VLAN 0 to HW filter on device team0
[  107.914703][   T36] bridge0: port 1(bridge_slave_0) entered blocking state
[  107.921930][   T36] bridge0: port 1(bridge_slave_0) entered forwarding state
[  107.969264][   T36] bridge0: port 2(bridge_slave_1) entered blocking state
[  107.976504][   T36] bridge0: port 2(bridge_slave_1) entered forwarding state
[  108.324167][ T5625] 8021q: adding VLAN 0 to HW filter on device batadv0
[  108.848839][ T5631] 8021q: adding VLAN 0 to HW filter on device batadv0
[  109.178879][ T5631] veth0_vlan: entered promiscuous mode
[  109.232859][ T5626] 8021q: adding VLAN 0 to HW filter on device batadv0
[  109.295964][ T5631] veth1_vlan: entered promiscuous mode
[  109.582094][ T5631] veth0_macvtap: entered promiscuous mode
[  109.629215][ T5626] veth0_vlan: entered promiscuous mode
[  109.688120][ T5631] veth1_macvtap: entered promiscuous mode
[  109.710189][ T5626] veth1_vlan: entered promiscuous mode
[  109.731007][ T5625] veth0_vlan: entered promiscuous mode
[  109.817490][ T5625] veth1_vlan: entered promiscuous mode
[  109.834297][ T5631] batman_adv: batadv0: Interface activated: batadv_slave_0
[  109.846422][ T5629] 8021q: adding VLAN 0 to HW filter on device batadv0
[  109.887608][ T5631] batman_adv: batadv0: Interface activated: batadv_slave_1
[  109.935646][ T5627] 8021q: adding VLAN 0 to HW filter on device batadv0
[  110.040140][ T5626] veth0_macvtap: entered promiscuous mode
[  110.051375][ T1107] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  110.069737][ T5628] 8021q: adding VLAN 0 to HW filter on device batadv0
[  110.119717][ T5626] veth1_macvtap: entered promiscuous mode
[  110.200074][ T5625] veth0_macvtap: entered promiscuous mode
[  110.268593][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_0
[  110.285957][ T5625] veth1_macvtap: entered promiscuous mode
[  110.357094][ T5626] batman_adv: batadv0: Interface activated: batadv_slave_1
[  110.377136][ T5629] veth0_vlan: entered promiscuous mode
[  110.465747][ T1122] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.478691][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  110.482412][ T1122] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.489157][ T5629] veth1_vlan: entered promiscuous mode
[  110.507526][ T5625] batman_adv: batadv0: Interface activated: batadv_slave_0
[  110.571698][ T5625] batman_adv: batadv0: Interface activated: batadv_slave_1
[  110.623811][   T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  110.633550][  T973] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  110.636906][   T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  110.661190][ T1122] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  110.687766][ T5628] veth0_vlan: entered promiscuous mode
[  110.808479][ T1122] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  110.824661][ T5629] veth0_macvtap: entered promiscuous mode
[  110.842300][ T5631] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[  110.851590][ T1122] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  110.897160][ T5628] veth1_vlan: entered promiscuous mode
[  110.926681][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  110.972017][ T5629] veth1_macvtap: entered promiscuous mode
[  110.982113][   T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  110.995042][ T5627] veth0_vlan: entered promiscuous mode
[  111.008171][ T1107] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  111.017197][ T1107] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  111.065457][   T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  111.109300][ T5627] veth1_vlan: entered promiscuous mode
[  111.130716][   T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  111.182753][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  111.195472][   T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  111.209089][   T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  111.253614][ T5629] batman_adv: batadv0: Interface activated: batadv_slave_0
[  111.293633][   T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  111.310939][   T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  111.320973][   T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  111.348591][ T5629] batman_adv: batadv0: Interface activated: batadv_slave_1
[  111.474486][ T5628] veth0_macvtap: entered promiscuous mode
[  111.544876][   T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  111.559092][ T5628] veth1_macvtap: entered promiscuous mode
[  111.573147][   T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  111.574893][ T5627] veth0_macvtap: entered promiscuous mode
[  111.635112][ T5627] veth1_macvtap: entered promiscuous mode
[  111.673731][   T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  111.686984][ T5859] loop0: detected capacity change from 0 to 32768
[  111.708387][ T5628] batman_adv: batadv0: Interface activated: batadv_slave_0
[  111.736698][ T5859] BTRFS: device fsid 97240a68-9a28-4597-b04c-66b27e1182f2 devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.1 (5859)
[  111.796322][ T5628] batman_adv: batadv0: Interface activated: batadv_slave_1
[  111.866733][ T5859] BTRFS info (device loop0): first mount of filesystem 97240a68-9a28-4597-b04c-66b27e1182f2
[  111.898133][ T5859] BTRFS info (device loop0): using blake2b checksum algorithm
[  111.911917][ T1122] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  111.982660][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_0
[  112.031889][   T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  112.094147][ T5627] batman_adv: batadv0: Interface activated: batadv_slave_1
[  112.105113][ T5859] BTRFS info (device loop0): enabling ssd optimizations
[  112.113426][   T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  112.147724][ T5859] BTRFS info (device loop0): turning on async discard
[  112.189221][ T5859] BTRFS info (device loop0): enabling free space tree
[  112.204523][ T1122] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  112.231689][ T1107] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  112.248067][ T1122] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  112.277234][   T30] audit: type=1800 audit(1785874786.050:2): pid=5879 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.5" name="attr_allow_any_host" dev="configfs" ino=8458 res=0 errno=0
[  112.303918][ T5875] nvmet: adding nsid 1 to subsystem testnqn
[  112.376080][   T30] audit: type=1800 audit(1785874786.140:3): pid=5875 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.5" name="device_path" dev="configfs" ino=9378 res=0 errno=0
[  112.421674][   T30] audit: type=1800 audit(1785874786.180:4): pid=5875 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.5" name="enable" dev="configfs" ino=8527 res=0 errno=0
[  112.460281][   T30] audit: type=1800 audit(1785874786.220:5): pid=5875 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.5" name="addr_trtype" dev="configfs" ino=8533 res=0 errno=0
[  112.511870][   T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  112.529822][ T5631] BTRFS info (device loop0): last unmount of filesystem 97240a68-9a28-4597-b04c-66b27e1182f2
[  112.530014][   T30] audit: type=1800 audit(1785874786.260:6): pid=5875 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.5" name="addr_adrfam" dev="configfs" ino=9383 res=0 errno=0
[  112.555213][ T5875] nvmet_tcp: enabling port 1 (127.0.0.1:4420)
[  112.565541][   T30] audit: type=1800 audit(1785874786.270:7): pid=5875 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.5" name="addr_traddr" dev="configfs" ino=8542 res=0 errno=0
[  112.589765][   T30] audit: type=1800 audit(1785874786.290:8): pid=5875 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.5" name="addr_trsvcid" dev="configfs" ino=8543 res=0 errno=0
[  112.695041][ T5861] loop2: detected capacity change from 0 to 32768
[  112.759345][   T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  112.797472][   T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  112.975459][   T57] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  112.981877][   T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  113.058689][   T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  113.259637][  T973] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  113.310562][  T973] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  113.432260][ T5770] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[  113.432995][ T5783] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[  113.471531][ T1107] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  113.492400][ T1107] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  113.568145][   T30] audit: type=1800 audit(1785874787.340:9): pid=5888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.9" name="zoned" dev="configfs" ino=8868 res=0 errno=0
[  113.583209][   T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  113.636091][ T5888] null_blk: nullb1: using native zone append
[  113.645652][   T30] audit: type=1800 audit(1785874787.350:10): pid=5888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.9" name="memory_backed" dev="configfs" ino=8869 res=0 errno=0
[  113.648476][ T5770] usb 1-1: New USB device found, idVendor=046d, idProduct=c222, bcdDevice= 0.00
[  113.681645][ T5783] usb 5-1: Using ep0 maxpacket: 16
[  113.682522][  T973] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  113.716570][ T5890] Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers
[  113.716570][ T5890] 
[  113.724234][ T5783] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  113.761877][ T5890] CIFS: VFS: Use of the less secure dialect vers=1.0 is not recommended unless required for access to very old servers
[  113.767331][ T5770] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  113.783646][  T973] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  113.789053][   T30] audit: type=1800 audit(1785874787.380:11): pid=5888 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.9" name="zone_nr_conv" dev="configfs" ino=8876 res=0 errno=0
[  113.821365][ T5783] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
[  113.835610][ T5783] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00
[  113.845141][ T5783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  113.845587][ T5890] CIFS: Attempting to mount //127.0.0.1/share
[  113.870532][   T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  113.879821][   T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  113.914092][ T5783] usb 5-1: config 0 descriptor??
[  113.919122][   T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  113.934235][   T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  114.178326][ T5888] null_blk: disk nullb1 created
[  114.536740][ T5783] input: HID 045e:07da as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:045E:07DA.0001/input/input5
[  114.595050][ T5890] CIFS: VFS: cifs_mount failed w/return code = -512
[  114.714159][ T5770] lg-g15 0003:046D:C222.0002: hidraw0: USB HID v1.11 Device [HID 046d:c222] on usb-dummy_hcd.0-1/input0
[  114.775313][ T5783] microsoft 0003:045E:07DA.0001: input,hidraw1: USB HID v0.00 Mouse [HID 045e:07da] on usb-dummy_hcd.4-1/input0
[  114.850817][   T24] usb 6-1: new high-speed USB device number 2 using dummy_hcd
[  115.046003][   T24] usb 6-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00
[  115.109038][   T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  115.163207][   T24] usb 6-1: Product: syz
[  115.181178][   T24] usb 6-1: Manufacturer: syz
[  115.206295][   T24] usb 6-1: SerialNumber: syz
[  115.266466][ T5907] loop3: detected capacity change from 0 to 1024
[  115.395189][   T24] usb 6-1: cannot find UAC_HEADER
[  115.449543][ T5907] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  115.451278][   T24] snd-usb-audio 6-1:1.0: probe with driver snd-usb-audio failed with error -22
[  115.565810][   T24] usb 6-1: cannot find UAC_HEADER
[  115.594417][   T24] snd-usb-audio 6-1:1.1: probe with driver snd-usb-audio failed with error -22
[  115.620564][ T5783] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[  115.702958][   T24] usb 6-1: cannot find UAC_HEADER
[  115.718954][   T24] snd-usb-audio 6-1:1.2: probe with driver snd-usb-audio failed with error -22
[  115.796707][ T5770] lg-g15 0003:046D:C222.0002: Error -71 disabling keyboard emulation for the G-keys, falling back to generic hid-input driver
[  115.810781][ T5783] usb 3-1: Using ep0 maxpacket: 16
[  115.821670][    T9] usb 5-1: USB disconnect, device number 2
[  115.839650][ T5915] EXT4-fs warning (device loop3): ext4_resize_fs:2018: can't read last block, resize aborted
[  115.840482][ T5783] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  115.904530][ T5783] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
[  115.948099][ T5783] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00
[  115.955845][ T5770] usb 1-1: USB disconnect, device number 2
[  116.009796][ T5783] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  116.116343][ T5783] usb 3-1: config 0 descriptor??
[  116.453973][ T5628] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  116.466306][ T5908] loop1: detected capacity change from 0 to 32768
[  116.567353][ T5908] JBD2: Ignoring recovery information on journal
[  116.656320][ T5916] usb 6-1: USB disconnect, device number 2
[  116.849580][ T5908] ocfs2: Mounting device (7,1) on (node local, slot 0) with ordered data mode.
[  116.875485][ T5921] loop4: detected capacity change from 0 to 1024
[  117.055728][ T5921] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  117.255532][ T5783] microsoft 0003:045E:07DA.0003: unknown main item tag 0x0
[  117.300093][ T5783] microsoft 0003:045E:07DA.0003: unknown main item tag 0x0
[  117.340338][ T5783] microsoft 0003:045E:07DA.0003: unknown main item tag 0x0
[  117.358976][ T5783] microsoft 0003:045E:07DA.0003: unknown main item tag 0x0
[  117.385066][ T5783] microsoft 0003:045E:07DA.0003: unknown main item tag 0x0
[  117.415488][ T5783] microsoft 0003:045E:07DA.0003: unknown main item tag 0x0
[  117.428473][ T5934] ./dev/loop1: Can't open blockdev
[  117.450141][ T5906] ocfs2: Unmounting device (7,1) on (node local)
[  117.468330][ T5783] microsoft 0003:045E:07DA.0003: unknown main item tag 0x0
[  117.488559][ T5783] microsoft 0003:045E:07DA.0003: unknown main item tag 0x0
[  117.519742][ T5783] microsoft 0003:045E:07DA.0003: unknown main item tag 0x0
[  117.537174][ T5783] microsoft 0003:045E:07DA.0003: unknown main item tag 0x0
[  117.604537][ T5783] input: HID 045e:07da as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:045E:07DA.0003/input/input7
[  117.615334][ T5927] configfs-gadget.g1 gadget.33: uvc: uvc_function_bind()
[  117.646268][ T5921] EXT4-fs warning (device loop4): ext4_resize_fs:2018: can't read last block, resize aborted
[  117.691240][ T5783] microsoft 0003:045E:07DA.0003: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.2-1/input0
[  118.173461][   T10] usb 3-1: USB disconnect, device number 2
[  118.247771][ T5625] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  118.666365][ T5939] loop5: detected capacity change from 0 to 32768
[  118.693345][ T5935] NFSD: Unable to initialize client recovery tracking! (-110)
[  118.699300][    T9] logitech-hidpp-device 0005:046D:B012.0004: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1
[  118.714727][ T5935] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING.
[  118.746131][ T5935] NFSD: starting 90-second grace period (net f00004a2)
[  118.760680][ T5783] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[  118.938970][ T5783] usb 2-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice= 1.00
[  118.979066][ T5783] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  119.092890][ T5960] fido_id[5960]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory
[  119.129343][ T5783] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state.
[  119.161914][ T5783] usb 2-1: setting power ON
[  119.175869][ T5783] dvb-usb: bulk message failed: -22 (2/0)
[  119.242733][ T5783] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  119.291323][ T5783] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID))
[  119.326215][ T5783] usb 2-1: media controller created
[  119.399354][ T5783] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  119.494404][ T5783] usb 2-1: selecting invalid altsetting 6
[  119.515411][ T5783] usb 2-1: digital interface selection failed (-22)
[  119.526770][ T5783] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)'
[  119.536715][ T5783] usb 2-1: setting power OFF
[  119.547026][ T5783] dvb-usb: bulk message failed: -22 (2/0)
[  119.554023][ T5783] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected.
[  119.564384][ T5783] usb 2-1: setting power ON
[  119.568953][ T5783] dvb-usb: bulk message failed: -22 (2/0)
[  119.842769][ T5973] loop4: detected capacity change from 0 to 32768
[  120.201466][ T5946] NFSD: Unable to initialize client recovery tracking! (-110)
[  120.237025][ T5979] kAFS: unable to lookup cell 'syz0'
[  120.257932][ T5946] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING.
[  120.312977][ T5946] NFSD: starting 90-second grace period (net f00005e4)
[  120.420315][ T5783] usb 2-1: analog interface selection failed (-71)
[  120.662162][ T5976] svc: failed to register lockdv1 RPC service (errno 512).
[  120.689485][ T5783] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected.
[  120.700963][ T5976] lockd_up: makesock failed, error=-512
[  120.735822][ T5783] dvb_usb_cxusb 2-1:1.0: probe with driver dvb_usb_cxusb failed with error -71
[  120.757777][ T5976] svc: failed to register nfsdv3 RPC service (errno 111).
[  120.779234][ T5783] usb 2-1: USB disconnect, device number 2
[  120.815531][ T5976] svc: failed to register nfsaclv3 RPC service (errno 512).
[  120.836624][ T5976] failed to unregister tcp with rpcbind
[  120.857810][ T5976] svc: failed to register nfsdv3 RPC service (errno 97).
[  120.889933][ T5976] svc: failed to register nfsaclv3 RPC service (errno 97).
[  120.911104][ T5976] failed to unregister tcp with rpcbind
[  120.960798][    T9] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[  121.147610][    T9] usb 5-1: New USB device found, idVendor=046d, idProduct=0900, bcdDevice= 0.00
[  121.160688][  T932] usb 6-1: new high-speed USB device number 3 using dummy_hcd
[  121.172135][    T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  121.193373][    T9] usb 5-1: Product: syz
[  121.199025][    T9] usb 5-1: Manufacturer: syz
[  121.203876][    T9] usb 5-1: SerialNumber: syz
[  121.222469][    T9] gspca_main: spca500-2.14.0 probing 046d:0900
[  121.347177][  T932] usb 6-1: New USB device found, idVendor=2040, idProduct=b120, bcdDevice= 0.00
[  121.373081][  T932] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  121.442508][  T932] cx231xx 6-1:1.1: New device   @ 480 Mbps (2040:b120) with 2 interfaces
[  121.470658][ T5896] usb 2-1: new high-speed USB device number 3 using dummy_hcd
[  121.569048][  T932] cx231xx 6-1:1.1: Failed to read PCB config
[  121.576158][  T932] cx231xx 6-1:1.1: probe with driver cx231xx failed with error -110
[  121.630611][ T5783] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[  121.648988][ T5896] usb 2-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 0.00
[  121.659448][ T5896] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  121.731182][    T9] gspca_spca500: reg write: error -32
[  121.746093][    T9] gspca_spca500: reg write: error -32
[  121.767508][    T9] gspca_spca500: reg write: error -32
[  121.774916][    T9] gspca_spca500: reg write: error -32
[  121.775233][ T6012] loop3: detected capacity change from 0 to 1024
[  121.780624][ T5770] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[  121.799576][    T9] gspca_spca500: reg write: error -32
[  121.810149][    T9] gspca_spca500: reg write: error -32
[  121.816259][    T9] gspca_spca500: reg write: error -32
[  121.816839][ T5783] usb 3-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08
[  121.822391][    T9] gspca_spca500: reg write: error -32
[  121.843489][    T9] gspca_spca500: reg write: error -32
[  121.848668][ T5783] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  121.859081][ T5783] usb 3-1: Product: syz
[  121.864094][ T5783] usb 3-1: Manufacturer: syz
[  121.864723][ T6012] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  121.869033][ T5783] usb 3-1: SerialNumber: syz
[  121.902159][    T9] gspca_spca500: reg write: error -32
[  121.927047][    T9] gspca_spca500: reg write: error -32
[  121.944389][    T9] gspca_spca500: reg write: error -32
[  121.955297][    T9] gspca_spca500: reg write: error -32
[  121.975130][ T5770] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice= 1.01
[  121.989816][    T9] gspca_spca500: reg write: error -32
[  122.024195][ T5770] usb 1-1: New USB device strings: Mfr=2, Product=3, SerialNumber=1
[  122.033291][    T9] videodev: could not get a free minor
[  122.044436][  T932] usb 3-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
[  122.055686][    T9] gspca_main: video_register_device err -23
[  122.064845][ T5770] usb 1-1: Product: syz
[  122.082513][ T5770] usb 1-1: Manufacturer: syz
[  122.089949][    T9] spca500 5-1:1.0: probe with driver spca500 failed with error -23
[  122.098574][ T5770] usb 1-1: SerialNumber: syz
[  122.153657][ T5770] pvrusb2: Hardware description: Terratec Grabster AV400
[  122.169101][ T5770] pvrusb2: **********
[  122.173305][ T5770] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental.
[  122.185496][ T5770] pvrusb2: Important functionality might not be entirely working.
[  122.197179][ T5770] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver.
[  122.213676][ T5770] pvrusb2: **********
[  122.218305][ T5628] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  122.513517][   T10] usb 5-1: USB disconnect, device number 3
[  122.680657][    T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[  122.844153][    T9] usb 4-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00
[  122.853636][    T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  122.877292][    T9] usb 4-1: NFC: intf ffff888023ffd000 id ffffffff8fc6b9e0
[  122.926896][    T9] nfcmrvl 4-1:1.0: NFC: registered with nci successfully
[  123.208134][   T57] nfcmrvl 4-1:1.0: NFC: send entry, len 4
[  123.420858][    T9] usb 5-1: new high-speed USB device number 4 using dummy_hcd
[  123.435412][  T932] usb 3-1: Service connection timeout for: 256
[  123.446364][  T932] ath9k_htc 3-1:1.0: ath9k_htc: Unable to initialize HTC services
[  123.482155][  T932] ath9k_htc: Failed to initialize the device
[  123.501011][  T932] usb 3-1: ath9k_htc: USB layer deinitialized
[  123.605668][    T9] usb 5-1: New USB device found, idVendor=0584, idProduct=0008, bcdDevice= 1.02
[  123.615502][    T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  123.635052][    T9] ums-alauda 5-1:1.0: USB Mass Storage device detected
[  123.655479][    T9] ums-alauda 5-1:1.0: This device (0584,0008,0102 S 06 P f4) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel syzkaller)
[  123.655479][    T9]    Please send a copy of this message to <linux-usb@vger.kernel.org> and <usb-storage@lists.one-eyed-alien.net>
[  123.689914][    T9] scsi host1: usb-storage 5-1:1.0
[  123.981929][    T9] usb 6-1: USB disconnect, device number 3
[  124.290989][ T5896] gud 2-1:1.0: probe with driver gud failed with error -71
[  124.328078][ T5896] usb 2-1: USB disconnect, device number 3
[  124.368252][ T2363] pvrusb2: Failed to submit write-control URB status=-2
[  124.396492][ T5770] usb 1-1: USB disconnect, device number 3
[  124.417086][    T9] usb 6-1: new high-speed USB device number 4 using dummy_hcd
[  124.438635][ T2363] pvrusb2: Device being rendered inoperable
[  124.483907][ T2363] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[  124.495966][ T2363] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[  124.572956][ T5783] usb 3-1: USB disconnect, device number 3
[  124.625402][    T9] usb 6-1: New USB device found, idVendor=045e, idProduct=0775, bcdDevice= 1.00
[  124.646215][    T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[  124.656275][    T9] usb 6-1: Product: syz
[  124.673773][    T9] usb 6-1: Manufacturer: syz
[  124.696126][    T9] input: Samsung SUR40 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input8
[  124.717869][ T1122] scsi 1:0:0:0: Direct-Access     Fujifilm DPC-R1 (Alauda)  0102 PQ: 0 ANSI: 0 CCS
[  124.734745][ T1122] scsi 1:0:0:1: Direct-Access     Fujifilm DPC-R1 (Alauda)  0102 PQ: 0 ANSI: 0 CCS
[  124.804804][ T1122] sd 1:0:0:0: Attached scsi generic sg1 type 0
[  124.813174][   T13] sd 1:0:0:0: [sdb] Media removed, stopped polling
[  124.892922][   T12] sd 1:0:0:1: [sdc] Media removed, stopped polling
[  124.904209][ T1122] sd 1:0:0:1: Attached scsi generic sg2 type 0
[  124.926095][   T13] sd 1:0:0:0: [sdb] Attached SCSI removable disk
[  124.971283][ T5783] usb 3-1: new full-speed USB device number 4 using dummy_hcd
[  125.017267][   T12] sd 1:0:0:1: [sdc] Attached SCSI removable disk
[  125.153455][ T5783] usb 3-1: not running at top speed; connect to a high speed hub
[  125.164898][ T5783] usb 3-1: config index 0 descriptor too short (expected 161, got 153)
[  125.176869][ T5783] usb 3-1: config 1 has an invalid descriptor of length 9, skipping remainder of the config
[  125.187340][ T5783] usb 3-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 1.00
[  125.196921][ T5783] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  125.223846][ T5783] gspca_main: spca501-2.14.0 probing 0000:0000
[  125.382271][ T5770] usb 1-1: new high-speed USB device number 4 using dummy_hcd
[  125.400599][ T6029] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  125.412019][    C0] nfcmrvl 4-1:1.0: NFC: urb ffff8880329faa00 status -2 count 0
[  125.459849][   T29] usb 4-1: USB disconnect, device number 2
[  125.478903][   T29] usb 4-1: NFC: intf ffff888023ffd000
[  125.575508][ T5770] usb 1-1: New USB device found, idVendor=17e9, idProduct=0000, bcdDevice= 0.00
[  125.606501][ T5770] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  125.662389][ T6048] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount.
[  125.698046][ T6048] CIFS: Attempting to mount //127.0.0.1/test
[  125.709901][ T6048] CIFS: VFS: Error connecting to socket. Aborting operation.
[  125.720935][ T6048] CIFS: VFS: cifs_mount failed w/return code = -111
[  125.813652][    T9] videodev: could not get a free minor
[  125.825394][    T9] sur40 6-1:1.0: Unable to register video subdevice.
[  125.837442][    T9] sur40 6-1:1.0: probe with driver sur40 failed with error -23
[  125.941524][ T5783] gspca_spca501: reg write: error -110
[  125.967027][ T4987] ==================================================================
[  125.971268][ T5783] spca501 3-1:1.0: Reg write failed for 0x02,0xa048,0x00
[  125.975309][ T4987] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  125.989999][ T4987] Read of size 1 at addr ffff88807f806c0a by task udevd/4987
[  125.997397][ T4987] 
[  125.999738][ T4987] CPU: 0 UID: 0 PID: 4987 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
[  125.999790][ T4987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  125.999812][ T4987] Call Trace:
[  125.999824][ T4987]  <TASK>
[  125.999837][ T4987]  dump_stack_lvl+0x100/0x190
[  125.999886][ T4987]  print_report+0x13d/0x4b0
[  125.999949][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  125.999999][ T4987]  ? __virt_addr_valid+0x239/0x430
[  126.000048][ T4987]  ? string+0x471/0x4d0
[  126.000092][ T4987]  kasan_report+0xdf/0x1c0
[  126.000135][ T4987]  ? string+0x471/0x4d0
[  126.000181][ T4987]  string+0x471/0x4d0
[  126.000220][ T4987]  ? __pfx_string+0x10/0x10
[  126.000263][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  126.000309][ T4987]  vsnprintf+0x422/0x1300
[  126.000361][ T4987]  ? __pfx_vsnprintf+0x10/0x10
[  126.000404][ T4987]  ? uevent_show+0x166/0x3a0
[  126.000448][ T4987]  ? sysfs_kf_seq_show+0x217/0x3f0
[  126.000492][ T4987]  ? seq_read_iter+0x32f/0x1270
[  126.000539][ T4987]  ? kernfs_fop_read_iter+0x46c/0x610
[  126.000579][ T4987]  ? vfs_read+0x82e/0xb40
[  126.000621][ T4987]  ? ksys_read+0x12a/0x250
[  126.000662][ T4987]  ? do_syscall_64+0x115/0x870
[  126.000712][ T4987]  add_uevent_var+0x183/0x3a0
[  126.000751][ T4987]  ? __pfx_add_uevent_var+0x10/0x10
[  126.000802][ T4987]  ? input_dev_uevent+0x16d/0x910
[  126.000851][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  126.000899][ T4987]  input_dev_uevent+0x1bf/0x910
[  126.000950][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  126.000999][ T4987]  dev_uevent+0x2f1/0x870
[  126.001036][ T4987]  ? __pfx_dev_uevent+0x10/0x10
[  126.001068][ T4987]  ? kasan_save_track+0x14/0x30
[  126.001117][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  126.001156][ T4987]  ? __kasan_kmalloc+0xaa/0xb0
[  126.001207][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  126.001247][ T4987]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  126.001294][ T4987]  ? uevent_show+0x166/0x3a0
[  126.001357][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  126.001400][ T4987]  uevent_show+0x1ca/0x3a0
[  126.001441][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  126.001484][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  126.001527][ T4987]  dev_attr_show+0x52/0xa0
[  126.001585][ T4987]  ? __pfx_dev_attr_show+0x10/0x10
[  126.001637][ T4987]  sysfs_kf_seq_show+0x217/0x3f0
[  126.001685][ T4987]  seq_read_iter+0x32f/0x1270
[  126.001743][ T4987]  kernfs_fop_read_iter+0x46c/0x610
[  126.001788][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  126.001831][ T4987]  ? rw_verify_area+0xce/0x6d0
[  126.001869][ T4987]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  126.001911][ T4987]  vfs_read+0x82e/0xb40
[  126.001960][ T4987]  ? __pfx_vfs_read+0x10/0x10
[  126.002010][ T4987]  ? __pfx___do_sys_newfstat+0x10/0x10
[  126.002090][ T4987]  ksys_read+0x12a/0x250
[  126.002139][ T4987]  ? __pfx_ksys_read+0x10/0x10
[  126.002190][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  126.002243][ T4987]  do_syscall_64+0x115/0x870
[  126.002299][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  126.002338][ T4987] RIP: 0033:0x7f0dc3ca7407
[  126.002368][ T4987] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  126.002403][ T4987] RSP: 002b:00007ffe09f45080 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  126.002437][ T4987] RAX: ffffffffffffffda RBX: 00007f0dc4385880 RCX: 00007f0dc3ca7407
[  126.002461][ T4987] RDX: 0000000000001000 RSI: 000055dce2afc1a0 RDI: 000000000000000c
[  126.002484][ T4987] RBP: 00007f0dc3defff0 R08: 0000000000000000 R09: 0000000000000000
[  126.002507][ T4987] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  126.002529][ T4987] R13: 00007f0dc3defea0 R14: 0000000000000000 R15: 000055dce29f5b30
[  126.002565][ T4987]  </TASK>
[  126.002577][ T4987] 
[  126.003667][ T5783] spca501 3-1:1.0: probe with driver spca501 failed with error -22
[  126.011594][ T4987] Allocated by task 9:
[  126.011617][ T4987]  kasan_save_stack+0x30/0x50
[  126.011679][ T4987]  kasan_save_track+0x14/0x30
[  126.011734][ T4987]  __kasan_kmalloc+0xaa/0xb0
[  126.011792][ T4987]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  126.011839][ T4987]  sur40_probe+0x1a8/0x1580
[  126.059580][ T5783] uvcvideo 3-1:1.0: Found UVC 1.00 device <unnamed> (0000:0000)
[  126.060768][ T4987]  usb_probe_interface+0x303/0x8f0
[  126.060841][ T4987]  really_probe+0x241/0xa60
[  126.060891][ T4987]  __driver_probe_device+0x20e/0x450
[  126.060940][ T4987]  driver_probe_device+0x4a/0x140
[  126.060989][ T4987]  __device_attach_driver+0x1df/0x320
[  126.071546][ T5783] uvcvideo 3-1:1.0: UVC non compliance - GET_DEF(PROBE) not supported. Enabling workaround.
[  126.075047][ T4987]  bus_for_each_drv+0x159/0x1e0
[  126.075096][ T4987]  __device_attach+0x1e4/0x4d0
[  126.086518][ T5896] usb 6-1: USB disconnect, device number 4
[  126.088801][ T4987]  device_initial_probe+0xaf/0xd0
[  126.088862][ T4987]  bus_probe_device+0x64/0x160
[  126.108180][ T5783] uvcvideo 3-1:1.1: Failed to query (GET_CUR) UVC probe control : -32 (exp. 26).
[  126.108539][ T4987]  device_add+0x121d/0x1970
[  126.122545][ T5783] uvcvideo 3-1:1.1: Failed to initialize the device (-5).
[  126.127643][ T4987]  usb_set_configuration+0xd97/0x1c60
[  126.127704][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  126.149728][ T5783] uvcvideo 3-1:1.0: probe with driver uvcvideo failed with error -5
[  126.152797][ T4987]  usb_probe_device+0xef/0x400
[  126.152858][ T4987]  really_probe+0x241/0xa60
[  126.470494][ T5641] Bluetooth: hci6: Opcode 0x1003 failed: -110
[  126.479813][ T4987]  __driver_probe_device+0x20e/0x450
[  126.479875][ T4987]  driver_probe_device+0x4a/0x140
[  126.479923][ T4987]  __device_attach_driver+0x1df/0x320
[  126.479966][ T4987]  bus_for_each_drv+0x159/0x1e0
[  126.479999][ T4987]  __device_attach+0x1e4/0x4d0
[  126.480040][ T4987]  device_initial_probe+0xaf/0xd0
[  126.480082][ T4987]  bus_probe_device+0x64/0x160
[  126.480117][ T4987]  device_add+0x121d/0x1970
[  126.480163][ T4987]  usb_new_device.cold+0x685/0x115c
[  126.480199][ T4987]  hub_event+0x30a3/0x4a60
[  126.480240][ T4987]  process_one_work+0xa23/0x1940
[  126.480270][ T4987]  worker_thread+0x5ef/0xe50
[  126.480296][ T4987]  kthread+0x370/0x450
[  126.480343][ T4987]  ret_from_fork+0x72b/0xd50
[  126.480382][ T4987]  ret_from_fork_asm+0x1a/0x30
[  126.480425][ T4987] 
[  126.480432][ T4987] Freed by task 9:
[  126.480447][ T4987]  kasan_save_stack+0x30/0x50
[  126.480496][ T4987]  kasan_save_track+0x14/0x30
[  126.480543][ T4987]  kasan_save_free_info+0x3b/0x70
[  126.480582][ T4987]  __kasan_slab_free+0x5f/0x80
[  126.480609][ T4987]  kfree+0x22b/0x6c0
[  126.480645][ T4987]  sur40_probe+0xc36/0x1580
[  126.480683][ T4987]  usb_probe_interface+0x303/0x8f0
[  126.480733][ T4987]  really_probe+0x241/0xa60
[  126.480775][ T4987]  __driver_probe_device+0x20e/0x450
[  126.480828][ T4987]  driver_probe_device+0x4a/0x140
[  126.480871][ T4987]  __device_attach_driver+0x1df/0x320
[  126.480915][ T4987]  bus_for_each_drv+0x159/0x1e0
[  126.480949][ T4987]  __device_attach+0x1e4/0x4d0
[  126.480991][ T4987]  device_initial_probe+0xaf/0xd0
[  126.481036][ T4987]  bus_probe_device+0x64/0x160
[  126.481073][ T4987]  device_add+0x121d/0x1970
[  126.481119][ T4987]  usb_set_configuration+0xd97/0x1c60
[  126.481162][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  126.481199][ T4987]  usb_probe_device+0xef/0x400
[  126.481245][ T4987]  really_probe+0x241/0xa60
[  126.481290][ T4987]  __driver_probe_device+0x20e/0x450
[  126.481360][ T4987]  driver_probe_device+0x4a/0x140
[  126.481412][ T4987]  __device_attach_driver+0x1df/0x320
[  126.481465][ T4987]  bus_for_each_drv+0x159/0x1e0
[  126.481497][ T4987]  __device_attach+0x1e4/0x4d0
[  126.481538][ T4987]  device_initial_probe+0xaf/0xd0
[  126.481582][ T4987]  bus_probe_device+0x64/0x160
[  126.481618][ T4987]  device_add+0x121d/0x1970
[  126.481667][ T4987]  usb_new_device.cold+0x685/0x115c
[  126.481705][ T4987]  hub_event+0x30a3/0x4a60
[  126.481751][ T4987]  process_one_work+0xa23/0x1940
[  126.481784][ T4987]  worker_thread+0x5ef/0xe50
[  126.481825][ T4987]  kthread+0x370/0x450
[  126.481875][ T4987]  ret_from_fork+0x72b/0xd50
[  126.481919][ T4987]  ret_from_fork_asm+0x1a/0x30
[  126.481969][ T4987] 
[  126.481978][ T4987] The buggy address belongs to the object at ffff88807f806000
[  126.481978][ T4987]  which belongs to the cache kmalloc-4k of size 4096
[  126.482007][ T4987] The buggy address is located 3082 bytes inside of
[  126.482007][ T4987]  freed 4096-byte region [ffff88807f806000, ffff88807f807000)
[  126.805478][ T4987] 
[  126.807806][ T4987] The buggy address belongs to the physical page:
[  126.814213][ T4987] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f800
[  126.822987][ T4987] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  126.831586][ T4987] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  126.839187][ T4987] page_type: f5(slab)
[  126.843181][ T4987] raw: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  126.851783][ T4987] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  126.860477][ T4987] head: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  126.869167][ T4987] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  126.878333][ T4987] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  126.887047][ T4987] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  126.895832][ T4987] page dumped because: kasan: bad access detected
[  126.902242][ T4987] page_owner tracks the page as allocated
[  126.907953][ T4987] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4996, tgid 4996 (udevd), ts 58249348224, free_ts 58222770964
[  126.928146][ T4987]  post_alloc_hook+0xfd/0x120
[  126.932854][ T4987]  get_page_from_freelist+0xf48/0x3530
[  126.938343][ T4987]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  126.944450][ T4987]  new_slab+0xa2/0x640
[  126.948545][ T4987]  refill_objects+0xe3/0x410
[  126.953241][ T4987]  __pcs_replace_empty_main+0x376/0x680
[  126.958810][ T4987]  __kmalloc_noprof+0x66d/0x820
[  126.963690][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  126.969371][ T4987]  tomoyo_path_perm+0x276/0x460
[  126.974245][ T4987]  security_inode_getattr+0x116/0x280
[  126.979639][ T4987]  vfs_fstat+0x4b/0xe0
[  126.983845][ T4987]  __do_sys_newfstat+0x8b/0x110
[  126.988735][ T4987]  do_syscall_64+0x115/0x870
[  126.993362][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  126.999288][ T4987] page last free pid 4992 tgid 4992 stack trace:
[  127.005611][ T4987]  __free_frozen_pages+0x79f/0x1090
[  127.010977][ T4987]  qlist_free_all+0x47/0xf0
[  127.015551][ T4987]  kasan_quarantine_reduce+0x1a0/0x1f0
[  127.021049][ T4987]  __kasan_slab_alloc+0x69/0x90
[  127.025923][ T4987]  __kmalloc_noprof+0x2bf/0x820
[  127.030827][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  127.036525][ T4987]  tomoyo_check_open_permission+0x2af/0x3c0
[  127.042443][ T4987]  tomoyo_file_open+0x6b/0x90
[  127.047159][ T4987]  security_file_open+0xb5/0x1e0
[  127.052125][ T4987]  do_dentry_open+0x588/0x14d0
[  127.056911][ T4987]  vfs_open+0x82/0x3f0
[  127.060982][ T4987]  path_openat+0x2873/0x4280
[  127.065632][ T4987]  do_file_open+0x20e/0x430
[  127.070193][ T4987]  do_sys_openat2+0x10f/0x1e0
[  127.074896][ T4987]  __x64_sys_openat+0x12d/0x210
[  127.079794][ T4987]  do_syscall_64+0x115/0x870
[  127.084696][ T4987] 
[  127.087161][ T4987] Memory state around the buggy address:
[  127.092832][ T4987]  ffff88807f806b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  127.100900][ T4987]  ffff88807f806b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  127.109005][ T4987] >ffff88807f806c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  127.117073][ T4987]                       ^
[  127.121408][ T4987]  ffff88807f806c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  127.130170][ T4987]  ffff88807f806d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  127.138244][ T4987] ==================================================================
[  127.253570][ T5770] udl 1-1:1.0: [drm] Unrecognized vendor firmware descriptor
[  127.259316][ T4987] Disabling lock debugging due to kernel taint
[  127.272329][ T4987] ==================================================================
[  127.280435][ T4987] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  127.283742][ T5770] [drm:udl_init] *ERROR* Selecting channel failed
[  127.287404][ T4987] Read of size 1 at addr ffff88807f806c0b by task udevd/4987
[  127.287436][ T4987] 
[  127.287458][ T4987] CPU: 1 UID: 0 PID: 4987 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  127.287509][ T4987] Tainted: [B]=BAD_PAGE
[  127.287523][ T4987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  127.287546][ T4987] Call Trace:
[  127.287558][ T4987]  <TASK>
[  127.287571][ T4987]  dump_stack_lvl+0x100/0x190
[  127.287613][ T4987]  print_report+0x13d/0x4b0
[  127.287668][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.287713][ T4987]  ? __virt_addr_valid+0x239/0x430
[  127.287759][ T4987]  ? string+0x471/0x4d0
[  127.287800][ T4987]  kasan_report+0xdf/0x1c0
[  127.287846][ T4987]  ? string+0x471/0x4d0
[  127.287891][ T4987]  string+0x471/0x4d0
[  127.287933][ T4987]  ? __pfx_string+0x10/0x10
[  127.287976][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.288024][ T4987]  vsnprintf+0x422/0x1300
[  127.288076][ T4987]  ? __pfx_vsnprintf+0x10/0x10
[  127.288120][ T4987]  ? uevent_show+0x166/0x3a0
[  127.288167][ T4987]  ? sysfs_kf_seq_show+0x217/0x3f0
[  127.288213][ T4987]  ? seq_read_iter+0x32f/0x1270
[  127.288261][ T4987]  ? kernfs_fop_read_iter+0x46c/0x610
[  127.288301][ T4987]  ? vfs_read+0x82e/0xb40
[  127.288342][ T4987]  ? ksys_read+0x12a/0x250
[  127.288386][ T4987]  ? do_syscall_64+0x115/0x870
[  127.288438][ T4987]  add_uevent_var+0x183/0x3a0
[  127.288478][ T4987]  ? __pfx_add_uevent_var+0x10/0x10
[  127.288523][ T4987]  ? input_dev_uevent+0x16d/0x910
[  127.288574][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  127.288623][ T4987]  input_dev_uevent+0x1bf/0x910
[  127.288672][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  127.288720][ T4987]  dev_uevent+0x2f1/0x870
[  127.288756][ T4987]  ? __pfx_dev_uevent+0x10/0x10
[  127.288788][ T4987]  ? kasan_save_track+0x14/0x30
[  127.288850][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.288894][ T4987]  ? __kasan_kmalloc+0xaa/0xb0
[  127.288950][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.288994][ T4987]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  127.289044][ T4987]  ? uevent_show+0x166/0x3a0
[  127.289092][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  127.289137][ T4987]  uevent_show+0x1ca/0x3a0
[  127.289182][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.289228][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  127.289273][ T4987]  dev_attr_show+0x52/0xa0
[  127.289331][ T4987]  ? __pfx_dev_attr_show+0x10/0x10
[  127.289388][ T4987]  sysfs_kf_seq_show+0x217/0x3f0
[  127.289438][ T4987]  seq_read_iter+0x32f/0x1270
[  127.289496][ T4987]  kernfs_fop_read_iter+0x46c/0x610
[  127.289537][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.289581][ T4987]  ? rw_verify_area+0xce/0x6d0
[  127.289620][ T4987]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  127.289663][ T4987]  vfs_read+0x82e/0xb40
[  127.289710][ T4987]  ? __pfx_vfs_read+0x10/0x10
[  127.289756][ T4987]  ? __pfx___do_sys_newfstat+0x10/0x10
[  127.289831][ T4987]  ksys_read+0x12a/0x250
[  127.289876][ T4987]  ? __pfx_ksys_read+0x10/0x10
[  127.289923][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  127.289971][ T4987]  do_syscall_64+0x115/0x870
[  127.290022][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  127.290060][ T4987] RIP: 0033:0x7f0dc3ca7407
[  127.290088][ T4987] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  127.290124][ T4987] RSP: 002b:00007ffe09f45080 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  127.290159][ T4987] RAX: ffffffffffffffda RBX: 00007f0dc4385880 RCX: 00007f0dc3ca7407
[  127.290184][ T4987] RDX: 0000000000001000 RSI: 000055dce2afc1a0 RDI: 000000000000000c
[  127.290207][ T4987] RBP: 00007f0dc3defff0 R08: 0000000000000000 R09: 0000000000000000
[  127.290230][ T4987] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  127.290253][ T4987] R13: 00007f0dc3defea0 R14: 0000000000000000 R15: 000055dce29f5b30
[  127.290288][ T4987]  </TASK>
[  127.290300][ T4987] 
[  127.672401][ T4987] Allocated by task 9:
[  127.676469][ T4987]  kasan_save_stack+0x30/0x50
[  127.681294][ T4987]  kasan_save_track+0x14/0x30
[  127.686031][ T4987]  __kasan_kmalloc+0xaa/0xb0
[  127.690647][ T4987]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  127.696153][ T4987]  sur40_probe+0x1a8/0x1580
[  127.700773][ T4987]  usb_probe_interface+0x303/0x8f0
[  127.705938][ T4987]  really_probe+0x241/0xa60
[  127.710497][ T4987]  __driver_probe_device+0x20e/0x450
[  127.715810][ T4987]  driver_probe_device+0x4a/0x140
[  127.720868][ T4987]  __device_attach_driver+0x1df/0x320
[  127.726269][ T4987]  bus_for_each_drv+0x159/0x1e0
[  127.731197][ T4987]  __device_attach+0x1e4/0x4d0
[  127.735988][ T4987]  device_initial_probe+0xaf/0xd0
[  127.741042][ T4987]  bus_probe_device+0x64/0x160
[  127.745893][ T4987]  device_add+0x121d/0x1970
[  127.750430][ T4987]  usb_set_configuration+0xd97/0x1c60
[  127.755917][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  127.761317][ T4987]  usb_probe_device+0xef/0x400
[  127.766332][ T4987]  really_probe+0x241/0xa60
[  127.770885][ T4987]  __driver_probe_device+0x20e/0x450
[  127.776334][ T4987]  driver_probe_device+0x4a/0x140
[  127.781383][ T4987]  __device_attach_driver+0x1df/0x320
[  127.786781][ T4987]  bus_for_each_drv+0x159/0x1e0
[  127.792184][ T4987]  __device_attach+0x1e4/0x4d0
[  127.797077][ T4987]  device_initial_probe+0xaf/0xd0
[  127.802136][ T4987]  bus_probe_device+0x64/0x160
[  127.806917][ T4987]  device_add+0x121d/0x1970
[  127.811452][ T4987]  usb_new_device.cold+0x685/0x115c
[  127.816842][ T4987]  hub_event+0x30a3/0x4a60
[  127.821281][ T4987]  process_one_work+0xa23/0x1940
[  127.826243][ T4987]  worker_thread+0x5ef/0xe50
[  127.830844][ T4987]  kthread+0x370/0x450
[  127.834970][ T4987]  ret_from_fork+0x72b/0xd50
[  127.839582][ T4987]  ret_from_fork_asm+0x1a/0x30
[  127.844368][ T4987] 
[  127.846686][ T4987] Freed by task 9:
[  127.850400][ T4987]  kasan_save_stack+0x30/0x50
[  127.855113][ T4987]  kasan_save_track+0x14/0x30
[  127.859858][ T4987]  kasan_save_free_info+0x3b/0x70
[  127.864997][ T4987]  __kasan_slab_free+0x5f/0x80
[  127.869774][ T4987]  kfree+0x22b/0x6c0
[  127.873688][ T4987]  sur40_probe+0xc36/0x1580
[  127.878207][ T4987]  usb_probe_interface+0x303/0x8f0
[  127.883348][ T4987]  really_probe+0x241/0xa60
[  127.887871][ T4987]  __driver_probe_device+0x20e/0x450
[  127.893171][ T4987]  driver_probe_device+0x4a/0x140
[  127.898469][ T4987]  __device_attach_driver+0x1df/0x320
[  127.903971][ T4987]  bus_for_each_drv+0x159/0x1e0
[  127.908851][ T4987]  __device_attach+0x1e4/0x4d0
[  127.913897][ T4987]  device_initial_probe+0xaf/0xd0
[  127.918996][ T4987]  bus_probe_device+0x64/0x160
[  127.923774][ T4987]  device_add+0x121d/0x1970
[  127.928315][ T4987]  usb_set_configuration+0xd97/0x1c60
[  127.933833][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  127.939229][ T4987]  usb_probe_device+0xef/0x400
[  127.944053][ T4987]  really_probe+0x241/0xa60
[  127.948669][ T4987]  __driver_probe_device+0x20e/0x450
[  127.954439][ T4987]  driver_probe_device+0x4a/0x140
[  127.959503][ T4987]  __device_attach_driver+0x1df/0x320
[  127.964899][ T4987]  bus_for_each_drv+0x159/0x1e0
[  127.969774][ T4987]  __device_attach+0x1e4/0x4d0
[  127.974619][ T4987]  device_initial_probe+0xaf/0xd0
[  127.979674][ T4987]  bus_probe_device+0x64/0x160
[  127.984490][ T4987]  device_add+0x121d/0x1970
[  127.989066][ T4987]  usb_new_device.cold+0x685/0x115c
[  127.994302][ T4987]  hub_event+0x30a3/0x4a60
[  127.998769][ T4987]  process_one_work+0xa23/0x1940
[  128.003743][ T4987]  worker_thread+0x5ef/0xe50
[  128.008343][ T4987]  kthread+0x370/0x450
[  128.012467][ T4987]  ret_from_fork+0x72b/0xd50
[  128.017079][ T4987]  ret_from_fork_asm+0x1a/0x30
[  128.022046][ T4987] 
[  128.024810][ T4987] The buggy address belongs to the object at ffff88807f806000
[  128.024810][ T4987]  which belongs to the cache kmalloc-4k of size 4096
[  128.038870][ T4987] The buggy address is located 3083 bytes inside of
[  128.038870][ T4987]  freed 4096-byte region [ffff88807f806000, ffff88807f807000)
[  128.052860][ T4987] 
[  128.055179][ T4987] The buggy address belongs to the physical page:
[  128.061773][ T4987] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f800
[  128.070573][ T4987] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  128.079078][ T4987] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  128.086624][ T4987] page_type: f5(slab)
[  128.090616][ T4987] raw: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  128.099203][ T4987] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  128.107792][ T4987] head: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  128.116472][ T4987] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  128.125235][ T4987] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  128.133911][ T4987] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  128.142672][ T4987] page dumped because: kasan: bad access detected
[  128.149100][ T4987] page_owner tracks the page as allocated
[  128.154821][ T4987] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4996, tgid 4996 (udevd), ts 58249348224, free_ts 58222770964
[  128.174829][ T4987]  post_alloc_hook+0xfd/0x120
[  128.179545][ T4987]  get_page_from_freelist+0xf48/0x3530
[  128.185081][ T4987]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  128.191122][ T4987]  new_slab+0xa2/0x640
[  128.195234][ T4987]  refill_objects+0xe3/0x410
[  128.199862][ T4987]  __pcs_replace_empty_main+0x376/0x680
[  128.205438][ T4987]  __kmalloc_noprof+0x66d/0x820
[  128.210321][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  128.215905][ T4987]  tomoyo_path_perm+0x276/0x460
[  128.221212][ T4987]  security_inode_getattr+0x116/0x280
[  128.226609][ T4987]  vfs_fstat+0x4b/0xe0
[  128.230712][ T4987]  __do_sys_newfstat+0x8b/0x110
[  128.235599][ T4987]  do_syscall_64+0x115/0x870
[  128.240214][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  128.246160][ T4987] page last free pid 4992 tgid 4992 stack trace:
[  128.252494][ T4987]  __free_frozen_pages+0x79f/0x1090
[  128.257716][ T4987]  qlist_free_all+0x47/0xf0
[  128.262265][ T4987]  kasan_quarantine_reduce+0x1a0/0x1f0
[  128.267770][ T4987]  __kasan_slab_alloc+0x69/0x90
[  128.272660][ T4987]  __kmalloc_noprof+0x2bf/0x820
[  128.277657][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  128.283237][ T4987]  tomoyo_check_open_permission+0x2af/0x3c0
[  128.289162][ T4987]  tomoyo_file_open+0x6b/0x90
[  128.293865][ T4987]  security_file_open+0xb5/0x1e0
[  128.298833][ T4987]  do_dentry_open+0x588/0x14d0
[  128.303622][ T4987]  vfs_open+0x82/0x3f0
[  128.307733][ T4987]  path_openat+0x2873/0x4280
[  128.312391][ T4987]  do_file_open+0x20e/0x430
[  128.316929][ T4987]  do_sys_openat2+0x10f/0x1e0
[  128.321648][ T4987]  __x64_sys_openat+0x12d/0x210
[  128.326532][ T4987]  do_syscall_64+0x115/0x870
[  128.331155][ T4987] 
[  128.333473][ T4987] Memory state around the buggy address:
[  128.339098][ T4987]  ffff88807f806b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  128.347199][ T4987]  ffff88807f806b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  128.355288][ T4987] >ffff88807f806c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  128.363367][ T4987]                       ^
[  128.368001][ T4987]  ffff88807f806c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  128.376095][ T4987]  ffff88807f806d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  128.384171][ T4987] ==================================================================
[  128.400232][ T5770] [drm] Initialized udl 0.0.1 for 1-1:1.0 on minor 2
[  128.407102][ T5770] [drm] Initialized udl on minor 2
[  128.414508][ T5770] udl 1-1:1.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9
[  128.423053][ T5770] udl 1-1:1.0: [drm] Cannot find any crtc or sizes
[  128.451112][ T5857] udl 1-1:1.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9
[  128.460843][ T5770] usb 1-1: USB disconnect, device number 4
[  128.468698][ T5857] udl 1-1:1.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffed
[  128.482572][ T5857] udl 1-1:1.0: [drm] Cannot find any crtc or sizes
[  128.505630][ T4987] ==================================================================
[  128.513742][ T4987] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  128.520808][ T4987] Read of size 1 at addr ffff88807f806c0c by task udevd/4987
[  128.528203][ T4987] 
[  128.530554][ T4987] CPU: 1 UID: 0 PID: 4987 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  128.530609][ T4987] Tainted: [B]=BAD_PAGE
[  128.530622][ T4987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  128.530645][ T4987] Call Trace:
[  128.530657][ T4987]  <TASK>
[  128.530670][ T4987]  dump_stack_lvl+0x100/0x190
[  128.530717][ T4987]  print_report+0x13d/0x4b0
[  128.530774][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  128.530820][ T4987]  ? __virt_addr_valid+0x239/0x430
[  128.530873][ T4987]  ? string+0x471/0x4d0
[  128.530917][ T4987]  kasan_report+0xdf/0x1c0
[  128.530957][ T4987]  ? string+0x471/0x4d0
[  128.531003][ T4987]  string+0x471/0x4d0
[  128.531046][ T4987]  ? __pfx_string+0x10/0x10
[  128.531091][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  128.531140][ T4987]  vsnprintf+0x422/0x1300
[  128.531192][ T4987]  ? __pfx_vsnprintf+0x10/0x10
[  128.531259][ T4987]  ? uevent_show+0x166/0x3a0
[  128.531321][ T4987]  ? sysfs_kf_seq_show+0x217/0x3f0
[  128.531369][ T4987]  ? seq_read_iter+0x32f/0x1270
[  128.531419][ T4987]  ? kernfs_fop_read_iter+0x46c/0x610
[  128.531492][ T4987]  ? vfs_read+0x82e/0xb40
[  128.531540][ T4987]  ? ksys_read+0x12a/0x250
[  128.531585][ T4987]  ? do_syscall_64+0x115/0x870
[  128.531640][ T4987]  add_uevent_var+0x183/0x3a0
[  128.531682][ T4987]  ? __pfx_add_uevent_var+0x10/0x10
[  128.531729][ T4987]  ? input_dev_uevent+0x16d/0x910
[  128.531783][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  128.531839][ T4987]  input_dev_uevent+0x1bf/0x910
[  128.531892][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  128.531949][ T4987]  dev_uevent+0x2f1/0x870
[  128.531990][ T4987]  ? __pfx_dev_uevent+0x10/0x10
[  128.532029][ T4987]  ? kasan_save_track+0x14/0x30
[  128.532094][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  128.532140][ T4987]  ? __kasan_kmalloc+0xaa/0xb0
[  128.532199][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  128.532251][ T4987]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  128.532317][ T4987]  ? uevent_show+0x166/0x3a0
[  128.532386][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  128.532439][ T4987]  uevent_show+0x1ca/0x3a0
[  128.532499][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  128.532596][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  128.532651][ T4987]  dev_attr_show+0x52/0xa0
[  128.532729][ T4987]  ? __pfx_dev_attr_show+0x10/0x10
[  128.532860][ T4987]  sysfs_kf_seq_show+0x217/0x3f0
[  128.532945][ T4987]  seq_read_iter+0x32f/0x1270
[  128.533009][ T4987]  kernfs_fop_read_iter+0x46c/0x610
[  128.533079][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  128.533127][ T4987]  ? rw_verify_area+0xce/0x6d0
[  128.533169][ T4987]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  128.533214][ T4987]  vfs_read+0x82e/0xb40
[  128.533273][ T4987]  ? __pfx_vfs_read+0x10/0x10
[  128.533345][ T4987]  ? __pfx___do_sys_newfstat+0x10/0x10
[  128.533422][ T4987]  ksys_read+0x12a/0x250
[  128.533469][ T4987]  ? __pfx_ksys_read+0x10/0x10
[  128.533521][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  128.533574][ T4987]  do_syscall_64+0x115/0x870
[  128.533629][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  128.533668][ T4987] RIP: 0033:0x7f0dc3ca7407
[  128.533709][ T4987] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  128.533745][ T4987] RSP: 002b:00007ffe09f45080 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  128.533783][ T4987] RAX: ffffffffffffffda RBX: 00007f0dc4385880 RCX: 00007f0dc3ca7407
[  128.533810][ T4987] RDX: 0000000000001000 RSI: 000055dce2afc1a0 RDI: 000000000000000c
[  128.533835][ T4987] RBP: 00007f0dc3defff0 R08: 0000000000000000 R09: 0000000000000000
[  128.533868][ T4987] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  128.533892][ T4987] R13: 00007f0dc3defea0 R14: 0000000000000000 R15: 000055dce29f5b30
[  128.533929][ T4987]  </TASK>
[  128.533941][ T4987] 
[  128.538386][ T5857] usb 3-1: USB disconnect, device number 4
[  128.545083][ T4987] Allocated by task 9:
[  128.545106][ T4987]  kasan_save_stack+0x30/0x50
[  128.545170][ T4987]  kasan_save_track+0x14/0x30
[  128.923694][ T4987]  __kasan_kmalloc+0xaa/0xb0
[  128.928335][ T4987]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  128.933747][ T4987]  sur40_probe+0x1a8/0x1580
[  128.938283][ T4987]  usb_probe_interface+0x303/0x8f0
[  128.943434][ T4987]  really_probe+0x241/0xa60
[  128.947959][ T4987]  __driver_probe_device+0x20e/0x450
[  128.953271][ T4987]  driver_probe_device+0x4a/0x140
[  128.958320][ T4987]  __device_attach_driver+0x1df/0x320
[  128.963728][ T4987]  bus_for_each_drv+0x159/0x1e0
[  128.968617][ T4987]  __device_attach+0x1e4/0x4d0
[  128.973436][ T4987]  device_initial_probe+0xaf/0xd0
[  128.978746][ T4987]  bus_probe_device+0x64/0x160
[  128.983550][ T4987]  device_add+0x121d/0x1970
[  128.988174][ T4987]  usb_set_configuration+0xd97/0x1c60
[  128.993582][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  128.999067][ T4987]  usb_probe_device+0xef/0x400
[  129.003864][ T4987]  really_probe+0x241/0xa60
[  129.008409][ T4987]  __driver_probe_device+0x20e/0x450
[  129.013726][ T4987]  driver_probe_device+0x4a/0x140
[  129.018792][ T4987]  __device_attach_driver+0x1df/0x320
[  129.024294][ T4987]  bus_for_each_drv+0x159/0x1e0
[  129.029382][ T4987]  __device_attach+0x1e4/0x4d0
[  129.034175][ T4987]  device_initial_probe+0xaf/0xd0
[  129.039228][ T4987]  bus_probe_device+0x64/0x160
[  129.044010][ T4987]  device_add+0x121d/0x1970
[  129.048553][ T4987]  usb_new_device.cold+0x685/0x115c
[  129.053772][ T4987]  hub_event+0x30a3/0x4a60
[  129.058224][ T4987]  process_one_work+0xa23/0x1940
[  129.063172][ T4987]  worker_thread+0x5ef/0xe50
[  129.067808][ T4987]  kthread+0x370/0x450
[  129.071918][ T4987]  ret_from_fork+0x72b/0xd50
[  129.076539][ T4987]  ret_from_fork_asm+0x1a/0x30
[  129.081356][ T4987] 
[  129.084021][ T4987] Freed by task 9:
[  129.087737][ T4987]  kasan_save_stack+0x30/0x50
[  129.092455][ T4987]  kasan_save_track+0x14/0x30
[  129.097177][ T4987]  kasan_save_free_info+0x3b/0x70
[  129.102249][ T4987]  __kasan_slab_free+0x5f/0x80
[  129.107025][ T4987]  kfree+0x22b/0x6c0
[  129.110940][ T4987]  sur40_probe+0xc36/0x1580
[  129.115501][ T4987]  usb_probe_interface+0x303/0x8f0
[  129.120675][ T4987]  really_probe+0x241/0xa60
[  129.125484][ T4987]  __driver_probe_device+0x20e/0x450
[  129.130898][ T4987]  driver_probe_device+0x4a/0x140
[  129.135960][ T4987]  __device_attach_driver+0x1df/0x320
[  129.141543][ T4987]  bus_for_each_drv+0x159/0x1e0
[  129.146605][ T4987]  __device_attach+0x1e4/0x4d0
[  129.151429][ T4987]  device_initial_probe+0xaf/0xd0
[  129.156525][ T4987]  bus_probe_device+0x64/0x160
[  129.161351][ T4987]  device_add+0x121d/0x1970
[  129.165943][ T4987]  usb_set_configuration+0xd97/0x1c60
[  129.171386][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  129.176825][ T4987]  usb_probe_device+0xef/0x400
[  129.181631][ T4987]  really_probe+0x241/0xa60
[  129.186167][ T4987]  __driver_probe_device+0x20e/0x450
[  129.191491][ T4987]  driver_probe_device+0x4a/0x140
[  129.196640][ T4987]  __device_attach_driver+0x1df/0x320
[  129.202050][ T4987]  bus_for_each_drv+0x159/0x1e0
[  129.206934][ T4987]  __device_attach+0x1e4/0x4d0
[  129.211734][ T4987]  device_initial_probe+0xaf/0xd0
[  129.216810][ T4987]  bus_probe_device+0x64/0x160
[  129.221603][ T4987]  device_add+0x121d/0x1970
[  129.226149][ T4987]  usb_new_device.cold+0x685/0x115c
[  129.231389][ T4987]  hub_event+0x30a3/0x4a60
[  129.235902][ T4987]  process_one_work+0xa23/0x1940
[  129.240955][ T4987]  worker_thread+0x5ef/0xe50
[  129.245574][ T4987]  kthread+0x370/0x450
[  129.249706][ T4987]  ret_from_fork+0x72b/0xd50
[  129.254329][ T4987]  ret_from_fork_asm+0x1a/0x30
[  129.259208][ T4987] 
[  129.261532][ T4987] The buggy address belongs to the object at ffff88807f806000
[  129.261532][ T4987]  which belongs to the cache kmalloc-4k of size 4096
[  129.275684][ T4987] The buggy address is located 3084 bytes inside of
[  129.275684][ T4987]  freed 4096-byte region [ffff88807f806000, ffff88807f807000)
[  129.289767][ T4987] 
[  129.292102][ T4987] The buggy address belongs to the physical page:
[  129.298520][ T4987] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f800
[  129.307292][ T4987] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  129.315802][ T4987] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  129.323366][ T4987] page_type: f5(slab)
[  129.327360][ T4987] raw: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  129.335967][ T4987] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  129.344659][ T4987] head: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  129.353354][ T4987] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  129.362044][ T4987] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  129.370732][ T4987] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  129.379499][ T4987] page dumped because: kasan: bad access detected
[  129.386014][ T4987] page_owner tracks the page as allocated
[  129.391723][ T4987] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4996, tgid 4996 (udevd), ts 58249348224, free_ts 58222770964
[  129.411733][ T4987]  post_alloc_hook+0xfd/0x120
[  129.416464][ T4987]  get_page_from_freelist+0xf48/0x3530
[  129.421956][ T4987]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  129.427877][ T4987]  new_slab+0xa2/0x640
[  129.431966][ T4987]  refill_objects+0xe3/0x410
[  129.436633][ T4987]  __pcs_replace_empty_main+0x376/0x680
[  129.442201][ T4987]  __kmalloc_noprof+0x66d/0x820
[  129.447089][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  129.452710][ T4987]  tomoyo_path_perm+0x276/0x460
[  129.457596][ T4987]  security_inode_getattr+0x116/0x280
[  129.463167][ T4987]  vfs_fstat+0x4b/0xe0
[  129.467276][ T4987]  __do_sys_newfstat+0x8b/0x110
[  129.472247][ T4987]  do_syscall_64+0x115/0x870
[  129.476863][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  129.482818][ T4987] page last free pid 4992 tgid 4992 stack trace:
[  129.489631][ T4987]  __free_frozen_pages+0x79f/0x1090
[  129.494853][ T4987]  qlist_free_all+0x47/0xf0
[  129.499388][ T4987]  kasan_quarantine_reduce+0x1a0/0x1f0
[  129.504944][ T4987]  __kasan_slab_alloc+0x69/0x90
[  129.509826][ T4987]  __kmalloc_noprof+0x2bf/0x820
[  129.514705][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  129.520321][ T4987]  tomoyo_check_open_permission+0x2af/0x3c0
[  129.526238][ T4987]  tomoyo_file_open+0x6b/0x90
[  129.530923][ T4987]  security_file_open+0xb5/0x1e0
[  129.535971][ T4987]  do_dentry_open+0x588/0x14d0
[  129.540795][ T4987]  vfs_open+0x82/0x3f0
[  129.544875][ T4987]  path_openat+0x2873/0x4280
[  129.549529][ T4987]  do_file_open+0x20e/0x430
[  129.554065][ T4987]  do_sys_openat2+0x10f/0x1e0
[  129.558756][ T4987]  __x64_sys_openat+0x12d/0x210
[  129.563623][ T4987]  do_syscall_64+0x115/0x870
[  129.568601][ T4987] 
[  129.570918][ T4987] Memory state around the buggy address:
[  129.576547][ T4987]  ffff88807f806b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  129.584623][ T4987]  ffff88807f806b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  129.592785][ T4987] >ffff88807f806c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  129.601199][ T4987]                       ^
[  129.605526][ T4987]  ffff88807f806c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  129.613632][ T4987]  ffff88807f806d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  129.621733][ T4987] ==================================================================
[  129.672880][   T29] usb 5-1: USB disconnect, device number 4
[  129.683183][ T5865] sd 1:0:0:1: [sdc] Test Unit Ready failed: Result: hostbyte=DID_NO_CONNECT driverbyte=DRIVER_OK
[  129.699677][ T4987] ==================================================================
[  129.708046][ T4987] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  129.715028][ T4987] Read of size 1 at addr ffff88807f806c0d by task udevd/4987
[  129.722510][ T4987] 
[  129.725017][ T4987] CPU: 1 UID: 0 PID: 4987 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  129.725066][ T4987] Tainted: [B]=BAD_PAGE
[  129.725078][ T4987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  129.725099][ T4987] Call Trace:
[  129.725111][ T4987]  <TASK>
[  129.725123][ T4987]  dump_stack_lvl+0x100/0x190
[  129.725164][ T4987]  print_report+0x13d/0x4b0
[  129.725217][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  129.725259][ T4987]  ? __virt_addr_valid+0x239/0x430
[  129.725302][ T4987]  ? string+0x471/0x4d0
[  129.725340][ T4987]  kasan_report+0xdf/0x1c0
[  129.725390][ T4987]  ? string+0x471/0x4d0
[  129.725447][ T4987]  string+0x471/0x4d0
[  129.725487][ T4987]  ? __pfx_string+0x10/0x10
[  129.725527][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  129.725573][ T4987]  vsnprintf+0x422/0x1300
[  129.725622][ T4987]  ? __pfx_vsnprintf+0x10/0x10
[  129.725665][ T4987]  ? uevent_show+0x166/0x3a0
[  129.725708][ T4987]  ? sysfs_kf_seq_show+0x217/0x3f0
[  129.725751][ T4987]  ? seq_read_iter+0x32f/0x1270
[  129.725797][ T4987]  ? kernfs_fop_read_iter+0x46c/0x610
[  129.725842][ T4987]  ? vfs_read+0x82e/0xb40
[  129.725882][ T4987]  ? ksys_read+0x12a/0x250
[  129.725923][ T4987]  ? do_syscall_64+0x115/0x870
[  129.725973][ T4987]  add_uevent_var+0x183/0x3a0
[  129.726010][ T4987]  ? __pfx_add_uevent_var+0x10/0x10
[  129.726053][ T4987]  ? input_dev_uevent+0x16d/0x910
[  129.726101][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  129.726147][ T4987]  input_dev_uevent+0x1bf/0x910
[  129.726194][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  129.726240][ T4987]  dev_uevent+0x2f1/0x870
[  129.726273][ T4987]  ? __pfx_dev_uevent+0x10/0x10
[  129.726305][ T4987]  ? kasan_save_track+0x14/0x30
[  129.726359][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  129.726401][ T4987]  ? __kasan_kmalloc+0xaa/0xb0
[  129.726455][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  129.726512][ T4987]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  129.726571][ T4987]  ? uevent_show+0x166/0x3a0
[  129.726616][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  129.726659][ T4987]  uevent_show+0x1ca/0x3a0
[  129.726701][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  129.726745][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  129.726788][ T4987]  dev_attr_show+0x52/0xa0
[  129.726848][ T4987]  ? __pfx_dev_attr_show+0x10/0x10
[  129.726903][ T4987]  sysfs_kf_seq_show+0x217/0x3f0
[  129.726950][ T4987]  seq_read_iter+0x32f/0x1270
[  129.727006][ T4987]  kernfs_fop_read_iter+0x46c/0x610
[  129.727044][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  129.727086][ T4987]  ? rw_verify_area+0xce/0x6d0
[  129.727124][ T4987]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  129.727164][ T4987]  vfs_read+0x82e/0xb40
[  129.727208][ T4987]  ? __pfx_vfs_read+0x10/0x10
[  129.727253][ T4987]  ? __pfx___do_sys_newfstat+0x10/0x10
[  129.727322][ T4987]  ksys_read+0x12a/0x250
[  129.727364][ T4987]  ? __pfx_ksys_read+0x10/0x10
[  129.727412][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  129.727458][ T4987]  do_syscall_64+0x115/0x870
[  129.727508][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  129.727544][ T4987] RIP: 0033:0x7f0dc3ca7407
[  129.727570][ T4987] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  129.727616][ T4987] RSP: 002b:00007ffe09f45080 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  129.727658][ T4987] RAX: ffffffffffffffda RBX: 00007f0dc4385880 RCX: 00007f0dc3ca7407
[  129.727681][ T4987] RDX: 0000000000001000 RSI: 000055dce2afc1a0 RDI: 000000000000000c
[  129.727703][ T4987] RBP: 00007f0dc3defff0 R08: 0000000000000000 R09: 0000000000000000
[  129.727725][ T4987] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  129.727747][ T4987] R13: 00007f0dc3defea0 R14: 0000000000000000 R15: 000055dce29f5b30
[  129.727781][ T4987]  </TASK>
[  129.727792][ T4987] 
[  130.097847][ T4987] Allocated by task 9:
[  130.101919][ T4987]  kasan_save_stack+0x30/0x50
[  130.106746][ T4987]  kasan_save_track+0x14/0x30
[  130.111485][ T4987]  __kasan_kmalloc+0xaa/0xb0
[  130.116277][ T4987]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  130.121670][ T4987]  sur40_probe+0x1a8/0x1580
[  130.126274][ T4987]  usb_probe_interface+0x303/0x8f0
[  130.131417][ T4987]  really_probe+0x241/0xa60
[  130.135941][ T4987]  __driver_probe_device+0x20e/0x450
[  130.141264][ T4987]  driver_probe_device+0x4a/0x140
[  130.146350][ T4987]  __device_attach_driver+0x1df/0x320
[  130.151904][ T4987]  bus_for_each_drv+0x159/0x1e0
[  130.156845][ T4987]  __device_attach+0x1e4/0x4d0
[  130.161646][ T4987]  device_initial_probe+0xaf/0xd0
[  130.167065][ T4987]  bus_probe_device+0x64/0x160
[  130.171863][ T4987]  device_add+0x121d/0x1970
[  130.176386][ T4987]  usb_set_configuration+0xd97/0x1c60
[  130.181989][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  130.187392][ T4987]  usb_probe_device+0xef/0x400
[  130.192325][ T4987]  really_probe+0x241/0xa60
[  130.196919][ T4987]  __driver_probe_device+0x20e/0x450
[  130.202258][ T4987]  driver_probe_device+0x4a/0x140
[  130.207315][ T4987]  __device_attach_driver+0x1df/0x320
[  130.212848][ T4987]  bus_for_each_drv+0x159/0x1e0
[  130.217759][ T4987]  __device_attach+0x1e4/0x4d0
[  130.222591][ T4987]  device_initial_probe+0xaf/0xd0
[  130.227647][ T4987]  bus_probe_device+0x64/0x160
[  130.232431][ T4987]  device_add+0x121d/0x1970
[  130.236990][ T4987]  usb_new_device.cold+0x685/0x115c
[  130.242215][ T4987]  hub_event+0x30a3/0x4a60
[  130.246689][ T4987]  process_one_work+0xa23/0x1940
[  130.251657][ T4987]  worker_thread+0x5ef/0xe50
[  130.256276][ T4987]  kthread+0x370/0x450
[  130.260385][ T4987]  ret_from_fork+0x72b/0xd50
[  130.265548][ T4987]  ret_from_fork_asm+0x1a/0x30
[  130.270513][ T4987] 
[  130.272830][ T4987] Freed by task 9:
[  130.276546][ T4987]  kasan_save_stack+0x30/0x50
[  130.281375][ T4987]  kasan_save_track+0x14/0x30
[  130.286091][ T4987]  kasan_save_free_info+0x3b/0x70
[  130.291518][ T4987]  __kasan_slab_free+0x5f/0x80
[  130.296295][ T4987]  kfree+0x22b/0x6c0
[  130.300233][ T4987]  sur40_probe+0xc36/0x1580
[  130.304745][ T4987]  usb_probe_interface+0x303/0x8f0
[  130.309936][ T4987]  really_probe+0x241/0xa60
[  130.314492][ T4987]  __driver_probe_device+0x20e/0x450
[  130.319844][ T4987]  driver_probe_device+0x4a/0x140
[  130.325030][ T4987]  __device_attach_driver+0x1df/0x320
[  130.330441][ T4987]  bus_for_each_drv+0x159/0x1e0
[  130.335413][ T4987]  __device_attach+0x1e4/0x4d0
[  130.340226][ T4987]  device_initial_probe+0xaf/0xd0
[  130.345304][ T4987]  bus_probe_device+0x64/0x160
[  130.350088][ T4987]  device_add+0x121d/0x1970
[  130.354660][ T4987]  usb_set_configuration+0xd97/0x1c60
[  130.360074][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  130.365676][ T4987]  usb_probe_device+0xef/0x400
[  130.370481][ T4987]  really_probe+0x241/0xa60
[  130.375011][ T4987]  __driver_probe_device+0x20e/0x450
[  130.380320][ T4987]  driver_probe_device+0x4a/0x140
[  130.385372][ T4987]  __device_attach_driver+0x1df/0x320
[  130.390804][ T4987]  bus_for_each_drv+0x159/0x1e0
[  130.395706][ T4987]  __device_attach+0x1e4/0x4d0
[  130.400611][ T4987]  device_initial_probe+0xaf/0xd0
[  130.405763][ T4987]  bus_probe_device+0x64/0x160
[  130.410575][ T4987]  device_add+0x121d/0x1970
[  130.415107][ T4987]  usb_new_device.cold+0x685/0x115c
[  130.420321][ T4987]  hub_event+0x30a3/0x4a60
[  130.424792][ T4987]  process_one_work+0xa23/0x1940
[  130.429920][ T4987]  worker_thread+0x5ef/0xe50
[  130.434521][ T4987]  kthread+0x370/0x450
[  130.438711][ T4987]  ret_from_fork+0x72b/0xd50
[  130.443365][ T4987]  ret_from_fork_asm+0x1a/0x30
[  130.448299][ T4987] 
[  130.450623][ T4987] The buggy address belongs to the object at ffff88807f806000
[  130.450623][ T4987]  which belongs to the cache kmalloc-4k of size 4096
[  130.464723][ T4987] The buggy address is located 3085 bytes inside of
[  130.464723][ T4987]  freed 4096-byte region [ffff88807f806000, ffff88807f807000)
[  130.478731][ T4987] 
[  130.481103][ T4987] The buggy address belongs to the physical page:
[  130.487509][ T4987] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f800
[  130.496299][ T4987] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  130.504837][ T4987] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  130.512485][ T4987] page_type: f5(slab)
[  130.516517][ T4987] raw: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  130.525117][ T4987] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  130.533717][ T4987] head: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  130.542415][ T4987] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  130.551115][ T4987] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  130.559803][ T4987] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  130.568493][ T4987] page dumped because: kasan: bad access detected
[  130.574932][ T4987] page_owner tracks the page as allocated
[  130.580639][ T4987] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4996, tgid 4996 (udevd), ts 58249348224, free_ts 58222770964
[  130.600731][ T4987]  post_alloc_hook+0xfd/0x120
[  130.605500][ T4987]  get_page_from_freelist+0xf48/0x3530
[  130.610983][ T4987]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  130.616940][ T4987]  new_slab+0xa2/0x640
[  130.621034][ T4987]  refill_objects+0xe3/0x410
[  130.625655][ T4987]  __pcs_replace_empty_main+0x376/0x680
[  130.631227][ T4987]  __kmalloc_noprof+0x66d/0x820
[  130.636141][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  130.641839][ T4987]  tomoyo_path_perm+0x276/0x460
[  130.646708][ T4987]  security_inode_getattr+0x116/0x280
[  130.652197][ T4987]  vfs_fstat+0x4b/0xe0
[  130.656337][ T4987]  __do_sys_newfstat+0x8b/0x110
[  130.661218][ T4987]  do_syscall_64+0x115/0x870
[  130.665836][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  130.671778][ T4987] page last free pid 4992 tgid 4992 stack trace:
[  130.678146][ T4987]  __free_frozen_pages+0x79f/0x1090
[  130.683366][ T4987]  qlist_free_all+0x47/0xf0
[  130.687916][ T4987]  kasan_quarantine_reduce+0x1a0/0x1f0
[  130.693450][ T4987]  __kasan_slab_alloc+0x69/0x90
[  130.698348][ T4987]  __kmalloc_noprof+0x2bf/0x820
[  130.703250][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  130.708870][ T4987]  tomoyo_check_open_permission+0x2af/0x3c0
[  130.714798][ T4987]  tomoyo_file_open+0x6b/0x90
[  130.719485][ T4987]  security_file_open+0xb5/0x1e0
[  130.724619][ T4987]  do_dentry_open+0x588/0x14d0
[  130.729401][ T4987]  vfs_open+0x82/0x3f0
[  130.733472][ T4987]  path_openat+0x2873/0x4280
[  130.738122][ T4987]  do_file_open+0x20e/0x430
[  130.742648][ T4987]  do_sys_openat2+0x10f/0x1e0
[  130.747357][ T4987]  __x64_sys_openat+0x12d/0x210
[  130.752228][ T4987]  do_syscall_64+0x115/0x870
[  130.756882][ T4987] 
[  130.759210][ T4987] Memory state around the buggy address:
[  130.764839][ T4987]  ffff88807f806b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  130.772907][ T4987]  ffff88807f806b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  130.780987][ T4987] >ffff88807f806c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  130.789081][ T4987]                       ^
[  130.793436][ T4987]  ffff88807f806c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  130.801854][ T4987]  ffff88807f806d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  130.809921][ T4987] ==================================================================
[  130.839722][ T4987] ==================================================================
[  130.847832][ T4987] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  130.854812][ T4987] Read of size 1 at addr ffff88807f806c0e by task udevd/4987
[  130.862201][ T4987] 
[  130.864536][ T4987] CPU: 1 UID: 0 PID: 4987 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  130.864592][ T4987] Tainted: [B]=BAD_PAGE
[  130.864606][ T4987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  130.864629][ T4987] Call Trace:
[  130.864641][ T4987]  <TASK>
[  130.864654][ T4987]  dump_stack_lvl+0x100/0x190
[  130.864701][ T4987]  print_report+0x13d/0x4b0
[  130.864757][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  130.864804][ T4987]  ? __virt_addr_valid+0x239/0x430
[  130.864852][ T4987]  ? string+0x471/0x4d0
[  130.864895][ T4987]  kasan_report+0xdf/0x1c0
[  130.864938][ T4987]  ? string+0x471/0x4d0
[  130.864985][ T4987]  string+0x471/0x4d0
[  130.865027][ T4987]  ? __pfx_string+0x10/0x10
[  130.865069][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  130.865116][ T4987]  vsnprintf+0x422/0x1300
[  130.865168][ T4987]  ? __pfx_vsnprintf+0x10/0x10
[  130.865213][ T4987]  ? uevent_show+0x166/0x3a0
[  130.865264][ T4987]  ? sysfs_kf_seq_show+0x217/0x3f0
[  130.865311][ T4987]  ? seq_read_iter+0x32f/0x1270
[  130.865368][ T4987]  ? kernfs_fop_read_iter+0x46c/0x610
[  130.865410][ T4987]  ? vfs_read+0x82e/0xb40
[  130.865455][ T4987]  ? ksys_read+0x12a/0x250
[  130.865501][ T4987]  ? do_syscall_64+0x115/0x870
[  130.865556][ T4987]  add_uevent_var+0x183/0x3a0
[  130.865600][ T4987]  ? __pfx_add_uevent_var+0x10/0x10
[  130.865647][ T4987]  ? input_dev_uevent+0x16d/0x910
[  130.865702][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  130.865753][ T4987]  input_dev_uevent+0x1bf/0x910
[  130.865806][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  130.865850][ T4987]  dev_uevent+0x2f1/0x870
[  130.865883][ T4987]  ? __pfx_dev_uevent+0x10/0x10
[  130.865917][ T4987]  ? kasan_save_track+0x14/0x30
[  130.865975][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  130.866022][ T4987]  ? __kasan_kmalloc+0xaa/0xb0
[  130.866081][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  130.866127][ T4987]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  130.866180][ T4987]  ? uevent_show+0x166/0x3a0
[  130.866231][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  130.866277][ T4987]  uevent_show+0x1ca/0x3a0
[  130.866331][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  130.866380][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  130.866427][ T4987]  dev_attr_show+0x52/0xa0
[  130.866487][ T4987]  ? __pfx_dev_attr_show+0x10/0x10
[  130.866545][ T4987]  sysfs_kf_seq_show+0x217/0x3f0
[  130.866597][ T4987]  seq_read_iter+0x32f/0x1270
[  130.866658][ T4987]  kernfs_fop_read_iter+0x46c/0x610
[  130.866700][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  130.866745][ T4987]  ? rw_verify_area+0xce/0x6d0
[  130.866786][ T4987]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  130.866830][ T4987]  vfs_read+0x82e/0xb40
[  130.866879][ T4987]  ? __pfx_vfs_read+0x10/0x10
[  130.866925][ T4987]  ? __pfx___do_sys_newfstat+0x10/0x10
[  130.866999][ T4987]  ksys_read+0x12a/0x250
[  130.867045][ T4987]  ? __pfx_ksys_read+0x10/0x10
[  130.867095][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  130.867144][ T4987]  do_syscall_64+0x115/0x870
[  130.867198][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  130.867238][ T4987] RIP: 0033:0x7f0dc3ca7407
[  130.867266][ T4987] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  130.867303][ T4987] RSP: 002b:00007ffe09f45080 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  130.867344][ T4987] RAX: ffffffffffffffda RBX: 00007f0dc4385880 RCX: 00007f0dc3ca7407
[  130.867370][ T4987] RDX: 0000000000001000 RSI: 000055dce2afc1a0 RDI: 000000000000000c
[  130.867395][ T4987] RBP: 00007f0dc3defff0 R08: 0000000000000000 R09: 0000000000000000
[  130.867420][ T4987] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  130.867444][ T4987] R13: 00007f0dc3defea0 R14: 0000000000000000 R15: 000055dce29f5b30
[  130.867480][ T4987]  </TASK>
[  130.867493][ T4987] 
[  131.235500][ T4987] Allocated by task 9:
[  131.239586][ T4987]  kasan_save_stack+0x30/0x50
[  131.244309][ T4987]  kasan_save_track+0x14/0x30
[  131.249547][ T4987]  __kasan_kmalloc+0xaa/0xb0
[  131.254170][ T4987]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  131.259694][ T4987]  sur40_probe+0x1a8/0x1580
[  131.264758][ T4987]  usb_probe_interface+0x303/0x8f0
[  131.269910][ T4987]  really_probe+0x241/0xa60
[  131.274467][ T4987]  __driver_probe_device+0x20e/0x450
[  131.279830][ T4987]  driver_probe_device+0x4a/0x140
[  131.284902][ T4987]  __device_attach_driver+0x1df/0x320
[  131.290310][ T4987]  bus_for_each_drv+0x159/0x1e0
[  131.295269][ T4987]  __device_attach+0x1e4/0x4d0
[  131.300271][ T4987]  device_initial_probe+0xaf/0xd0
[  131.305452][ T4987]  bus_probe_device+0x64/0x160
[  131.310248][ T4987]  device_add+0x121d/0x1970
[  131.314791][ T4987]  usb_set_configuration+0xd97/0x1c60
[  131.320287][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  131.325783][ T4987]  usb_probe_device+0xef/0x400
[  131.330590][ T4987]  really_probe+0x241/0xa60
[  131.335120][ T4987]  __driver_probe_device+0x20e/0x450
[  131.340517][ T4987]  driver_probe_device+0x4a/0x140
[  131.345581][ T4987]  __device_attach_driver+0x1df/0x320
[  131.351071][ T4987]  bus_for_each_drv+0x159/0x1e0
[  131.356282][ T4987]  __device_attach+0x1e4/0x4d0
[  131.361081][ T4987]  device_initial_probe+0xaf/0xd0
[  131.366156][ T4987]  bus_probe_device+0x64/0x160
[  131.371309][ T4987]  device_add+0x121d/0x1970
[  131.375888][ T4987]  usb_new_device.cold+0x685/0x115c
[  131.381113][ T4987]  hub_event+0x30a3/0x4a60
[  131.385568][ T4987]  process_one_work+0xa23/0x1940
[  131.390518][ T4987]  worker_thread+0x5ef/0xe50
[  131.395133][ T4987]  kthread+0x370/0x450
[  131.399237][ T4987]  ret_from_fork+0x72b/0xd50
[  131.403874][ T4987]  ret_from_fork_asm+0x1a/0x30
[  131.408671][ T4987] 
[  131.410987][ T4987] Freed by task 9:
[  131.414698][ T4987]  kasan_save_stack+0x30/0x50
[  131.419428][ T4987]  kasan_save_track+0x14/0x30
[  131.424138][ T4987]  kasan_save_free_info+0x3b/0x70
[  131.429223][ T4987]  __kasan_slab_free+0x5f/0x80
[  131.434111][ T4987]  kfree+0x22b/0x6c0
[  131.438028][ T4987]  sur40_probe+0xc36/0x1580
[  131.442550][ T4987]  usb_probe_interface+0x303/0x8f0
[  131.447724][ T4987]  really_probe+0x241/0xa60
[  131.452271][ T4987]  __driver_probe_device+0x20e/0x450
[  131.457592][ T4987]  driver_probe_device+0x4a/0x140
[  131.462913][ T4987]  __device_attach_driver+0x1df/0x320
[  131.468333][ T4987]  bus_for_each_drv+0x159/0x1e0
[  131.473371][ T4987]  __device_attach+0x1e4/0x4d0
[  131.478158][ T4987]  device_initial_probe+0xaf/0xd0
[  131.483209][ T4987]  bus_probe_device+0x64/0x160
[  131.488075][ T4987]  device_add+0x121d/0x1970
[  131.492610][ T4987]  usb_set_configuration+0xd97/0x1c60
[  131.498009][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  131.503405][ T4987]  usb_probe_device+0xef/0x400
[  131.508190][ T4987]  really_probe+0x241/0xa60
[  131.512711][ T4987]  __driver_probe_device+0x20e/0x450
[  131.518028][ T4987]  driver_probe_device+0x4a/0x140
[  131.523069][ T4987]  __device_attach_driver+0x1df/0x320
[  131.528473][ T4987]  bus_for_each_drv+0x159/0x1e0
[  131.533349][ T4987]  __device_attach+0x1e4/0x4d0
[  131.538133][ T4987]  device_initial_probe+0xaf/0xd0
[  131.543177][ T4987]  bus_probe_device+0x64/0x160
[  131.547953][ T4987]  device_add+0x121d/0x1970
[  131.552486][ T4987]  usb_new_device.cold+0x685/0x115c
[  131.557697][ T4987]  hub_event+0x30a3/0x4a60
[  131.562135][ T4987]  process_one_work+0xa23/0x1940
[  131.567080][ T4987]  worker_thread+0x5ef/0xe50
[  131.571671][ T4987]  kthread+0x370/0x450
[  131.575765][ T4987]  ret_from_fork+0x72b/0xd50
[  131.580369][ T4987]  ret_from_fork_asm+0x1a/0x30
[  131.585160][ T4987] 
[  131.587509][ T4987] The buggy address belongs to the object at ffff88807f806000
[  131.587509][ T4987]  which belongs to the cache kmalloc-4k of size 4096
[  131.601654][ T4987] The buggy address is located 3086 bytes inside of
[  131.601654][ T4987]  freed 4096-byte region [ffff88807f806000, ffff88807f807000)
[  131.615636][ T4987] 
[  131.617949][ T4987] The buggy address belongs to the physical page:
[  131.624358][ T4987] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f800
[  131.633125][ T4987] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  131.641719][ T4987] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  131.649282][ T4987] page_type: f5(slab)
[  131.653283][ T4987] raw: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  131.661881][ T4987] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  131.670503][ T4987] head: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  131.679318][ T4987] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  131.687997][ T4987] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  131.696765][ T4987] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  131.705433][ T4987] page dumped because: kasan: bad access detected
[  131.711843][ T4987] page_owner tracks the page as allocated
[  131.717548][ T4987] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4996, tgid 4996 (udevd), ts 58249348224, free_ts 58222770964
[  131.737726][ T4987]  post_alloc_hook+0xfd/0x120
[  131.742545][ T4987]  get_page_from_freelist+0xf48/0x3530
[  131.748094][ T4987]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  131.754047][ T4987]  new_slab+0xa2/0x640
[  131.758145][ T4987]  refill_objects+0xe3/0x410
[  131.762820][ T4987]  __pcs_replace_empty_main+0x376/0x680
[  131.768627][ T4987]  __kmalloc_noprof+0x66d/0x820
[  131.773733][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  131.779367][ T4987]  tomoyo_path_perm+0x276/0x460
[  131.784253][ T4987]  security_inode_getattr+0x116/0x280
[  131.789663][ T4987]  vfs_fstat+0x4b/0xe0
[  131.793782][ T4987]  __do_sys_newfstat+0x8b/0x110
[  131.798694][ T4987]  do_syscall_64+0x115/0x870
[  131.803322][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  131.809238][ T4987] page last free pid 4992 tgid 4992 stack trace:
[  131.815573][ T4987]  __free_frozen_pages+0x79f/0x1090
[  131.820926][ T4987]  qlist_free_all+0x47/0xf0
[  131.825464][ T4987]  kasan_quarantine_reduce+0x1a0/0x1f0
[  131.831000][ T4987]  __kasan_slab_alloc+0x69/0x90
[  131.835866][ T4987]  __kmalloc_noprof+0x2bf/0x820
[  131.840861][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  131.846472][ T4987]  tomoyo_check_open_permission+0x2af/0x3c0
[  131.852428][ T4987]  tomoyo_file_open+0x6b/0x90
[  131.857231][ T4987]  security_file_open+0xb5/0x1e0
[  131.862228][ T4987]  do_dentry_open+0x588/0x14d0
[  131.867048][ T4987]  vfs_open+0x82/0x3f0
[  131.871247][ T4987]  path_openat+0x2873/0x4280
[  131.875921][ T4987]  do_file_open+0x20e/0x430
[  131.880483][ T4987]  do_sys_openat2+0x10f/0x1e0
[  131.885263][ T4987]  __x64_sys_openat+0x12d/0x210
[  131.890131][ T4987]  do_syscall_64+0x115/0x870
[  131.894838][ T4987] 
[  131.897152][ T4987] Memory state around the buggy address:
[  131.902796][ T4987]  ffff88807f806b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  131.911737][ T4987]  ffff88807f806b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  131.919815][ T4987] >ffff88807f806c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  131.928312][ T4987]                       ^
[  131.932727][ T4987]  ffff88807f806c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  131.940808][ T4987]  ffff88807f806d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  131.948889][ T4987] ==================================================================
[  131.990053][ T4987] ==================================================================
[  131.998225][ T4987] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  132.005214][ T4987] Read of size 1 at addr ffff88807f806c0f by task udevd/4987
[  132.012657][ T4987] 
[  132.015001][ T4987] CPU: 1 UID: 0 PID: 4987 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  132.015057][ T4987] Tainted: [B]=BAD_PAGE
[  132.015071][ T4987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  132.015094][ T4987] Call Trace:
[  132.015106][ T4987]  <TASK>
[  132.015119][ T4987]  dump_stack_lvl+0x100/0x190
[  132.015166][ T4987]  print_report+0x13d/0x4b0
[  132.015223][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  132.015277][ T4987]  ? __virt_addr_valid+0x239/0x430
[  132.015326][ T4987]  ? string+0x471/0x4d0
[  132.015369][ T4987]  kasan_report+0xdf/0x1c0
[  132.015411][ T4987]  ? string+0x471/0x4d0
[  132.015458][ T4987]  string+0x471/0x4d0
[  132.015502][ T4987]  ? __pfx_string+0x10/0x10
[  132.015547][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  132.015597][ T4987]  vsnprintf+0x422/0x1300
[  132.015652][ T4987]  ? __pfx_vsnprintf+0x10/0x10
[  132.015699][ T4987]  ? uevent_show+0x166/0x3a0
[  132.015749][ T4987]  ? sysfs_kf_seq_show+0x217/0x3f0
[  132.015798][ T4987]  ? seq_read_iter+0x32f/0x1270
[  132.015850][ T4987]  ? kernfs_fop_read_iter+0x46c/0x610
[  132.015892][ T4987]  ? vfs_read+0x82e/0xb40
[  132.015938][ T4987]  ? ksys_read+0x12a/0x250
[  132.015984][ T4987]  ? do_syscall_64+0x115/0x870
[  132.016040][ T4987]  add_uevent_var+0x183/0x3a0
[  132.016082][ T4987]  ? __pfx_add_uevent_var+0x10/0x10
[  132.016128][ T4987]  ? input_dev_uevent+0x16d/0x910
[  132.016182][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  132.016231][ T4987]  input_dev_uevent+0x1bf/0x910
[  132.016289][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  132.016339][ T4987]  dev_uevent+0x2f1/0x870
[  132.016376][ T4987]  ? __pfx_dev_uevent+0x10/0x10
[  132.016410][ T4987]  ? kasan_save_track+0x14/0x30
[  132.016471][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  132.016517][ T4987]  ? __kasan_kmalloc+0xaa/0xb0
[  132.016577][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  132.016623][ T4987]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  132.016677][ T4987]  ? uevent_show+0x166/0x3a0
[  132.016728][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  132.016781][ T4987]  uevent_show+0x1ca/0x3a0
[  132.016827][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  132.016876][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  132.016924][ T4987]  dev_attr_show+0x52/0xa0
[  132.016986][ T4987]  ? __pfx_dev_attr_show+0x10/0x10
[  132.017047][ T4987]  sysfs_kf_seq_show+0x217/0x3f0
[  132.017100][ T4987]  seq_read_iter+0x32f/0x1270
[  132.017162][ T4987]  kernfs_fop_read_iter+0x46c/0x610
[  132.017205][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  132.017252][ T4987]  ? rw_verify_area+0xce/0x6d0
[  132.017301][ T4987]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  132.017346][ T4987]  vfs_read+0x82e/0xb40
[  132.017395][ T4987]  ? __pfx_vfs_read+0x10/0x10
[  132.017445][ T4987]  ? __pfx___do_sys_newfstat+0x10/0x10
[  132.017521][ T4987]  ksys_read+0x12a/0x250
[  132.017568][ T4987]  ? __pfx_ksys_read+0x10/0x10
[  132.017619][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  132.017669][ T4987]  do_syscall_64+0x115/0x870
[  132.017724][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  132.017763][ T4987] RIP: 0033:0x7f0dc3ca7407
[  132.017791][ T4987] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  132.017828][ T4987] RSP: 002b:00007ffe09f45080 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  132.017865][ T4987] RAX: ffffffffffffffda RBX: 00007f0dc4385880 RCX: 00007f0dc3ca7407
[  132.017892][ T4987] RDX: 0000000000001000 RSI: 000055dce2afc1a0 RDI: 000000000000000c
[  132.017916][ T4987] RBP: 00007f0dc3defff0 R08: 0000000000000000 R09: 0000000000000000
[  132.017941][ T4987] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  132.017965][ T4987] R13: 00007f0dc3defea0 R14: 0000000000000000 R15: 000055dce29f5b30
[  132.018002][ T4987]  </TASK>
[  132.018015][ T4987] 
[  132.388432][ T4987] Allocated by task 9:
[  132.392491][ T4987]  kasan_save_stack+0x30/0x50
[  132.397234][ T4987]  kasan_save_track+0x14/0x30
[  132.402031][ T4987]  __kasan_kmalloc+0xaa/0xb0
[  132.406670][ T4987]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  132.412111][ T4987]  sur40_probe+0x1a8/0x1580
[  132.416638][ T4987]  usb_probe_interface+0x303/0x8f0
[  132.421973][ T4987]  really_probe+0x241/0xa60
[  132.426519][ T4987]  __driver_probe_device+0x20e/0x450
[  132.431861][ T4987]  driver_probe_device+0x4a/0x140
[  132.437094][ T4987]  __device_attach_driver+0x1df/0x320
[  132.442495][ T4987]  bus_for_each_drv+0x159/0x1e0
[  132.447539][ T4987]  __device_attach+0x1e4/0x4d0
[  132.452467][ T4987]  device_initial_probe+0xaf/0xd0
[  132.457670][ T4987]  bus_probe_device+0x64/0x160
[  132.462480][ T4987]  device_add+0x121d/0x1970
[  132.467013][ T4987]  usb_set_configuration+0xd97/0x1c60
[  132.472413][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  132.477872][ T4987]  usb_probe_device+0xef/0x400
[  132.482664][ T4987]  really_probe+0x241/0xa60
[  132.487184][ T4987]  __driver_probe_device+0x20e/0x450
[  132.492590][ T4987]  driver_probe_device+0x4a/0x140
[  132.497642][ T4987]  __device_attach_driver+0x1df/0x320
[  132.503039][ T4987]  bus_for_each_drv+0x159/0x1e0
[  132.507904][ T4987]  __device_attach+0x1e4/0x4d0
[  132.512717][ T4987]  device_initial_probe+0xaf/0xd0
[  132.517790][ T4987]  bus_probe_device+0x64/0x160
[  132.522630][ T4987]  device_add+0x121d/0x1970
[  132.527188][ T4987]  usb_new_device.cold+0x685/0x115c
[  132.532502][ T4987]  hub_event+0x30a3/0x4a60
[  132.537156][ T4987]  process_one_work+0xa23/0x1940
[  132.542129][ T4987]  worker_thread+0x5ef/0xe50
[  132.546733][ T4987]  kthread+0x370/0x450
[  132.550858][ T4987]  ret_from_fork+0x72b/0xd50
[  132.555473][ T4987]  ret_from_fork_asm+0x1a/0x30
[  132.560271][ T4987] 
[  132.562743][ T4987] Freed by task 9:
[  132.566507][ T4987]  kasan_save_stack+0x30/0x50
[  132.571228][ T4987]  kasan_save_track+0x14/0x30
[  132.576031][ T4987]  kasan_save_free_info+0x3b/0x70
[  132.581128][ T4987]  __kasan_slab_free+0x5f/0x80
[  132.585928][ T4987]  kfree+0x22b/0x6c0
[  132.589845][ T4987]  sur40_probe+0xc36/0x1580
[  132.594387][ T4987]  usb_probe_interface+0x303/0x8f0
[  132.599530][ T4987]  really_probe+0x241/0xa60
[  132.604056][ T4987]  __driver_probe_device+0x20e/0x450
[  132.609364][ T4987]  driver_probe_device+0x4a/0x140
[  132.614412][ T4987]  __device_attach_driver+0x1df/0x320
[  132.619898][ T4987]  bus_for_each_drv+0x159/0x1e0
[  132.624919][ T4987]  __device_attach+0x1e4/0x4d0
[  132.629721][ T4987]  device_initial_probe+0xaf/0xd0
[  132.634831][ T4987]  bus_probe_device+0x64/0x160
[  132.639629][ T4987]  device_add+0x121d/0x1970
[  132.644279][ T4987]  usb_set_configuration+0xd97/0x1c60
[  132.649719][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  132.655216][ T4987]  usb_probe_device+0xef/0x400
[  132.660057][ T4987]  really_probe+0x241/0xa60
[  132.664594][ T4987]  __driver_probe_device+0x20e/0x450
[  132.669911][ T4987]  driver_probe_device+0x4a/0x140
[  132.674960][ T4987]  __device_attach_driver+0x1df/0x320
[  132.680569][ T4987]  bus_for_each_drv+0x159/0x1e0
[  132.685500][ T4987]  __device_attach+0x1e4/0x4d0
[  132.690334][ T4987]  device_initial_probe+0xaf/0xd0
[  132.695470][ T4987]  bus_probe_device+0x64/0x160
[  132.700340][ T4987]  device_add+0x121d/0x1970
[  132.704884][ T4987]  usb_new_device.cold+0x685/0x115c
[  132.710223][ T4987]  hub_event+0x30a3/0x4a60
[  132.714679][ T4987]  process_one_work+0xa23/0x1940
[  132.719625][ T4987]  worker_thread+0x5ef/0xe50
[  132.724257][ T4987]  kthread+0x370/0x450
[  132.728369][ T4987]  ret_from_fork+0x72b/0xd50
[  132.733003][ T4987]  ret_from_fork_asm+0x1a/0x30
[  132.738082][ T4987] 
[  132.740398][ T4987] The buggy address belongs to the object at ffff88807f806000
[  132.740398][ T4987]  which belongs to the cache kmalloc-4k of size 4096
[  132.754475][ T4987] The buggy address is located 3087 bytes inside of
[  132.754475][ T4987]  freed 4096-byte region [ffff88807f806000, ffff88807f807000)
[  132.768670][ T4987] 
[  132.771016][ T4987] The buggy address belongs to the physical page:
[  132.777515][ T4987] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f800
[  132.786325][ T4987] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  132.794829][ T4987] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  132.802498][ T4987] page_type: f5(slab)
[  132.806493][ T4987] raw: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  132.815179][ T4987] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  132.823893][ T4987] head: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  132.832606][ T4987] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  132.841370][ T4987] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  132.850057][ T4987] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  132.858749][ T4987] page dumped because: kasan: bad access detected
[  132.865188][ T4987] page_owner tracks the page as allocated
[  132.871029][ T4987] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4996, tgid 4996 (udevd), ts 58249348224, free_ts 58222770964
[  132.891069][ T4987]  post_alloc_hook+0xfd/0x120
[  132.895784][ T4987]  get_page_from_freelist+0xf48/0x3530
[  132.901277][ T4987]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  132.907219][ T4987]  new_slab+0xa2/0x640
[  132.911408][ T4987]  refill_objects+0xe3/0x410
[  132.916040][ T4987]  __pcs_replace_empty_main+0x376/0x680
[  132.921707][ T4987]  __kmalloc_noprof+0x66d/0x820
[  132.926592][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  132.932172][ T4987]  tomoyo_path_perm+0x276/0x460
[  132.937041][ T4987]  security_inode_getattr+0x116/0x280
[  132.942446][ T4987]  vfs_fstat+0x4b/0xe0
[  132.946543][ T4987]  __do_sys_newfstat+0x8b/0x110
[  132.951517][ T4987]  do_syscall_64+0x115/0x870
[  132.956225][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  132.962154][ T4987] page last free pid 4992 tgid 4992 stack trace:
[  132.968476][ T4987]  __free_frozen_pages+0x79f/0x1090
[  132.973691][ T4987]  qlist_free_all+0x47/0xf0
[  132.978224][ T4987]  kasan_quarantine_reduce+0x1a0/0x1f0
[  132.983726][ T4987]  __kasan_slab_alloc+0x69/0x90
[  132.988586][ T4987]  __kmalloc_noprof+0x2bf/0x820
[  132.993575][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  132.999160][ T4987]  tomoyo_check_open_permission+0x2af/0x3c0
[  133.005080][ T4987]  tomoyo_file_open+0x6b/0x90
[  133.010036][ T4987]  security_file_open+0xb5/0x1e0
[  133.015291][ T4987]  do_dentry_open+0x588/0x14d0
[  133.020341][ T4987]  vfs_open+0x82/0x3f0
[  133.024426][ T4987]  path_openat+0x2873/0x4280
[  133.029044][ T4987]  do_file_open+0x20e/0x430
[  133.033577][ T4987]  do_sys_openat2+0x10f/0x1e0
[  133.038297][ T4987]  __x64_sys_openat+0x12d/0x210
[  133.043245][ T4987]  do_syscall_64+0x115/0x870
[  133.047887][ T4987] 
[  133.050201][ T4987] Memory state around the buggy address:
[  133.055833][ T4987]  ffff88807f806b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.064006][ T4987]  ffff88807f806b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.072073][ T4987] >ffff88807f806c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.080138][ T4987]                       ^
[  133.084466][ T4987]  ffff88807f806c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.092637][ T4987]  ffff88807f806d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  133.100715][ T4987] ==================================================================
[  133.116580][ T1313] ieee802154 phy0 wpan0: encryption failed: -22
[  133.123045][ T1313] ieee802154 phy1 wpan1: encryption failed: -22
[  133.141638][ T4987] ==================================================================
[  133.149938][ T4987] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  133.156932][ T4987] Read of size 1 at addr ffff88807f806c10 by task udevd/4987
[  133.164522][ T4987] 
[  133.166876][ T4987] CPU: 1 UID: 0 PID: 4987 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  133.166932][ T4987] Tainted: [B]=BAD_PAGE
[  133.166946][ T4987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  133.166970][ T4987] Call Trace:
[  133.166983][ T4987]  <TASK>
[  133.166997][ T4987]  dump_stack_lvl+0x100/0x190
[  133.167047][ T4987]  print_report+0x13d/0x4b0
[  133.167107][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  133.167155][ T4987]  ? __virt_addr_valid+0x239/0x430
[  133.167204][ T4987]  ? string+0x471/0x4d0
[  133.167248][ T4987]  kasan_report+0xdf/0x1c0
[  133.167291][ T4987]  ? string+0x471/0x4d0
[  133.167347][ T4987]  string+0x471/0x4d0
[  133.167392][ T4987]  ? __pfx_string+0x10/0x10
[  133.167438][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  133.167489][ T4987]  vsnprintf+0x422/0x1300
[  133.167545][ T4987]  ? __pfx_vsnprintf+0x10/0x10
[  133.167593][ T4987]  ? uevent_show+0x166/0x3a0
[  133.167643][ T4987]  ? sysfs_kf_seq_show+0x217/0x3f0
[  133.167692][ T4987]  ? seq_read_iter+0x32f/0x1270
[  133.167745][ T4987]  ? kernfs_fop_read_iter+0x46c/0x610
[  133.167786][ T4987]  ? vfs_read+0x82e/0xb40
[  133.167831][ T4987]  ? ksys_read+0x12a/0x250
[  133.167876][ T4987]  ? do_syscall_64+0x115/0x870
[  133.167931][ T4987]  add_uevent_var+0x183/0x3a0
[  133.167974][ T4987]  ? __pfx_add_uevent_var+0x10/0x10
[  133.168022][ T4987]  ? input_dev_uevent+0x16d/0x910
[  133.168078][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  133.168130][ T4987]  input_dev_uevent+0x1bf/0x910
[  133.168183][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  133.168235][ T4987]  dev_uevent+0x2f1/0x870
[  133.168274][ T4987]  ? __pfx_dev_uevent+0x10/0x10
[  133.168317][ T4987]  ? kasan_save_track+0x14/0x30
[  133.168382][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  133.168430][ T4987]  ? __kasan_kmalloc+0xaa/0xb0
[  133.168491][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  133.168538][ T4987]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  133.168593][ T4987]  ? uevent_show+0x166/0x3a0
[  133.168644][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  133.168692][ T4987]  uevent_show+0x1ca/0x3a0
[  133.168740][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  133.168788][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  133.168836][ T4987]  dev_attr_show+0x52/0xa0
[  133.168898][ T4987]  ? __pfx_dev_attr_show+0x10/0x10
[  133.168958][ T4987]  sysfs_kf_seq_show+0x217/0x3f0
[  133.169010][ T4987]  seq_read_iter+0x32f/0x1270
[  133.169073][ T4987]  kernfs_fop_read_iter+0x46c/0x610
[  133.169116][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  133.169164][ T4987]  ? rw_verify_area+0xce/0x6d0
[  133.169206][ T4987]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  133.169251][ T4987]  vfs_read+0x82e/0xb40
[  133.169310][ T4987]  ? __pfx_vfs_read+0x10/0x10
[  133.169360][ T4987]  ? __pfx___do_sys_newfstat+0x10/0x10
[  133.169435][ T4987]  ksys_read+0x12a/0x250
[  133.169483][ T4987]  ? __pfx_ksys_read+0x10/0x10
[  133.169533][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  133.169581][ T4987]  do_syscall_64+0x115/0x870
[  133.169635][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  133.169671][ T4987] RIP: 0033:0x7f0dc3ca7407
[  133.169699][ T4987] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  133.169734][ T4987] RSP: 002b:00007ffe09f45080 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  133.169769][ T4987] RAX: ffffffffffffffda RBX: 00007f0dc4385880 RCX: 00007f0dc3ca7407
[  133.169794][ T4987] RDX: 0000000000001000 RSI: 000055dce2afc1a0 RDI: 000000000000000c
[  133.169818][ T4987] RBP: 00007f0dc3defff0 R08: 0000000000000000 R09: 0000000000000000
[  133.169840][ T4987] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  133.169863][ T4987] R13: 00007f0dc3defea0 R14: 0000000000000000 R15: 000055dce29f5b30
[  133.169900][ T4987]  </TASK>
[  133.169914][ T4987] 
[  133.542578][ T4987] Allocated by task 9:
[  133.546644][ T4987]  kasan_save_stack+0x30/0x50
[  133.551516][ T4987]  kasan_save_track+0x14/0x30
[  133.556261][ T4987]  __kasan_kmalloc+0xaa/0xb0
[  133.560889][ T4987]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  133.566285][ T4987]  sur40_probe+0x1a8/0x1580
[  133.570849][ T4987]  usb_probe_interface+0x303/0x8f0
[  133.576009][ T4987]  really_probe+0x241/0xa60
[  133.580535][ T4987]  __driver_probe_device+0x20e/0x450
[  133.586202][ T4987]  driver_probe_device+0x4a/0x140
[  133.591250][ T4987]  __device_attach_driver+0x1df/0x320
[  133.596649][ T4987]  bus_for_each_drv+0x159/0x1e0
[  133.601604][ T4987]  __device_attach+0x1e4/0x4d0
[  133.606432][ T4987]  device_initial_probe+0xaf/0xd0
[  133.611497][ T4987]  bus_probe_device+0x64/0x160
[  133.616365][ T4987]  device_add+0x121d/0x1970
[  133.620957][ T4987]  usb_set_configuration+0xd97/0x1c60
[  133.626355][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  133.631741][ T4987]  usb_probe_device+0xef/0x400
[  133.636539][ T4987]  really_probe+0x241/0xa60
[  133.641064][ T4987]  __driver_probe_device+0x20e/0x450
[  133.646382][ T4987]  driver_probe_device+0x4a/0x140
[  133.651525][ T4987]  __device_attach_driver+0x1df/0x320
[  133.656956][ T4987]  bus_for_each_drv+0x159/0x1e0
[  133.661844][ T4987]  __device_attach+0x1e4/0x4d0
[  133.666654][ T4987]  device_initial_probe+0xaf/0xd0
[  133.671730][ T4987]  bus_probe_device+0x64/0x160
[  133.676519][ T4987]  device_add+0x121d/0x1970
[  133.681071][ T4987]  usb_new_device.cold+0x685/0x115c
[  133.686318][ T4987]  hub_event+0x30a3/0x4a60
[  133.690761][ T4987]  process_one_work+0xa23/0x1940
[  133.695750][ T4987]  worker_thread+0x5ef/0xe50
[  133.700491][ T4987]  kthread+0x370/0x450
[  133.704606][ T4987]  ret_from_fork+0x72b/0xd50
[  133.709223][ T4987]  ret_from_fork_asm+0x1a/0x30
[  133.714033][ T4987] 
[  133.716349][ T4987] Freed by task 9:
[  133.720069][ T4987]  kasan_save_stack+0x30/0x50
[  133.724974][ T4987]  kasan_save_track+0x14/0x30
[  133.729975][ T4987]  kasan_save_free_info+0x3b/0x70
[  133.736472][ T4987]  __kasan_slab_free+0x5f/0x80
[  133.741442][ T4987]  kfree+0x22b/0x6c0
[  133.745392][ T4987]  sur40_probe+0xc36/0x1580
[  133.749922][ T4987]  usb_probe_interface+0x303/0x8f0
[  133.755262][ T4987]  really_probe+0x241/0xa60
[  133.759925][ T4987]  __driver_probe_device+0x20e/0x450
[  133.765539][ T4987]  driver_probe_device+0x4a/0x140
[  133.770810][ T4987]  __device_attach_driver+0x1df/0x320
[  133.776253][ T4987]  bus_for_each_drv+0x159/0x1e0
[  133.781313][ T4987]  __device_attach+0x1e4/0x4d0
[  133.786126][ T4987]  device_initial_probe+0xaf/0xd0
[  133.791213][ T4987]  bus_probe_device+0x64/0x160
[  133.796005][ T4987]  device_add+0x121d/0x1970
[  133.800753][ T4987]  usb_set_configuration+0xd97/0x1c60
[  133.806246][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  133.811911][ T4987]  usb_probe_device+0xef/0x400
[  133.816834][ T4987]  really_probe+0x241/0xa60
[  133.821457][ T4987]  __driver_probe_device+0x20e/0x450
[  133.826777][ T4987]  driver_probe_device+0x4a/0x140
[  133.831875][ T4987]  __device_attach_driver+0x1df/0x320
[  133.837401][ T4987]  bus_for_each_drv+0x159/0x1e0
[  133.842308][ T4987]  __device_attach+0x1e4/0x4d0
[  133.847125][ T4987]  device_initial_probe+0xaf/0xd0
[  133.852216][ T4987]  bus_probe_device+0x64/0x160
[  133.857069][ T4987]  device_add+0x121d/0x1970
[  133.861614][ T4987]  usb_new_device.cold+0x685/0x115c
[  133.866939][ T4987]  hub_event+0x30a3/0x4a60
[  133.871388][ T4987]  process_one_work+0xa23/0x1940
[  133.876339][ T4987]  worker_thread+0x5ef/0xe50
[  133.880950][ T4987]  kthread+0x370/0x450
[  133.885096][ T4987]  ret_from_fork+0x72b/0xd50
[  133.890177][ T4987]  ret_from_fork_asm+0x1a/0x30
[  133.895169][ T4987] 
[  133.897491][ T4987] The buggy address belongs to the object at ffff88807f806000
[  133.897491][ T4987]  which belongs to the cache kmalloc-4k of size 4096
[  133.911763][ T4987] The buggy address is located 3088 bytes inside of
[  133.911763][ T4987]  freed 4096-byte region [ffff88807f806000, ffff88807f807000)
[  133.926115][ T4987] 
[  133.928444][ T4987] The buggy address belongs to the physical page:
[  133.934889][ T4987] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f800
[  133.943792][ T4987] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  133.952402][ T4987] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  133.959959][ T4987] page_type: f5(slab)
[  133.963953][ T4987] raw: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  133.972562][ T4987] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  133.981355][ T4987] head: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  133.990291][ T4987] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  133.999184][ T4987] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  134.007873][ T4987] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  134.016542][ T4987] page dumped because: kasan: bad access detected
[  134.023090][ T4987] page_owner tracks the page as allocated
[  134.028796][ T4987] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4996, tgid 4996 (udevd), ts 58249348224, free_ts 58222770964
[  134.049418][ T4987]  post_alloc_hook+0xfd/0x120
[  134.054166][ T4987]  get_page_from_freelist+0xf48/0x3530
[  134.059794][ T4987]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  134.065737][ T4987]  new_slab+0xa2/0x640
[  134.069923][ T4987]  refill_objects+0xe3/0x410
[  134.074541][ T4987]  __pcs_replace_empty_main+0x376/0x680
[  134.080108][ T4987]  __kmalloc_noprof+0x66d/0x820
[  134.084990][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  134.090606][ T4987]  tomoyo_path_perm+0x276/0x460
[  134.095606][ T4987]  security_inode_getattr+0x116/0x280
[  134.101000][ T4987]  vfs_fstat+0x4b/0xe0
[  134.105109][ T4987]  __do_sys_newfstat+0x8b/0x110
[  134.109991][ T4987]  do_syscall_64+0x115/0x870
[  134.114602][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  134.120519][ T4987] page last free pid 4992 tgid 4992 stack trace:
[  134.126851][ T4987]  __free_frozen_pages+0x79f/0x1090
[  134.132081][ T4987]  qlist_free_all+0x47/0xf0
[  134.136609][ T4987]  kasan_quarantine_reduce+0x1a0/0x1f0
[  134.142094][ T4987]  __kasan_slab_alloc+0x69/0x90
[  134.146947][ T4987]  __kmalloc_noprof+0x2bf/0x820
[  134.151825][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  134.157402][ T4987]  tomoyo_check_open_permission+0x2af/0x3c0
[  134.163492][ T4987]  tomoyo_file_open+0x6b/0x90
[  134.168272][ T4987]  security_file_open+0xb5/0x1e0
[  134.173304][ T4987]  do_dentry_open+0x588/0x14d0
[  134.178273][ T4987]  vfs_open+0x82/0x3f0
[  134.182441][ T4987]  path_openat+0x2873/0x4280
[  134.187060][ T4987]  do_file_open+0x20e/0x430
[  134.191596][ T4987]  do_sys_openat2+0x10f/0x1e0
[  134.196314][ T4987]  __x64_sys_openat+0x12d/0x210
[  134.201464][ T4987]  do_syscall_64+0x115/0x870
[  134.206086][ T4987] 
[  134.208413][ T4987] Memory state around the buggy address:
[  134.214160][ T4987]  ffff88807f806b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  134.222329][ T4987]  ffff88807f806b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  134.230497][ T4987] >ffff88807f806c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  134.238565][ T4987]                          ^
[  134.243165][ T4987]  ffff88807f806c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  134.251242][ T4987]  ffff88807f806d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  134.259341][ T4987] ==================================================================
[  134.277677][ T4987] ==================================================================
[  134.285878][ T4987] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  134.292861][ T4987] Read of size 1 at addr ffff88807f806c11 by task udevd/4987
[  134.300515][ T4987] 
[  134.302859][ T4987] CPU: 1 UID: 0 PID: 4987 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  134.302911][ T4987] Tainted: [B]=BAD_PAGE
[  134.302924][ T4987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  134.302946][ T4987] Call Trace:
[  134.302957][ T4987]  <TASK>
[  134.302970][ T4987]  dump_stack_lvl+0x100/0x190
[  134.303014][ T4987]  print_report+0x13d/0x4b0
[  134.303066][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  134.303111][ T4987]  ? __virt_addr_valid+0x239/0x430
[  134.303156][ T4987]  ? string+0x471/0x4d0
[  134.303196][ T4987]  kasan_report+0xdf/0x1c0
[  134.303235][ T4987]  ? string+0x471/0x4d0
[  134.303278][ T4987]  string+0x471/0x4d0
[  134.303318][ T4987]  ? __pfx_string+0x10/0x10
[  134.303359][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  134.303405][ T4987]  vsnprintf+0x422/0x1300
[  134.303455][ T4987]  ? __pfx_vsnprintf+0x10/0x10
[  134.303498][ T4987]  ? uevent_show+0x166/0x3a0
[  134.303548][ T4987]  ? sysfs_kf_seq_show+0x217/0x3f0
[  134.303592][ T4987]  ? seq_read_iter+0x32f/0x1270
[  134.303644][ T4987]  ? kernfs_fop_read_iter+0x46c/0x610
[  134.303683][ T4987]  ? vfs_read+0x82e/0xb40
[  134.303724][ T4987]  ? ksys_read+0x12a/0x250
[  134.303765][ T4987]  ? do_syscall_64+0x115/0x870
[  134.303817][ T4987]  add_uevent_var+0x183/0x3a0
[  134.303855][ T4987]  ? __pfx_add_uevent_var+0x10/0x10
[  134.303899][ T4987]  ? input_dev_uevent+0x16d/0x910
[  134.303948][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  134.303995][ T4987]  input_dev_uevent+0x1bf/0x910
[  134.304043][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  134.304093][ T4987]  dev_uevent+0x2f1/0x870
[  134.304127][ T4987]  ? __pfx_dev_uevent+0x10/0x10
[  134.304159][ T4987]  ? kasan_save_track+0x14/0x30
[  134.304219][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  134.304262][ T4987]  ? __kasan_kmalloc+0xaa/0xb0
[  134.304316][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  134.304359][ T4987]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  134.304409][ T4987]  ? uevent_show+0x166/0x3a0
[  134.304455][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  134.304499][ T4987]  uevent_show+0x1ca/0x3a0
[  134.304543][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  134.304587][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  134.304637][ T4987]  dev_attr_show+0x52/0xa0
[  134.304703][ T4987]  ? __pfx_dev_attr_show+0x10/0x10
[  134.304759][ T4987]  sysfs_kf_seq_show+0x217/0x3f0
[  134.304808][ T4987]  seq_read_iter+0x32f/0x1270
[  134.304864][ T4987]  kernfs_fop_read_iter+0x46c/0x610
[  134.304904][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  134.304947][ T4987]  ? rw_verify_area+0xce/0x6d0
[  134.304985][ T4987]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  134.305025][ T4987]  vfs_read+0x82e/0xb40
[  134.305071][ T4987]  ? __pfx_vfs_read+0x10/0x10
[  134.305116][ T4987]  ? __pfx___do_sys_newfstat+0x10/0x10
[  134.305186][ T4987]  ksys_read+0x12a/0x250
[  134.305230][ T4987]  ? __pfx_ksys_read+0x10/0x10
[  134.305275][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  134.305321][ T4987]  do_syscall_64+0x115/0x870
[  134.305371][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  134.305408][ T4987] RIP: 0033:0x7f0dc3ca7407
[  134.305439][ T4987] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  134.305474][ T4987] RSP: 002b:00007ffe09f45080 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  134.305508][ T4987] RAX: ffffffffffffffda RBX: 00007f0dc4385880 RCX: 00007f0dc3ca7407
[  134.305533][ T4987] RDX: 0000000000001000 RSI: 000055dce2afc1a0 RDI: 000000000000000c
[  134.305555][ T4987] RBP: 00007f0dc3defff0 R08: 0000000000000000 R09: 0000000000000000
[  134.305579][ T4987] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  134.305601][ T4987] R13: 00007f0dc3defea0 R14: 0000000000000000 R15: 000055dce29f5b30
[  134.305640][ T4987]  </TASK>
[  134.305652][ T4987] 
[  134.674827][ T4987] Allocated by task 9:
[  134.678912][ T4987]  kasan_save_stack+0x30/0x50
[  134.684148][ T4987]  kasan_save_track+0x14/0x30
[  134.688867][ T4987]  __kasan_kmalloc+0xaa/0xb0
[  134.693559][ T4987]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  134.699076][ T4987]  sur40_probe+0x1a8/0x1580
[  134.703606][ T4987]  usb_probe_interface+0x303/0x8f0
[  134.708847][ T4987]  really_probe+0x241/0xa60
[  134.713433][ T4987]  __driver_probe_device+0x20e/0x450
[  134.718747][ T4987]  driver_probe_device+0x4a/0x140
[  134.723799][ T4987]  __device_attach_driver+0x1df/0x320
[  134.729196][ T4987]  bus_for_each_drv+0x159/0x1e0
[  134.734145][ T4987]  __device_attach+0x1e4/0x4d0
[  134.738932][ T4987]  device_initial_probe+0xaf/0xd0
[  134.743986][ T4987]  bus_probe_device+0x64/0x160
[  134.749023][ T4987]  device_add+0x121d/0x1970
[  134.753612][ T4987]  usb_set_configuration+0xd97/0x1c60
[  134.759022][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  134.764425][ T4987]  usb_probe_device+0xef/0x400
[  134.769212][ T4987]  really_probe+0x241/0xa60
[  134.773736][ T4987]  __driver_probe_device+0x20e/0x450
[  134.779042][ T4987]  driver_probe_device+0x4a/0x140
[  134.784114][ T4987]  __device_attach_driver+0x1df/0x320
[  134.789510][ T4987]  bus_for_each_drv+0x159/0x1e0
[  134.794369][ T4987]  __device_attach+0x1e4/0x4d0
[  134.799156][ T4987]  device_initial_probe+0xaf/0xd0
[  134.804331][ T4987]  bus_probe_device+0x64/0x160
[  134.809138][ T4987]  device_add+0x121d/0x1970
[  134.813680][ T4987]  usb_new_device.cold+0x685/0x115c
[  134.818899][ T4987]  hub_event+0x30a3/0x4a60
[  134.823342][ T4987]  process_one_work+0xa23/0x1940
[  134.828329][ T4987]  worker_thread+0x5ef/0xe50
[  134.833077][ T4987]  kthread+0x370/0x450
[  134.837231][ T4987]  ret_from_fork+0x72b/0xd50
[  134.842151][ T4987]  ret_from_fork_asm+0x1a/0x30
[  134.846959][ T4987] 
[  134.849294][ T4987] Freed by task 9:
[  134.853133][ T4987]  kasan_save_stack+0x30/0x50
[  134.857889][ T4987]  kasan_save_track+0x14/0x30
[  134.862601][ T4987]  kasan_save_free_info+0x3b/0x70
[  134.867735][ T4987]  __kasan_slab_free+0x5f/0x80
[  134.872533][ T4987]  kfree+0x22b/0x6c0
[  134.876453][ T4987]  sur40_probe+0xc36/0x1580
[  134.881082][ T4987]  usb_probe_interface+0x303/0x8f0
[  134.886243][ T4987]  really_probe+0x241/0xa60
[  134.890779][ T4987]  __driver_probe_device+0x20e/0x450
[  134.896092][ T4987]  driver_probe_device+0x4a/0x140
[  134.901141][ T4987]  __device_attach_driver+0x1df/0x320
[  134.906618][ T4987]  bus_for_each_drv+0x159/0x1e0
[  134.911493][ T4987]  __device_attach+0x1e4/0x4d0
[  134.916289][ T4987]  device_initial_probe+0xaf/0xd0
[  134.921366][ T4987]  bus_probe_device+0x64/0x160
[  134.926148][ T4987]  device_add+0x121d/0x1970
[  134.930772][ T4987]  usb_set_configuration+0xd97/0x1c60
[  134.936165][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  134.941552][ T4987]  usb_probe_device+0xef/0x400
[  134.946340][ T4987]  really_probe+0x241/0xa60
[  134.950864][ T4987]  __driver_probe_device+0x20e/0x450
[  134.956255][ T4987]  driver_probe_device+0x4a/0x140
[  134.961310][ T4987]  __device_attach_driver+0x1df/0x320
[  134.966743][ T4987]  bus_for_each_drv+0x159/0x1e0
[  134.971636][ T4987]  __device_attach+0x1e4/0x4d0
[  134.976440][ T4987]  device_initial_probe+0xaf/0xd0
[  134.981518][ T4987]  bus_probe_device+0x64/0x160
[  134.986300][ T4987]  device_add+0x121d/0x1970
[  134.990920][ T4987]  usb_new_device.cold+0x685/0x115c
[  134.996258][ T4987]  hub_event+0x30a3/0x4a60
[  135.000795][ T4987]  process_one_work+0xa23/0x1940
[  135.005895][ T4987]  worker_thread+0x5ef/0xe50
[  135.010500][ T4987]  kthread+0x370/0x450
[  135.014609][ T4987]  ret_from_fork+0x72b/0xd50
[  135.019215][ T4987]  ret_from_fork_asm+0x1a/0x30
[  135.023999][ T4987] 
[  135.026311][ T4987] The buggy address belongs to the object at ffff88807f806000
[  135.026311][ T4987]  which belongs to the cache kmalloc-4k of size 4096
[  135.040397][ T4987] The buggy address is located 3089 bytes inside of
[  135.040397][ T4987]  freed 4096-byte region [ffff88807f806000, ffff88807f807000)
[  135.054389][ T4987] 
[  135.056708][ T4987] The buggy address belongs to the physical page:
[  135.063112][ T4987] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f800
[  135.071883][ T4987] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  135.080386][ T4987] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  135.087937][ T4987] page_type: f5(slab)
[  135.091966][ T4987] raw: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  135.100555][ T4987] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  135.109145][ T4987] head: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122
[  135.118086][ T4987] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000
[  135.126794][ T4987] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[  135.135481][ T4987] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  135.144152][ T4987] page dumped because: kasan: bad access detected
[  135.150567][ T4987] page_owner tracks the page as allocated
[  135.156279][ T4987] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4996, tgid 4996 (udevd), ts 58249348224, free_ts 58222770964
[  135.176315][ T4987]  post_alloc_hook+0xfd/0x120
[  135.181030][ T4987]  get_page_from_freelist+0xf48/0x3530
[  135.186519][ T4987]  __alloc_frozen_pages_noprof+0x299/0x2dc0
[  135.192447][ T4987]  new_slab+0xa2/0x640
[  135.196538][ T4987]  refill_objects+0xe3/0x410
[  135.201156][ T4987]  __pcs_replace_empty_main+0x376/0x680
[  135.206724][ T4987]  __kmalloc_noprof+0x66d/0x820
[  135.211607][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  135.217196][ T4987]  tomoyo_path_perm+0x276/0x460
[  135.222065][ T4987]  security_inode_getattr+0x116/0x280
[  135.227456][ T4987]  vfs_fstat+0x4b/0xe0
[  135.231644][ T4987]  __do_sys_newfstat+0x8b/0x110
[  135.236525][ T4987]  do_syscall_64+0x115/0x870
[  135.241141][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  135.247043][ T4987] page last free pid 4992 tgid 4992 stack trace:
[  135.253365][ T4987]  __free_frozen_pages+0x79f/0x1090
[  135.258734][ T4987]  qlist_free_all+0x47/0xf0
[  135.263284][ T4987]  kasan_quarantine_reduce+0x1a0/0x1f0
[  135.268782][ T4987]  __kasan_slab_alloc+0x69/0x90
[  135.273640][ T4987]  __kmalloc_noprof+0x2bf/0x820
[  135.278537][ T4987]  tomoyo_realpath_from_path+0xb6/0x690
[  135.284198][ T4987]  tomoyo_check_open_permission+0x2af/0x3c0
[  135.290114][ T4987]  tomoyo_file_open+0x6b/0x90
[  135.294809][ T4987]  security_file_open+0xb5/0x1e0
[  135.299780][ T4987]  do_dentry_open+0x588/0x14d0
[  135.304572][ T4987]  vfs_open+0x82/0x3f0
[  135.308849][ T4987]  path_openat+0x2873/0x4280
[  135.313847][ T4987]  do_file_open+0x20e/0x430
[  135.318386][ T4987]  do_sys_openat2+0x10f/0x1e0
[  135.323100][ T4987]  __x64_sys_openat+0x12d/0x210
[  135.327964][ T4987]  do_syscall_64+0x115/0x870
[  135.332626][ T4987] 
[  135.334947][ T4987] Memory state around the buggy address:
[  135.340662][ T4987]  ffff88807f806b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  135.348779][ T4987]  ffff88807f806b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  135.356850][ T4987] >ffff88807f806c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  135.364925][ T4987]                          ^
[  135.369519][ T4987]  ffff88807f806c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  135.377598][ T4987]  ffff88807f806d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  135.386191][ T4987] ==================================================================
[  135.415007][ T4987] ==================================================================
[  135.423173][ T4987] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0
[  135.430313][ T4987] Read of size 1 at addr ffff88807f806c12 by task udevd/4987
[  135.437701][ T4987] 
[  135.440059][ T4987] CPU: 1 UID: 0 PID: 4987 Comm: udevd Tainted: G    B               syzkaller #0 PREEMPT(full) 
[  135.440118][ T4987] Tainted: [B]=BAD_PAGE
[  135.440132][ T4987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  135.440157][ T4987] Call Trace:
[  135.440169][ T4987]  <TASK>
[  135.440183][ T4987]  dump_stack_lvl+0x100/0x190
[  135.440230][ T4987]  print_report+0x13d/0x4b0
[  135.440288][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  135.440353][ T4987]  ? __virt_addr_valid+0x239/0x430
[  135.440402][ T4987]  ? string+0x471/0x4d0
[  135.440443][ T4987]  kasan_report+0xdf/0x1c0
[  135.440486][ T4987]  ? string+0x471/0x4d0
[  135.440532][ T4987]  string+0x471/0x4d0
[  135.440578][ T4987]  ? __pfx_string+0x10/0x10
[  135.440624][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  135.440676][ T4987]  vsnprintf+0x422/0x1300
[  135.440731][ T4987]  ? __pfx_vsnprintf+0x10/0x10
[  135.440779][ T4987]  ? uevent_show+0x166/0x3a0
[  135.440825][ T4987]  ? sysfs_kf_seq_show+0x217/0x3f0
[  135.440874][ T4987]  ? seq_read_iter+0x32f/0x1270
[  135.440927][ T4987]  ? kernfs_fop_read_iter+0x46c/0x610
[  135.440971][ T4987]  ? vfs_read+0x82e/0xb40
[  135.441017][ T4987]  ? ksys_read+0x12a/0x250
[  135.441063][ T4987]  ? do_syscall_64+0x115/0x870
[  135.441120][ T4987]  add_uevent_var+0x183/0x3a0
[  135.441163][ T4987]  ? __pfx_add_uevent_var+0x10/0x10
[  135.441212][ T4987]  ? input_dev_uevent+0x16d/0x910
[  135.441266][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  135.441328][ T4987]  input_dev_uevent+0x1bf/0x910
[  135.441402][ T4987]  ? __pfx_input_dev_uevent+0x10/0x10
[  135.441454][ T4987]  dev_uevent+0x2f1/0x870
[  135.441492][ T4987]  ? __pfx_dev_uevent+0x10/0x10
[  135.441527][ T4987]  ? kasan_save_track+0x14/0x30
[  135.441589][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  135.441637][ T4987]  ? __kasan_kmalloc+0xaa/0xb0
[  135.441698][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  135.441746][ T4987]  ? __kmalloc_cache_noprof+0x2e5/0x6c0
[  135.441800][ T4987]  ? uevent_show+0x166/0x3a0
[  135.441852][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  135.441901][ T4987]  uevent_show+0x1ca/0x3a0
[  135.441948][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  135.441998][ T4987]  ? __pfx_uevent_show+0x10/0x10
[  135.442044][ T4987]  dev_attr_show+0x52/0xa0
[  135.442106][ T4987]  ? __pfx_dev_attr_show+0x10/0x10
[  135.442167][ T4987]  sysfs_kf_seq_show+0x217/0x3f0
[  135.442221][ T4987]  seq_read_iter+0x32f/0x1270
[  135.442284][ T4987]  kernfs_fop_read_iter+0x46c/0x610
[  135.442336][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  135.442383][ T4987]  ? rw_verify_area+0xce/0x6d0
[  135.442426][ T4987]  ? __pfx_kernfs_fop_read_iter+0x10/0x10
[  135.442472][ T4987]  vfs_read+0x82e/0xb40
[  135.442522][ T4987]  ? __pfx_vfs_read+0x10/0x10
[  135.442572][ T4987]  ? __pfx___do_sys_newfstat+0x10/0x10
[  135.442653][ T4987]  ksys_read+0x12a/0x250
[  135.442701][ T4987]  ? __pfx_ksys_read+0x10/0x10
[  135.442752][ T4987]  ? srso_alias_return_thunk+0x5/0xfbef5
[  135.442804][ T4987]  do_syscall_64+0x115/0x870
[  135.442861][ T4987]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  135.442902][ T4987] RIP: 0033:0x7f0dc3ca7407
[  135.442932][ T4987] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  135.442971][ T4987] RSP: 002b:00007ffe09f45080 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
[  135.443009][ T4987] RAX: ffffffffffffffda RBX: 00007f0dc4385880 RCX: 00007f0dc3ca7407
[  135.443037][ T4987] RDX: 0000000000001000 RSI: 000055dce2afc1a0 RDI: 000000000000000c
[  135.443062][ T4987] RBP: 00007f0dc3defff0 R08: 0000000000000000 R09: 0000000000000000
[  135.443088][ T4987] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[  135.443112][ T4987] R13: 00007f0dc3defea0 R14: 0000000000000000 R15: 000055dce29f5b30
[  135.443150][ T4987]  </TASK>
[  135.443163][ T4987] 
[  135.813556][ T4987] Allocated by task 9:
[  135.817696][ T4987]  kasan_save_stack+0x30/0x50
[  135.822418][ T4987]  kasan_save_track+0x14/0x30
[  135.827134][ T4987]  __kasan_kmalloc+0xaa/0xb0
[  135.831940][ T4987]  __kmalloc_cache_noprof+0x2e5/0x6c0
[  135.837447][ T4987]  sur40_probe+0x1a8/0x1580
[  135.841975][ T4987]  usb_probe_interface+0x303/0x8f0
[  135.847126][ T4987]  really_probe+0x241/0xa60
[  135.851654][ T4987]  __driver_probe_device+0x20e/0x450
[  135.856975][ T4987]  driver_probe_device+0x4a/0x140
[  135.862032][ T4987]  __device_attach_driver+0x1df/0x320
[  135.867448][ T4987]  bus_for_each_drv+0x159/0x1e0
[  135.872504][ T4987]  __device_attach+0x1e4/0x4d0
[  135.877305][ T4987]  device_initial_probe+0xaf/0xd0
[  135.882446][ T4987]  bus_probe_device+0x64/0x160
[  135.887238][ T4987]  device_add+0x121d/0x1970
[  135.891798][ T4987]  usb_set_configuration+0xd97/0x1c60
[  135.897294][ T4987]  usb_generic_driver_probe+0xa1/0xe0
[  135.902699][ T4987]  usb_probe_device+0xef/0x400
[  135.907623][ T4987]  really_probe+0x241/0xa60
[  135.912152][ T4987]  __driver_probe_device+0x20e/0x450
[  135.917497][ T4987]  driver_probe_device+0x4a/0x140
[  135.922549][ T4987]  __device_attach_driver+0x1df/0x320
[  135.927954][ T4987]  bus_for_each_drv+0x159/0x1e0
[  135.932996][ T4987]  __device_attach+0x1e4/0x4d0
[  135.937817][ T4987]  device_initial_probe+0xaf/0xd0
[  135.942901][ T4987]  bus_probe_device+0x64/0x160
[  135.947683][ T4987]  device_add+0x121d/0x1970
[  135.952215][ T4987]  usb_new_device.cold+0x685/0x115c
[  135.957427][ T4987]  hub_event+0x30a3/0x4a60
[  135.961930][ T4987]  process_one_work+0xa23/0x1940