last executing test programs: 3.124810254s ago: executing program 1 (id=41): rt_sigreturn() 1.650148778s ago: executing program 3 (id=543): set_robust_list(&(0x7f0000000000), 0x0) 1.648966978s ago: executing program 3 (id=547): timerfd_settime(0xffffffffffffffff, 0x0, &(0x7f0000000000), &(0x7f0000000000)) 1.648820358s ago: executing program 3 (id=549): clock_gettime(0x0, &(0x7f0000000000)) 1.647842978s ago: executing program 3 (id=551): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mISDNtimer', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mISDNtimer', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mISDNtimer', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mISDNtimer', 0x800, 0x0) 1.615630439s ago: executing program 3 (id=554): semget(0xffffffffffffffff, 0x0, 0x0) 1.615327219s ago: executing program 3 (id=557): pause() 1.513694534s ago: executing program 1 (id=577): munlockall() 1.410392968s ago: executing program 0 (id=609): pread64(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) 1.410157609s ago: executing program 0 (id=611): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video2', 0x2, 0x0) 1.410099989s ago: executing program 2 (id=612): fstatfs(0xffffffffffffffff, &(0x7f0000000000)) 1.410048118s ago: executing program 0 (id=613): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/iommu', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/iommu', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/iommu', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/iommu', 0x800, 0x0) 1.36788452s ago: executing program 2 (id=614): mlock(0x0, 0x0) 1.3677379s ago: executing program 4 (id=615): setrlimit(0x0, &(0x7f0000000000)) 1.36762292s ago: executing program 0 (id=616): uselib(0x0) 1.36757793s ago: executing program 4 (id=617): syz_init_net_socket$ax25(0x3, 0x2, 0x0) 1.367525s ago: executing program 0 (id=618): socket$unix(0x1, 0x1, 0x0) 1.36744806s ago: executing program 2 (id=619): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/binder', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/binder', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/binder', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/binder', 0x800, 0x0) 1.184773188s ago: executing program 0 (id=620): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.170051619s ago: executing program 2 (id=621): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.084777922s ago: executing program 4 (id=622): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 1.029336305s ago: executing program 1 (id=623): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 779.039916ms ago: executing program 2 (id=625): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 725.213498ms ago: executing program 1 (id=627): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 722.278828ms ago: executing program 4 (id=626): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 447.26941ms ago: executing program 5 (id=628): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 391.125073ms ago: executing program 4 (id=632): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptp1', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptp1', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptp1', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptp1', 0x800, 0x0) 305.015356ms ago: executing program 1 (id=630): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 213.82967ms ago: executing program 2 (id=633): msgsnd(0x0, &(0x7f0000000000), 0x0, 0x0) 156.148463ms ago: executing program 4 (id=635): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 73.318186ms ago: executing program 5 (id=634): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/bluetooth/6lowpan_control', 0x2, 0x0) 56.187777ms ago: executing program 5 (id=639): syz_open_dev$sndpcmp(&(0x7f0000000040), 0x2, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x2, 0x1) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x2, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000100), 0x2, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000140), 0xc, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0xc, 0x1) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xc, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000200), 0xc, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000240), 0x16, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000280), 0x16, 0x1) syz_open_dev$sndpcmp(&(0x7f00000002c0), 0x16, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000300), 0x16, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x20, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000380), 0x20, 0x1) syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x20, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000400), 0x20, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x2a, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000480), 0x2a, 0x1) syz_open_dev$sndpcmp(&(0x7f00000004c0), 0x2a, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000500), 0x2a, 0x800) 42.013618ms ago: executing program 5 (id=640): syz_open_dev$sndmidi(&(0x7f0000000040), 0x3, 0x0) syz_open_dev$sndmidi(&(0x7f0000000080), 0x3, 0x1) syz_open_dev$sndmidi(&(0x7f00000000c0), 0x3, 0x2) syz_open_dev$sndmidi(&(0x7f0000000100), 0x3, 0x800) syz_open_dev$sndmidi(&(0x7f0000000140), 0xd, 0x0) syz_open_dev$sndmidi(&(0x7f0000000180), 0xd, 0x1) syz_open_dev$sndmidi(&(0x7f00000001c0), 0xd, 0x2) syz_open_dev$sndmidi(&(0x7f0000000200), 0xd, 0x800) syz_open_dev$sndmidi(&(0x7f0000000240), 0x17, 0x0) syz_open_dev$sndmidi(&(0x7f0000000280), 0x17, 0x1) syz_open_dev$sndmidi(&(0x7f00000002c0), 0x17, 0x2) syz_open_dev$sndmidi(&(0x7f0000000300), 0x17, 0x800) syz_open_dev$sndmidi(&(0x7f0000000340), 0x21, 0x0) syz_open_dev$sndmidi(&(0x7f0000000380), 0x21, 0x1) syz_open_dev$sndmidi(&(0x7f00000003c0), 0x21, 0x2) syz_open_dev$sndmidi(&(0x7f0000000400), 0x21, 0x800) syz_open_dev$sndmidi(&(0x7f0000000440), 0x2b, 0x0) syz_open_dev$sndmidi(&(0x7f0000000480), 0x2b, 0x1) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2b, 0x2) syz_open_dev$sndmidi(&(0x7f0000000500), 0x2b, 0x800) 28.633909ms ago: executing program 5 (id=641): syz_open_dev$usbfs(&(0x7f0000000040), 0x4, 0x0) syz_open_dev$usbfs(&(0x7f0000000080), 0x4, 0x1) syz_open_dev$usbfs(&(0x7f00000000c0), 0x4, 0x2) syz_open_dev$usbfs(&(0x7f0000000100), 0x4, 0x800) syz_open_dev$usbfs(&(0x7f0000000140), 0xe, 0x0) syz_open_dev$usbfs(&(0x7f0000000180), 0xe, 0x1) syz_open_dev$usbfs(&(0x7f00000001c0), 0xe, 0x2) syz_open_dev$usbfs(&(0x7f0000000200), 0xe, 0x800) syz_open_dev$usbfs(&(0x7f0000000240), 0x18, 0x0) syz_open_dev$usbfs(&(0x7f0000000280), 0x18, 0x1) syz_open_dev$usbfs(&(0x7f00000002c0), 0x18, 0x2) syz_open_dev$usbfs(&(0x7f0000000300), 0x18, 0x800) syz_open_dev$usbfs(&(0x7f0000000340), 0x22, 0x0) syz_open_dev$usbfs(&(0x7f0000000380), 0x22, 0x1) syz_open_dev$usbfs(&(0x7f00000003c0), 0x22, 0x2) syz_open_dev$usbfs(&(0x7f0000000400), 0x22, 0x800) syz_open_dev$usbfs(&(0x7f0000000440), 0x2c, 0x0) syz_open_dev$usbfs(&(0x7f0000000480), 0x2c, 0x1) syz_open_dev$usbfs(&(0x7f00000004c0), 0x2c, 0x2) syz_open_dev$usbfs(&(0x7f0000000500), 0x2c, 0x800) 1.13823ms ago: executing program 1 (id=636): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 0s ago: executing program 5 (id=642): syz_open_dev$sndpcmp(&(0x7f0000000040), 0x4, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x4, 0x1) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x4, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000100), 0x4, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000140), 0xe, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000180), 0xe, 0x1) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0xe, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000200), 0xe, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000240), 0x18, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000280), 0x18, 0x1) syz_open_dev$sndpcmp(&(0x7f00000002c0), 0x18, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000300), 0x18, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000340), 0x22, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000380), 0x22, 0x1) syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x22, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000400), 0x22, 0x800) syz_open_dev$sndpcmp(&(0x7f0000000440), 0x2c, 0x0) syz_open_dev$sndpcmp(&(0x7f0000000480), 0x2c, 0x1) syz_open_dev$sndpcmp(&(0x7f00000004c0), 0x2c, 0x2) syz_open_dev$sndpcmp(&(0x7f0000000500), 0x2c, 0x800) kernel console output (not intermixed with test programs): [ 18.617777][ T29] audit: type=1400 audit(1764821069.086:62): avc: denied { search } for pid=3201 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.639824][ T29] audit: type=1400 audit(1764821069.086:63): avc: denied { search } for pid=3201 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=477 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.663029][ T29] audit: type=1400 audit(1764821069.086:64): avc: denied { search } for pid=3201 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=481 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.686101][ T29] audit: type=1400 audit(1764821069.086:65): avc: denied { search } for pid=3201 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=482 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.712275][ T29] audit: type=1400 audit(1764821069.086:66): avc: denied { read open } for pid=3202 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=482 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.0.54' (ED25519) to the list of known hosts. [ 22.200210][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 22.200224][ T29] audit: type=1400 audit(1764821072.676:70): avc: denied { mounton } for pid=3305 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.229457][ T29] audit: type=1400 audit(1764821072.696:71): avc: denied { mount } for pid=3305 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.230274][ T3305] cgroup: Unknown subsys name 'net' [ 22.258841][ T29] audit: type=1400 audit(1764821072.726:72): avc: denied { unmount } for pid=3305 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.410717][ T3305] cgroup: Unknown subsys name 'cpuset' [ 22.416723][ T3305] cgroup: Unknown subsys name 'rlimit' [ 22.587407][ T29] audit: type=1400 audit(1764821073.056:73): avc: denied { setattr } for pid=3305 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 22.610874][ T29] audit: type=1400 audit(1764821073.056:74): avc: denied { create } for pid=3305 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.631436][ T29] audit: type=1400 audit(1764821073.056:75): avc: denied { write } for pid=3305 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.651779][ T29] audit: type=1400 audit(1764821073.056:76): avc: denied { read } for pid=3305 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.659237][ T3310] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.672240][ T29] audit: type=1400 audit(1764821073.066:77): avc: denied { read } for pid=3047 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 22.701846][ T29] audit: type=1400 audit(1764821073.076:78): avc: denied { mounton } for pid=3305 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.726590][ T29] audit: type=1400 audit(1764821073.076:79): avc: denied { mount } for pid=3305 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.767881][ T3305] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.904320][ T3386] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 25.230281][ T3861] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 25.404301][ T3912] mmap: syz.2.572 (3912) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 25.852406][ T3968] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 27.012627][ T3991] ================================================================== [ 27.020938][ T3991] BUG: KCSAN: data-race in fill_mg_cmtime / shmem_mknod [ 27.028085][ T3991] [ 27.030423][ T3991] write to 0xffff8881042569a4 of 4 bytes by task 3309 on cpu 0: [ 27.038189][ T3991] shmem_mknod+0x137/0x180 [ 27.042790][ T3991] shmem_create+0x34/0x50 [ 27.047155][ T3991] path_openat+0x1115/0x23b0 [ 27.051869][ T3991] do_filp_open+0x109/0x230 [ 27.056402][ T3991] do_sys_openat2+0xa6/0x150 [ 27.061532][ T3991] __x64_sys_openat+0xf2/0x120 [ 27.066293][ T3991] x64_sys_call+0x2b07/0x3000 [ 27.070984][ T3991] do_syscall_64+0xd8/0x2a0 [ 27.075675][ T3991] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 27.081552][ T3991] [ 27.083864][ T3991] read to 0xffff8881042569a4 of 4 bytes by task 3991 on cpu 1: [ 27.091523][ T3991] fill_mg_cmtime+0x5b/0x260 [ 27.096278][ T3991] generic_fillattr+0x24a/0x340 [ 27.101202][ T3991] shmem_getattr+0x181/0x200 [ 27.105881][ T3991] vfs_getattr_nosec+0x146/0x1e0 [ 27.110880][ T3991] vfs_statx+0x113/0x390 [ 27.115101][ T3991] vfs_fstatat+0x115/0x170 [ 27.119494][ T3991] __se_sys_newfstatat+0x55/0x260 [ 27.124491][ T3991] __x64_sys_newfstatat+0x55/0x70 [ 27.129579][ T3991] x64_sys_call+0x111f/0x3000 [ 27.134244][ T3991] do_syscall_64+0xd8/0x2a0 [ 27.138901][ T3991] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 27.144881][ T3991] [ 27.147184][ T3991] value changed: 0x1d6d5876 -> 0x1d743b72 [ 27.152895][ T3991] [ 27.155199][ T3991] Reported by Kernel Concurrency Sanitizer on: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 27.161325][ T3991] CPU: 1 UID: 0 PID: 3991 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) [ 27.170755][ T3991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 27.180884][ T3991] ==================================================================