program: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TCFLSH(r1, 0x400455c8, 0x2) syz_mount_image$bcachefs(&(0x7f0000005b00), &(0x7f0000000040)='./file0\x00', 0x2001800, &(0x7f0000000080)=ANY=[], 0x1, 0x5b69, &(0x7f000000b6c0)="$eJzs3Q2MXWWdMPBz7p1pZzptmaJALR8doPQtvAJTii/QYBx4I+CrRQQtKkhb6bQM9gM6rYUqtpCIBnl5m7wbZU0khGjChhDcJev6saaYRczKGpu4bHF3XQxoVnaDNQjapcTZzNxz7tx75jz33Ln3Ti34+wXm3HPuc//P83/OM2fOee7pvREAAAB/Ep767Ojvrlz07h/eNfzq7iu+vfnOqK88sb0nLdCfLG/7Y7WQI2l218KJZXZc7B2a9dS77n3fs1/52Neef2HBsuVfvfmyw7fOXXXPPUM/ueDwj/5wR1HcdDydObkevxRH0ck/XvbFu7//9Anj2+Ioispx/54oWhCXvrcgzoQYfC2KovXVdtY/+firKzaML/d8YXbd9mMyQYz3P21zk3H2ue9uPelX51z27L6fXvrqYM9r2/ZMFol7asZTFM1fW/v67iiKepP/x6WjbWH64mR51fgra153YUG7urqaa//ZgfVFyXJWsuwriJM+f2pmvbu5ZkRdmWVPk69rVWmG46fS/Td3huvPHtyy9SxIlt9IlmdOM/74UW3exPE0KsVRV7W6TfHkGIlq9lscxRP7fnK9VDcW4szYiKMozqyXMuvl7kxeE/UmA60cx/Xb03KZ7QPJ9q5k+6kFY+2awPa3pfkmv6iHkt/OnmxHJPqmPKjmNSFt188btOVIKNUcg/K2p+3tSXZGX7KtLz52ymvGcqTPrX7hvsee3/XAkv5AO+Kvx0n8uKX4z2y+6MDSXT87uDAUf20piV9qKf7oOS8/+uLVPzghGH9vGr/cUvznzl/6pe/s3nko2D+/Sfunq6X45ZVnHV5+1+DqYPsfTOP3tBT/oUsf+fL8dzz5aLD9g2n/9LbWPyM7Xr/u4eMOBuNHafw5LcW/5JXjz1i59ZGNwfhPpP3T11L8p0dHVt190+KdA6H4+9P481qKf9ovrr9u34Hh54LtH0r7p7+l+O9ccslVqw5uuTd07Iz3HKm/sABvTm9JzrE+n6y3ep3Zrprrhfv748o539zk/3mdrCgjzlz3AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAnPNS/fvgP3zrl9a5kfXby4JRyZZlunxVFcW8URaPb123bPrJl48DNW3ds27Ju08C67QPDW7Zvu33g/LcPbBu+ZdO628efHTx7ReV1x0ZxZRmfPKXusbGxsVJ//ba0vk9c8P8fHzjlwD9H0eBxPzmlK9j+99+x6H8vyPmZEQ+Nbfp/Z9zw4ty/31HZ0J+0qz/QrijQrosffmnlr77d+3+jaPD4Ru3692WXf7+uQRMbJuMkSrOj0sSD2fGc3HZUW520J+2vrg0jm4YHi/u3HMjjl4f+6kM7R2/cU+nfnmAeTfZv79DY77d884kbL951VWXD0brfi/o7zSJtX9p/PUl/z0/ymh/IqyuQ191nnPpv//Tnm1/aEw12/Xbx1LqL8upOBkB3/Lam6k1rmBPX90lPUj7d4+nrzt2++ZZzR2/fdfbI5nUbhzcOb1mxYsWF568474Lz/te5E6lXfnYs/7T+/9Fk/kdmPG29YGgk/dnceCpqV1F/jLeruD9qWxT6/XvrBy//lzv/eu/VlQ1F4zwtXT2eJMs547t5eVQz3qb2VV5eRf3QHeiHjdf0/cUrA1v/q+g4VLtnan9mxENjvx35h3fN3Xf6DZUNR+Q4X9ugFo/z1VYn7emuPe4sP3r7d3ZUTvLqy23X6Xe9/OF//FY8UG3frFnRbeu2b9+2vPLzCOX11ms+3dm8Llz6n7fuWnvngil5nVf5OTdp6dz4xNx2ZbemeS2e+FmOkm5JF1FPKT+/7qjSvuzfhfR12V7tS57ri4/NzSsrfW71C/c99vyuB5aEejr+eqXG3mheZRmfFCi5KfPCcrXBefUXjY8oitbWbkv78Ylv/tnAvh8u2FwwPmZHlZEx5Wc2vaGxz1w095ej1+5fVdlwZI4rNQ1q8bhSbfVkeyb6a+K4ct7Rk8cM7+ecPZzu57pfrHhobN9Jb9+44m+3J7/2Rf1bLT2lf0vR8IooKjoOLM6sz9RxIFvPZPn8eAOZ9b6o3NJx47nzl37pO7t3HgoeN37T7HHj03Vr5TaPG3FgPB34zF/+/lMHnnlP6+OpPr2hsfcsLX/0XxevSDr0aPl960nGdU9gXFdbnbQnrj1unHPj1k3rK9uP3vPfZBm+/om7as6zRm/f9Yl1mzYNbxttLq9mz0vSvLK9PJ5RqYXzkvS379iC67p0f03mNXMPmumvZn/f0vavz/ZXi79vkKcvilv6e/bM5osOLN31s4P9gbjx2lISv9RS/NFzXn70xat/cEIw/t40fldL8csrzzq8/K7B1cH4D8ZJ/J6W4j906SNfnv+OJx8Nxh9M29/b2vnEyI7Xr3v4uHD/R2n8vpbiPz06surumxbvDMbfHyf1jJ/bRdHjr67YUFmPo+7kOJy2o7uuXVF2Pc6slzLr5dr1UmUOvlpBOY7rt6flku2n1rQlz7WB7enZY8/CyvJQuh5lHzTefrQp1ZwT5G0vOr8GgDeT9P3/9Fwjff9/cfIHseb9/8oynlX3+oXJ+dTCyU0T13l3DlT+kE53Xi9tR3ZeL42/7PT6GK3O6xXNy52WWa+0qzeZR+uqtqfBecPcqIl5uan1NJ6Xy6RfPG828PnMhq6Jub3QfutOZiry3mfOtHfueIR2z7MX5re6ep4dGnfZ+Y70ffq4yXGXvS8iHXfZ+yLS+IsyE2it3hfR2riLquMundZoMO4mMiueT506LqIG/To5LvKjZcfFNMZRf2Uczez7Um/86/2ZnX83nxCIn/wdOdqv99Pt6fGhq8l5gNWB7Z2aB0gPF2m7fp5T16wG7es08wAAMHn9n/4NHr/+H/9bPZA5zy+6bsleZaTxgvexlPPbU3T9O/V+tjktnfdd8srxZ6zc+sjG4HnxE83el3JL3dqcgvtSivpxSWa9sB8Dt4IUzTsszZTvi+a11I+n/eL66/YdGH4u2I9DlROp4n7cW7c2r81+XJZZL+zH7vxWFfVjtp6i8XtmZr0vuSNouv3+ziWXXLXq4JZ7g/2+p9l+f7Burb+g35Pr9Dh2nV4f33X6UXGdPtPzkX+0eYBk3npG5gG6o+iawFPTnQfom/KgmteERvMAR1LT8wCBvwsA8EaWXv9X75dPrv//LlOu3evD4HnbUGfuZw2et1XPa9s7Lw+2v3pe3t77l8H41eui9q5bgv1TvW5p77orGL963dXePE2wf55I+6e98/7QPxdIz/vf+NdFMzvP8Ka8LooKr4u6I9dFAAC8gaTX/+npanr//5PJevbceOavc2f6OnSmr6Nnep5hpudJ3ujXuW/0eYaZnmczDzAD8wDeHwUA4Kj07mR5Q5PluybuIY6ij99403lr1g9/cs2GbcPDo7esu3F4zciWke3Vct0TV15T75MO1Vd0n3Re+TkNyq8Jxq9vz2WB8iHt5h+qryj/vPKN8l8bjF/fnssD5UPazT9UX1H+eeUb5b8uGL++PVcEyoe0m3+ovqL888o3yv/jwfj17XlPoHxIu/mH6ivKP698o/xvDMavb8//CZQPaTf/UH1F+U+UnxXlxM8vn/28zFD+7w2UD2k3/1B9RfnnlW+U/3Awfn173hcoH9Ju/qH6ivLPK98o/w3B+PXtWRUoH5KTf9qCpvIP1VeUf175RvlvDMavb8+VgfIh7e7/UH1F+eeVb5T/TcH49e15f6B8SLv5h+oryj+vfKP8R4Lx69tzVaB8SLv5h+oryj+vfKP8bw7Gr2/PBwLlQ9rNP1RfUf555Rvl/4lg/Pr2XB0oH9Ju/qH6ivLPK98o/03B+PXtuSZQPqTd/EP1FeWfV75R/puD8evb88FA+ZB28w/VV5R/XvlG+W8Jxq9vz4cC5UPazT9UX1H+eeUb5b81GL++PasD5UPazT9UX1H+eeUb5X9LMH59e64NlA9pN/9QfUX555VvlP+twfj17flwoHxIu/mH6ivKP698o/y3BePXt+cjgfIh7eYfqq8o/7zyjfIfDcavb89HA+VD2s0/VF9R/nnlG+W/PRi/vj3XBcqHtJt/qL6i/PPKN8p/RzB+fXuuD5QPaTf/UH1F+eeVb5T/J4Px69vzsUD5kHbzD9VXlH9e+Ub57wzGr2/PDYHyUyQ34rSbf6i+ovzzyjfK/7Zg/Pr2rAmUD6nmv33b8PCaHbesX7d9eM2WreuHR9fs3DayfftwcqLW7n2JwfvKkvsSu6Ouhvkvyqwfk3w+0DGBzwfKlk/DnjjxYOrnA2Wr7Sr4nJyi/ZWtv+hzhhZlPtE6NN5C+7foeNDseMiq+/2oDJKRLaPD26Yev3sb9kftmIgmbpvrrSzj45sqn/24zkA1hZrPp6dhPtnNs5MbAWfHxzVVPgp8H9x0NZ9PHMwnrx3T/R67NOy0vscu82OKnM9orct3w+jEQXpk3aaRXcNT2z/nKGj/H6cfS1PaUbT/40w7FiQtWRD6vrdAu3d+4z8e+vWv/+a9UTR4XPmktvovHhpbe+j4j//44tnnjre/1LD91ZLp9yoXfP9htnyaT9emraPb/+eGrTu25L+Dlt7vXKquz9D9zkme5SbvXw7d7zHd+5fjKQ+OTs3evwwAAPCnIv33/+n16sJk6ntBZoqg+Xng9v59dHAeeH9z88DZ2YiieeBs+TTtZueB+9qcB87WH5qnLTUo3+h9l2bngT8aKD9dzY+T9j4HIDhOkp4qGifZf4dfNE6y5ac7TnrbHCfZ+ovGSV75Ru9PNztOrg2UD2l+PLT3uRPB8TDY3HjIfq9m0XjIlp/ueOhpczxk6y8aD3nlG92v0+x4+GCgfLOaHx/tfS5McHysbW58ZL8vpWh8ZMtPd3zEbY6PbP1F4yOvfKP7GZsdHx8IlE81v//b+9ye4P7f29z+z35vS9H+z5af7v4vtbn/s/UX7f+88o3u5252/18ZKJ+q3//jO35ivw+v2bl1W+090DP9vS0hzbdvZr+3plXNt39mP/dp5tvf8c+VmjhkxHlvMs9I+9u7bgr2//723ulqvv0z+71ErTpi78cm/1az6POnit6n/Uhg+3Tfp5015cHRyfu0AAAAMPPS9//Tr+NPPx/+C8ky8DX9LSuaJ91T87iVedKZ/35v37+dG79D379dNI9pPq9BZUcB83kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACdMbtr4cTyqc+O/u7KRe/+4V3Dr+6+4tub79w7NOupd937vme/8rGvPf/CgmXLv3rzZYdvnbvqnnuGfnLB4R/94Y7CwP2VxZnJak8UxS/FUXTyj5d98e7vP33C+LY4iqJy3L8nihbEpe8tiDMRBl+Lomh9tZ31Tz7+6ooN48s9X5hdt/2YTJBsXlFfOW1PXTuj2woz4g2oJxlnn/vu1pN+dc5lz+776aWvDva8tm3PZJG4p2Y8RdH8tbWv746iqDf5f1w62hamL06WV0VRNKfmdRcWtOu0Jtt/dmB9UbKclSz7CuKkz5+aWe9ush1dmWVPk69rVWmG46fS/Td3huvPHtyy9SxIlt9IlmdOM345/T+OSnHUVa1uUzw5RqKa/RZH8cS+n1wv1Y2FODM24iiKM+ulzHq5O5PXRL3JQCvHcf32tFxm+0CyvSvZfmrBWLsmsP1tab7JL+qhTP7ZoH1THlTzmpC26+cN2nIklGqOQXnb0/b2JDujL9nWFx875TVjOdLnVr9w32PP73pgSX+gHfHX4yR+3FL8ZzZfdGDprp8dXBiKv7aUxC+1FH/0nJcfffHqH5wQjL83jV9uKf5z5y/90nd27zwU7J/fpP3T1VL88sqzDi+/a3B1sP0PpvF7Wor/0KWPfHn+O558NNj+wbR/elvrn5Edr1/38HEHg/GjNP6cluJf8srxZ6zc+sjGYPwn0v7payn+06Mjq+6+afHOgVD8/Wn8eS3FP+0X11+378Dwc8H2D6X9099S/HcuueSqVQe33Bs6dsZ7jtRfWIA3p7ck51ifT9Zbvc5sV831wv39ceWcb27y/7xOVpQxXs/8GYwPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCb0/Dl9+++fP+aK7riKIoDZcZypM+VZw0NDbRQb3nlWYeX3zW4unbbwhbiAAAAAMXS6/BSdUtPtDDaGfdGJ+aWT+cITkzX4vrt2TmE3smSHYlT6lCccofidHUoTneH4szqUJzZHYrTUxCnJ2ouTm/DOKWm2zOnQ3H6OhRnbttxKiN5XofaM79DcY7pUJz+zFOtjsMFDdvTfJxjOxTnLR2K89YOxTmuQ3GO71CcEzoUJzunPN1xOC8puSgUZ+JBuTBOV1yuPpE3n57Wc3LmgFmaZj194/WUiuvJztlPt57eJvM5vc16epqsZ2mb9cRN1nNmm/WUCupJx+1t2fal9aRrxeP/0FgURbe3H2diuatDcT7VoTif7lCcOzoU5zMdirO7zTgAzUqv/yevG/uj2V0XR3OSI052FiC93l1cefWU41FP9gI9kcY7KbN9VlG87IV6Jt7iDrfvtMz27rp4XdXzpgbx+mvjLck8WZhvdkIh075l042XnVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgBk0fPn9uy/fv+aKKI7G/8s1liN9rjxraGighXpXv3DfY8/vemDJf7NrdzFyleUDwN+z88m28J/+A3UghY6UVoxISxflIzUc9GKWGJQARgOmu6UMdcO2i+w2hRVZ6wXxQgOJJq5eGa4whAs1KCrJcqExKAmbKDYRlBuJogESIKEmJmN255z56szOOqJd4Pe7OGfO8z7v+5x3tmnyvLvtsUJ2iIUAAACAgdI+PNeMFEMhuzvko3xHXjE5Bygmz5lS4x5VRlbvo9GWNfOzSf7uucN37Z69d/7DU4cPHKodqh0ZGxu78vKxvVfs/ejuO6ama3sa11AYsF4uWW/23vk7D0xP1+6ebTx3v3c5mVduhSZXLseT9/7/AXWiJL9V57/3YfBPCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATq9adXGhujwxPhqFEPXJqfeQjmXycVwZou61b27defXMo4faY4XsEAsBAAAAA6V9eK4ZKYZCNhMy4dzVpwtbqaUQWn0/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw3lOrLi5UlyfGN0UhRH1y6j2kY5l8HFeGqPub2anrH/jC9mPtsfIa+YUhagAAAAANaR8+0owUQznsCLno3I689GzgvK753XnpOuevM6/77KBf3o515u1aZ94HB+R9KrnfEwAAAOCdL+3/s81IKRSyZ/bt/wf19Wne9q68THIf5m8FAAAAgP9M2v/nm5FyKGTLzX59vf3+hV156fxBv7dP5w/6vX2ad3GfOt2/zwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANq5adXGhujwxnolCiPrk1HtIxzL5OK4MUffFy3d9++cLx062xwrZIRYCAAAABkr78FbrXQyF7GjIhU2rff+Vu/7+xfnJ41typWQ4nw/3HJibu3tv45rm7fjq65/73U+jyil5lzWup2VzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA26pWXVyoLk+MnxGFEPXJqfeQjmXycVwZou6LU0f/eesj57zWHisPsQ4AAAAwWNqHt3r/YiiHfMiHratP7b3+ipGu+f3ODAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB3j9l75+88MD1du3sjfciEDfEaPvjw3v1wuv9nAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANopadXGhujwxXoxCiPrk1HtIxzL5OK4MUffhjz/63bM+8ovH2mPlIdYBAAAABkv78FbvXwzlkAu5cM7qU68zgdX+v/Q/fEkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGBDqFUXF6rLE+NnRiFEfXLqPaRjmXwcV4aoe+GfP3/r0onai+2xQnaIhQAAAICB0j4834wUQyF7WSiEbcnzdOeEKJPce58LtObd1TFtdN3z7uuYl1n3vK917Syb7KYxr5iuV2rcm/Mqp86rhBDKybxya2CyY154qGPWmet+z+91zCsNmBcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgA6pVFxeqyxPjURRC1Cen3kM6lsnHcWWIus8dvurErvk/vtYeKw+xDgAAADBY2oe3ev9iKIfzw1nh/NW+P5Q689O8fY+8cvVff3bGN0LYs/W3F2T7rv+Xi6u/7L6EMNKZNBLC/yX1oj71jv34bw+/+upPPhnCnnMy206pl127XueScX3y5Nbbnt1X2D3gywEAAIB3ibT/zzUjpVDIHunb/6eN9r/V/8+cfdN9W5Jr0pF3zRgpJfVG+tS784pv/qhywYk/rPT/a9X79JfP+8SWMHNFPJVeG5EuUVyffnDn/pc3P3003XWjfqarfvq9vHTyh585NnvwK436xVBM4udle9U/9drljLj+1pEnnjq4b/6GzvrZPvt/YOf7//T77xx+ZaX+G9tHm/U/sMb+165/9s3V548//tCNnfVzfeofumnT99+szPyje/+jXQsn33zjB972U+gSxfU3pp65ZvPSjv2d9UMIk+2J6ff/1BPfqiz9esvhtH76tyIX7+iq3/ZPrf3adeYUxfWlbZccGntyblNn/airfrr/E/f/4K0vnXjuuu793969/771u/d/3a7MLS9sHxvmj2cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN4BatXFheryxHjIhBD1yan3kI5l8nFcGaLuxy669obrXzvy9fZYITvEQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDbplZdXKguT4yPRCFEfXLqPaRjmXwcV4aoO3vp64+9fOOv3tceKw+xDgAAADBY2oe3ev9iKId8yIfR1b5/8uTW257dV9gdSo3RKLlnp2dm5z50x8zRI7efpjcHAAAA1ivt/7PNSCkUsheFXNL/L2275NDYk3Ob0v4/hDC5cineMTVdGwvNc4LrdmVueWH7WKV5TtCed+nBmenkmCBd9/6rNr80+9nl63uuu7eV98bUM9dsXtqxP83LJffVvMtaedMP7tz/8uanj6Z5I+k5xUrenlbeW0eeeOrgvvkb0vFM+3pteWffXH3++OMP3dhcJ7mPJnUBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAf7EDBwIAAAAAQP6vjVBVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWF/ToKkar64wB+zsyujs66/9l/lJsUqZhokKxUVEK0CkkPbUiBLxb4kJWRSS1hCOEmZGESPlUERURBIFIQ9FCEBWWQREGE9hCG9lAPsRFtiBsZs3vP7sx17+52aw3k84HL8Zw793t+99zj3RkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4b83v6B1rjz49+PudS277fO+2kT23v7/jqYP9847eeuCOE6/c++ap0z2r1r7x0MbRR7sG9u/v//rG0S/+fHLG4CfGm9VZtxZC/DmGcOWXq17Y9+mxxc2xGEKoxsZQCD2x8nFPzCX0nQ0h3DdRZ/vJd0euu7/ZDj03v238f7mQ/H2FejXVM67RXi8Xl1q2z575cOcVP67ZeOLItxtG+mpnHxua/EisteynELq3tl7fGUJYkB1Nabf1pouzdlMIYWHLdTfNUNfyWdZ/bUF/SdbOy9r6DDnp/LJcv3OWdXTk2tosryurMsf5SXp+XXM8f/7llp+nJ2vfy9rVfzO/mo4YKjF0TEz3cJzcI6HlucUQx579ZL/Sthdibm/EEGKuX8n1q525+xqbN9to1Rjbx9PncuNLs/GObHzZDHvt7oLxy9P9Zv9Rz+TuPx9aP+8fE/c1JtX1/TS1XAiVlnfQVOOp3lr2MOrZWD3+/7xrzk0hndt8+vm3T+1+dUWjoI74TszyY6n8b3bcfHzl7u+Ge4vyt1ay/Eqp/ME1vx7+6a7PFhfmH0z51VL5J69f+eIHe3adKVyfX9L6dJTKr667ZnTt3r7NhfW/lvJrE/n5fTFd/usbDr3cfcMnhwvr70vrs6Dc+mx//I8tb106XJgfUv7CZv65qfb0dPnrf7vs6nU7Dz1QmP9RWp96qfqPDW4f2PfgVbuWFuV/lfIXlcpf/sM9W44c33aysP7+tD6NUvm3rFi/aWD4kQNF7844dKH+wgJcnC7JvmM9m/XL/s78p1p+L7zUiOPf+bqyY9G/OVFOc57uOcwHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAv9iBAxIAAAAAQf9ftyNQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgqQAAAP//8q5M/Q==") ioctl$NBD_SET_SOCK(r1, 0xab00, r1) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) [ 74.682826][ T4687] Bluetooth: hci0: command tx timeout [ 74.928534][ T5339] loop0: detected capacity change from 0 to 32768 [ 74.942760][ T5337] ================================================================== [ 74.946545][ T5337] BUG: KASAN: slab-use-after-free in hci_uart_write_work+0x2ca/0x550 [ 74.950345][ T5337] Read of size 8 at addr ffff88804445dd58 by task kworker/0:5/5337 [ 74.953910][ T5337] [ 74.954982][ T5337] CPU: 0 UID: 0 PID: 5337 Comm: kworker/0:5 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 74.954998][ T5337] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 74.955008][ T5337] Workqueue: events hci_uart_write_work [ 74.955028][ T5337] Call Trace: [ 74.955035][ T5337] [ 74.955041][ T5337] dump_stack_lvl+0x189/0x250 [ 74.955057][ T5337] ? __virt_addr_valid+0x1c8/0x5c0 [ 74.955071][ T5337] ? rcu_is_watching+0x15/0xb0 [ 74.959765][ T5337] ? __pfx_dump_stack_lvl+0x10/0x10 [ 74.959779][ T5337] ? rcu_is_watching+0x15/0xb0 [ 74.959791][ T5337] ? lock_release+0x4b/0x3e0 [ 74.959803][ T5337] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 74.959862][ T5337] ? __virt_addr_valid+0x1c8/0x5c0 [ 74.959877][ T5337] ? __virt_addr_valid+0x4a5/0x5c0 [ 74.959891][ T5337] print_report+0xca/0x230 [ 74.959903][ T5337] ? hci_uart_write_work+0x2ca/0x550 [ 74.959916][ T5337] kasan_report+0x118/0x150 [ 74.959931][ T5337] ? hci_uart_write_work+0x2ca/0x550 [ 74.959946][ T5337] ? __pfx_pty_write+0x10/0x10 [ 74.959958][ T5337] hci_uart_write_work+0x2ca/0x550 [ 74.959974][ T5337] ? process_scheduled_works+0x9ef/0x17b0 [ 74.959988][ T5337] process_scheduled_works+0xae1/0x17b0 [ 74.960007][ T5337] ? __pfx_process_scheduled_works+0x10/0x10 [ 74.960023][ T5337] worker_thread+0x8a0/0xda0 [ 74.960037][ T5337] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 74.960054][ T5337] ? __kthread_parkme+0x7b/0x200 [ 74.960070][ T5337] kthread+0x70e/0x8a0 [ 74.960087][ T5337] ? __pfx_worker_thread+0x10/0x10 [ 74.960098][ T5337] ? __pfx_kthread+0x10/0x10 [ 74.960113][ T5337] ? _raw_spin_unlock_irq+0x23/0x50 [ 74.960128][ T5337] ? lockdep_hardirqs_on+0x9c/0x150 [ 74.960144][ T5337] ? __pfx_kthread+0x10/0x10 [ 74.960159][ T5337] ret_from_fork+0x3fc/0x770 [ 74.960173][ T5337] ? __pfx_ret_from_fork+0x10/0x10 [ 74.960186][ T5337] ? __pfx_kthread+0x10/0x10 [ 74.960201][ T5337] ret_from_fork_asm+0x1a/0x30 [ 74.960222][ T5337] [ 74.960226][ T5337] [ 75.047630][ T5337] Allocated by task 5337: [ 75.049640][ T5337] kasan_save_track+0x3e/0x80 [ 75.051821][ T5337] __kasan_slab_alloc+0x6c/0x80 [ 75.054063][ T5337] kmem_cache_alloc_node_noprof+0x1bb/0x3c0 [ 75.056631][ T5337] __alloc_skb+0x112/0x2d0 [ 75.058605][ T5337] h5_prepare_pkt+0x184/0x530 [ 75.060597][ T5337] h5_dequeue+0x197/0x790 [ 75.062487][ T5337] hci_uart_write_work+0x24a/0x550 [ 75.064756][ T5337] process_scheduled_works+0xae1/0x17b0 [ 75.067349][ T5337] worker_thread+0x8a0/0xda0 [ 75.069825][ T5337] kthread+0x70e/0x8a0 [ 75.072241][ T5337] ret_from_fork+0x3fc/0x770 [ 75.074807][ T5337] ret_from_fork_asm+0x1a/0x30 [ 75.077556][ T5337] [ 75.078793][ T5337] The buggy address belongs to the object at ffff88804445dc80 [ 75.078793][ T5337] which belongs to the cache skbuff_head_cache of size 240 [ 75.084851][ T5337] The buggy address is located 216 bytes inside of [ 75.084851][ T5337] freed 240-byte region [ffff88804445dc80, ffff88804445dd70) [ 75.090296][ T5337] [ 75.091285][ T5337] The buggy address belongs to the physical page: [ 75.093961][ T5337] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4445d [ 75.097667][ T5337] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 75.100719][ T5337] page_type: f5(slab) [ 75.102361][ T5337] raw: 04fff00000000000 ffff8880304f1b40 dead000000000122 0000000000000000 [ 75.106614][ T5337] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000 [ 75.111008][ T5337] page dumped because: kasan: bad access detected [ 75.113820][ T5337] page_owner tracks the page as allocated [ 75.116248][ T5337] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 12, tgid 12 (kworker/u4:0), ts 74782951925, free_ts 73013142577 [ 75.124285][ T5337] post_alloc_hook+0x240/0x2a0 [ 75.126542][ T5337] get_page_from_freelist+0x21e4/0x22c0 [ 75.129150][ T5337] __alloc_frozen_pages_noprof+0x181/0x370 [ 75.131628][ T5337] alloc_pages_mpol+0x232/0x4a0 [ 75.133838][ T5337] allocate_slab+0x8a/0x3b0 [ 75.135854][ T5337] ___slab_alloc+0xbfc/0x1480 [ 75.137935][ T5337] kmem_cache_alloc_node_noprof+0x280/0x3c0 [ 75.140451][ T5337] __alloc_skb+0x112/0x2d0 [ 75.142489][ T5337] nsim_dev_trap_report_work+0x29a/0xb80 [ 75.144856][ T5337] process_scheduled_works+0xae1/0x17b0 [ 75.147292][ T5337] worker_thread+0x8a0/0xda0 [ 75.149982][ T5337] kthread+0x70e/0x8a0 [ 75.152383][ T5337] ret_from_fork+0x3fc/0x770 [ 75.154715][ T5337] ret_from_fork_asm+0x1a/0x30 [ 75.157001][ T5337] page last free pid 4737 tgid 4737 stack trace: [ 75.159858][ T5337] __free_frozen_pages+0xc71/0xe70 [ 75.162131][ T5337] __slab_free+0x326/0x400 [ 75.164705][ T5337] qlist_free_all+0x97/0x140 [ 75.166968][ T5337] kasan_quarantine_reduce+0x148/0x160 [ 75.169465][ T5337] __kasan_slab_alloc+0x22/0x80 [ 75.171517][ T5337] kmem_cache_alloc_lru_noprof+0x1c6/0x3d0 [ 75.174058][ T5337] shmem_alloc_inode+0x28/0x40 [ 75.176172][ T5337] alloc_inode+0x67/0x1b0 [ 75.178059][ T5337] new_inode+0x22/0x170 [ 75.180086][ T5337] shmem_get_inode+0x346/0xe90 [ 75.182502][ T5337] shmem_mknod+0x18c/0x3e0 [ 75.184945][ T5337] path_openat+0x14f4/0x3830 [ 75.187241][ T5337] do_filp_open+0x1fa/0x410 [ 75.189177][ T5337] do_sys_openat2+0x121/0x1c0 [ 75.191054][ T5337] __x64_sys_openat+0x138/0x170 [ 75.193262][ T5337] do_syscall_64+0xfa/0x3b0 [ 75.195240][ T5337] [ 75.196300][ T5337] Memory state around the buggy address: [ 75.198647][ T5337] ffff88804445dc00: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 75.202054][ T5337] ffff88804445dc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.206183][ T5337] >ffff88804445dd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 75.209898][ T5337] ^ [ 75.212833][ T5337] ffff88804445dd80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 75.216294][ T5337] ffff88804445de00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 75.219536][ T5337] ================================================================== [ 75.301152][ T5337] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 75.304440][ T5337] CPU: 0 UID: 0 PID: 5337 Comm: kworker/0:5 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 75.309794][ T5337] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 75.315146][ T5337] Workqueue: events hci_uart_write_work [ 75.317468][ T5337] Call Trace: [ 75.318954][ T5337] [ 75.320263][ T5337] dump_stack_lvl+0x99/0x250 [ 75.322487][ T5337] ? __asan_memcpy+0x40/0x70 [ 75.324952][ T5337] ? __pfx_dump_stack_lvl+0x10/0x10 [ 75.327548][ T5337] ? __pfx__printk+0x10/0x10 [ 75.330295][ T5337] panic+0x2db/0x790 [ 75.332437][ T5337] ? __pfx_preempt_schedule+0x10/0x10 [ 75.334914][ T5337] ? __pfx_panic+0x10/0x10 [ 75.336850][ T5337] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 75.339612][ T5337] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 75.343320][ T5337] ? hci_uart_write_work+0x2ca/0x550 [ 75.346114][ T5337] check_panic_on_warn+0x89/0xb0 [ 75.348765][ T5337] ? hci_uart_write_work+0x2ca/0x550 [ 75.351302][ T5337] end_report+0x78/0x160 [ 75.353317][ T5337] kasan_report+0x129/0x150 [ 75.355402][ T5337] ? hci_uart_write_work+0x2ca/0x550 [ 75.357771][ T5337] ? __pfx_pty_write+0x10/0x10 [ 75.359725][ T5337] hci_uart_write_work+0x2ca/0x550 [ 75.361629][ T5337] ? process_scheduled_works+0x9ef/0x17b0 [ 75.364529][ T5337] process_scheduled_works+0xae1/0x17b0 [ 75.367549][ T5337] ? __pfx_process_scheduled_works+0x10/0x10 [ 75.370249][ T5337] worker_thread+0x8a0/0xda0 [ 75.372203][ T5337] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 75.374971][ T5337] ? __kthread_parkme+0x7b/0x200 [ 75.377001][ T5337] kthread+0x70e/0x8a0 [ 75.378624][ T5337] ? __pfx_worker_thread+0x10/0x10 [ 75.380772][ T5337] ? __pfx_kthread+0x10/0x10 [ 75.382789][ T5337] ? _raw_spin_unlock_irq+0x23/0x50 [ 75.385371][ T5337] ? lockdep_hardirqs_on+0x9c/0x150 [ 75.387624][ T5337] ? __pfx_kthread+0x10/0x10 [ 75.389217][ T5337] ret_from_fork+0x3fc/0x770 [ 75.390944][ T5337] ? __pfx_ret_from_fork+0x10/0x10 [ 75.393013][ T5337] ? __pfx_kthread+0x10/0x10 [ 75.394757][ T5337] ret_from_fork_asm+0x1a/0x30 [ 75.396488][ T5337] [ 75.397900][ T5337] Kernel Offset: disabled [ 75.399505][ T5337] Rebooting in 86400 seconds..