last executing test programs:

3.333252817s ago: executing program 0 (id=472):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x240}, 0xe)
setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000100)={0x3, 0x8}, 0x2)
r1 = socket$igmp6(0xa, 0x3, 0x2)
poll(&(0x7f00000027c0)=[{r1, 0x2754}, {r0, 0x1082}], 0x2, 0x749)

3.245100906s ago: executing program 1 (id=473):
r0 = add_key$keyring(&(0x7f0000000140), &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe)
r1 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000680)={'syz', 0x3}, 0x0, 0x0, r0)
r2 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000001940)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0c70f5db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb06001b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246c89ed5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b3", 0x559, r1)
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
keyctl$get_security(0x11, r2, &(0x7f0000003040)=""/36, 0x24)

2.938100688s ago: executing program 1 (id=475):
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmmsg$unix(r1, &(0x7f00000bd000), 0x492492492492846, 0x0)
fcntl$setstatus(r1, 0x4, 0x42000)
ppoll(&(0x7f0000000040)=[{r1, 0x140}], 0x1, 0x0, 0x0, 0x0)
connect$unix(r0, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e)

2.576030055s ago: executing program 2 (id=478):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1c}}, 0x10)
connect$inet(r0, &(0x7f00000000c0)={0x2, 0x2, @multicast1}, 0x10)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=@migrate={0x50, 0x21, 0x1, 0x70bd26, 0x25dfdbfb, {{@in=@rand_addr=0x64010102, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4e24, 0x0, 0x4e21, 0xffff, 0x2, 0xa0, 0xa0, 0x3a}, 0x6e6bb3, 0x1}}, 0x50}, 0x1, 0x0, 0x0, 0x4000}, 0x90)
sendmmsg(r0, &(0x7f0000000100), 0x800001d, 0x300)

2.547181228s ago: executing program 2 (id=479):
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), 0xffffffffffffffff)
setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_CQM(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000003f00000008000300", @ANYRES32=r2, @ANYBLOB="1c005e800800020001000000080001"], 0x38}, 0x1, 0x0, 0x0, 0x20048000}, 0x0)

2.455690998s ago: executing program 2 (id=480):
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r0=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
io_setup(0x8, &(0x7f0000000600)=<r1=>0x0)
io_submit(r1, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r0, 0x0}])

2.300133523s ago: executing program 0 (id=481):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = dup(r1)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_GET_MSRS_cpu(r3, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x400000b7, 0x0, 0x10}]})

2.242206819s ago: executing program 2 (id=482):
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x7)
syz_mount_image$f2fs(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x82, &(0x7f0000000100)=ANY=[@ANYBLOB='test_dummy_encryption=v1,checkpoint=disable,noacl,fsync_mode=strict,jqfmt=vfsold,noquota,fsync_mode=posix,usrjquota=ext4\x00,resuid=', @ANYRES64, @ANYRES16], 0x1, 0x105b3, &(0x7f0000000740)="$eJzs3E1rHHUcB/DftvbRWoP0QU8OiJAFd8kmaVAQidqiBVOCDwdPutndLNvu7oTs5sGePLQnfQleBZHefA1e+jaKB8GT4K2i7MxEEg1izYZtm88Hhu/Mf+f/m/9s5/LbKQngyJpKfvu1FOfjTEQcj4hzEdl+qdgyi3m8GBEvR8SxXVupGP9r4GREnI2I86Piec1S8dHC7w8efvvS9Te/+v5Bufbzd99M7q6BSXs1Inpr+f5WL8+0nefNYry+2cmyN79ZZP5B71ZxnOa51VrJKmzVd86rZznXzs9P1zYGo1zt1hujbHdWs/G1fn7BwWZ7p0424WZ9PTtutlay7AzSLNu383VtF3l7MMzrNIt6X2TlYzjcyXy8td3K72ftVpaN/rAYz+umzdb2KDeLLC4XjbTbzNax8r+/5sfeB53+xnay2VofdNJ+cqVae71aW6jU1tNma9iar9R7zYX5ZLrdHZ1WGbbqvcV2mra7rWoj7ZWT6XajUanVkumrrZVOvZ/UatW56kzlSrnYey1578YnSbeZTI/ynU5/Y9jpDpLVdD3JZ5ST2ercG+XklVry0dJysvzhtWtLyx9/dvXTG28vXX+3OOkfy0qmZ2dmZyu1mcpsrez+D6J0sOkcdR4ggEf2b/1/1rSH/h8YP/2//j92979x7Ej2v/p/OAAPEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAkfXTiR/ez3am8uNni/HniqEXIuJyRFyKiIsR8cc+jsfJPTUvRESp2N/v/BN/W8OPpcgqjOacKrazEbFYbA+fP+xvAQAAAJ5e9+7fubu7tX7rUSZ/Of71cFiO7TdY/GhzelwXyX7yeWZc1S5kxbbHVO3iTsmxuBQRJ6Z+GVO1y6N/oHOfj6naf3J8T5zeFaU89n1gAACAJ9veTmBs3RsAAACPna8nvQAmI3tfW/xf/OJd8Kk8iheCZ/YcAQAAAE+g0qQXAAAAABy6rP/39/8AAADg6Xbv/p27k14DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH+yc++4aQRxHID/QDaQl4IiHlehilJScIgcIWVKW7Jv444zWEKcA3c+ggUWu2PsxVCxLAh/n7TMA/hpQKKYGXYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEv3kE3Hd/Ob20NzlqtX16s94ipi31MAAADA0Syy6TivdIv2t9T/I3X9iohhRAwioh+7p++t+FzK7EVEI9V3vT7bGsN9RJ6wfk87XV8j4k+6nn4e+1sAAACAyzWfjSYRrXU1f/i9qfEBpEWbTlV5+ZLPp6rSennY/4rS+i+RlRhERNZ9rChtGBHN739Tq5bfX6tUdN4UjaJo1jEKAACgXuWZQGWzNwAAAM7Ov1MPgNPI92vTf/HTXnC7KNKG4JdSCwAAADhf23fbbzTqHQcAAABwAvn8/935f2lVwPl/AAAAcBmK8/8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4pkU2Hc9no8mhOcvVYar5NAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADP7M85CoUwGIXRmzfqnoL7X5ZciK2tzTmQn48MRQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7oy18rri3Tg6xrrz7ZhJft1t/PugsfW4sSf5zCd/AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ/tzdoIhEARhsP/DCwxpMf+wpEFjEKEKFj52mIcBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4K0+18v3jl/jSPLvb2NKso8kc0eNpaPG2oXG1oXx9DUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCyAwcCAAAAAED+r41QVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVhR04EAAAAAAA8n9thKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqirswIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgo7cCAAAAAAAOT/2ghVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV2IEDAQAAAAAg/9dGqKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsIOHAgAAAAAAPm/NkJVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVUVduBAAAAAAADI/7URqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqrADBwIAAAAAQP6vjVBVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWF/bk3USAI4zj87t4ddwsX3ZVgvvhRg4mRaAl+gLCwNViADZkYmS42oi0o6AhmRrKBz5P8/sMkMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAezo/uf99PHxERB75aP1//IyIr8g3TTP8vs5sezrUP7c53e3Haf7FpFNERBHZaz8CANCS8t40lqtq0U3tpfZTB6nlrK7mbT4aAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAu7NyxalNRGADgk6SJVidHK4jgoIuNTaxGyOJQ6C4IuoU2lmKqkmZoS5c+gejk6ivYTV/BFxActODg0EHBRRAlyU16gkFShHtD/T747/1zh3PPyRD4739uAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4lsO9cHaQ50IIczNHedf7r7sr485vn32YG8SXO28uxmN2hyiGEB6ut5rXU1zLtNvc3nnUaLWabYlEIhkmWf8yAQBw0hST6Nb1n4r7y91ruXoIv16N1v9Xojz8pf7//PL8hUH83HrXie8V1/8Lqa1w+pU7G0/Lm9s719Y3GmvNtebjarWyeHPxxu1blXLvWUnZExMAAAD+TSmJuP7P1//s/5+J8jBh/X9v6cH9+F4F9f9YR02/rGcCAADwfzt36fu33JjruVIpbDU6nfZC/zj8XOkfM5jqsZ1KIq7/C/WsZwUAAACk4XAvN9L/X43yMGH/f/717kE8ZiGEMJv0/+dXnrRW01vOVEvjdeKs1wgAAEC2ZpOI+//F3v7//HDLQz6EcPVyP0/+BnCi+v/ji7sjL63H+/+r6S1xKuVr/e+jd66FMFPLekYAAACcZKeT6Bb7B8X95faP50sl+/8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgN/s2DFKA0EUBuDNblYrMWClVl5AtLMKWAhi4yFEQfAEIogHEFtL72DpHVIr2FhYpvAG8mZ3VNIELHaVfB9M3iMMmZdJk38BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYa7r/3VfxMmr6sn3v+ePqJOrLTA3v9+ubsaIfdDn0PzTY63sCAAAAFkGV831RFG/142HUcpzyf533ROZ/WGn6nOdnc3+uT3evGzn/Xx9vXX4dNGrOiQ89O7843ensG/59q3N3DNPNp2cvVfpByqObtWmd7nNwO5kcLKV2uYtpAYDf2M61bfL/oai7fQ4GwMIYtqv4kf+rcb8zAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHThMwAA//8P+F2Y")
r0 = syz_open_procfs(0x0, &(0x7f00000112c0)='mountinfo\x00')
lseek(r0, 0x10001, 0x0)

2.200301004s ago: executing program 3 (id=483):
syz_mount_image$nilfs2(&(0x7f0000000b80), &(0x7f0000000040)='./file2\x00', 0x3200400, &(0x7f0000003140)=ANY=[], 0x3, 0xa76, &(0x7f00000000c0)="$eJzs3U2MG1cBAOA33vUmmwTilIQuSWgTftry091ms4SfCJqquRA1FbdKEZcoTUtEGhCpBK0qkeTEjVZVuPIjTuVQAUJqLyjqiUslGolLxaFw4EAUpEocoJC4iv2e136xNfb+2V5/n/T89s0bz3szOx6PZ+a9F4CJVWm8Li3NFSFcffPV4/984B+zd6Y82pqj1nidbktVQwhFTE9ny3tvqhnfev+lM93iIiw2XlM6PHmz9d7tIYRL4UC4Fmph79Xrr7y9+MTJyyeuHHzntaM31mftAQBgsnzr2tGlPX/7875dH7x+37GwpTU9nZ/XYnpHPO8/Fk/80/l/JXSmi7bQbiabbzqGSjbfVJf52supZvNN9yh/JltutZW/r2O+LSXlT7VN67beMM7SflwLRWW+I12pzM83f5OHxu/6mWL+wrnzz1wcUkWBNffv+0MIB4RBQ71e/3FjA45AXdY/3KgPvw7CeoT6zmEfgQCa8vuFd7mUX1lYndbSpvsr/+Zjle7vhzWw0fu/8ser/F9fjuWf+uu61oPJsFm/v9J6pc/RjpjO7yPkzy8N+vlPy5uKL9PZ8sv0uo8wLvcXetVzaoPrsVK96p/vF5vV12OctsM3svz2z0/+Px2X/zHQ3X8m7Pr/gRGow6YO1RGog9B3qA/7AASMrOXn5prqUcrPn+vL87eU5G8tyZ8tyd9Wkr+9JB8m2e+f/2l4uVj+nZ//ph/0eli6zvaRGH90wPrk1yMHLT9/7ndQqy0/f54YRtkbp586+5WnT11vPv9ftPb/23F/PxDTtfjZuhZnSNcL8+vqrWf/a53lVHrMd09Wn3TcqGxJ89ebJe7unK/Yvbyc0Hacuasec53v29lrvv2d89Wy+WZj2JrVNz8/2Za9L51/pONq2l7T2fpWs/WYyeqRjiu7YpzXA1Yi7Y+9nv9P++dcqBbPnDt/9pGYTvvpn6aqW+5MP9S+0N9sTN2B1em3/c9c6Gz/s6M1vVppPy7sXJ5etB8Xatn0xWaydZs8TT8c0+l77jtTs43p82e+d/7ptV55mHAXX3jxu6fPnz/7A3+kP2ZtFn/4Y9hHJmC9LTz/3PcXLr7w4sPnnjv97Nlnz144fOTI4cXFI189vLTQOK9faD+7BzaT5S/9YdcEAAAAAAAAAAAA6NcPTxy//pe3vvxus/3/cvu/1P4/Pfmb2v//JGv/n7eTT+3gUzvAXV3yG+PuvdFZj5lsvmoMH8vquzsrZ0/2vo/HuDWOX2z/n9rb5/26pvrcm03P++9N82XdCdzVX8pM1gdJPl7gp2J8Jca/CjBExWz3yTHu6N863N2/ddrXU/8U+qUYT+n/lvaG1I9Jav/dq1+ndPzftQF1ZO1tRHPCYa8j0N2/Rr7/77Yz8aHXZQKC7TxRoV43igcwGoY9/me67pniC3/85tY7Ic1287HO42XefymsxqiPP6n8URj/s1izSrTGv+vr+Neld/WOfp77H13hvz+/8W5bsWFvv8ffy9mqp36gd5eX2e6DWH5a/wdDf+XXf5mVn98Q6tP/svK39Vn+Xeu/f2Xl/z+WnzbbQ5/ut/xmjYtKZz3y68bp/l9+3Ti5la1/6ttz4PVf4UCNt2P5MMl6jzPb7wi2o2ko4/92uT+6UvlzGF+K6XQgTM855N/Ig9Y/PV+Rvgf2ZMsvSr7fxmWc4l4mffzfr8W47POQxv9N+2OtS7rSlq522bbjvq/AZvPeyN//G7NwaQTqIIxomB2BOnSGer2+vhe0Sgy1cIa+/Yd993nY5Q97+5fJx//Nz+Hz8X8r2Q+IfPzf/P35+L95fj6+Xp6fj/+bb898/N88/95sufkV7LmS/E+U5O8tyd+3nD/bLX9/yfs/WZJ/MMRzkh7595W8//6S/HtK8qdK8j9Tkv/ZkvwHSvIfKsn/XEn+Zpfao0zq+sMky9vn+fzD5Ej3f3p9/neX5APj62evH3r81O++XWu2/59p/V5L9/GOxXQ1/nb+UUzn971DW/pO3lsx/fcsf9Svd8AkyfvPyL/fHyzJB8ZXes7L5xsmUNG9x55++63qdZ7PePl8jL8Q4y/G+OEYz8d4IcaHYry4QfVjfTz+2z8cfblY/r2/M8vv93nyvD1Q3k/U4T7rk18fGPR59rwfv0GttvwVNgcDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYmkrjdWlprgjh6puvHn/q5LmFO1Mebc1Ra7xOt6WqrfeF8EiMp2L8i/jHrfdfOtMe345xERZDEYrW9PDkzVZJ20MIl8KBcC3Uwt6r1195e/GJk5dPXDn4zmtHb6zfFgAAAIDN78MAAAD//+bcHCE=")
openat(0xffffffffffffff9c, &(0x7f0000000b40)='./file1\x00', 0xc042, 0x1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000c80)='./file1\x00', 0xc042, 0x1)
fcntl$setlease(r0, 0x400, 0x1)
unlink(&(0x7f0000000cc0)='./file1\x00')

2.088073135s ago: executing program 0 (id=484):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys_sec\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys_sec\x00', &(0x7f0000000080)='securityfs\x00', 0x0, 0x0)
syz_mount_image$cramfs(&(0x7f0000000140), &(0x7f0000000180)='./file0\x00', 0x0, &(0x7f00000001c0)=ANY=[], 0x1, 0x14a, &(0x7f0000000200)="$eJzs0DFLOmEAx/Hf/c+/VGgWGViQCQ1JYp4n1tSgkSRkB4VLk2AXBIqRUI5KtDUErQ6W0CS+BctaLIWwN9HiFjgWd6cchi/h95nu+T7Hb3h2tjpeeIC+A7rtnGB8wHOgJGKHX41GRDtZAUzo99mzczWfV4+Nv54iGCr2SoCWX+zAyWlGXU/nMtq5F8FwVO+S1krAFICo02jBQfOuAM15o8ljWmjQFi1A1GHu/dwDq9rerLn3DaBQ9tVrb/vtVty/9rgk4jruW54TRrtbvZFjC1WbS0RSfX1AVL//DLT8H4F6rdtpJ/aUhNIJyfJGSApKUrirvLfj4eItLLu2C+Doz54VLrclCVwJwJ1+13sW7ACalb6Snd6sDB/sUvQAQqGcTrn+V1POmX8QveZTjZgcW4mIiIiIiIiIiIiIiIiIiAy/AQAA///PFGIf")
mount(0x0, &(0x7f0000000380)='.\x00', 0x0, 0x2200020, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0)

1.924938592s ago: executing program 1 (id=485):
setns(0xc9, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x44001}, 0x4040850)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a48000000030a010200000000000000000a0000050900030093797a30000000000900010073797a3100000000080007006e617400140004800800024054dd5e54080001400000000014000000110001"], 0x70}}, 0x24044850)
close(r0)

1.861756068s ago: executing program 0 (id=486):
syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = eventfd(0x0)
io_setup(0xc, &(0x7f0000000140)=<r1=>0x0)
io_submit(r1, 0x2, &(0x7f0000000040)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0xc2, r0, &(0x7f0000000180)='\x00\x00\x00a\x00\x00\x00\x00', 0x8, 0x34}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x7, 0xffff, r0, 0x0, 0x0, 0x0, 0x0, 0x1, r0}])
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)

1.454211861s ago: executing program 1 (id=487):
r0 = socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0xe62}, 0x1c)
setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000080)=0xc59, 0x4)
recvmmsg(r0, &(0x7f0000004780)=[{{0x0, 0x0, 0x0}, 0x8000}], 0x1, 0x2, 0x0)
sendto$inet6(r0, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c)

1.314635215s ago: executing program 3 (id=488):
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
recvmsg(r1, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x2020)
r2 = openat(0xffffffffffffff9c, &(0x7f0000006540)='./file0\x00', 0x40042, 0x1)
mount$9p_fd(0x0, &(0x7f00000065c0)='./file0\x00', &(0x7f0000006600), 0x84, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}})
close_range(r0, 0xffffffffffffffff, 0x0)

1.146676172s ago: executing program 1 (id=489):
mmap$IORING_OFF_SQ_RING(0x0, 0xc00003, 0x3000007, 0x401d032, 0xffffffffffffffff, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
bind$inet6(r0, &(0x7f00000005c0)={0xa, 0x4e20, 0xffffffff, @empty, 0x5}, 0x1c)
recvfrom$inet6(r0, 0x0, 0x50, 0x0, &(0x7f0000000600)={0xa, 0x4e21, 0x8, @mcast1, 0x8}, 0x1c)
syz_emit_ethernet(0x6a, &(0x7f0000000640)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x48, 0x0, @wg=@cookie={0x3, 0x1, "280f43c5c060e8e110a0be848bfd416d2749409a365e7cc4", "94c66d507be164154f50b01b32a5e29d3202afc396737f47d7036e13fb67ef9f"}}}}}}, 0x0)

820.115976ms ago: executing program 0 (id=490):
openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000044882, 0x0)
r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001780), 0x4000000004002, 0x0)
r1 = dup(r0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r1, 0x2000)
move_pages(0x0, 0x1efe, &(0x7f0000000180), 0x0, &(0x7f00000001c0), 0x0)

819.863896ms ago: executing program 1 (id=491):
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x74, 0xa3, &(0x7f0000000000))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)

781.71581ms ago: executing program 3 (id=492):
syz_open_dev$mouse(&(0x7f0000000180), 0x0, 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000006000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000006000)='./sys\x00', &(0x7f0000006100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004100)='./sys/bus/serio/devices/serio1/protocol\x00', 0x1, 0x0)
write(r0, &(0x7f0000005000)='synaptics-smbus', 0xf)

618.699256ms ago: executing program 2 (id=493):
r0 = socket$nl_route(0x10, 0x3, 0x0)
mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x32, 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_to_bridge\x00', <r1=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x48, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40004}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000c00)=@newtclass={0x464, 0x28, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x1, 0xfff1}, {0x1, 0xfff1}}, [@tclass_kind_options=@c_htb={{0x8}, {0x438, 0x2, [@TCA_HTB_CTAB={0x404, 0x3, [0x8, 0xd, 0x1c0000, 0x2, 0x81, 0x2, 0x1, 0x1ff, 0x81, 0x8, 0x8, 0x100, 0x8, 0xf, 0x3, 0xdbd4, 0xfffffff8, 0xd37, 0x1, 0x5, 0x9, 0x804, 0x5, 0x3, 0x800, 0x8, 0xb43, 0x7, 0x7, 0xfffffffc, 0xffffff4e, 0x1, 0x9, 0x1, 0x81, 0x7ff, 0x4, 0x3, 0xfffffeff, 0x8, 0x4, 0x10, 0x3, 0x9, 0xfffffff7, 0x5, 0x8, 0x6, 0x0, 0xd3e, 0x2d, 0x276, 0x9, 0x4, 0x748, 0x7f, 0x9, 0xffffffff, 0x8, 0x7, 0x4, 0xfffffffb, 0x56, 0x9, 0xdf, 0x1ff, 0xc7, 0x8, 0xff, 0x0, 0x3, 0x2, 0x400, 0x7, 0xfff, 0x101, 0x1, 0xc0000, 0x5, 0xffff, 0x6, 0x7fffffff, 0x3, 0x477, 0x9, 0x4, 0xbe, 0x100, 0x0, 0x6, 0x1, 0x7, 0xe, 0x3, 0x9, 0x4, 0x9000000, 0x8, 0xd, 0xee11, 0x6, 0x6, 0x405, 0x4, 0x5, 0xc, 0x80, 0xffffffff, 0x1, 0x0, 0x3, 0x1, 0x8, 0x401, 0x6, 0xbdd, 0x3, 0x2, 0xd, 0x100, 0x5, 0xfffffffc, 0x200, 0x3, 0xe4f6, 0x7f, 0x3, 0x7, 0x5, 0x80, 0x100, 0x5a6, 0x7, 0x4, 0xeebe, 0x47ac1a21, 0xff, 0x5, 0x9, 0x1ff, 0x101, 0x19, 0x8, 0x6, 0xfff, 0x9, 0x2, 0x100, 0x2, 0x2, 0x8, 0xfff, 0x7fff, 0x2, 0x0, 0x1, 0x1ff, 0x2, 0xffffffff, 0x3039, 0x1, 0x2, 0x5a, 0x0, 0x7, 0x7, 0x9, 0x5, 0xfffffb5b, 0x101, 0x3, 0x485, 0xfffffeff, 0x400, 0x5, 0x7, 0x200, 0x585, 0xfffffffd, 0x0, 0xa, 0x1, 0x6, 0x7fff, 0x9000, 0xb, 0x917, 0xfffff000, 0x505, 0x8, 0x5, 0xfffffffc, 0xb, 0xfffff70f, 0x80000001, 0x4, 0x3355d8d5, 0x1, 0x81, 0x7fff, 0xfffffffd, 0xb5d, 0x7, 0x7, 0x600, 0x791f, 0x3, 0x1, 0x6, 0x1ff, 0x1000, 0x8, 0x1000, 0x72e, 0x100, 0x0, 0x25, 0xfffffffb, 0x7, 0xff, 0x0, 0x7, 0xfff, 0x401, 0xffffffff, 0x81, 0x3, 0x1, 0x8, 0x7, 0x8cc0, 0x1, 0xffff, 0x7, 0x2, 0xfffffff4, 0x8000, 0x9, 0x5, 0x1, 0x100, 0x350, 0x3, 0x7d84, 0xf75, 0x78e, 0xfff, 0x2e, 0x20000000, 0x2, 0xc, 0x5, 0x5, 0x2, 0x5, 0x9]}, @TCA_HTB_PARMS={0x30, 0x1, {{0x9, 0x1, 0x0, 0x3f1, 0x2, 0x5}, {0x8, 0x0, 0x8, 0x7b, 0x7ff, 0x4}, 0x4, 0x7, 0xffff, 0x8, 0x644}}]}}]}, 0x464}}, 0x0)

380.075911ms ago: executing program 0 (id=494):
r0 = syz_usb_connect(0x0, 0x32, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000200000040a61b01000100000000010902200001010080320904"], 0x0)
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
syz_usb_control_io(r0, 0x0, 0x0)
syz_open_dev$dvb_frontend(&(0x7f0000000100), 0x1, 0x802)
close(0x3)

379.777471ms ago: executing program 3 (id=495):
r0 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ipvlan0\x00', <r1=>0x0})
r2 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0xfffc, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x48004}, 0x20000000)
sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffbffff, {0x0, 0x0, 0x0, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0x8, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xff}]}]}, @TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x2}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040000)

269.146323ms ago: executing program 3 (id=496):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_ublk_setup_io_uring(0x20, &(0x7f00000014c0)={0x0, 0x1000000, 0x3900, 0x0, 0x1e9}, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0, &(0x7f0000000000)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r0, 0x0, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0, 0x40002102, 0x1, {0x3}})
syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@any_dev={0x4, 0xd74, 0x0, 0x0, 0x1000, 0x80000001, 0x0, 0x0, 0x10}}}, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0)

56.777814ms ago: executing program 2 (id=497):
r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a0000904000001030101000921080800012201000905810377"], 0x0)
syz_usb_disconnect(r0)
r1 = syz_usb_connect$uac1(0x0, 0x72, &(0x7f0000000b80)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x582, 0x4d, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x1, 0xb0, 0xff, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x6a, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0x8, 0x5, 0x4, {0x7, 0x25, 0x1, 0xc, 0x1, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x3, 0x4, 0x2, {0x7, 0x25, 0x1, 0x8, 0x9, 0x5}}}}}}}}]}}, 0x0)
syz_usb_control_io(r1, &(0x7f00000014c0)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000001440)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7, 0x2, 0x5, 0x1f, "bd911c60", "0501eac6"}}, 0x0}, 0x0)
syz_usb_control_io$printer(r1, 0x0, &(0x7f00000020c0)={0x34, 0x0, 0x0, 0x0, &(0x7f0000001f40)={0x20, 0x0, 0x5, {0x3, "35b349"}}, 0x0, 0x0})

0s ago: executing program 3 (id=498):
syz_mount_image$iso9660(&(0x7f0000000000), &(0x7f0000000800)='./file0\x00', 0x2204806, &(0x7f0000000540)=ANY=[@ANYBLOB="636865636b3d7374726963742c636865636b3d72656c61786564006d6f64653d3078303030303030303030303030303030312c6d61703d6f66662c73657373696f6e3d3078303030303030303030303030303036322c696f636861727365741636bd27bceeb671e4844b3d6d6163677265656b416d61703d61636f726e2c696f636861727365743d69736f383835392d322c73657373696f6e3d3078303030303030303030303030303035382c73686f776173736f632c6d6f64653d3078666666666666666666666666666666652c636865636b3d7374726963742c6673636f6e746578743d73797374656d5f752c7065726d6974"], 0xfa, 0x69f, &(0x7f0000000f00)="$eJzs3c9v2+Ydx/EP5V+yOwTFNhRBkB9PkhVwsEyR5MaBkQEtR1E2N0kUSHmwgQFF1thFEDndkg5YfOl82Q+gA3berZcddts/MKDn/he7bUCx3QZsBw4kRVmyRMlqHLdZ3y8jEUV++Txfkgq/oSU+EgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkOXUyuWKpYbX2t4x+Zxa4DcnLE9bW9CtdOLW1H4lK/6jYlEX01kXv328+I34rxu6nD67rGL8UNTha2+8fv9b84Vs/QkJfRGatcFnzw8fP+h2956eInZOMzf/ZVLhFEGbbssLfa9pb7rGC32zsb5evrNVD03da7jhbthxm8YJ3ELHD8yqc8tUNjbWjFva9bdbmzW74WYz732vWi6vmx8upQdaUil0trxGw2ttJjHx4jjmnvn4J2mAazeN2X/U3VublmQcVMlbWBgIqk5rqVquViuVarWyfnfj7r1yeX5kRjlmlfs0EnHmL1q8Ys7u5A28oEJc//9mSQ0V1dK2dmTG/jiqKZCvZs7ynqz+v3nHndjvYP3PqvxF6e3e4ktK6v/V9NnVvPqfk4uRSVYYt8TKmT/bz0KSkdEzPdehHuuBuupqT0/PoG0jc+1MWjmHn025aslTKF+emrKTOaY3x2hD61pXWe9qS3WFMqrLU0OuQu0qVEdu8opyFMiVrY58BTJalaNbMqpoQxtak5Grknbla1stbaomW/+Oomhfj5L9vjYhR2VBlZyApcGg6oSW8ur/Tz9KX6e9+l+m/n9dpa+DpfThs0kxwFdA1Lv+n9G1l5MNAAAAAAB4Gazkt+9W8t79FUmR6l7DLeevsHie2QEAAAAAgLNgKVrSZVnx9b+kK7KmXP8DAAAAAIBXjpXcY2dJWkk+1G8d3wl1ml8CzJ1DigAAAAAA4AUld/5fXZSiZNCKa7Jmuv4HAAAAAACvgN8OjLE/n42xG2Vv6xckhe0l66//XFKwYB21d75jHdjxEvtgrpCEjHwCoFO/ZIV/SAfqTcbrXZSUPHPcy1avt94gmP1xBz/fnzbWvxWcSGBxbrCBEwlc6K1txT2vz/ee6WNdf3so9uFhQcmStJeVutdwS47fuF+RbV8odNydzi+ePPqlFPS3c/9Rd6/03gfdh0kuR/Gso4M4j4+ydP6y2Nt1w7kkD/1c/hulpCtjt3hZ9azL37WaK1bSbznb/jnZB4XjY5S7/cN96te6kR6zGytp7Mphf8T9ePuL8fZXSskhG9r6YME6zqJycsvHHYicLIpJFjfTmJurN9OHLL+4nYJV/O6cVC2NHoOhLKqDWUzfF9a/RvbFpCx6+2ItzuLTuKGcLNZmy2LkiADAl2U/GfUnufMvGcR8pO5m5SE7qX2hujO9ur8zXN0//GNcGdP/Xsz33puY2EtR8Rl91Urq0KKSE+v8pZEzerY19oWics7o5ReobnFffz7+DqRe2iNZ/CeKovuVpN/fn6iqn8QrfJLbb9hId/udDw9+lgyAH3t/7/29J9Xq2nr5rXL5blULyWb0HuZE7QEAjJj+HTtTI6y3dD2NuP7wH2+mU0MV75v9jxSU9J4+UFcPtZB9hcC18a2uDHwM4XZ61aqBq1bzxuv3l6WTsRXdzr2qS2rpQGy1H7ugbJXhSn0cu/aSjwIAAOfrxpQ6PL7+F4fq/22tphGrl8Zedw/X8t7Vcf+SPi+2Mj35d856bwAA8PXgBp9bK53fWEHgtd+tbGxU7M6WawLf+ZEJvNqma7xWxw2cLbu16Zp24Hd8x2+YdqAlr+aGJtxut/2gY+p+YNp+6O0k3/xuel/9HrpNu9XxnLDdcO3QNY7f6thOx9S80DHt7R80vHDLDZKVw7breHXPsTue3zKhvx04bsmY0HUHAr2a2+p4dS+ebJl24DXtYNf82G9sN11Tc0Mn8NodP20w68tr1f2gmTRbUjTzFx0CAPD/6Nnzw8cPut29pycnluNL83TOkXJiRicWxzTIGEEAAHzFHJfrGVYq9qc+jV5KVgAAAAAAAAAAAAAAAAAAAAAAYND0W/pmnFgYd7Og1J/z8wu9OfqVjm8xHGnH0lknNstEYda1slsiDh9/NiF4uT8n2/2DMUfntoF//4b0WjJH6Zz5ccHF/Has6X0tTzi4p5yYi3fQaYO/v5/u0dyYeOHYRUv9YzF/9v8c4oknf8pZFEVRNHn1peF9uDhpA4cn5iU9XXyBQ3D+5yIA5+t/AQAA//+xxzz3")
quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f0000000180)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='memory.events\x00', 0x275a, 0x0)
ioctl$BLKFLSBUF(r0, 0x1261, 0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.1.4' (ED25519) to the list of known hosts.
[   84.752854][ T5775] cgroup: Unknown subsys name 'net'
[   84.887211][ T5775] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   86.595528][ T5775] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   88.810964][ T5798] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   88.822727][ T5798] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   88.848925][ T5798] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   88.856865][ T5798] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   88.866432][ T5798] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   88.874954][ T5798] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   88.877116][ T5800] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   88.889903][ T5798] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   88.897914][ T5803] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   88.898482][ T5801] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   88.909059][ T5803] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   88.919135][ T5801] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   88.926467][ T5800] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   88.933491][ T5803] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[   88.934890][ T5803] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   88.945155][ T5800] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   88.956212][ T5793] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   88.963606][ T5793] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   88.971753][ T5800] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   88.986445][ T5793] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[   88.993892][ T5800] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   88.994256][ T5793] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   89.012324][ T5796] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[   89.020004][ T5796] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   89.112559][ T5787] (null): rxe_set_mtu: Set mtu to 1024
[   89.121213][ T5788] (null): rxe_set_mtu: Set mtu to 1024
[   89.127617][ T5788] rxe_eth0 speed is unknown, defaulting to 1000
[   89.142328][ T5787] rdma_rxe: rxe_newlink: failed to add rxe_eth0
[   89.153834][ T5786] (null): rxe_set_mtu: Set mtu to 1024
[   89.161070][ T5786] rdma_rxe: rxe_newlink: failed to add rxe_eth0
[   89.172086][ T5788] rxe_eth0 speed is unknown, defaulting to 1000
[   89.194555][ T5788] rxe_eth0 speed is unknown, defaulting to 1000
[   89.206683][ T5789] (null): rxe_set_mtu: Set mtu to 1024
[   89.229324][ T5789] rdma_rxe: rxe_newlink: failed to add rxe_eth0
[   89.525754][ T5788] infiniband rxe0: set active
[   89.534961][   T27] rxe_eth0 speed is unknown, defaulting to 1000
[   89.542379][ T5788] infiniband rxe0: added rxe_eth0
[   89.634938][ T5788] RDS/IB: rxe0: added
[   89.643121][ T5788] smc: adding ib device rxe0 with port count 1
[   89.650808][ T5788] smc:    ib device rxe0 port 1 has pnetid 
[   89.671508][   T27] rxe_eth0 speed is unknown, defaulting to 1000
[   89.708449][ T5788] rxe_eth0 speed is unknown, defaulting to 1000
[   89.794590][ T5787] chnl_net:caif_netlink_parms(): no params data found
[   89.824665][ T5789] chnl_net:caif_netlink_parms(): no params data found
[   89.949017][ T5786] chnl_net:caif_netlink_parms(): no params data found
[   90.116905][ T5788] rxe_eth0 speed is unknown, defaulting to 1000
[   90.185459][ T5787] bridge0: port 1(bridge_slave_0) entered blocking state
[   90.201979][ T5787] bridge0: port 1(bridge_slave_0) entered disabled state
[   90.222356][ T5787] bridge_slave_0: entered allmulticast mode
[   90.240231][ T5787] bridge_slave_0: entered promiscuous mode
[   90.290734][ T5787] bridge0: port 2(bridge_slave_1) entered blocking state
[   90.298079][ T5787] bridge0: port 2(bridge_slave_1) entered disabled state
[   90.318867][ T5787] bridge_slave_1: entered allmulticast mode
[   90.326455][ T5787] bridge_slave_1: entered promiscuous mode
[   90.491270][ T5787] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   90.503059][ T5789] bridge0: port 1(bridge_slave_0) entered blocking state
[   90.511290][ T5789] bridge0: port 1(bridge_slave_0) entered disabled state
[   90.518898][ T5789] bridge_slave_0: entered allmulticast mode
[   90.526382][ T5789] bridge_slave_0: entered promiscuous mode
[   90.579213][ T5787] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   90.591971][ T5788] rxe_eth0 speed is unknown, defaulting to 1000
[   90.601646][ T5789] bridge0: port 2(bridge_slave_1) entered blocking state
[   90.612878][ T5789] bridge0: port 2(bridge_slave_1) entered disabled state
[   90.620367][ T5789] bridge_slave_1: entered allmulticast mode
[   90.628118][ T5789] bridge_slave_1: entered promiscuous mode
[   90.665152][ T5786] bridge0: port 1(bridge_slave_0) entered blocking state
[   90.682145][ T5786] bridge0: port 1(bridge_slave_0) entered disabled state
[   90.698638][ T5786] bridge_slave_0: entered allmulticast mode
[   90.706181][ T5786] bridge_slave_0: entered promiscuous mode
[   90.726667][ T5786] bridge0: port 2(bridge_slave_1) entered blocking state
[   90.737603][ T5786] bridge0: port 2(bridge_slave_1) entered disabled state
[   90.745837][ T5786] bridge_slave_1: entered allmulticast mode
[   90.757365][ T5786] bridge_slave_1: entered promiscuous mode
[   90.854251][ T5789] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   90.890723][ T5787] team0: Port device team_slave_0 added
[   90.928606][ T5786] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   90.943487][ T5786] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   90.962665][ T5789] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   91.002016][ T5787] team0: Port device team_slave_1 added
[   91.026267][ T5796] Bluetooth: hci2: command tx timeout
[   91.097682][ T5789] team0: Port device team_slave_0 added
[   91.103745][ T5796] Bluetooth: hci1: command tx timeout
[   91.103945][ T5796] Bluetooth: hci3: command tx timeout
[   91.116107][ T5796] Bluetooth: hci0: command tx timeout
[   91.133817][ T5787] batman_adv: batadv0: Adding interface: batadv_slave_0
[   91.141245][ T5787] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   91.178740][ T5787] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   91.193635][ T5788] rxe_eth0 speed is unknown, defaulting to 1000
[   91.222716][ T5786] team0: Port device team_slave_0 added
[   91.244021][ T5786] team0: Port device team_slave_1 added
[   91.252263][ T5789] team0: Port device team_slave_1 added
[   91.304456][ T5787] batman_adv: batadv0: Adding interface: batadv_slave_1
[   91.319461][ T5787] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   91.368405][ T5787] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   91.459909][ T5789] batman_adv: batadv0: Adding interface: batadv_slave_0
[   91.466953][ T5789] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   91.499544][ T5789] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   91.541530][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_0
[   91.552839][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   91.583301][ T5786] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   91.595392][ T5789] batman_adv: batadv0: Adding interface: batadv_slave_1
[   91.602490][ T5789] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   91.628915][ T5789] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   91.652096][   T27] rxe_eth0 speed is unknown, defaulting to 1000
[   91.692526][ T5786] batman_adv: batadv0: Adding interface: batadv_slave_1
[   91.699844][ T5786] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   91.731544][ T5786] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   91.828707][ T5789] hsr_slave_0: entered promiscuous mode
[   91.835817][ T5789] hsr_slave_1: entered promiscuous mode
[   91.885483][ T5787] hsr_slave_0: entered promiscuous mode
[   91.892586][ T5787] hsr_slave_1: entered promiscuous mode
[   91.903713][ T5787] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   91.912403][ T5787] Cannot create hsr debugfs directory
[   92.065225][ T5786] hsr_slave_0: entered promiscuous mode
[   92.077905][ T5786] hsr_slave_1: entered promiscuous mode
[   92.089946][ T5786] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   92.097613][ T5786] Cannot create hsr debugfs directory
[   92.463901][ T5788] chnl_net:caif_netlink_parms(): no params data found
[   92.530846][ T5450] infiniband rxe0: set active
[   92.587508][   T27] rxe_eth0 speed is unknown, defaulting to 1000
[   92.648608][ T5788] bridge0: port 1(bridge_slave_0) entered blocking state
[   92.655885][ T5788] bridge0: port 1(bridge_slave_0) entered disabled state
[   92.664116][ T5788] bridge_slave_0: entered allmulticast mode
[   92.673599][ T5788] bridge_slave_0: entered promiscuous mode
[   92.702582][ T5788] bridge0: port 2(bridge_slave_1) entered blocking state
[   92.710063][ T5788] bridge0: port 2(bridge_slave_1) entered disabled state
[   92.717293][ T5788] bridge_slave_1: entered allmulticast mode
[   92.724914][ T5788] bridge_slave_1: entered promiscuous mode
[   92.767773][ T5787] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   92.782065][ T5787] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   92.818023][ T5788] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   92.831449][ T5787] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   92.869169][ T5788] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   92.881302][ T5787] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   92.951294][ T5788] team0: Port device team_slave_0 added
[   92.976870][ T5789] netdevsim netdevsim3 netdevsim0: renamed from eth0
[   92.993127][ T5788] team0: Port device team_slave_1 added
[   93.024742][ T5788] batman_adv: batadv0: Adding interface: batadv_slave_0
[   93.031950][ T5788] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   93.062156][ T5788] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   93.073771][ T5789] netdevsim netdevsim3 netdevsim1: renamed from eth1
[   93.085326][ T5789] netdevsim netdevsim3 netdevsim2: renamed from eth2
[   93.097888][ T5788] batman_adv: batadv0: Adding interface: batadv_slave_1
[   93.106163][ T5788] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   93.108839][ T5796] Bluetooth: hci2: command tx timeout
[   93.138460][ T5788] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   93.165331][ T5789] netdevsim netdevsim3 netdevsim3: renamed from eth3
[   93.179464][ T5796] Bluetooth: hci3: command tx timeout
[   93.179491][   T53] Bluetooth: hci0: command tx timeout
[   93.184970][ T5796] Bluetooth: hci1: command tx timeout
[   93.271807][ T5788] hsr_slave_0: entered promiscuous mode
[   93.281930][ T5788] hsr_slave_1: entered promiscuous mode
[   93.291113][ T5788] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   93.298963][ T5788] Cannot create hsr debugfs directory
[   93.319521][ T5786] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   93.332712][ T5786] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   93.353803][ T5786] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   93.384445][ T5786] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   93.632110][ T5787] 8021q: adding VLAN 0 to HW filter on device bond0
[   93.721235][ T5787] 8021q: adding VLAN 0 to HW filter on device team0
[   93.733687][ T5788] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   93.745501][ T5788] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   93.770574][ T5788] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   93.785716][ T1086] bridge0: port 1(bridge_slave_0) entered blocking state
[   93.793177][ T1086] bridge0: port 1(bridge_slave_0) entered forwarding state
[   93.816640][ T5789] 8021q: adding VLAN 0 to HW filter on device bond0
[   93.826041][ T5788] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   93.842990][ T1086] bridge0: port 2(bridge_slave_1) entered blocking state
[   93.850274][ T1086] bridge0: port 2(bridge_slave_1) entered forwarding state
[   93.934502][ T5786] 8021q: adding VLAN 0 to HW filter on device bond0
[   93.963416][ T5789] 8021q: adding VLAN 0 to HW filter on device team0
[   93.996057][ T1086] bridge0: port 1(bridge_slave_0) entered blocking state
[   94.003558][ T1086] bridge0: port 1(bridge_slave_0) entered forwarding state
[   94.047392][ T5786] 8021q: adding VLAN 0 to HW filter on device team0
[   94.062458][   T51] bridge0: port 2(bridge_slave_1) entered blocking state
[   94.069688][   T51] bridge0: port 2(bridge_slave_1) entered forwarding state
[   94.156475][ T1086] bridge0: port 1(bridge_slave_0) entered blocking state
[   94.163727][ T1086] bridge0: port 1(bridge_slave_0) entered forwarding state
[   94.176138][ T1086] bridge0: port 2(bridge_slave_1) entered blocking state
[   94.183436][ T1086] bridge0: port 2(bridge_slave_1) entered forwarding state
[   94.275362][ T5788] 8021q: adding VLAN 0 to HW filter on device bond0
[   94.355056][ T5788] 8021q: adding VLAN 0 to HW filter on device team0
[   94.405988][   T34] bridge0: port 1(bridge_slave_0) entered blocking state
[   94.413410][   T34] bridge0: port 1(bridge_slave_0) entered forwarding state
[   94.460507][   T34] bridge0: port 2(bridge_slave_1) entered blocking state
[   94.468129][   T34] bridge0: port 2(bridge_slave_1) entered forwarding state
[   94.544900][ T5787] 8021q: adding VLAN 0 to HW filter on device batadv0
[   94.744342][ T5787] veth0_vlan: entered promiscuous mode
[   94.762937][ T5787] veth1_vlan: entered promiscuous mode
[   94.901017][ T5787] veth0_macvtap: entered promiscuous mode
[   94.915668][ T5789] 8021q: adding VLAN 0 to HW filter on device batadv0
[   94.927766][ T5787] veth1_macvtap: entered promiscuous mode
[   95.025302][ T5787] batman_adv: batadv0: Interface activated: batadv_slave_0
[   95.047594][ T5787] batman_adv: batadv0: Interface activated: batadv_slave_1
[   95.076799][ T5787] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   95.092672][ T5787] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   95.111938][ T5787] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   95.121281][ T5787] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   95.134886][ T5789] veth0_vlan: entered promiscuous mode
[   95.172844][ T5786] 8021q: adding VLAN 0 to HW filter on device batadv0
[   95.189684][ T5796] Bluetooth: hci2: command tx timeout
[   95.216481][ T5789] veth1_vlan: entered promiscuous mode
[   95.254502][ T5788] 8021q: adding VLAN 0 to HW filter on device batadv0
[   95.262071][ T5796] Bluetooth: hci0: command tx timeout
[   95.262105][ T5796] Bluetooth: hci3: command tx timeout
[   95.269286][ T5796] Bluetooth: hci1: command tx timeout
[   95.390448][   T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   95.403811][ T5789] veth0_macvtap: entered promiscuous mode
[   95.412303][   T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   95.436672][ T5789] veth1_macvtap: entered promiscuous mode
[   95.506618][ T5789] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   95.517693][ T5789] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   95.532710][ T5789] batman_adv: batadv0: Interface activated: batadv_slave_0
[   95.553493][ T5788] veth0_vlan: entered promiscuous mode
[   95.563457][ T5789] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   95.574207][   T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   95.584076][   T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   95.592404][ T5789] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   95.604950][ T5789] batman_adv: batadv0: Interface activated: batadv_slave_1
[   95.615351][ T5786] veth0_vlan: entered promiscuous mode
[   95.646601][ T5788] veth1_vlan: entered promiscuous mode
[   95.675852][ T5789] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   95.687525][ T5789] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   95.702871][ T5789] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   95.712133][ T5789] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   95.726592][ T5786] veth1_vlan: entered promiscuous mode
[   95.817472][ T5787] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   95.859657][ T5786] veth0_macvtap: entered promiscuous mode
[   95.882782][ T5786] veth1_macvtap: entered promiscuous mode
[   95.919922][ T5788] veth0_macvtap: entered promiscuous mode
[   95.952898][ T5788] veth1_macvtap: entered promiscuous mode
[   96.005038][   T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.017399][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   96.033299][   T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   96.041141][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   96.054831][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   96.067868][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   96.084047][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_0
[   96.110689][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   96.125755][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   96.139096][ T5786] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   96.154695][ T5786] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   96.174889][ T5786] batman_adv: batadv0: Interface activated: batadv_slave_1
[   96.203256][ T5786] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   96.213558][ T5786] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   96.224161][ T5786] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   96.233400][ T5786] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   96.251618][ T5788] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   96.264494][ T5788] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   96.278236][ T5788] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   96.289701][ T5788] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   96.301231][ T5788] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   96.313510][ T5788] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   96.331059][ T5788] batman_adv: batadv0: Interface activated: batadv_slave_0
[   96.370291][ T5788] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   96.390784][ T5788] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   96.401189][ T5788] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   96.419612][ T5788] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   96.433792][ T5788] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   96.445350][ T5788] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   96.457808][ T5788] batman_adv: batadv0: Interface activated: batadv_slave_1
[   96.469566][   T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.491525][   T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   96.535252][ T5788] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   96.545859][ T5788] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   96.559530][ T5788] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   96.568679][ T5788] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   96.588580][   T28] audit: type=1800 audit(1793193793.932:2): pid=5911 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.6" name="direction" dev="configfs" ino=6674 res=0 errno=0
[   96.765716][ T3424] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.798389][ T3424] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   96.826077][ T5913] warning: `syz.0.7' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   96.900798][  T749] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.909647][  T749] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   96.968791][ T3424] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   96.976694][ T3424] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   97.106245][ T3424] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   97.143620][ T3424] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   97.170774][ T5919] FAULT_INJECTION: forcing a failure.
[   97.170774][ T5919] name fail_usercopy, interval 1, probability 0, space 0, times 1
[   97.234982][ T5919] CPU: 0 PID: 5919 Comm: syz.0.9 Not tainted syzkaller #0
[   97.242210][ T5919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[   97.252386][ T5919] Call Trace:
[   97.255729][ T5919]  <TASK>
[   97.258718][ T5919]  dump_stack_lvl+0x18c/0x250
[   97.263490][ T5919]  ? show_regs_print_info+0x20/0x20
[   97.268762][ T5919]  ? load_image+0x420/0x420
[   97.273329][ T5919]  ? __might_fault+0xaa/0x120
[   97.278079][ T5919]  ? __lock_acquire+0x7eb0/0x7eb0
[   97.283186][ T5919]  ? __lock_acquire+0x7eb0/0x7eb0
[   97.288277][ T5919]  should_fail_ex+0x394/0x4c0
[   97.293029][ T5919]  set_fd_set+0x3a/0x90
[   97.297261][ T5919]  core_sys_select+0x8c9/0xa80
[   97.302128][ T5919]  ? poll_select_set_timeout+0x150/0x150
[   97.307869][ T5919]  ? sigprocmask+0x190/0x190
[   97.312543][ T5919]  __se_sys_pselect6+0x272/0x340
[   97.317615][ T5919]  ? __x64_sys_pselect6+0xf0/0xf0
[   97.322722][ T5919]  ? __x64_sys_pselect6+0x21/0xf0
[   97.327866][ T5919]  do_syscall_64+0x55/0xb0
[   97.332353][ T5919]  ? clear_bhb_loop+0x40/0x90
[   97.337133][ T5919]  ? clear_bhb_loop+0x40/0x90
[   97.341900][ T5919]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[   97.347876][ T5919] RIP: 0033:0x7f939399f559
[   97.352365][ T5919] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[   97.372073][ T5919] RSP: 002b:00007f93948d4028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e
[   97.380657][ T5919] RAX: ffffffffffffffda RBX: 00007f9393c25fa0 RCX: 00007f939399f559
[   97.388691][ T5919] RDX: 0000200000000c80 RSI: 0000000000000000 RDI: 0000000000000000
[   97.396819][ T5919] RBP: 00007f9393a36b20 R08: 0000200000000d00 R09: 0000200000000d40
[   97.404854][ T5919] R10: 0000200000000cc0 R11: 0000000000000246 R12: 0000000000000000
[   97.412911][ T5919] R13: 00007f9393c26038 R14: 00007f9393c25fa0 R15: 00007ffc86c0e5c8
[   97.420967][ T5919]  </TASK>
[   97.444804][ T5796] Bluetooth: hci2: command tx timeout
[   97.445837][   T53] Bluetooth: hci1: command tx timeout
[   97.452004][ T5796] Bluetooth: hci3: command tx timeout
[   97.458895][ T5793] Bluetooth: hci0: command tx timeout
[   97.471128][    T9] cfg80211: failed to load regulatory.db
[   97.483638][ T5923] syz.1.2[5923]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
[   97.505940][ T5923] loop1: detected capacity change from 0 to 512
[   97.540850][ T5923] EXT4-fs: Ignoring removed bh option
[   97.575547][ T5923] EXT4-fs (loop1): Test dummy encryption mode enabled
[   97.593551][ T5923] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support!
[   97.607776][ T5923] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode
[   97.638929][ T5880] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[   97.681881][ T5923] EXT4-fs (loop1): 1 truncate cleaned up
[   97.700341][ T5923] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[   97.841219][ T5786] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   97.849005][ T5880] usb 4-1: Using ep0 maxpacket: 16
[   97.881024][ T5880] usb 4-1: too many endpoints for config 0 interface 0 altsetting 6: 254, using maximum allowed: 30
[   97.906446][ T5880] usb 4-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 255, changing to 11
[   97.962200][ T5880] usb 4-1: config 0 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 254
[   97.985980][ T5880] usb 4-1: config 0 interface 0 has no altsetting 0
[   98.006439][ T5880] usb 4-1: New USB device found, idVendor=0925, idProduct=8866, bcdDevice= 0.00
[   98.034708][ T5880] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   98.071067][ T5880] usb 4-1: config 0 descriptor??
[   98.265654][ T5944] netlink: 8 bytes leftover after parsing attributes in process `syz.0.16'.
[   98.289787][ T5944] Zero length message leads to an empty skb
[   98.409275][ T5948] capability: warning: `syz.2.19' uses deprecated v2 capabilities in a way that may be insecure
[   98.554576][ T5880] input: HID 0925:8866 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0925:8866.0001/input/input5
[   98.723144][ T5880] smartjoyplus 0003:0925:8866.0001: input,hidraw0: USB HID vd.8b Joystick [HID 0925:8866] on usb-dummy_hcd.3-1/input0
[   98.798553][ T5880] smartjoyplus 0003:0925:8866.0001: no output reports found
[   98.864671][ T5880] usb 4-1: USB disconnect, device number 2
[   99.060449][ T5957] fido_id[5957]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory
[   99.227799][ T5965] loop0: detected capacity change from 0 to 512
[   99.271130][ T5965] EXT4-fs: Ignoring removed nobh option
[   99.303057][ T5965] EXT4-fs: Ignoring removed nomblk_io_submit option
[   99.393603][ T5965] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   99.428547][ T5965] ext4 filesystem being mounted at /11/bus supports timestamps until 2038-01-19 (0x7fffffff)
[   99.449590][ T5971] FAULT_INJECTION: forcing a failure.
[   99.449590][ T5971] name fail_usercopy, interval 1, probability 0, space 0, times 0
[   99.495345][ T5971] CPU: 1 PID: 5971 Comm: syz.1.28 Not tainted syzkaller #0
[   99.502642][ T5971] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[   99.512750][ T5971] Call Trace:
[   99.516076][ T5971]  <TASK>
[   99.519058][ T5971]  dump_stack_lvl+0x18c/0x250
[   99.523802][ T5971]  ? show_regs_print_info+0x20/0x20
[   99.529056][ T5971]  ? load_image+0x420/0x420
[   99.533637][ T5971]  ? __might_fault+0xaa/0x120
[   99.538397][ T5971]  ? __lock_acquire+0x7eb0/0x7eb0
[   99.543485][ T5971]  should_fail_ex+0x394/0x4c0
[   99.548222][ T5971]  _copy_from_user+0x2f/0xe0
[   99.552925][ T5971]  __sys_bpf+0x23e/0x890
[   99.557230][ T5971]  ? bpf_link_show_fdinfo+0x560/0x560
[   99.562719][ T5971]  ? lock_chain_count+0x20/0x20
[   99.567639][ T5971]  __x64_sys_bpf+0x7c/0x90
[   99.572118][ T5971]  do_syscall_64+0x55/0xb0
[   99.576601][ T5971]  ? clear_bhb_loop+0x40/0x90
[   99.581361][ T5971]  ? clear_bhb_loop+0x40/0x90
[   99.586104][ T5971]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[   99.592088][ T5971] RIP: 0033:0x7ff45699f559
[   99.596550][ T5971] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[   99.616228][ T5971] RSP: 002b:00007ff4578e7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[   99.624750][ T5971] RAX: ffffffffffffffda RBX: 00007ff456c25fa0 RCX: 00007ff45699f559
[   99.632783][ T5971] RDX: 0000000000000048 RSI: 0000200000000000 RDI: 0000000000000000
[   99.640814][ T5971] RBP: 00007ff456a36b20 R08: 0000000000000000 R09: 0000000000000000
[   99.648839][ T5971] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   99.656867][ T5971] R13: 00007ff456c26038 R14: 00007ff456c25fa0 R15: 00007fffa78b17b8
[   99.664965][ T5971]  </TASK>
[   99.833737][ T5787] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   99.865500][ T5974] syz.3.29 uses obsolete (PF_INET,SOCK_PACKET)
[   99.999249][ T5976] ������: renamed from vlan0 (while UP)
[  100.155041][ T5982] capability: warning: `syz.1.32' uses 32-bit capabilities (legacy support in use)
[  100.350277][ T5989] loop3: detected capacity change from 0 to 512
[  100.452767][ T5992] loop0: detected capacity change from 0 to 64
[  100.731988][ T5994] loop2: detected capacity change from 0 to 8
[  100.756886][ T5994] Dev loop2: unable to read RDB block 8
[  100.780136][ T5994]  loop2: unable to read partition table
[  100.805467][ T5994] loop2: partition table beyond EOD, truncated
[  100.828898][ T5994] loop_reread_partitions: partition scan of loop2 (�被x�^>��� ) failed (rc=-5)
[  101.154568][ T6002] loop3: detected capacity change from 0 to 256
[  101.182485][ T6002] exfat: Deprecated parameter 'utf8'
[  101.241574][ T6002] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0xe3908169, utbl_chksum : 0xe619d30d)
[  101.364736][ T6004] loop1: detected capacity change from 0 to 2048
[  101.378930][ T5904] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[  101.472271][ T6005] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  101.588512][ T5904] usb 1-1: Using ep0 maxpacket: 32
[  101.600860][ T5904] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  101.645609][ T5904] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  101.671884][ T5904] usb 1-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00
[  101.682447][ T5904] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  101.697825][ T5904] usb 1-1: config 0 descriptor??
[  102.105759][ T6018] netlink: 'syz.1.47': attribute type 4 has an invalid length.
[  102.151725][ T5904] ft260 0003:0403:6030.0002: unknown main item tag 0x0
[  102.179200][ T5904] ft260 0003:0403:6030.0002: unknown main item tag 0x0
[  102.342379][ T5904] ft260 0003:0403:6030.0002: chip code: 0000 0000
[  102.548560][ T5904] ft260 0003:0403:6030.0002: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.0-1/input0
[  102.746269][ T5904] ft260 0003:0403:6030.0002: failed to retrieve status: -71, no wakeup
[  102.775344][ T5904] ft260 0003:0403:6030.0002: failed to retrieve status: -71
[  102.808860][ T5904] ft260 0003:0403:6030.0002: failed to reset I2C controller: -71
[  102.866435][ T5904] usb 1-1: USB disconnect, device number 2
[  102.987676][ T6025] netlink: 16 bytes leftover after parsing attributes in process `syz.2.50'.
[  103.014834][ T6020] loop3: detected capacity change from 0 to 32768
[  103.093651][ T6020] JBD2: Ignoring recovery information on journal
[  103.181957][ T6020] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode.
[  103.545813][ T6020] (syz.3.48,6020,1):ocfs2_split_extent:5080 ERROR: status = -5
[  103.584765][ T6020] (syz.3.48,6020,1):ocfs2_change_extent_flag:5226 ERROR: status = -5
[  103.597976][ T6020] (syz.3.48,6020,1):ocfs2_mark_extent_refcounted:2386 ERROR: status = -5
[  103.606767][ T6020] (syz.3.48,6020,1):ocfs2_add_refcount_flag:3732 ERROR: status = -5
[  103.615627][ T6020] (syz.3.48,6020,1):ocfs2_reflink_remap_extent:4594 ERROR: status = -5
[  103.630289][ T6020] (syz.3.48,6020,1):ocfs2_reflink_remap_blocks:4718 ERROR: status = -5
[  103.647893][ T6042] loop0: detected capacity change from 0 to 512
[  103.656467][ T6020] (syz.3.48,6020,1):ocfs2_remap_file_range:2746 ERROR: status = -5
[  103.672173][ T6042] EXT4-fs: Ignoring removed orlov option
[  103.714118][ T6042] EXT4-fs: Ignoring removed mblk_io_submit option
[  103.778193][ T6042] EXT4-fs error (device loop0): ext4_iget_extra_inode:4752: inode #15: comm syz.0.55: corrupted in-inode xattr: e_value size too large
[  103.849728][ T6042] EXT4-fs error (device loop0): ext4_orphan_get:1413: comm syz.0.55: couldn't read orphan inode 15 (err -117)
[  103.884587][ T6042] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  103.897227][ T6020] syz.3.48 (6020) used greatest stack depth: 20264 bytes left
[  103.998278][ T6049] Bluetooth: MGMT ver 1.22
[  104.080613][ T5787] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  104.124831][ T5789] ocfs2: Unmounting device (7,3) on (node local)
[  104.417905][ T6040] loop1: detected capacity change from 0 to 32768
[  104.997273][   T28] audit: type=1326 audit(1793193802.332:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6071 comm="syz.0.65" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f939399f559 code=0x7ffc0000
[  105.108518][   T28] audit: type=1326 audit(1793193802.332:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6071 comm="syz.0.65" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f939399f559 code=0x7ffc0000
[  105.158479][   T28] audit: type=1326 audit(1793193802.342:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6071 comm="syz.0.65" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f939399f559 code=0x7ffc0000
[  105.254826][   T28] audit: type=1326 audit(1793193802.342:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6071 comm="syz.0.65" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f939399f559 code=0x7ffc0000
[  105.321837][   T28] audit: type=1326 audit(1793193802.372:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6071 comm="syz.0.65" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=285 compat=0 ip=0x7f939399f559 code=0x7ffc0000
[  105.427432][   T28] audit: type=1326 audit(1793193802.392:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6071 comm="syz.0.65" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f939399f559 code=0x7ffc0000
[  105.461322][   T28] audit: type=1326 audit(1793193802.392:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6071 comm="syz.0.65" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f939399f559 code=0x7ffc0000
[  105.549423][   T28] audit: type=1326 audit(1793193802.392:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6071 comm="syz.0.65" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f939399f559 code=0x7ffc0000
[  105.649582][   T28] audit: type=1326 audit(1793193802.392:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6071 comm="syz.0.65" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f939399f559 code=0x7ffc0000
[  105.953409][ T6097] loop1: detected capacity change from 0 to 8192
[  105.989198][ T6102] hugetlbfs: syz.2.75 (6102): Using mlock ulimits for SHM_HUGETLB is obsolete
[  106.013785][ T6097] REISERFS warning:  read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[  106.078825][ T6097] REISERFS (device loop1): found reiserfs format "3.6" with non-standard journal
[  106.119113][ T6097] REISERFS (device loop1): using ordered data mode
[  106.162308][ T6097] reiserfs: using flush barriers
[  106.218252][ T6097] REISERFS (device loop1): journal params: device loop1, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
[  106.263691][ T6097] REISERFS (device loop1): checking transaction log (loop1)
[  106.351395][ T6111] Illegal XDP return value 4294967274 on prog  (id 7) dev N/A, expect packet loss!
[  106.473016][ T6097] REISERFS (device loop1): Using tea hash to sort names
[  106.496424][ T6097] REISERFS warning (device loop1): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 SD] (nlink == 4) not found (pos 2)
[  106.537865][ T6097] REISERFS (device loop1): Created .reiserfs_priv - reserved for xattr storage.
[  106.603302][ T6116] loop2: detected capacity change from 0 to 256
[  106.614254][ T6117] loop0: detected capacity change from 0 to 128
[  106.625611][ T6116] exfat: Deprecated parameter 'namecase'
[  106.656392][ T6117] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1)
[  106.700450][ T6116] exFAT-fs (loop2): failed to load upcase table (idx : 0x0001fe89, chksum : 0xeb34f926, utbl_chksum : 0xe619d30d)
[  106.724124][   T28] audit: type=1800 audit(1793193804.062:12): pid=6097 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.74" name="file1" dev="loop1" ino=4 res=0 errno=0
[  106.931786][ T3424] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1)
[  106.955139][ T5880] rxe_eth0 speed is unknown, defaulting to 1000
[  107.174667][ T5883] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0
[  107.228765][ T5883] hid-generic 0000:0000:0000.0003: hidraw0: <UNKNOWN> HID v0.00 Device [syz1] on syz0
[  108.234371][ T6130] loop2: detected capacity change from 0 to 32768
[  108.326391][ T6130] XFS (loop2): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  108.484457][ T6130] XFS (loop2): Ending clean mount
[  108.811623][ T6166] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[  109.578991][   T53] Bluetooth: hci4: command 0xfc11 tx timeout
[  109.588812][ T5800] Bluetooth: hci4: Entering manufacturer mode failed (-110)
[  109.777377][ T5788] XFS (loop2): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  110.738182][ T6225] syzkaller1: entered promiscuous mode
[  110.744046][ T6225] syzkaller1: entered allmulticast mode
[  110.954385][ T6230] rxe_eth0 speed is unknown, defaulting to 1000
[  111.251017][ T6221] loop1: detected capacity change from 0 to 32768
[  111.331529][ T6221] XFS (loop1): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  111.471276][ T6221] XFS (loop1): Ending clean mount
[  111.548243][   T28] audit: type=1800 audit(1793193808.892:13): pid=6221 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.116" name="file1" dev="loop1" ino=4422 res=0 errno=0
[  111.832412][   T28] audit: type=1326 audit(1793193809.182:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6254 comm="syz.2.127" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f91ad99f559 code=0x0
[  111.970267][ T5786] XFS (loop1): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  112.662352][ T6273] loop3: detected capacity change from 0 to 2048
[  112.750300][ T6273] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  113.002639][ T5880] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[  113.240638][ T5880] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  113.251982][ T5880] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  113.273953][ T5880] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  113.302126][ T5880] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  113.324266][ T5880] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  113.352129][ T5880] usb 1-1: config 0 descriptor??
[  113.787389][ T5880] plantronics 0003:047F:FFFF.0004: reserved main item tag 0xd
[  113.802214][ T5880] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving
[  113.835121][ T5880] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0
[  114.172424][ T5880] usb 1-1: USB disconnect, device number 3
[  114.407045][ T6314] batman_adv: Routing algorithm '' is not supported
[  115.600203][ T6365] loop2: detected capacity change from 0 to 128
[  115.672998][ T6365] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1)
[  115.698503][ T5880] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[  115.884100][   T51] FAT-fs (loop2): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1)
[  115.901436][ T5880] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  115.922856][ T5880] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  115.958391][ T5880] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  116.008494][ T5880] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  116.028188][ T5880] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  116.048576][ T5880] usb 2-1: config 0 descriptor??
[  116.247371][ T6363] loop0: detected capacity change from 0 to 32768
[  116.325839][ T6363] XFS (loop0): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  116.422080][ T6363] XFS (loop0): Ending clean mount
[  116.490586][ T5880] plantronics 0003:047F:FFFF.0005: reserved main item tag 0xd
[  116.525845][ T5880] plantronics 0003:047F:FFFF.0005: No inputs registered, leaving
[  116.588679][ T5880] plantronics 0003:047F:FFFF.0005: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0
[  116.753975][ T5787] XFS (loop0): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  116.876517][ T5880] usb 2-1: USB disconnect, device number 2
[  117.385410][ T6399] loop0: detected capacity change from 0 to 8192
[  117.403707][ T6399] REISERFS warning:  read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[  117.418734][ T6399] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal
[  117.429358][ T6399] REISERFS (device loop0): using ordered data mode
[  117.435944][ T6399] reiserfs: using flush barriers
[  117.440967][ T5880] usb 4-1: new high-speed USB device number 3 using dummy_hcd
[  117.453759][ T6399] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
[  117.475418][ T6399] REISERFS (device loop0): checking transaction log (loop0)
[  117.628461][ T5880] usb 4-1: Using ep0 maxpacket: 8
[  117.645578][ T5880] usb 4-1: config index 0 descriptor too short (expected 301, got 45)
[  117.668671][ T5880] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  117.706624][ T6399] REISERFS (device loop0): Using tea hash to sort names
[  117.715079][ T5880] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  117.725710][ T6399] REISERFS warning (device loop0): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 SD] (nlink == 4) not found (pos 2)
[  117.740917][ T5880] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  117.746316][ T6404] loop2: detected capacity change from 0 to 1024
[  117.751442][ T6399] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage.
[  117.753770][ T5880] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  117.820057][ T6404] EXT4-fs (loop2): stripe (2) is not aligned with cluster size (16), stripe is disabled
[  117.872600][   T28] audit: type=1800 audit(1793193815.222:15): pid=6399 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.183" name="file1" dev="loop0" ino=4 res=0 errno=0
[  117.894489][ T5880] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23
[  117.904369][ T5880] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  117.917684][ T6404] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  118.153200][ T5880] usb 4-1: usb_control_msg returned -32
[  118.166052][ T5880] usbtmc 4-1:16.0: can't read capabilities
[  118.260532][ T5788] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  118.432621][ T6413] loop2: detected capacity change from 0 to 1024
[  118.459538][ T6413] =======================================================
[  118.459538][ T6413] WARNING: The mand mount option has been deprecated and
[  118.459538][ T6413]          and is ignored by this kernel. Remove the mand
[  118.459538][ T6413]          option from the mount to silence this warning.
[  118.459538][ T6413] =======================================================
[  118.517401][ T6406] loop1: detected capacity change from 0 to 32768
[  118.549154][ T6413] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled
[  118.589032][ T6406] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by syz.1.186 (6406)
[  118.607898][ T6414] usbtmc 4-1:16.0: INITIATE_CLEAR returned 0
[  118.675452][ T6413] EXT4-fs error (device loop2): ext4_map_blocks:720: inode #3: block 1: comm syz.2.189: lblock 1 mapped to illegal pblock 1 (length 1)
[  118.749389][ T6406] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  118.770886][ T6413] Quota error (device loop2): write_blk: dquota write failed
[  118.798799][ T6406] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[  118.812169][ T5904] usb 4-1: USB disconnect, device number 3
[  118.823508][ T6413] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota
[  118.839004][ T6406] BTRFS info (device loop1): metadata ratio 2
[  118.856483][ T6406] BTRFS info (device loop1): force zlib compression, level 3
[  118.879484][ T6413] EXT4-fs error (device loop2): ext4_acquire_dquot:6949: comm syz.2.189: Failed to acquire dquot type 0
[  118.902897][ T6406] BTRFS info (device loop1): enabling auto defrag
[  118.924028][ T6413] EXT4-fs error (device loop2): ext4_free_blocks:6694: comm syz.2.189: Freeing blocks not in datazone - block = 0, count = 4096
[  118.948519][ T6406] BTRFS info (device loop1): max_inline at 0
[  118.959906][ T6406] BTRFS info (device loop1): using free space tree
[  118.976477][ T6413] EXT4-fs error (device loop2): ext4_read_inode_bitmap:140: comm syz.2.189: Invalid inode bitmap blk 0 in block_group 0
[  118.993356][   T51] EXT4-fs error (device loop2): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:4: lblock 1 mapped to illegal pblock 1 (length 1)
[  119.009532][ T6413] EXT4-fs error (device loop2) in ext4_free_inode:363: Corrupt filesystem
[  119.031374][ T6413] EXT4-fs (loop2): 1 orphan inode deleted
[  119.041672][ T6412] loop0: detected capacity change from 0 to 32768
[  119.062540][ T6413] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  119.078187][ T6412] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop0 scanned by syz.0.188 (6412)
[  119.102466][   T51] Quota error (device loop2): remove_tree: Can't read quota data block 1
[  119.113600][ T6412] BTRFS info (device loop0): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0
[  119.128604][ T6412] BTRFS info (device loop0): using crc32c (crc32c-intel) checksum algorithm
[  119.137541][ T6412] BTRFS info (device loop0): setting incompat feature flag for COMPRESS_ZSTD (0x10)
[  119.175100][   T51] EXT4-fs error (device loop2): ext4_release_dquot:6985: comm kworker/u4:4: Failed to release dquot type 0
[  119.180356][ T6413] EXT4-fs error (device loop2): ext4_map_blocks:610: inode #3: block 1: comm syz.2.189: lblock 1 mapped to illegal pblock 1 (length 1)
[  119.223940][ T6406] BTRFS info (device loop1): auto enabling async discard
[  119.229660][ T6412] BTRFS info (device loop0): use zstd compression, level 3
[  119.242082][ T6412] BTRFS info (device loop0): force clearing of disk cache
[  119.250537][ T6413] Quota error (device loop2): find_tree_dqentry: Can't read quota tree block 1
[  119.254588][ T6412] BTRFS info (device loop0): enabling disk space caching
[  119.271106][ T6412] BTRFS info (device loop0): disk space caching is enabled
[  119.285126][ T6413] Quota error (device loop2): qtree_read_dquot: Can't read quota structure for id 60928
[  119.337627][ T6413] EXT4-fs error (device loop2): ext4_acquire_dquot:6949: comm syz.2.189: Failed to acquire dquot type 0
[  119.505124][ T6412] BTRFS info (device loop0): enabling ssd optimizations
[  119.544134][   T28] audit: type=1800 audit(1793193816.892:16): pid=6448 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.186" name="file1" dev="loop1" ino=260 res=0 errno=0
[  119.564939][ T6412] BTRFS info (device loop0): auto enabling async discard
[  119.593801][ T6412] BTRFS info (device loop0): rebuilding free space tree
[  119.642971][ T5788] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  119.654195][   T51] EXT4-fs error (device loop2): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:4: lblock 1 mapped to illegal pblock 1 (length 1)
[  119.701217][   T51] Quota error (device loop2): remove_tree: Can't read quota data block 1
[  119.717666][   T51] EXT4-fs error (device loop2): ext4_release_dquot:6985: comm kworker/u4:4: Failed to release dquot type 0
[  119.854334][ T6412] BTRFS info (device loop0): disabling free space tree
[  119.868515][ T6412] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[  119.879657][ T6412] BTRFS info (device loop0): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
[  119.940956][ T5786] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  120.323943][ T6456] rxe_eth0 speed is unknown, defaulting to 1000
[  120.792469][ T5787] BTRFS info (device loop0): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0
[  120.978912][ T5903] usb 2-1: new high-speed USB device number 3 using dummy_hcd
[  121.187193][ T5903] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  121.206955][ T5903] usb 2-1: New USB device found, idVendor=0b48, idProduct=1006, bcdDevice= 1.00
[  121.216897][ T5903] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  121.238485][ T5903] usb 2-1: Product: syz
[  121.242740][ T5903] usb 2-1: Manufacturer: syz
[  121.247645][ T5903] usb 2-1: SerialNumber: syz
[  121.528968][ T5903] dvbdev: DVB: registering new adapter (DEC3000-s)
[  121.582636][ T5903] usb 2-1: DVB: registering adapter 1 frontend 0 (TechnoTrend/Hauppauge DEC3000-s Frontend)...
[  121.730222][ T5903] usb 2-1: selecting invalid altsetting 8
[  121.793758][ T6469] loop0: detected capacity change from 0 to 4096
[  121.873507][ T6469] ntfs3: loop0: Failed to load $Extend (-22).
[  121.884651][ T6469] ntfs3: loop0: Failed to initialize $Extend.
[  121.958460][    T9] usb 4-1: new high-speed USB device number 4 using dummy_hcd
[  122.018709][ T5904] usb 2-1: USB disconnect, device number 3
[  122.207372][    T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  122.242225][    T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  122.254594][    T9] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  122.290881][    T9] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  122.306340][    T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  122.319502][    T9] usb 4-1: config 0 descriptor??
[  122.755087][    T9] plantronics 0003:047F:FFFF.0006: reserved main item tag 0xd
[  122.775767][    T9] plantronics 0003:047F:FFFF.0006: No inputs registered, leaving
[  122.814548][    T9] plantronics 0003:047F:FFFF.0006: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0
[  123.094900][    T9] usb 4-1: USB disconnect, device number 4
[  123.176917][ T6473] loop1: detected capacity change from 0 to 32768
[  123.215450][ T6473] XFS (loop1): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  123.270566][ T6473] XFS (loop1): Ending clean mount
[  123.367407][ T6477] loop0: detected capacity change from 0 to 40427
[  123.398756][ T6477] F2FS-fs (loop0): build fault injection attr: rate: 690, type: 0x7ffff
[  123.412883][ T6477] F2FS-fs (loop0): Image doesn't support compression
[  123.424766][ T6477] F2FS-fs (loop0): Image doesn't support compression
[  123.456578][ T6477] F2FS-fs (loop0): invalid crc value
[  123.486263][ T6477] F2FS-fs (loop0): Found nat_bits in checkpoint
[  123.604724][ T6477] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
[  123.960556][ T5787] syz-executor: attempt to access beyond end of device
[  123.960556][ T5787] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  123.995365][ T5787] F2FS-fs (loop0): Stopped filesystem due to reason: 3
[  124.114131][ T6496] loop3: detected capacity change from 0 to 8192
[  124.171554][ T6496] REISERFS warning:  read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[  124.199992][ T6496] REISERFS (device loop3): found reiserfs format "3.6" with non-standard journal
[  124.215647][ T6496] REISERFS (device loop3): using ordered data mode
[  124.222917][ T6496] reiserfs: using flush barriers
[  124.231591][ T6496] REISERFS (device loop3): journal params: device loop3, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
[  124.257230][ T6496] REISERFS (device loop3): checking transaction log (loop3)
[  124.418626][ T5883] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[  124.515077][ T6496] REISERFS (device loop3): Using tea hash to sort names
[  124.548738][ T6496] REISERFS warning (device loop3): vs-13060 reiserfs_update_sd_size: stat data of object [1 2 0x0 SD] (nlink == 4) not found (pos 2)
[  124.563403][ T5786] XFS (loop1): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  124.577414][ T6496] REISERFS (device loop3): Created .reiserfs_priv - reserved for xattr storage.
[  124.610899][ T5883] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  124.658682][ T5883] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  124.685070][ T5883] usb 3-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00
[  124.718912][ T5883] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  124.741988][ T5883] usb 3-1: config 0 descriptor??
[  124.817109][   T28] audit: type=1800 audit(1793193822.162:17): pid=6496 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.197" name="file1" dev="loop3" ino=4 res=0 errno=0
[  125.204873][ T6512] rxe_eth0 speed is unknown, defaulting to 1000
[  125.635653][ T5883] hid-led: probe of 0003:27B8:01ED.0007 failed with error -71
[  125.666992][ T5883] usb 3-1: USB disconnect, device number 2
[  126.017053][ T6519] loop3: detected capacity change from 0 to 32768
[  126.047698][ T6519] XFS (loop3): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  126.124144][ T6519] XFS (loop3): Ending clean mount
[  126.174035][ T6519] XFS (loop3): User initiated shutdown received.
[  126.181688][ T6519] XFS (loop3): Log I/O Error (0x6) detected at xfs_fs_goingdown+0x71/0x150 (fs/xfs/xfs_fsops.c:501).  Shutting down filesystem.
[  126.200232][ T6519] XFS (loop3): Please unmount the filesystem and rectify the problem(s)
[  126.231528][ T5789] XFS (loop3): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  126.533998][ T6535] loop0: detected capacity change from 0 to 8192
[  126.554756][ T6535] REISERFS warning:  read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025
[  126.616788][ T6535] REISERFS (device loop0): found reiserfs format "3.6" with non-standard journal
[  126.628920][ T6535] REISERFS (device loop0): using ordered data mode
[  126.635788][ T6535] reiserfs: using flush barriers
[  126.640986][ T5903] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[  126.690820][ T6535] REISERFS (device loop0): journal params: device loop0, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30
[  126.712373][ T6535] REISERFS (device loop0): checking transaction log (loop0)
[  126.837313][ T5903] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  126.878405][ T5903] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  126.928525][ T5903] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  126.975066][ T5903] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  127.008467][ T6535] REISERFS (device loop0): Using tea hash to sort names
[  127.038838][ T6535] REISERFS (device loop0): Created .reiserfs_priv - reserved for xattr storage.
[  127.047726][ T5903] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  127.114292][ T5903] usb 3-1: config 0 descriptor??
[  127.298692][ T6547] netlink: 4 bytes leftover after parsing attributes in process `syz.1.225'.
[  127.574775][ T5903] plantronics 0003:047F:FFFF.0008: reserved main item tag 0xd
[  127.595050][ T5903] plantronics 0003:047F:FFFF.0008: No inputs registered, leaving
[  127.628745][ T5903] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0
[  127.677898][ T6551] loop0: detected capacity change from 0 to 4096
[  127.914764][ T6545] loop3: detected capacity change from 0 to 32768
[  127.932218][ T5903] usb 3-1: USB disconnect, device number 3
[  127.983171][ T6545] XFS (loop3): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  128.064281][ T6545] XFS (loop3): Ending clean mount
[  128.116661][   T28] audit: type=1800 audit(1793193825.462:18): pid=6545 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.216" name="file1" dev="loop3" ino=4422 res=0 errno=0
[  128.389925][ T5789] XFS (loop3): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  128.700348][ T6565] rxe_eth0 speed is unknown, defaulting to 1000
[  128.726865][ T6569] netlink: 'syz.1.222': attribute type 21 has an invalid length.
[  128.755418][ T6569] netlink: 128 bytes leftover after parsing attributes in process `syz.1.222'.
[  128.787252][ T6569] netlink: 3 bytes leftover after parsing attributes in process `syz.1.222'.
[  129.250492][ T6588] loop3: detected capacity change from 0 to 128
[  129.686801][ T6599] loop5: detected capacity change from 0 to 7
[  129.741564][ T6599] Dev loop5: unable to read RDB block 7
[  129.762370][ T6599]  loop5: AHDI p2
[  129.766906][ T6599] loop5: partition table partially beyond EOD, truncated
[  130.902831][ T6617] loop1: detected capacity change from 0 to 4096
[  131.132074][ T6617] ntfs3: loop1: failed to convert "0080" to koi8-ru
[  131.173592][ T6617] ntfs3: loop1: failed to convert name for inode 1e.
[  131.211314][ T6617] ntfs3: loop1: ino=1f, mi_enum_attr
[  131.235797][ T6617] ntfs3: loop1: failed to convert "256c" to koi8-ru
[  131.245165][ T6628] ntfs3: loop1: failed to convert "256c" to koi8-ru
[  131.754353][ T6643] FAULT_INJECTION: forcing a failure.
[  131.754353][ T6643] name failslab, interval 1, probability 0, space 0, times 1
[  131.773274][ T6643] CPU: 1 PID: 6643 Comm: syz.0.253 Not tainted syzkaller #0
[  131.780701][ T6643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[  131.790819][ T6643] Call Trace:
[  131.794171][ T6643]  <TASK>
[  131.797162][ T6643]  dump_stack_lvl+0x18c/0x250
[  131.801959][ T6643]  ? show_regs_print_info+0x20/0x20
[  131.807238][ T6643]  ? load_image+0x420/0x420
[  131.811819][ T6643]  ? __might_sleep+0xe0/0xe0
[  131.816511][ T6643]  ? __lock_acquire+0x7eb0/0x7eb0
[  131.821877][ T6643]  should_fail_ex+0x394/0x4c0
[  131.826632][ T6643]  should_failslab+0x9/0x20
[  131.831207][ T6643]  slab_pre_alloc_hook+0x59/0x300
[  131.836305][ T6643]  ? get_callchain_buffers+0x1a2/0x360
[  131.841835][ T6643]  ? get_callchain_buffers+0x1a2/0x360
[  131.841868][ T6627] loop2: detected capacity change from 0 to 32768
[  131.847331][ T6643]  __kmem_cache_alloc_node+0x53/0x260
[  131.847394][ T6643]  ? get_callchain_buffers+0x1a2/0x360
[  131.847418][ T6643]  __kmalloc_node+0xa6/0x240
[  131.847449][ T6643]  ? rcu_is_watching+0x15/0xb0
[  131.847479][ T6643]  get_callchain_buffers+0x1a2/0x360
[  131.847509][ T6643]  stack_map_alloc+0x2fc/0x4b0
[  131.847539][ T6643]  map_create+0x877/0x12f0
[  131.847572][ T6643]  __sys_bpf+0x651/0x890
[  131.860443][ T6627] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.246 (6627)
[  131.864922][ T6643]  ? bpf_link_show_fdinfo+0x560/0x560
[  131.864976][ T6643]  ? lock_chain_count+0x20/0x20
[  131.915576][ T6643]  __x64_sys_bpf+0x7c/0x90
[  131.920051][ T6643]  do_syscall_64+0x55/0xb0
[  131.924505][ T6643]  ? clear_bhb_loop+0x40/0x90
[  131.929235][ T6643]  ? clear_bhb_loop+0x40/0x90
[  131.933956][ T6643]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  131.939941][ T6643] RIP: 0033:0x7f939399f559
[  131.944606][ T6643] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  131.964270][ T6643] RSP: 002b:00007f93948d4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
[  131.972770][ T6643] RAX: ffffffffffffffda RBX: 00007f9393c25fa0 RCX: 00007f939399f559
[  131.980788][ T6643] RDX: 0000000000000050 RSI: 0000200000000140 RDI: 0000000000000000
[  131.988817][ T6643] RBP: 00007f9393a36b20 R08: 0000000000000000 R09: 0000000000000000
[  131.997018][ T6643] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  132.005035][ T6643] R13: 00007f9393c26038 R14: 00007f9393c25fa0 R15: 00007ffc86c0e5c8
[  132.013061][ T6643]  </TASK>
[  132.050045][ T6627] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  132.064280][ T6627] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm
[  132.084023][ T6627] BTRFS info (device loop2): using free space tree
[  132.096410][ T6646] netlink: 124 bytes leftover after parsing attributes in process `syz.1.254'.
[  132.298841][ T6627] BTRFS info (device loop2): enabling ssd optimizations
[  132.305894][ T6627] BTRFS info (device loop2): auto enabling async discard
[  132.498461][ T5788] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  132.528042][ T6670] loop3: detected capacity change from 0 to 128
[  132.630032][ T6670] FAT-fs (loop3): error, invalid FAT chain (i_pos 548, last_block 8)
[  132.648070][ T6670] FAT-fs (loop3): Filesystem has been set read-only
[  132.667595][ T6670] FAT-fs (loop3): error, corrupted file size (i_pos 548, 522)
[  132.832505][    T8] IPVS: starting estimator thread 0...
[  132.895802][   T28] audit: type=1326 audit(1793193830.242:19): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6674 comm="syz.3.261" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fac98b9f559 code=0x0
[  132.968668][ T6673] IPVS: using max 21 ests per chain, 50400 per kthread
[  133.063550][ T6558] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 9 /dev/loop2 scanned by udevd (6558)
[  133.103042][ T1292] ieee802154 phy0 wpan0: encryption failed: -22
[  133.110272][ T1292] ieee802154 phy1 wpan1: encryption failed: -22
[  133.155672][ T6664] loop0: detected capacity change from 0 to 32768
[  133.286660][ T6664] XFS (loop0): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  133.411352][ T6664] XFS (loop0): Ending clean mount
[  133.474476][   T28] audit: type=1800 audit(1793193830.822:20): pid=6664 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.255" name="file1" dev="loop0" ino=4422 res=0 errno=0
[  133.813365][ T6700] loop1: detected capacity change from 0 to 64
[  133.891415][ T5787] XFS (loop0): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  133.992651][ T6700] hfs: request for non-existent node 131072 in B*Tree
[  134.024267][ T6700] hfs: request for non-existent node 131072 in B*Tree
[  134.188640][   T27] usb 4-1: new high-speed USB device number 5 using dummy_hcd
[  134.412233][   T27] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 32
[  134.425923][   T27] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 97
[  134.454596][   T27] usb 4-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice= 1.00
[  134.470395][ T6706] loop1: detected capacity change from 0 to 512
[  134.479584][   T27] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  134.491021][ T6706] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended
[  134.510199][ T6702] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  134.543676][ T6702] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  134.577356][   T27] cyberjack 4-1:1.0: Reiner SCT Cyberjack USB card reader converter detected
[  134.595665][ T6706] EXT4-fs warning (device loop1): ext4_update_dynamic_rev:1158: updating to rev 1 because of new feature flag, running e2fsck is recommended
[  134.613958][   T27] usb 4-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0
[  134.628477][ T6706] EXT4-fs error (device loop1): ext4_validate_block_bitmap:439: comm syz.1.270: bg 0: block 248: padding at end of block bitmap is not set
[  134.651533][ T6698] loop2: detected capacity change from 0 to 32768
[  134.660057][ T6706] Quota error (device loop1): write_blk: dquota write failed
[  134.667679][ T6706] Quota error (device loop1): qtree_write_dquot: Error -28 occurred while creating quota
[  134.677883][ T6706] EXT4-fs error (device loop1): ext4_acquire_dquot:6949: comm syz.1.270: Failed to acquire dquot type 1
[  134.695760][ T6698] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop2 scanned by syz.2.266 (6698)
[  134.711241][ T6706] EXT4-fs (loop1): 1 truncate cleaned up
[  134.719216][ T6706] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0008-000000000000 r/w without journal. Quota mode: writeback.
[  134.760699][ T6706] Quota error (device loop1): find_tree_dqentry: Cycle in quota tree detected: block 2 index 2
[  134.798784][ T6698] BTRFS info (device loop2): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[  134.822287][ T6706] Quota error (device loop1): qtree_read_dquot: Can't read quota structure for id 131074
[  134.840963][ T6698] BTRFS info (device loop2): using blake2b (blake2b-256-generic) checksum algorithm
[  134.878144][ T6698] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_ZSTD (0x10)
[  134.898408][ T6706] EXT4-fs error (device loop1): ext4_acquire_dquot:6949: comm syz.1.270: Failed to acquire dquot type 1
[  134.925367][ T6698] BTRFS info (device loop2): use zstd compression, level 3
[  134.942173][ T5904] usb 4-1: USB disconnect, device number 5
[  134.968465][ T6698] BTRFS info (device loop2): using free space tree
[  134.981376][ T5904] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0
[  134.999466][ T5904] cyberjack 4-1:1.0: device disconnected
[  135.071928][ T5786] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0008-000000000000.
[  135.169084][ T6698] BTRFS info (device loop2): enabling ssd optimizations
[  135.176163][ T6698] BTRFS info (device loop2): auto enabling async discard
[  135.382982][ T6705] loop0: detected capacity change from 0 to 32768
[  135.476830][ T6705] XFS (loop0): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  135.684401][ T5788] BTRFS info (device loop2): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8
[  135.698783][ T6705] XFS (loop0): Ending clean mount
[  135.903637][ T6745] loop3: detected capacity change from 0 to 256
[  136.024257][ T6745] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d)
[  136.110261][ T5787] XFS (loop0): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  136.893186][  T749] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  137.033899][  T749] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  137.176921][  T749] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  137.356904][  T749] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  137.578911][ T5800] Bluetooth: hci4: Opcode 0x0c03 failed: -110
[  137.820229][ T6765] overlay: Unexpected value for 'default_permissions'
[  137.883926][   T53] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  137.896602][   T53] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  137.908472][   T53] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  137.938584][   T53] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  137.956599][   T53] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[  137.966798][   T53] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  138.050443][ T6770] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  138.058396][ T6770] IPv6: NLM_F_CREATE should be set when creating new route
[  138.065766][ T6770] IPv6: NLM_F_CREATE should be set when creating new route
[  138.073655][ T6770] IPv6: NLM_F_CREATE should be set when creating new route
[  138.130253][ T6766] rxe_eth0 speed is unknown, defaulting to 1000
[  138.756599][ T6766] chnl_net:caif_netlink_parms(): no params data found
[  139.005199][ T6766] bridge0: port 1(bridge_slave_0) entered blocking state
[  139.013389][ T6766] bridge0: port 1(bridge_slave_0) entered disabled state
[  139.027321][ T6766] bridge_slave_0: entered allmulticast mode
[  139.049268][ T6766] bridge_slave_0: entered promiscuous mode
[  139.065280][ T6766] bridge0: port 2(bridge_slave_1) entered blocking state
[  139.093328][ T6766] bridge0: port 2(bridge_slave_1) entered disabled state
[  139.101302][ T6766] bridge_slave_1: entered allmulticast mode
[  139.109523][ T6766] bridge_slave_1: entered promiscuous mode
[  139.232659][ T6766] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  139.285480][ T6766] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  139.446671][ T6766] team0: Port device team_slave_0 added
[  139.504844][ T6766] team0: Port device team_slave_1 added
[  139.554546][  T749] hsr_slave_0: left promiscuous mode
[  139.561517][  T749] hsr_slave_1: left promiscuous mode
[  139.567834][  T749] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  139.575469][  T749] batman_adv: batadv0: Removing interface: batadv_slave_0
[  139.584495][  T749] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  139.592097][  T749] batman_adv: batadv0: Removing interface: batadv_slave_1
[  139.605468][  T749] bridge_slave_1: left allmulticast mode
[  139.611750][  T749] bridge_slave_1: left promiscuous mode
[  139.619347][  T749] bridge0: port 2(bridge_slave_1) entered disabled state
[  139.635039][  T749] bridge_slave_0: left allmulticast mode
[  139.641384][  T749] bridge_slave_0: left promiscuous mode
[  139.647220][  T749] bridge0: port 1(bridge_slave_0) entered disabled state
[  139.683318][  T749] veth1_macvtap: left promiscuous mode
[  139.689600][  T749] veth0_macvtap: left promiscuous mode
[  139.695249][  T749] veth1_vlan: left promiscuous mode
[  139.703172][  T749] veth0_vlan: left promiscuous mode
[  140.063895][ T5800] Bluetooth: hci3: command tx timeout
[  140.477969][  T749] team0 (unregistering): Port device team_slave_1 removed
[  140.532641][  T749] team0 (unregistering): Port device team_slave_0 removed
[  140.586688][  T749] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  140.639312][  T749] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  141.053413][  T749] bond0 (unregistering): Released all slaves
[  141.167905][ T6766] batman_adv: batadv0: Adding interface: batadv_slave_0
[  141.181831][ T6766] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  141.213107][ T6766] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  141.226041][ T6766] batman_adv: batadv0: Adding interface: batadv_slave_1
[  141.241241][ T6766] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  141.267427][ T6766] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  141.381489][ T6766] hsr_slave_0: entered promiscuous mode
[  141.388773][ T6766] hsr_slave_1: entered promiscuous mode
[  141.395394][ T6766] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  141.405149][ T6766] Cannot create hsr debugfs directory
[  142.139146][ T5800] Bluetooth: hci3: command tx timeout
[  142.227085][ T6766] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  142.239678][ T6766] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  142.259506][ T6766] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  142.280230][ T6766] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  142.435779][ T6766] 8021q: adding VLAN 0 to HW filter on device bond0
[  142.482998][ T6766] 8021q: adding VLAN 0 to HW filter on device team0
[  142.522202][   T51] bridge0: port 1(bridge_slave_0) entered blocking state
[  142.529520][   T51] bridge0: port 1(bridge_slave_0) entered forwarding state
[  142.540798][   T51] bridge0: port 2(bridge_slave_1) entered blocking state
[  142.548028][   T51] bridge0: port 2(bridge_slave_1) entered forwarding state
[  142.878166][ T6766] 8021q: adding VLAN 0 to HW filter on device batadv0
[  142.954964][ T6766] veth0_vlan: entered promiscuous mode
[  142.977048][ T6766] veth1_vlan: entered promiscuous mode
[  143.037577][ T6766] veth0_macvtap: entered promiscuous mode
[  143.053147][ T6766] veth1_macvtap: entered promiscuous mode
[  143.093284][ T6766] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  143.108921][ T6766] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  143.122915][ T6766] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  143.134084][ T6766] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  143.152293][ T6766] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  143.166587][ T6766] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  143.182893][ T6766] batman_adv: batadv0: Interface activated: batadv_slave_0
[  143.195859][ T6766] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  143.206788][ T6766] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  143.217075][ T6766] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  143.228779][ T6766] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  143.239102][ T6766] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  143.249992][ T6766] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  143.266100][ T6766] batman_adv: batadv0: Interface activated: batadv_slave_1
[  143.293175][ T6766] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  143.302776][ T6766] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  143.314386][ T6766] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  143.324281][ T6766] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  143.476852][   T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  143.495535][   T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  143.550993][  T749] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  143.562971][  T749] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  143.672922][ T6848] loop2: detected capacity change from 0 to 512
[  143.693849][ T6848] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode
[  143.723472][ T6848] EXT4-fs error (device loop2): ext4_orphan_get:1434: comm syz.2.279: bad orphan inode 131083
[  143.774123][ T6848] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  143.856990][ T6766] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  144.219118][ T5800] Bluetooth: hci3: command tx timeout
[  145.337885][ T6861] loop2: detected capacity change from 0 to 32768
[  145.398329][    C0] sched: RT throttling activated
[  145.565198][ T6871] loop0: detected capacity change from 0 to 131072
[  145.581644][ T6871] F2FS-fs (loop0): invalid crc value
[  145.610841][ T6861] XFS (loop2): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  145.647679][ T6871] F2FS-fs (loop0): Found nat_bits in checkpoint
[  145.710623][ T6871] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e4
[  145.823504][ T6861] XFS (loop2): Ending clean mount
[  145.941789][   T28] audit: type=1800 audit(1793193843.282:21): pid=6861 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.287" name="file1" dev="loop2" ino=4422 res=0 errno=0
[  146.081768][ T6900] rxe_eth0 speed is unknown, defaulting to 1000
[  146.303225][ T5800] Bluetooth: hci3: command tx timeout
[  146.372163][ T6766] XFS (loop2): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  147.117516][ T6927] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[  148.824806][ T6955] loop2: detected capacity change from 0 to 32768
[  148.930974][ T6955] JBD2: Ignoring recovery information on journal
[  149.094160][ T6955] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode.
[  149.506879][ T6766] ocfs2: Unmounting device (7,2) on (node local)
[  149.869627][ T6981] rxe_eth0 speed is unknown, defaulting to 1000
[  149.917912][ T6984] loop2: detected capacity change from 0 to 512
[  149.971787][ T6984] EXT4-fs error (device loop2): ext4_orphan_get:1434: comm syz.2.321: bad orphan inode 15
[  150.022077][ T6984] ext4_test_bit(bit=14, block=5) = 0
[  150.030286][ T6984] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  150.096385][ T6984] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 7987 vs 220 free clusters
[  150.120887][ T5880] usb 4-1: new high-speed USB device number 6 using dummy_hcd
[  150.177525][ T6984] EXT4-fs error (device loop2): ext4_free_inode:356: comm syz.2.321: bit already cleared for inode 13
[  150.200759][ T6996] EXT4-fs error (device loop2): __ext4_new_inode:1083: comm syz.2.321: reserved inode found cleared - inode=1
[  150.273863][ T6992] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  150.288823][ T6992] Bluetooth: hci0: Opcode 0x0406 failed: -4
[  150.343753][ T6766] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  150.357180][ T6992] Bluetooth: hci0: Opcode 0x0406 failed: -4
[  150.385418][ T6992] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  150.410282][ T6992] Bluetooth: hci1: Opcode 0x0406 failed: -4
[  150.433251][ T5880] usb 4-1: config 0 has no interfaces?
[  150.444349][ T5880] usb 4-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=30.00
[  150.465340][ T5880] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  150.491098][ T6992] Bluetooth: hci1: Opcode 0x0406 failed: -4
[  150.502663][ T5880] usb 4-1: Product: syz
[  150.506936][ T5880] usb 4-1: Manufacturer: syz
[  150.515190][ T6992] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  150.538752][ T6992] Bluetooth: hci2: Opcode 0x0406 failed: -4
[  150.545590][ T5880] usb 4-1: SerialNumber: syz
[  150.574998][ T5880] r8152-cfgselector 4-1: config 0 descriptor??
[  150.589011][ T6992] Bluetooth: hci2: Opcode 0x0406 failed: -4
[  150.609863][ T6992] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  150.615984][ T6992] Bluetooth: hci3: Opcode 0x0406 failed: -4
[  150.666035][ T6998] 9pnet: p9_errstr2errno: server reported unknown error ���#�
[  150.666035][ T6998] \,���7�͈��^�
[  150.666035][ T6998] d#
[  150.688217][ T6992] Bluetooth: hci3: Opcode 0x0406 failed: -4
[  150.888783][ T5880] r8152-cfgselector 4-1: Unknown version 0x0000
[  150.901971][ T5880] r8152-cfgselector 4-1: USB disconnect, device number 6
[  150.956150][ T7001] loop1: detected capacity change from 0 to 4096
[  151.068216][ T7001] ntfs3: loop1: Failed to load $Extend (-22).
[  151.081603][ T7001] ntfs3: loop1: Failed to initialize $Extend.
[  151.537684][ T7018] input: syz0 as /devices/virtual/input/input10
[  152.138710][ T5800] Bluetooth: hci0: command 0x0c1a tx timeout
[  152.189333][ T7038] loop0: detected capacity change from 0 to 4096
[  152.193811][ T7044] netlink: 63 bytes leftover after parsing attributes in process `syz.3.348'.
[  152.228070][ T7046] overlayfs: "xino=on" is useless with all layers on same fs, ignore.
[  152.468932][ T5800] Bluetooth: hci1: command 0x0c1a tx timeout
[  152.538493][ T5800] Bluetooth: hci2: command 0x0c1a tx timeout
[  152.543087][ T7053] loop2: detected capacity change from 0 to 512
[  152.618156][ T7053] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem
[  152.638616][ T5800] Bluetooth: hci3: command 0x0c1a tx timeout
[  152.712191][ T7057] jffs2: notice: (7057) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[  152.810096][ T7053] EXT4-fs error (device loop2): ext4_orphan_get:1408: inode #15: comm syz.2.352: iget: bad i_size value: 360287970189639680
[  152.842157][ T7053] EXT4-fs error (device loop2): ext4_orphan_get:1413: comm syz.2.352: couldn't read orphan inode 15 (err -117)
[  152.945964][ T7053] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  152.970584][ T7063] loop4: detected capacity change from 0 to 7
[  152.984336][ T7063] Dev loop4: unable to read RDB block 7
[  153.008693][ T7063]  loop4: unable to read partition table
[  153.016320][ T7063] loop4: partition table beyond EOD, truncated
[  153.035635][ T7063] loop_reread_partitions: partition scan of loop4 (�被x������ ) failed (rc=-5)
[  153.226415][ T6766] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  153.337064][ T7073] netlink: 48 bytes leftover after parsing attributes in process `syz.2.360'.
[  153.396011][ T7075] loop0: detected capacity change from 0 to 512
[  153.414149][ T5880] usb 2-1: new full-speed USB device number 4 using dummy_hcd
[  153.435895][ T7075] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  153.486060][   T28] audit: type=1804 audit(1793193850.832:22): pid=7075 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.361" name="/newroot/88/file1/file1" dev="loop0" ino=15 res=1 errno=0
[  153.534093][ T5787] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  153.611264][ T5880] usb 2-1: too many endpoints for config 0 interface 0 altsetting 8: 130, using maximum allowed: 30
[  153.622579][ T7081] netlink: 104 bytes leftover after parsing attributes in process `syz.0.363'.
[  153.633452][ T5880] usb 2-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 130
[  153.647353][ T5880] usb 2-1: config 0 interface 0 has no altsetting 0
[  153.671873][ T5880] usb 2-1: New USB device found, idVendor=046d, idProduct=c298, bcdDevice= 0.00
[  153.684898][ T5880] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=64
[  153.695725][ T5880] usb 2-1: SerialNumber: syz
[  153.703133][ T5880] usb 2-1: config 0 descriptor??
[  153.713896][ T5880] usbhid 2-1:0.0: couldn't find an input interrupt endpoint
[  153.845267][ T7083] svc: failed to register nfsdv3 RPC service (errno 97).
[  153.857319][ T7083] svc: failed to register nfsaclv3 RPC service (errno 97).
[  153.930151][ T5880] usb 2-1: USB disconnect, device number 4
[  154.220496][   T53] Bluetooth: hci0: command 0x0c1a tx timeout
[  154.246254][ T7077] block nbd2: shutting down sockets
[  154.538465][ T5800] Bluetooth: hci1: command 0x0c1a tx timeout
[  154.556717][ T7087] loop0: detected capacity change from 0 to 40427
[  154.572473][ T7087] F2FS-fs (loop0): Invalid SB checksum offset: 0
[  154.586703][ T7087] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock
[  154.619173][ T7087] F2FS-fs (loop0): invalid crc value
[  154.629924][ T5800] Bluetooth: hci2: command 0x0c1a tx timeout
[  154.698477][ T5800] Bluetooth: hci3: command 0x0c1a tx timeout
[  154.723168][ T7093] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input11
[  154.954600][ T7087] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0
[  154.962814][ T7087] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
[  155.048922][  T791] usb 4-1: new high-speed USB device number 7 using dummy_hcd
[  155.113152][ T5787] syz-executor: attempt to access beyond end of device
[  155.113152][ T5787] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  155.143907][ T5787] F2FS-fs (loop0): Stopped filesystem due to reason: 3
[  155.305234][  T791] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  155.328379][  T791] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  155.338224][  T791] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  155.394487][  T791] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  155.412059][  T791] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  155.452419][  T791] usb 4-1: config 0 descriptor??
[  155.562155][ T7104] loop1: detected capacity change from 0 to 32768
[  155.632339][ T7104] XFS (loop1): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  155.792460][ T7104] XFS (loop1): Ending clean mount
[  155.835691][ T7122] loop2: detected capacity change from 0 to 2048
[  155.903574][  T791] plantronics 0003:047F:FFFF.0009: reserved main item tag 0xd
[  155.929628][ T7104] XFS (loop1): WARNING: Reset corrupted AGFL on AG 0. 1 blocks leaked. Please unmount and run xfs_repair.
[  155.964190][ T7122] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  155.976163][  T791] plantronics 0003:047F:FFFF.0009: No inputs registered, leaving
[  156.006644][  T791] plantronics 0003:047F:FFFF.0009: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0
[  156.053674][ T7122] ext4 filesystem being mounted at /20/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  156.186505][    T9] usb 4-1: USB disconnect, device number 7
[  156.214973][ T7130] EXT4-fs error (device loop2): ext4_validate_block_bitmap:439: comm syz.2.378: bg 0: block 345: padding at end of block bitmap is not set
[  156.245866][ T7129] fido_id[7129]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory
[  156.260848][ T5786] XFS (loop1): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  156.285850][ T7130] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 15 with max blocks 1 with error 117
[  156.303145][ T5800] Bluetooth: hci0: command 0x0c1a tx timeout
[  156.319601][ T7130] EXT4-fs (loop2): This should not happen!! Data will be lost
[  156.319601][ T7130] 
[  156.334334][ T7122] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 15 with error 28
[  156.347466][ T7122] EXT4-fs (loop2): This should not happen!! Data will be lost
[  156.347466][ T7122] 
[  156.359653][ T7122] EXT4-fs (loop2): Total free blocks count 0
[  156.365843][ T7122] EXT4-fs (loop2): Free/Dirty block details
[  156.375081][ T7122] EXT4-fs (loop2): free_blocks=0
[  156.380958][ T7122] EXT4-fs (loop2): dirty_blocks=176
[  156.386496][ T7122] EXT4-fs (loop2): Block reservation details
[  156.621677][ T5800] Bluetooth: hci1: command 0x0c1a tx timeout
[  156.698468][ T5800] Bluetooth: hci2: command 0x0c1a tx timeout
[  156.789074][ T5800] Bluetooth: hci3: command 0x0c1a tx timeout
[  157.275895][ T7140] loop3: detected capacity change from 0 to 32768
[  157.308637][ T7140] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.383 (7140)
[  157.346628][ T7140] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  157.365268][ T7155] loop0: detected capacity change from 0 to 2048
[  157.372234][ T7140] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[  157.422196][ T7140] BTRFS info (device loop3): setting nodatacow, compression disabled
[  157.434551][ T7155] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  157.438965][ T7140] BTRFS info (device loop3): disabling tree log
[  157.458068][ T7140] BTRFS info (device loop3): turning on async discard
[  157.496492][ T7140] BTRFS info (device loop3): max_inline at 0
[  157.527995][ T7140] BTRFS info (device loop3): using free space tree
[  158.106464][ T5789] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  158.566244][ T7199] loop0: detected capacity change from 0 to 164
[  159.048936][ T7191] loop1: detected capacity change from 0 to 40427
[  159.095365][ T7191] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12
[  159.124398][ T7191] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock
[  159.188896][ T7191] F2FS-fs (loop1): Found nat_bits in checkpoint
[  159.335965][ T7191] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0
[  159.355417][ T7191] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5
[  159.650977][ T7215] loop2: detected capacity change from 0 to 4096
[  159.740040][ T7218] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  159.891895][   T28] audit: type=1800 audit(1793193857.242:23): pid=7215 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.406" name="file1" dev="loop2" ino=15 res=0 errno=0
[  159.998516][   T27] usb 4-1: new high-speed USB device number 8 using dummy_hcd
[  160.060245][ T7224] netlink: 4 bytes leftover after parsing attributes in process `syz.0.410'.
[  160.175662][   T28] audit: type=1326 audit(1793193857.532:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7225 comm="syz.0.411" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f939399f559 code=0x0
[  160.208269][   T27] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  160.217537][   T27] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  160.309769][   T27] usb 4-1: config 0 descriptor??
[  160.326173][   T27] cp210x 4-1:0.0: cp210x converter detected
[  160.740333][   T27] cp210x 4-1:0.0: failed to get vendor val 0x0010 size 3: -32
[  160.766905][   T27] usb 4-1: cp210x converter now attached to ttyUSB0
[  160.959131][    T9] usb 4-1: USB disconnect, device number 8
[  160.983364][    T9] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0
[  160.994026][    T9] cp210x 4-1:0.0: device disconnected
[  161.009913][ T5904] usb 2-1: new high-speed USB device number 5 using dummy_hcd
[  161.127792][ T7247] loop0: detected capacity change from 0 to 64
[  161.181027][   T28] audit: type=1800 audit(1793193858.532:25): pid=7247 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.418" name="file1" dev="loop0" ino=21 res=0 errno=0
[  161.224343][ T5904] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32
[  161.238020][ T7247] syz.0.418: attempt to access beyond end of device
[  161.238020][ T7247] loop0: rw=34817, sector=39, nr_sectors = 125 limit=64
[  161.252919][ T5904] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  161.279163][ T5904] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66
[  161.290850][ T7247] syz.0.418: attempt to access beyond end of device
[  161.290850][ T7247] loop0: rw=34817, sector=167, nr_sectors = 1 limit=64
[  161.305820][ T5904] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  161.317367][ T7247] syz.0.418: attempt to access beyond end of device
[  161.317367][ T7247] loop0: rw=34817, sector=169, nr_sectors = 1 limit=64
[  161.331508][ T7247] syz.0.418: attempt to access beyond end of device
[  161.331508][ T7247] loop0: rw=34817, sector=171, nr_sectors = 7 limit=64
[  161.348571][ T5904] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40
[  161.357815][ T5904] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0
[  161.371748][ T7247] syz.0.418: attempt to access beyond end of device
[  161.371748][ T7247] loop0: rw=34817, sector=179, nr_sectors = 371 limit=64
[  161.385845][ T5904] usb 2-1: Product: syz
[  161.390273][ T5904] usb 2-1: Manufacturer: syz
[  161.402540][ T5904] cdc_wdm 2-1:1.0: skipping garbage
[  161.413481][ T5904] cdc_wdm 2-1:1.0: skipping garbage
[  161.421718][ T5904] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device
[  161.427725][ T5904] cdc_wdm 2-1:1.0: Unknown control protocol
[  161.654235][   T27] usb 2-1: USB disconnect, device number 5
[  162.252129][   T27] usb 2-1: new high-speed USB device number 6 using dummy_hcd
[  162.381070][ T7253] loop3: detected capacity change from 0 to 32768
[  162.419050][ T7253] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 scanned by syz.3.422 (7253)
[  162.460670][   T27] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32
[  162.479326][   T27] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  162.505751][ T7253] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  162.531372][   T27] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66
[  162.542392][   T53] Bluetooth: hci0: command 0x0c1a tx timeout
[  162.552499][ T5800] Bluetooth: hci0: Opcode 0x0c3a failed: -110
[  162.562954][ T7253] BTRFS info (device loop3): using crc32c (crc32c-intel) checksum algorithm
[  162.588416][   T27] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  162.608967][ T7253] BTRFS warning (device loop3): excessive commit interval 3581
[  162.629027][ T7253] BTRFS info (device loop3): force zlib compression, level 3
[  162.650508][   T27] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40
[  162.673376][ T7253] BTRFS info (device loop3): metadata ratio 107050
[  162.683482][   T27] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0
[  162.703884][ T7253] BTRFS info (device loop3): turning on flush-on-commit
[  162.714197][   T27] usb 2-1: Product: syz
[  162.728917][ T7253] BTRFS info (device loop3): max_inline at 0
[  162.735197][   T27] usb 2-1: Manufacturer: syz
[  162.756954][ T7253] BTRFS info (device loop3): using free space tree
[  162.776899][   T27] cdc_wdm 2-1:1.0: skipping garbage
[  162.787646][ T7257] loop2: detected capacity change from 0 to 40427
[  162.794726][   T27] cdc_wdm 2-1:1.0: skipping garbage
[  162.807045][   T27] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device
[  162.818118][   T27] cdc_wdm 2-1:1.0: Unknown control protocol
[  162.834539][ T7257] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12
[  162.854849][ T7257] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock
[  162.938447][ T7257] F2FS-fs (loop2): Found nat_bits in checkpoint
[  163.019059][ T7253] BTRFS info (device loop3): enabling ssd optimizations
[  163.085475][ T7261] loop0: detected capacity change from 0 to 32768
[  163.088851][ T7257] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0
[  163.150181][ T7257] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5
[  163.191492][ T7261] XFS (loop0): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  163.276000][ T7257] syz.2.423: attempt to access beyond end of device
[  163.276000][ T7257] loop2: rw=10241, sector=45096, nr_sectors = 8 limit=40427
[  163.371153][ T7261] XFS (loop0): Ending clean mount
[  163.401053][ T7257] syz.2.423: attempt to access beyond end of device
[  163.401053][ T7257] loop2: rw=2049, sector=45104, nr_sectors = 8 limit=40427
[  163.455874][ T7257] syz.2.423: attempt to access beyond end of device
[  163.455874][ T7257] loop2: rw=2049, sector=77824, nr_sectors = 56 limit=40427
[  163.512173][   T28] audit: type=1800 audit(1793193860.862:26): pid=7261 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.424" name="file1" dev="loop0" ino=6150 res=0 errno=0
[  163.543567][ T5789] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  163.575517][   T27] usb 2-1: USB disconnect, device number 6
[  163.878067][ T5787] XFS (loop0): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  163.955672][ T6558] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 10 /dev/loop3 scanned by udevd (6558)
[  164.887557][ T7306] loop3: detected capacity change from 0 to 32768
[  164.978984][ T7306] XFS (loop3): Mounting V5 Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a
[  165.107035][ T7306] XFS (loop3): Ending clean mount
[  165.144896][ T7342] overlayfs: upper fs does not support file handles, falling back to index=off.
[  165.426142][ T5789] XFS (loop3): Unmounting Filesystem ed37bf6e-74ea-4e01-afba-5fee274b0f3a
[  165.744597][ T7349] loop1: detected capacity change from 0 to 1024
[  166.048729][ T7344] loop2: detected capacity change from 0 to 32768
[  166.125599][ T7358] hfsplus: found bad thread record in catalog
[  166.133990][ T7344] JBD2: Ignoring recovery information on journal
[  166.244630][ T7344] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode.
[  166.292576][   T49] hfsplus: found bad thread record in catalog
[  166.335722][   T49] hfsplus: b-tree write err: -5, ino 8
[  166.662103][ T6766] OCFS2: ERROR (device loop2): int ocfs2_validate_gd_self(struct super_block *, struct buffer_head *, int): Group descriptor #1056 has bad signature 
[  166.696767][ T6766] On-disk corruption discovered. Please run fsck.ocfs2 once the filesystem is unmounted.
[  166.710372][ T6766] OCFS2: File system is now read-only.
[  166.715908][ T6766] (syz-executor,6766,0):_ocfs2_free_suballoc_bits:2511 ERROR: status = -30
[  166.733134][ T6766] (syz-executor,6766,0):_ocfs2_free_clusters:2605 ERROR: status = -30
[  166.748388][ T6766] (syz-executor,6766,0):ocfs2_sync_local_to_main:1001 ERROR: status = -30
[  166.757060][ T6766] (syz-executor,6766,0):ocfs2_sync_local_to_main:1013 ERROR: status = -30
[  166.771179][ T6766] (syz-executor,6766,0):ocfs2_shutdown_local_alloc:449 ERROR: status = -30
[  166.782760][ T7375] process 'syz.1.444' launched './file0' with NULL argv: empty string added
[  166.811942][ T7375] Invalid argument reading file caps for ./file0
[  166.839210][ T6766] ocfs2: Unmounting device (7,2) on (node local)
[  166.971809][ T7379] loop1: detected capacity change from 0 to 128
[  167.061817][ T7379] syz.1.447: attempt to access beyond end of device
[  167.061817][ T7379] loop1: rw=2049, sector=138, nr_sectors = 2 limit=128
[  167.134467][ T7379] syz.1.447: attempt to access beyond end of device
[  167.134467][ T7379] loop1: rw=2049, sector=140, nr_sectors = 2 limit=128
[  167.154762][ T7379] Buffer I/O error on dev loop1, logical block 70, lost async page write
[  167.163838][ T7379] syz.1.447: attempt to access beyond end of device
[  167.163838][ T7379] loop1: rw=2049, sector=142, nr_sectors = 2 limit=128
[  167.181880][ T7379] Buffer I/O error on dev loop1, logical block 71, lost async page write
[  167.223007][ T7379] syz.1.447: attempt to access beyond end of device
[  167.223007][ T7379] loop1: rw=2049, sector=144, nr_sectors = 2 limit=128
[  167.248768][ T5880] usb 1-1: new high-speed USB device number 4 using dummy_hcd
[  167.256709][ T7379] Buffer I/O error on dev loop1, logical block 72, lost async page write
[  167.279317][ T7379] syz.1.447: attempt to access beyond end of device
[  167.279317][ T7379] loop1: rw=2049, sector=146, nr_sectors = 104 limit=128
[  167.312154][ T7384] syz.1.447: attempt to access beyond end of device
[  167.312154][ T7384] loop1: rw=2049, sector=142, nr_sectors = 2 limit=128
[  167.326501][ T7384] Buffer I/O error on dev loop1, logical block 71, lost async page write
[  167.354177][ T7388] loop2: detected capacity change from 0 to 1024
[  167.440517][ T5880] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  167.460001][ T5880] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  167.479656][ T5880] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  167.493499][ T5880] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  167.506351][ T7388] hfsplus: catalog searching failed
[  167.513695][ T5880] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  167.535285][ T5880] usb 1-1: config 0 descriptor??
[  167.609143][   T51] hfsplus: b-tree write err: -5, ino 3
[  167.646904][ T6766] hfsplus: node 4:3 still has 1 user(s)!
[  167.736792][ T7395] iommufd_mock iommufd_mock1: Adding to iommu group 0
[  167.744641][ T5800] Bluetooth: hci2: command 0x0c1a tx timeout
[  167.848477][ T7397] loop2: detected capacity change from 0 to 256
[  167.983053][ T5880] plantronics 0003:047F:FFFF.000A: No inputs registered, leaving
[  168.014182][ T5880] plantronics 0003:047F:FFFF.000A: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0
[  168.168088][ T7402] input: syz1 as /devices/virtual/input/input14
[  168.262622][ T5880] usb 1-1: USB disconnect, device number 4
[  168.365416][ T7406] binder: 7405:7406 ioctl c0306201 0 returned -14
[  168.480864][ T7411] netlink: 24 bytes leftover after parsing attributes in process `syz.3.458'.
[  168.494200][ T7411] netlink: 67 bytes leftover after parsing attributes in process `syz.3.458'.
[  168.601298][ T7415] netlink: 16 bytes leftover after parsing attributes in process `syz.1.459'.
[  168.866946][ T7425] loop3: detected capacity change from 0 to 256
[  169.332090][ T7440] FAULT_INJECTION: forcing a failure.
[  169.332090][ T7440] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  169.360918][ T7440] CPU: 0 PID: 7440 Comm: syz.2.471 Not tainted syzkaller #0
[  169.368313][ T7440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[  169.378439][ T7440] Call Trace:
[  169.381776][ T7440]  <TASK>
[  169.384769][ T7440]  dump_stack_lvl+0x18c/0x250
[  169.389527][ T7440]  ? show_regs_print_info+0x20/0x20
[  169.394808][ T7440]  ? load_image+0x420/0x420
[  169.399383][ T7440]  ? __might_fault+0xaa/0x120
[  169.404132][ T7440]  ? __lock_acquire+0x7eb0/0x7eb0
[  169.409227][ T7440]  ? __up_read+0x2b8/0x6b0
[  169.413712][ T7440]  ? __virt_addr_valid+0x10c/0x380
[  169.418894][ T7440]  should_fail_ex+0x394/0x4c0
[  169.423651][ T7440]  _copy_to_user+0x2f/0xa0
[  169.428144][ T7440]  __se_sys_mincore+0x4fb/0x600
[  169.433077][ T7440]  ? lockdep_hardirqs_on+0x98/0x150
[  169.438357][ T7440]  do_syscall_64+0x55/0xb0
[  169.442888][ T7440]  ? clear_bhb_loop+0x40/0x90
[  169.447684][ T7440]  ? clear_bhb_loop+0x40/0x90
[  169.452438][ T7440]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  169.458400][ T7440] RIP: 0033:0x7f08a659f559
[  169.462877][ T7440] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  169.482606][ T7440] RSP: 002b:00007f08a73f8028 EFLAGS: 00000246 ORIG_RAX: 000000000000001b
[  169.491101][ T7440] RAX: ffffffffffffffda RBX: 00007f08a6825fa0 RCX: 00007f08a659f559
[  169.499144][ T7440] RDX: 0000000000000000 RSI: 0000000000004000 RDI: 0000200000ffa000
[  169.507183][ T7440] RBP: 00007f08a6636b20 R08: 0000000000000000 R09: 0000000000000000
[  169.515210][ T7440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  169.523235][ T7440] R13: 00007f08a6826038 R14: 00007f08a6825fa0 R15: 00007ffdeebcd268
[  169.531268][ T7440]  </TASK>
[  169.718911][ T7448] loop3: detected capacity change from 0 to 1024
[  169.741437][ T7448] hfsplus: write access to a journaled filesystem is not supported, use the force option at your own risk, mounting read-only.
[  169.898597][ T5800] Bluetooth: hci2: command 0x0c1a tx timeout
[  170.084108][ T7458] netlink: 8 bytes leftover after parsing attributes in process `syz.2.479'.
[  170.170184][ T7448] hfsplus: filesystem is marked journaled, leaving read-only.
[  170.507051][ T7469] loop0: detected capacity change from 0 to 16
[  170.530300][ T7469] MTD: Attempt to mount non-MTD device "/dev/loop0"
[  170.555936][ T6558] udevd[6558]: incorrect cramfs checksum on /dev/loop0
[  170.784399][ T7471] loop3: detected capacity change from 0 to 2048
[  170.946784][ T7474] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  171.038499][   T28] audit: type=1800 audit(1793193868.382:27): pid=7471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.483" name="file1" dev="loop3" ino=15 res=0 errno=0
[  171.167829][   T28] audit: type=1800 audit(1793193868.382:28): pid=7471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.483" name="file1" dev="loop3" ino=15 res=0 errno=0
[  171.518426][ T5800] Bluetooth: hci3: command 0x0c1a tx timeout
[  171.642917][ T7467] loop2: detected capacity change from 0 to 131072
[  171.669428][ T7467] F2FS-fs (loop2): Wrong secs_per_zone / total_sections (512, 24)
[  171.677412][ T7467] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock
[  171.685798][ T7467] F2FS-fs (loop2): Test dummy encryption mode enabled
[  171.695762][ T7467] F2FS-fs (loop2): invalid crc value
[  171.729269][ T7467] F2FS-fs (loop2): Found nat_bits in checkpoint
[  171.774405][ T7467] F2FS-fs (loop2): f2fs_check_nid_range: out-of-range nid=80000000, run fsck to fix.
[  171.793911][ T7467] F2FS-fs (loop2): Start checkpoint disabled!
[  171.830014][ T7467] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0
[  171.837182][ T7467] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6
[  171.965977][ T7497] input: PS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input15
[  172.449362][ T7506] netlink: 48 bytes leftover after parsing attributes in process `syz.2.493'.
[  172.558546][   T27] usb 1-1: new high-speed USB device number 5 using dummy_hcd
[  172.652033][ T7512] loop3: detected capacity change from 0 to 164
[  172.704648][ T7512] 
[  172.707070][ T7512] ======================================================
[  172.714132][ T7512] WARNING: possible circular locking dependency detected
[  172.721208][ T7512] syzkaller #0 Not tainted
[  172.725675][ T7512] ------------------------------------------------------
[  172.732738][ T7512] syz.3.498/7512 is trying to acquire lock:
[  172.738671][ T7512] ffff88807a6a80e0 (&type->s_umount_key#97){++++}-{3:3}, at: super_lock+0x189/0x390
[  172.748157][ T7512] 
[  172.748157][ T7512] but task is already holding lock:
[  172.755566][ T7512] ffff8880210cc788 (&bdev->bd_holder_lock){+.+.}-{3:3}, at: blkdev_common_ioctl+0x838/0x2580
[  172.765832][ T7512] 
[  172.765832][ T7512] which lock already depends on the new lock.
[  172.765832][ T7512] 
[  172.776284][ T7512] 
[  172.776284][ T7512] the existing dependency chain (in reverse order) is:
[  172.785346][ T7512] 
[  172.785346][ T7512] -> #4 (&bdev->bd_holder_lock){+.+.}-{3:3}:
[  172.793580][ T7512]        __mutex_lock+0x135/0xc80
[  172.798759][ T7512]        bd_finish_claiming+0x229/0x3f0
[  172.804367][ T7512]        blkdev_get_by_dev+0x469/0x610
[  172.809887][ T7512]        bdev_open_by_dev+0x77/0x100
[  172.815270][ T7512]        setup_bdev_super+0x59/0x660
[  172.820613][ T7512]        mount_bdev+0x1ce/0x2c0
[  172.825515][ T7512]        legacy_get_tree+0xea/0x180
[  172.830768][ T7512]        vfs_get_tree+0x8c/0x280
[  172.835760][ T7512]        do_new_mount+0x24a/0xa60
[  172.840834][ T7512]        init_mount+0xde/0x130
[  172.845652][ T7512]        do_mount_root+0x97/0x230
[  172.850735][ T7512]        mount_root_generic+0x1a6/0x3e0
[  172.856336][ T7512]        prepare_namespace+0xc2/0x100
[  172.861755][ T7512]        kernel_init_freeable+0x41a/0x560
[  172.867534][ T7512]        kernel_init+0x1d/0x1c0
[  172.872432][ T7512]        ret_from_fork+0x48/0x80
[  172.877426][ T7512]        ret_from_fork_asm+0x11/0x20
[  172.882766][ T7512] 
[  172.882766][ T7512] -> #3 (bdev_lock){+.+.}-{3:3}:
[  172.889953][ T7512]        __mutex_lock+0x135/0xc80
[  172.895043][ T7512]        bd_prepare_to_claim+0x1d9/0x4a0
[  172.900749][ T7512]        truncate_bdev_range+0x4e/0x260
[  172.906360][ T7512]        blkdev_fallocate+0x50d/0x6a0
[  172.911797][ T7512]        vfs_fallocate+0x585/0x6f0
[  172.916971][ T7512]        __x64_sys_fallocate+0xc1/0x110
[  172.922659][ T7512]        do_syscall_64+0x55/0xb0
[  172.927664][ T7512]        entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  172.934142][ T7512] 
[  172.934142][ T7512] -> #2 (mapping.invalidate_lock){++++}-{3:3}:
[  172.942547][ T7512]        down_write+0x97/0x200
[  172.947362][ T7512]        set_blocksize+0x247/0x4b0
[  172.952564][ T7512]        sb_min_blocksize+0xbe/0x190
[  172.957921][ T7512]        ext4_fill_super+0x6e7/0x6820
[  172.959299][    T8] usb 3-1: new high-speed USB device number 4 using dummy_hcd
[  172.963348][ T7512]        get_tree_bdev+0x3e5/0x520
[  172.963383][ T7512]        vfs_get_tree+0x8c/0x280
[  172.981009][ T7512]        do_new_mount+0x24a/0xa60
[  172.986086][ T7512]        init_mount+0xde/0x130
[  172.990998][ T7512]        do_mount_root+0x97/0x230
[  172.996091][ T7512]        mount_root_generic+0x1a6/0x3e0
[  173.001704][ T7512]        prepare_namespace+0xc2/0x100
[  173.007131][ T7512]        kernel_init_freeable+0x41a/0x560
[  173.012932][ T7512]        kernel_init+0x1d/0x1c0
[  173.017837][ T7512]        ret_from_fork+0x48/0x80
[  173.022831][ T7512]        ret_from_fork_asm+0x11/0x20
[  173.028176][ T7512] 
[  173.028176][ T7512] -> #1 (&sb->s_type->i_mutex_key#8){++++}-{3:3}:
[  173.036930][ T7512]        down_write+0x97/0x200
[  173.041745][ T7512]        set_blocksize+0x1ff/0x4b0
[  173.046911][ T7512]        sb_min_blocksize+0xbe/0x190
[  173.052272][ T7512]        isofs_fill_super+0xa1b/0x28d0
[  173.057799][ T7512]        mount_bdev+0x21c/0x2c0
[  173.062714][ T7512]        legacy_get_tree+0xea/0x180
[  173.067979][ T7512]        vfs_get_tree+0x8c/0x280
[  173.072970][ T7512]        do_new_mount+0x24a/0xa60
[  173.078055][ T7512]        __se_sys_mount+0x2e7/0x3d0
[  173.083306][ T7512]        do_syscall_64+0x55/0xb0
[  173.088311][ T7512]        entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  173.094788][ T7512] 
[  173.094788][ T7512] -> #0 (&type->s_umount_key#97){++++}-{3:3}:
[  173.103109][ T7512]        __lock_acquire+0x3a07/0x7eb0
[  173.108538][ T7512]        lock_acquire+0x19e/0x420
[  173.113623][ T7512]        down_read+0x46/0x2e0
[  173.118348][ T7512]        super_lock+0x189/0x390
[  173.123300][ T7512]        fs_bdev_sync+0xa4/0x170
[  173.128287][ T7512]        blkdev_common_ioctl+0x8a9/0x2580
[  173.134056][ T7512]        blkdev_ioctl+0x512/0x730
[  173.139140][ T7512]        __se_sys_ioctl+0xfd/0x170
[  173.144313][ T7512]        do_syscall_64+0x55/0xb0
[  173.149318][ T7512]        entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  173.155833][ T7512] 
[  173.155833][ T7512] other info that might help us debug this:
[  173.155833][ T7512] 
[  173.166151][ T7512] Chain exists of:
[  173.166151][ T7512]   &type->s_umount_key#97 --> bdev_lock --> &bdev->bd_holder_lock
[  173.166151][ T7512] 
[  173.179881][ T7512]  Possible unsafe locking scenario:
[  173.179881][ T7512] 
[  173.187386][ T7512]        CPU0                    CPU1
[  173.192791][ T7512]        ----                    ----
[  173.198199][ T7512]   lock(&bdev->bd_holder_lock);
[  173.203199][ T7512]                                lock(bdev_lock);
[  173.209462][    T8] usb 3-1: Using ep0 maxpacket: 32
[  173.209690][ T7512]                                lock(&bdev->bd_holder_lock);
[  173.222337][ T7512]   rlock(&type->s_umount_key#97);
[  173.227512][ T7512] 
[  173.227512][ T7512]  *** DEADLOCK ***
[  173.227512][ T7512] 
[  173.235701][ T7512] 1 lock held by syz.3.498/7512:
[  173.237286][    T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  173.240657][ T7512]  #0: ffff8880210cc788 (&bdev->bd_holder_lock){+.+.}-{3:3}, at: blkdev_common_ioctl+0x838/0x2580
[  173.262203][ T7512] 
[  173.262203][ T7512] stack backtrace:
[  173.268132][ T7512] CPU: 1 PID: 7512 Comm: syz.3.498 Not tainted syzkaller #0
[  173.275484][ T7512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[  173.281646][    T8] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[  173.285572][ T7512] Call Trace:
[  173.285585][ T7512]  <TASK>
[  173.285593][ T7512]  dump_stack_lvl+0x18c/0x250
[  173.285626][ T7512]  ? load_image+0x420/0x420
[  173.285647][ T7512]  ? show_regs_print_info+0x20/0x20
[  173.285678][ T7512]  ? print_circular_bug+0x12b/0x1a0
[  173.285709][ T7512]  check_noncircular+0x2fc/0x400
[  173.285740][ T7512]  ? print_deadlock_bug+0x5d0/0x5d0
[  173.285765][ T7512]  ? lockdep_lock+0xf5/0x230
[  173.285793][ T7512]  ? _find_first_zero_bit+0xd6/0x100
[  173.285823][ T7512]  __lock_acquire+0x3a07/0x7eb0
[  173.285863][ T7512]  ? verify_lock_unused+0x140/0x140
[  173.285899][ T7512]  ? verify_lock_unused+0x140/0x140
[  173.285925][ T7512]  ? stack_trace_save+0xaa/0x100
[  173.285951][ T7512]  ? stack_trace_snprint+0xf0/0xf0
[  173.285976][ T7512]  ? kasan_save_free_info+0x28/0x40
[  173.286009][ T7512]  ? __stack_depot_save+0x1f/0x660
[  173.286037][ T7512]  ? do_syscall_64+0x55/0xb0
[  173.286068][ T7512]  lock_acquire+0x19e/0x420
[  173.286092][ T7512]  ? super_lock+0x189/0x390
[  173.286119][ T7512]  ? __might_sleep+0xe0/0xe0
[  173.286147][ T7512]  ? read_lock_is_recursive+0x20/0x20
[  173.286171][ T7512]  ? __mutex_trylock_common+0x160/0x270
[  173.286194][ T7512]  ? trace_raw_output_contention_end+0xd0/0xd0
[  173.286221][ T7512]  down_read+0x46/0x2e0
[  173.286240][ T7512]  ? super_lock+0x189/0x390
[  173.324049][    T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  173.326120][ T7512]  super_lock+0x189/0x390
[  173.433583][ T7512]  ? end_current_label_crit_section+0x170/0x170
[  173.439907][ T7512]  ? user_get_super+0x180/0x180
[  173.444821][ T7512]  ? mutex_lock_nested+0x20/0x20
[  173.449830][ T7512]  fs_bdev_sync+0xa4/0x170
[  173.454313][ T7512]  ? fs_bdev_mark_dead+0x1f0/0x1f0
[  173.459476][ T7512]  blkdev_common_ioctl+0x8a9/0x2580
[  173.464734][ T7512]  ? tomoyo_path_number_perm+0x56b/0x5e0
[  173.470417][ T7512]  ? blkdev_bszset+0x1f0/0x1f0
[  173.475225][ T7512]  ? tomoyo_check_path_acl+0x1c0/0x1c0
[  173.480760][ T7512]  blkdev_ioctl+0x512/0x730
[  173.485358][ T7512]  ? blkdev_compat_ptr_ioctl+0xd0/0xd0
[  173.490919][ T7512]  ? bpf_lsm_file_ioctl+0x9/0x10
[  173.495913][ T7512]  ? security_file_ioctl+0x80/0xa0
[  173.501085][ T7512]  ? blkdev_compat_ptr_ioctl+0xd0/0xd0
[  173.506645][ T7512]  __se_sys_ioctl+0xfd/0x170
[  173.511299][ T7512]  do_syscall_64+0x55/0xb0
[  173.515776][ T7512]  ? clear_bhb_loop+0x40/0x90
[  173.520511][ T7512]  ? clear_bhb_loop+0x40/0x90
[  173.525251][ T7512]  entry_SYSCALL_64_after_hwframe+0x68/0xd2
[  173.531201][ T7512] RIP: 0033:0x7fac98b9f559
[  173.535658][ T7512] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  173.555320][ T7512] RSP: 002b:00007fac999db028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  173.561704][    T8] usb 3-1: config 0 descriptor??
[  173.563769][ T7512] RAX: ffffffffffffffda RBX: 00007fac98e25fa0 RCX: 00007fac98b9f559
[  173.576762][ T7512] RDX: 0000000000000000 RSI: 0000000000001261 RDI: 0000000000000004
[  173.584787][ T7512] RBP: 00007fac98c36b20 R08: 0000000000000000 R09: 0000000000000000
[  173.592807][ T7512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  173.600837][ T7512] R13: 00007fac98e26038 R14: 00007fac98e25fa0 R15: 00007ffed3017288
[  173.608880][ T7512]  </TASK>
[  173.613831][    T8] hub 3-1:0.0: USB hub found
[  173.649926][   T27] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  173.668471][   T27] usb 1-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice= 0.01
[  173.677669][   T27] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  173.693800][   T27] as10x_usb: device has been detected
[  173.702218][   T27] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan)
[  173.723456][   T27] usb 1-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)...
[  173.786006][   T27] as10x_usb: error during firmware upload part1
[  173.809388][   T27] Registered device Abilis Systems DVB-Titan
[  173.822996][    T8] hub 3-1:0.0: config failed, can't read hub descriptor (err -22)
[  173.845476][    T8] usbhid 3-1:0.0: can't add hid device: -71
[  173.853289][    T8] usbhid: probe of 3-1:0.0 failed with error -71
[  173.910529][    T8] usb 3-1: USB disconnect, device number 4
[  174.305845][    T9] usb 1-1: USB disconnect, device number 5
[  174.327055][    T9] Unregistered device Abilis Systems DVB-Titan
[  174.328196][    T9] as10x_usb: device has been disconnected
[  174.418497][    T8] usb 3-1: new high-speed USB device number 5 using dummy_hcd
[  174.598385][    T8] usb 3-1: Using ep0 maxpacket: 32
[  174.605715][    T8] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  174.617572][    T8] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[  174.627015][    T8] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  174.638187][    T8] usb 3-1: config 0 descriptor??
[  174.651116][    T8] hub 3-1:0.0: USB hub found
[  174.852856][    T8] hub 3-1:0.0: 7 ports detected
[  174.858239][    T8] hub 3-1:0.0: insufficient power available to use all downstream ports
[  175.264857][    T8] usb 3-1: USB disconnect, device number 5