program: r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000040)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000680)={0x2c, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x0}) syz_mount_image$udf(&(0x7f0000000180), &(0x7f0000000100)='./bus\x00', 0x1014494, &(0x7f00000002c0)={[{@iocharset={'iocharset', 0x3d, 'iso8859-4'}}, {@partition={'partition', 0x3d, 0x6}}, {@gid_forget}, {@session={'session', 0x3d, 0xfe8}}, {@noadinicb}, {@anchor}, {@uid_forget}]}, 0xfe, 0xc24, &(0x7f0000001480)="$eJzs3UFsHNd9B+D/Gy5Fym4rJk5Uu42LTVukMmO5sqSYilW4q5pmG0CWiVDMLQBX5EpdmFoSJNXIRtrQvfTQQ4Ci6CEnAq1RIEUDoymCHtnWBZKLD0VOPREtbARFD2wRIKeAxcy+lZY0ZcmmSFH299nUbznz3ux7b5YzkqA3LwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAiN976cKpZ9ODbgUAcJAuTX311Gn3fwD4RLnsz/8AAAAAAAAAAAAAAHDYpSjisUixeGkzzVTfdw1fbHdu3Jwen9i92tFU1Ryoypdfw8+ePnP2S8+NnevlB9e/356IV6YuX6i/uHB9cam1vNyaq0932rMLc617PsJe6+80Wg1A/fqrN+auXl2un37mzLbdN0feG3r0+Mj5sadOPtkrOz0+MTHVV6Y2+JHf/X3uNMPjSBRxMlI8/b2fpGZEFLH3sbjLZ2e/Ha06MVp1Ynp8ourIfLvZWSl3TvYGooio91Vq9MboAM7FnjQiVsvmlw0eLbs3tdhcal6Zb9Unm0sr7ZX2QmcydVtb9qceRZxLEWsRsTH0/sMNRhG1SPGdY5vpSkQM9Mbhi9XE4Du3o9jHPt6Dsp31wYi14iE4Z4fYUBTxcqT46dtFzJZjlr/iCxEvl/mDiDfLfCEilR+MsxHv7vI54uFUiyL+vDz/5zfTXHU96F1XLn6t/pXO1YW+sr3rykN/fzhIh/zaNBxFNKsr/mb66L/ZAQAAAAAAAAAAAAAAAOB+OxpFPBEpXvr3P6rmFUc1L/3Y+bHfH/nF/jnjj9/lOGXZZyJitbi3OblH8hTiyTSZ0gOeS/xJNhxF/HGe//fGg24MAAAAAAAAAAAAAAAAAADAJ9yPI8Xz75xIa9G/pni7c61+uXllvrsqbG/t396a6VtbW1v11M1GzpmcqznXcq7n3MgZRa6fs5FzJudqzrWc6zk3csZArp+zkXMm52rOtZzrOTdyRi3Xz9nIOZNzNedazvWcGznjkKzdCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwcVJEET+PFN/+xmaKFBGNiJno5vpQrwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8CANpSK+Hynqf9C4ta0WEan6v+tE+cvZaBwp89PRGCvzhWhcyNmsstZ44wG0n70ZTEX8KFIMDb9164Tn8z/Y/e7WxyDe/Obt736l1s2B3s6R94YePX7s/NjErz1+p9dptwaMXmx3btysT49PTEz1ba7ld/9037aR/L7F/ek6EbH82uuvNufnW0ufmBdFHIpmPKgXte6LWhyS9hzUi3y9il12FYfhp6BxWAaq9+IBX5g4EOX9/91I8dvv/Efvht+7//9C97tbd/j42Z/cvv8/v/NA+3T/f6xv2/P5dyODtYjhleuLg8cjhpdfe/1k+3rzWutaq3P21Kkvj419+cypwSMRw1fb862+V3seKgAAAAAAAAAAAAAAAICDlYr43UjR/NFmqkfEzWq+1sj5sadOPjkQA9V8q23ztl6Zunyh/uLC9cWl1vJya64+3WnPLsy17vXthqvpXtPjE/vSmbs6us/tPzr84sLia0vta3+4suv+R4YvXFleWWrO7r47jkYR0ejfMlo1eHp8omr0fLvZqapO7jqZ7sMbTEX8Z6SYPVs/0tuW5//tnOG/bf7/6s4D7dP8v0/1bSvfM6UifhYpfusvHo/PV+18JN43Zrnc30SK0XOfy+XiSFmu14bucwW6MwPLsv8bKf7h59vL9uZDPna77LP3Oq4Pi/L8H4sU3/+z78av523bn/+w+/l/ZOeB9un8f6Zv2yPbnlew566Tz//JSPHCY2/Fb+RtH/T8jyK2tra+FXEiF771fI59Ov+f7ds2Et33/c37130AAAAAAAAAAICH1mAq4m8jxZMTtfRc3nYv//5vbueB9unff/1y37a5A1qvaM+DCgAAAACHxGAq4seR4trKW7fmUG+f/903//N3bq+9Pp527K3+nu+XqucG3M+//+s3kt93Zu/dBgAAAAAAAAAAAAAAAAAAgEMlpSKey+upz9xlPfX1SPHSfz+dy6XjZbneOvAj1a/DlxY6Jy/Mzy/MNleaV+Zb9anF5myrrPuZSLH515/LdYtqffXP57rdNd6Ht3prsS9Fiom/65XtrsXeW5u8ux54dy32suynIsV//f32sr11rD97u+zpsuxfRYqv/9PuZY/fLnumLPvdSPHDr9d7ZR8py/aej9p9JulwLeZbz8wuzL/vUagAAAAAAAAAAAAAAAAAAADwYQ2mIv40UvzP9bVYrab9v3FrV85ab8Ob3+xb73+Hm9U6/yPV+v93ev1R1v8fuS+9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAh0uKIl6PFIuXNtP6UPl91/DFdufGzenxid2rHU1VzYGqfPk1/OzpM2e/9NzYuV5+cP377Yl4ZeryhfqLC9cXl1rLy625+nSnPbsw17rnI+y1/u2h6xqtBqB+/dUbc1evLtdPP3Nm2+6bI+8NPXp85PzYUyef7JWdHp+YmOorUxv8EO/+oRp325Eo4i8jxdPf+0n656GIIvY+Fnf57Oy3o1UnRqtOTI9PVB2Zbzc7K+XOyd5AFBH1vkqN3hgdwLnYk0bEatn8ssGjZfemFptLzSvzrfpkc2mlvdJe6EymbmvL/tSjiHMpYi0iNob6D3QkZxGvRorvHNtM/zIUMdAbhy9emvrqqdN3bkexr728i29V7awPRqwVD8E5O8SGooh/jBQ/fftE/OtQRC26X/GFiJfL/EHEm2W+EJHKD8bZiHeHHnSruV9qUcT/lef//GZ6eyii+pGprisXv1b/SufqQl/Z3nVl5/1hKyIeqvvDQTrk16bhKOKH1RV/M/2bn2sAAAAAAAAAAAAAAACAQ6SIX40Uz79zIlXzg2/NKW53rtUvN6/Md6f19eb+9eZMb21tbdVTNxs5Z3Ku5lzLuZ5zI2cUuX7ORs6ZnKs513Ku59zIGQO5fs5GzpmcqznXcq7n3MgZtVw/ZyPnTM7VnGs513Nu5IxDMncPAAAAAAAAAAAAAAAAAAD4eCmq/1J8+xubaWuou770THRz3XqgH3v/HwAA//9wn/vk") r1 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x0) ftruncate(r1, 0x2007ffc) sendfile(r1, r1, 0x0, 0x800000009) r2 = open(&(0x7f0000000000)='./bus\x00', 0x60142, 0x0) r3 = open(&(0x7f0000000080)='./bus\x00', 0x185102, 0x0) ftruncate(r3, 0x2007ffb) sendfile(r2, r3, 0x0, 0x1000000201005) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x6cb, 0x2968, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x20, 0x5, [{{0x9, 0x4, 0x0, 0xfe, 0x1, 0x3, 0x1, 0x3, 0x0, {0x9, 0x21, 0x7, 0x1, 0x1, {0x22, 0x9f8}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x1, 0x80, 0xb5}}}}}]}}]}}, 0x0) truncate(&(0x7f0000000040)='./file1\x00', 0x7fff) truncate(&(0x7f00000013c0)='./file1\x00', 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x141042, 0x0) pwritev2(r4, &(0x7f00000001c0)=[{&(0x7f0000000080)="ff", 0x1}], 0x1, 0x5406, 0x0, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r5, 0x80015b12, 0x0) syz_mount_image$btrfs(&(0x7f00000055c0), &(0x7f0000000480)='./file1\x00', 0x281240a, &(0x7f0000000380)={[{@space_cache}, {@space_cache_v1}, {@treelog}, {@nodatacow}, {@device={'device', 0x3d, './file0'}}, {@fragment_metadata}, {@datacow}, {@discard_async}, {@check_int}, {@fragment_metadata}]}, 0x2, 0x55b7, &(0x7f0000005600)="$eJzs3X9slPUdB/DnrrT8cLQ1sg41IKDOQOYsgy0xmqwIbGwouQlTmAYKDuPG2BiCg2mkzmUsirGui4hSJQ7+YHNaN8pwM1nVlc6Nn9MlbGSbLpDRIKaOOecSydK7+17vnqPtiT/q9PUi7fN87/N8v/e9J88f9z76fS4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAKIr+fOKOCbfdO3PE9utm3nfeNWevfbB1/okLb91as/mh7YP3Ne3/+rGalauPLp510/2phY+s72xtjqJEul8i23/BZTOuvH72giuGhAHrv5DZVlf39pSZri9kGhUFD3b3K/xZGEVReWyAsux2enYnWTBAbnd58YB9unZU2+pxw6fXb1vRsvHZJZdvKX7pdBsy0BMYKNnr6lDPtVSX/p2MHZFrh8suman0XKKZ/vEL7l15EQDAm1KbSm9yb0ezb3Fz7YZ4Pdaui7UbY+3wDqExv3EqMuNW9DbPMfF6v/Pc/47Msy4TFQb3Os9YPXv+c+1UvH+sHYsab2KehYdmI82Q3ua5LFYfqHkCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvJdccP2k2Xv3PPzS11b//g8Pv/adVz55dGX9LV2tsy9aN+/xph0/+MexmpWrjy6eddP9qYWPrO9sbY6i6nS/RKZ74pmaZHJS18xtj93TXrvgI3PWlGXHDdtBeQdHB8LOxVVRtCivcigM21kZRanCQroZbSgufCW987lQAAAA4P3kzPTvZK6diYPlBe1EOk0m0v+CTFi8dlTb6nHDp9dvW9Gy8dkll2859fFSvYxXd9Lxcu3qnp9EXjAO8Tc+Xk89HLq8aJy+xUeM5/nTj3eOXzTzhiFX7r5gzsQps7dcGv1swpGmpXPvG/HC8Pn7GmuL8n913/k/nDn5HwAAgLfiLeX/ikj+j+X5RbVVow6N+37ZY9fVnDgy44FfNnc892TyofKu1qdfrBh6269XFeX/MQVPWZT/w4xD/k9Gp5b/AQAA4L3snc7/dUXj9K2//P+rA5u/+N8V3xp7ZOJ/djz/9B8v3jq2csarwybe8MYTs15esKvhL0X5v7a0/D8of9rhwV1hwkuqoqi29JMKAAAAFAj/797z0ULI65lPDuJ5/bK7hj256/X1NybPWvavM+Z1Th795d2rvrlhU6JrQ/O6HUunLS/K/3Wl5f/yd+flAgAAACX43fZb7h791flbt+w5PHXHnanNFZdMe2XPz5uv6njpeKrsuZs7ivJ/qrT8P3hgXg4AAABwEk8NHbn/8KOHvzFl99oRe1c2TH18/L5Vcx7495R/XvHiX09surCyKP/Xl5b/h2W32ZUPmU47w18hNFVF0ZDunWWZQkfU+OlcAQAAAHibhJy+cOG69p3rB01+9ewjP16zfOlv9l763bs2jr754G9rbj/3+IH2G4vy/7K+7/8f7nQQ1v8X3P+vaP1/XiFz179L3BgAAACAD6Li9fzh9viZby7o7fv3S13///EzDw5uWnR+9ZjkttGTn/hwx1VrR782t+miT22/9fWPJir//pmi/N9QWv4vy9++nd//BwAAAKfg/+37/+YVjdO3/u7/3zH0mXPWfP6eH9V9e9hT575x96LvNR6acN7m8Wd8rOz81qmT/vTDovzfWFr+D9vT8l9eWzg/t1dF0cjunezdBLeG6S6JFVrK8wqZEx/rMTv0yBZaBucV0pbFenyiKorGdu80xAqnh0JjrNBVmS1sihX2hkL2esgVHo0V2sKVdm9ldrrxwi9CIbvAoiWsoDgttyQi1uN4bz26CyftcTD35AAAAB8oITxns2x5YTOKR9mWRH8HDOvvgGR/B5T1d8Cg2AHxA3t7PKovLITHfzqtdfHL1zw4s/3qBcfOmrJn/h0NH2qb277zSz9pO+dvVz8/57NF+X9Tafk/nIqKzKa39f9RWP+f/V7D3Pr/+lCojhVaQiEVv2NAKjxHJuzeGZ6jOpXt0TUyVwAAAID3tfC5QNkAzwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgfe/ceJ1V1Jwj8dNMPummaVhSML1Ajors0TRMMIo4ouqvRxSaS1TFDaIRGO7QBBVwxZsXXuEp0MWpMjOzgx1ETh1V8EHWiQnTEJKOS+JwVn4NOZNUl6KhxTJb9dN86RdWtLrsQUHC/3z+6TtXvPG89us69t84FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/z9csej+hrf7/69v/fJ7a9783l6TfzP5sI07/+W6uvcHnffMxkMG1t32zoB5899qm3D29S1Tl163bvniEFq6ypUlxcseGVBePvIPx91zx1WPNk0ZOOn8qky9mXjo0/mnPHPn4tjq631DuLcshIp0YFhdEqjM3K+L9e1ZF8JOYVMgW6KtNimRbjg8WhPCkrApkK3q/poQ6nICk556eMUVnYlrakLYP4RQnW7jpeqkjZp0YEhVEqhNB2ZVJIEPNyaygfvKkwBssfhmyL7ol7XkZ2jovlyR11/lVuvY5ys9vF4x0VA83ztHbONO5ahKP9CyRU9bQXVsEwVvj5XebTvAu61gOy/ytOV+kcp8Q9m4KVQdyqe3zZg6r2NufKQ8NDb2KlbTNnqe12yoyUmfN62n9A7zOowdaNgqr8OHaifUX/Hu+EOXn/rHM/efu3rylnbzhZxNmpve1qpD5jW3wzyP0TifJzvA26/gW9JgX7pCCCf+adey52a9svv6j14/efydL1167ZT5100a//yAX4z+x+t3vnfKlQXz/4ZPnv/Hl3O8Lc/LHVv9uD6Zm8dH6mJifX0yNwcAAIAdxuez17TnPaW56a+OfP2V0x+5d8HLS0+o+O6YX52yW33Fud/vOHGX5WP3uPzq9id3Lpj/Dy7t+H885F+XO9qVIYzrSlzUL4Tduh5PAj+L3Tm1Xwj7dKVa8gNHpAIrQ/hSV+LAbFWpEr1jicGpwO/rM4FxqcCqGGhJBW6OgUWpwMUxsCwVmBYDK1OBI2MgtOeP46D6zDhKDtTEQGuyEZfFsxDeq4+tpbbVmmxVAAAAW0lmdliZfzfnXIctzRCnl8tqesoQz8AumqE6VUN6BpudVhWtoaKnGsp7qiE77gWfPPyCmst6qrngNIyy/AwfD/pOeb/x+/7onpuH3dL88vjvvj/6xK/8+e33Vx74T//9vvPm3nBQwfy/6ZPn/9XddKSs4Ph/CBO7/sbc5ZlIRzbe2pKXAQAAANgC1zyx+OmbDjrm/zzw6gN373X9TeUrr/36/31t/UX7jjhhaFnvv/v2soL5/7jSzv+P+0R65WQOj8fdEDP7hdCUH0iqPbQwkBz17pMJAAAAwI4gezw+eyy8PXObnKKdnk8X5m/ZzPzxwP+4bvNfueGvn//y9U+fPH/Ifuuu+m9nf1S26+jf7Xz86uFPvrP3kH9o6F14/n9Laef/1+bfJp1YFXtxdb8QeucEHou97Ax0GRwDrx6eH8iMf1XcAAtjVZkTE7JVLYwlWmOgKRVYUqzEb7MldssPZJ6sbOMXZcfRnimREwAAAIDPXNwdEI/Lx/P/75t40F4HDnhl1Mt73z//jXGLTzq99of73bbLm/06Jow6eNxhRz1XMP9v3bzz/7vmwQWn93f0CWF4RQi90j8MeLw2WRgwBurKMokHa5O6eqWruqA2hLGdA0tX9Vpm/f+K9BqDT9UkVcXAbvv+dMOQzsRNNSEMzw08980bR3Um5qYC2ca/URPCoM7Rphtf3jtpvDLd+HW9Q9g7J5Ct6tTeIXQ2VpWu6uHqzHUM0lXdUR1C/5xAtqqDq0OYHwDYQcV/pdNzH5wz/9yZUzs62s7ahom4D78mzGjvaGucNqtjenWRPk1P9TlvGaMLCsdU6pVvXswsUTR50J1DS0lnfyfYlNtWZj9+wYmDmfvxu1Bl1zibK/PujkwPeeh+hU2EnG9SxYZcvo2HXJtbyaYnsaD+mL8q9Am9581pO6vxnKlz5541Ivlbavbm5G88zJRsqxHpbVXbXd9KeHkUXS0r5dNuqwNyKxk+94zZw+fMP3dY+xlTT2s7re07zaNHNDeP+uroUc3DO0fVlPztYagHdFd1aqgbbyxxXFtxqLtX5FTyWXxqSEhI7GiJqYvKLhw35dcPfmvPVWecc8qef7/n9GGn/NWVv5l9cuNhE39141+uLpj/z/7k+X/81Imf/Jn1GYod/2+Ih/mTxzcd5m+NgSWlHv9vKHY0P3tiwOBUYEEMLHCYHwAAgC+GuDsy7s2Me6VvqPune4+ePu2wD3950qRr/3b0mNPPWbt/w6XXHr/oP6x9b9GKo94tmP8vKO33/1tp/f/s0vVfK7bM/4GxRFOx9f/Ty/xn1/9fUGz9//Qy/9n1/5d8Duv/z8sGUpvkPev/AwAAXwSf3fr/PS7vn75AQEGGHpf3T18goCBDj8v4l3qBgM1e/39Wx1/UDrhy1pjDh83+8WMr9l3U/469Xhz/6/0WHzLs/uW3fTDi9oL5/6LS5v8W7gcAAIDtxyO/7P3tS98f8uAzj314dNnlv11/y4l/1XbQYX/o33zaxGNrvn/LvxXM/5eUNv//7Nf/C8XO/x9cLNBSbGFA6/8BAACwgyq2/t+t/V8dvHLusJuf+Pnbt73S+ovpY9/4d4t+8JWpQ5puXbXmNw3T1hbM/5eVNv+Pp12U5+WOvfm4PlnTLqTXtFtfn/3JAAAAAOwYykNjY2WJefNWRj3i07e5JrMU6Celcz37wIAV88ofuaasev0PLptyWOP5x5896+hL1n6/9umf1E5urD6rYP6/srT5f97vMh6qnVB/xbvjD/14+al/PHP/uasnbzr+DwAAAGw7pe6XAAAAAAAAAAAAAAAAPn/PtC4+5KMRx741fZ8Rf/rG8S/9YOEe33zsb67/89k/P/KBfdo3DplU8Pv/MLGrXLHf/8fr/sXfF+ySlzu22vP6f5n7k467fX7XkoWP14ewX25g5oUzdwqZa/MfkBtYMfnAgZ2JC9MlHnj5yDc6E1PSgWOG7fxBZ2JsKtAaF0n8UjoQr6r4Qd9UIC6v+HQ6ELfHsnSgKhO4rG8yjrL0tlpXl2yrsvS2eqEuhH45gey2urcuaaMsPcBrUoHsAM9MB+IAJ2QC5ele3d4n6VUM1MWif9Mn6RUAANut+C2wMsxo72hril/h4+3uFfm3Ud6SZRcUVltWYvMvZpYmmzzozqGlpHulv4tuutZ4ZajuHMKIgq+ruVnKuka5dWrpYdPtUmTIPa32Vl6kXNrmbrqq4iOqSUbUOG1Wx/TKHgc+sucszRU9ZhlRMNnJzVLetUlLqKWEvpQwohK3TQldjvfLQ2Njr1SuMTHYEPL09Ioo9ff6uev8FXsV5Ob525rrL+81sNeH/zb2kkce7lfZcfrEtkt2f+Kf+4+Y/uMfPtx63e8L5v8Npc3/q3PH9UHmYgAL4pX1Du0XQmuJIwIAAIAvvv95/tK7Tp61at2MlRXP/+53M8tPOLly43n3nHfuJS88uPCYy/79rVsaX1b2zIaT39pwzl+/9ZOv3PDoOa8cOe2ceyasOWxtW/XN3/2LpacPKpj/Dy5t/h/3YGUOBSd7O1bG6/9f1C+ErkvrNySBn8XhntovhH26Ui2xRHJB/a/FEk1J4Gdxh8mBsURrS35VvWNgWSrw+/pMYGUqsCoGMnspfhoyu3Kuqg9hVFdqYn6J2bFEQypwQgwMTgUaY6ApFegbA+NSgbf7ZgItqcA/xkBoz99Wd/fNbCsAAIDNkZlnVebfDel53rKKnjKU9ZShtqcM5T1lqO4pQ7FRxPt3xQyVqZNXynIyVaZrrUnVUpAhXgx/s/tVkCH8Nj9numBB0/H8g+z5BmX5Gcb88K7WQ74258cbLv3Rk0cffPHRi65+9/Jj+wy8+vn/3X5+n74bagvm/02lzf9r82+T1lfF+f+m6/8lgcdi966Op44PjoFXD88PZHYMrIqT3YXZqloyJTKT9oWps9AfC4NTgdmxxLhUoHViJrBkYKqq9vzGL8o23p4pkRMAAACAz1zcQRB308T5//Ix4b09j/6wefer+88e8+RjFxw1tWaX6pp/Hrt68djLqx85oHfB/H9cafP/2F6f3MYujr15vW8I95Zt6k02MKwuCcT9GHXx5/F71oWwU84OjmyJttqkRFWq4fBoTfIL9ap0VffXJGsMxPuTnnp4xRWdiWtqQtg/Z+9Lto2XqpM2atKBIVVJoDYdmFWRBOKen2zgvvIkAFssu1cwvqAyp7pkNXRfrsjr74tyTdD08Ar2gXaTr7vfXG0r1ekHMvtUszbvaSuojm2i4O2x0rttR3y3NXi35X6RynxD2bgpVB3Kp7fNmDqvY258JPeXrAW20fOc+yvVUtJb4XW44NP3tmfV6Q40pT4+mrov1/3rsCxW91DthPor3h1/6PJT/3jm/nNXTy65G0XEHwofevvsg17I2bzbWnXIvOZ2uM+TFp8nO+K/gcGethDC0otmPP3Uv3z4YsXa5v9y8Oild7z9xNKfHPLQjGFfWnfZl9e/8/4xBfP/ltLm/xWp2y4fxY05p18IQ3M27uNx84/vl3wO5gSST8n+hYHkkPva+qKfnAAAALC1ZXd3ZPcXtGdukxPC0/Pkwvwtm5k/7q8Y123+Uvvdf9Q/fO/wa978xtfX7n7l44ufWfOf3n7tqCmHP7Th2WXL32w+ftdnC+b/rZ88/++d6qbj/47/s404/t+t7X1XdO/0Awu2aFd0QXVsE47/d2t7f7c5/t8tx/8d/++O4/89cPy/W9v701bwLWm2L10hhNZ+N935i9qpQ/tcdd63pq3++bPvNY15qe78Y+/+H0cuDNddsOLPBfP/2aXN/63/1/2ifdn1/1qLrf83u9j6fwus/wcAAGxTRRaaS8/zClbvK8iQXr2vIEOPCwT2uMSg9f82e/2/2lPOPeW1+nf2uW78nf/57qkXv3jKyc/v3+vFk+486Zbh1w595cvrCub/C0qb/8eXQ5/c1j+f9f/GxUDJ6/8NnlikqkUxMNvCgAAAAGyPiu0gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4PO17OGFe2xcuN8htzy/6y1H/uuSVTP2/dVBG0eOOrVx6ML+ZVf/3b+8M2De/LfaJpx9fcvUpdetW744hPaucmVJ8bJHBpSXj/zDcffccdWjTVMGTjq/OlNvZeZ2j7zcsdWP60NYkvNIXUysr++8sykw6bjb51d0Jh6vD2G/3MDMC2fu1Jm4uT6EA3IDKyYfOLAzcWG6xAMvH/lGZ2JKOnDMsJ0/6EyMzQTK0t29oW/S3bJ0d6/oG0K/nEC2u9/um19Vto3/mAmUp9u4tS5pIxOoqItFf1SXtBFLdMQS7b1DGF4RQq90Vb+uTqqKgWxVf1+dVNUrXdV/rQ5hbGer6aperkqqqkiPfHVVUlUM7LbvTzcM6UwsqQpheG7guW/eOKozcWYqkG3861UhDOp8yaQbv6syabwy3fg1lSHsHUKoSpf414qkRFW6xGsVIfTPCWQbP70ihPmBL4T44TM998E588+dObWjo+2sbZioyrRVE2a0d7Q1TpvVMb061adiynLSGy/49GN/ccN50zpvJw+6c2gp6YpMucquLjdX5t0dub33PvarNreSTc9HQf0xf1XoE3rPm9N2VuM5U+fOPWtE8rfU7M3J316ZaLKtRuwo2+qA3EqGzz1j9vA5888d1n7G1NPaTmv7TvPoEc3No746elTz8M5RNSV/t8ZQb/zsh7p7RU4ln8UHgISExI6WKM/7dGva3j/IC77ob+poZaju+oAumFbkZinrGuXWGPQRn3LEn+Z7So8jGlEwcSjI0txzlpEFk4lNWWqSLF3f6womh7k1lXdt0ni/PDQ29iq2HRry7+Zu3ne2YPOuyWy6UtMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8P/YgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRV24FgAAAAAQJi/dRg9GwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXAoAAP//Bj7Nag==") r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000540)='memory.swap.current\x00', 0x275a, 0x0) writev(0xffffffffffffffff, &(0x7f0000001340)=[{&(0x7f0000000040)="ccd7a824903e0f439263c785e0bd25ac65e287057edb256f0d8bf04b994fbbbda023cd95d89db7471265814aab694153a729ab7947f62ac4528473485a036e7c4344a0b96f7cd898a509d6a1e00f70bcebd34f17dc985dc0e25a861d321c41b0810a8f8594996464857966aff9b136ce2ab0d13651b58f52c87cc14599a918b46381cbc1d307df16f111755820764782561515dac9874ab50b96d99a29f225075cba9b1c1e0db5422a17e78cdfb5f38f3b093b8e1b9cf87edee485df8fea590f3c4a5086ad272f0a57cd328c670ed6943e1ad776c2b826c418f859c970f4387877ff0174f2b0c15f51faf23a5a9a9f35709dc43b60b53eb9bd595b041992a466", 0x100}], 0x1) r7 = fsopen(&(0x7f0000000280)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000040)='source', &(0x7f0000000080)='//', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) syz_clone(0x0, 0x0, 0xfffffffffffffead, 0x0, 0x0, 0x0) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x20}) write$binfmt_script(r6, &(0x7f0000000000), 0x208e24b) syz_usb_connect$cdc_ncm(0x0, 0x0, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000c40)='./file1\x00', 0x0) [ 69.091617][ T4659] Bluetooth: hci0: command tx timeout [ 69.330784][ T10] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 69.480691][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 69.486883][ T10] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 69.489965][ T10] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 69.494870][ T10] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 69.498661][ T10] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 69.504614][ T10] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 69.509530][ T10] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 69.515203][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 69.725854][ T10] usb 5-1: usb_control_msg returned -32 [ 69.728142][ T10] usbtmc 5-1:16.0: can't read capabilities [ 70.091863][ T5314] loop0: detected capacity change from 0 to 2048 [ 70.102837][ T5314] UDF-fs: error (device loop0): udf_read_tagged: read failed, block=2362, location=2362 [ 70.117015][ T5314] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 70.122553][ T5314] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4 [ 70.128545][ T5314] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 70.156162][ T25] audit: type=1800 audit(1745615903.555:2): pid=5314 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.0" name="file1" dev="loop0" ino=1346 res=0 errno=0 [ 70.314498][ T5316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 70.327428][ T5316] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 70.375274][ T5314] usbtmc 5-1:16.0: control status returned 0 [ 70.437087][ T5315] [ 70.438216][ T5315] ============================================ [ 70.441206][ T5315] WARNING: possible recursive locking detected [ 70.443722][ T5315] 6.15.0-rc3-syzkaller-00244-gc3137514f1f1 #0 Not tainted [ 70.446461][ T5315] -------------------------------------------- [ 70.448739][ T5315] syz.0.0/5315 is trying to acquire lock: [ 70.450750][ T5315] ffff888042045d28 (&sbi->s_alloc_mutex){+.+.}-{4:4}, at: udf_free_blocks+0x9e2/0x17f0 [ 70.454375][ T5315] [ 70.454375][ T5315] but task is already holding lock: [ 70.457074][ T5315] ffff888042045d28 (&sbi->s_alloc_mutex){+.+.}-{4:4}, at: udf_prealloc_blocks+0x8d0/0x10b0 [ 70.460748][ T5315] [ 70.460748][ T5315] other info that might help us debug this: [ 70.463627][ T5315] Possible unsafe locking scenario: [ 70.463627][ T5315] [ 70.466322][ T5315] CPU0 [ 70.467615][ T5315] ---- [ 70.468915][ T5315] lock(&sbi->s_alloc_mutex); [ 70.470871][ T5315] lock(&sbi->s_alloc_mutex); [ 70.473104][ T5315] [ 70.473104][ T5315] *** DEADLOCK *** [ 70.473104][ T5315] [ 70.476771][ T5315] May be due to missing lock nesting notation [ 70.476771][ T5315] [ 70.480139][ T5315] 4 locks held by syz.0.0/5315: [ 70.481952][ T5315] #0: ffff88805132a420 (sb_writers#12){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 [ 70.485478][ T5315] #1: ffff88805208d5c0 (&sb->s_type->i_mutex_key#19){+.+.}-{4:4}, at: udf_file_write_iter+0x6e/0x6c0 [ 70.489447][ T5315] #2: ffff88805208d3f0 (&ei->i_data_sem#2){++++}-{4:4}, at: udf_map_block+0x291/0x42a0 [ 70.493264][ T5315] #3: ffff888042045d28 (&sbi->s_alloc_mutex){+.+.}-{4:4}, at: udf_prealloc_blocks+0x8d0/0x10b0 [ 70.496942][ T5315] [ 70.496942][ T5315] stack backtrace: [ 70.499366][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted 6.15.0-rc3-syzkaller-00244-gc3137514f1f1 #0 PREEMPT(full) [ 70.499383][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 70.499391][ T5315] Call Trace: [ 70.499401][ T5315] [ 70.499407][ T5315] dump_stack_lvl+0x189/0x250 [ 70.499435][ T5315] ? __pfx_dump_stack_lvl+0x10/0x10 [ 70.499451][ T5315] ? __pfx__printk+0x10/0x10 [ 70.499466][ T5315] ? print_lock_name+0xde/0x100 [ 70.499486][ T5315] print_deadlock_bug+0x28b/0x2a0 [ 70.499496][ T5315] validate_chain+0x1a3f/0x2140 [ 70.499506][ T5315] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 70.499570][ T5315] ? lockdep_hardirqs_on+0x9c/0x150 [ 70.499582][ T5315] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 70.499597][ T5315] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 70.499615][ T5315] __lock_acquire+0xaac/0xd20 [ 70.499629][ T5315] ? udf_free_blocks+0x9e2/0x17f0 [ 70.499638][ T5315] lock_acquire+0x120/0x360 [ 70.499646][ T5315] ? udf_free_blocks+0x9e2/0x17f0 [ 70.499654][ T5315] ? _raw_spin_unlock_irq+0x45/0x50 [ 70.499665][ T5315] __mutex_lock+0x182/0xe80 [ 70.499671][ T5315] ? udf_free_blocks+0x9e2/0x17f0 [ 70.499680][ T5315] ? rcu_read_unlock_special+0x3fe/0x4c0 [ 70.499689][ T5315] ? udf_free_blocks+0x9e2/0x17f0 [ 70.499698][ T5315] ? __pfx___mutex_lock+0x10/0x10 [ 70.499706][ T5315] ? __pfx___might_resched+0x10/0x10 [ 70.499717][ T5315] ? fs_reclaim_acquire+0x7d/0x100 [ 70.499727][ T5315] udf_free_blocks+0x9e2/0x17f0 [ 70.499736][ T5315] ? bdev_getblk+0x6e/0x670 [ 70.499744][ T5315] ? udf_get_fileshortad+0x6e/0x1b0 [ 70.499753][ T5315] ? __pfx_udf_free_blocks+0x10/0x10 [ 70.499764][ T5315] udf_delete_aext+0x4df/0xbc0 [ 70.499774][ T5315] ? udf_get_fileshortad+0xcb/0x1b0 [ 70.499782][ T5315] ? __pfx_udf_delete_aext+0x10/0x10 [ 70.499793][ T5315] udf_prealloc_blocks+0xb7e/0x10b0 [ 70.499801][ T5315] ? bdev_getblk+0x6e/0x670 [ 70.499808][ T5315] ? udf_get_filelongad+0x6e/0x1b0 [ 70.499815][ T5315] ? __pfx_udf_new_block+0x10/0x10 [ 70.499822][ T5315] ? udf_current_aext+0x660/0xad0 [ 70.499832][ T5315] ? __pfx_udf_prealloc_blocks+0x10/0x10 [ 70.499840][ T5315] ? udf_map_block+0x1508/0x42a0 [ 70.499849][ T5315] udf_map_block+0x1ddd/0x42a0 [ 70.499861][ T5315] ? __pfx_udf_map_block+0x10/0x10 [ 70.499869][ T5315] ? __pfx_mod_objcg_state+0x10/0x10 [ 70.499882][ T5315] ? do_raw_spin_unlock+0x4d/0x240 [ 70.499889][ T5315] __udf_get_block+0x52/0x250 [ 70.499898][ T5315] __block_write_begin_int+0x6b2/0x1900 [ 70.499914][ T5315] ? folio_add_lru+0x1b3/0x3d0 [ 70.499921][ T5315] ? __pfx_udf_get_block+0x10/0x10 [ 70.499930][ T5315] ? __pfx___block_write_begin_int+0x10/0x10 [ 70.499940][ T5315] ? __pfx_udf_get_block+0x10/0x10 [ 70.499948][ T5315] block_write_begin+0x8a/0x120 [ 70.499958][ T5315] ? udf_write_begin+0x7d/0x260 [ 70.499967][ T5315] udf_write_begin+0x100/0x260 [ 70.499977][ T5315] generic_perform_write+0x2c4/0x910 [ 70.499987][ T5315] ? __pfx_generic_perform_write+0x10/0x10 [ 70.499994][ T5315] ? file_update_time+0x2da/0x490 [ 70.500006][ T5315] ? __generic_file_write_iter+0xf9/0x230 [ 70.500013][ T5315] ? udf_file_write_iter+0x1a3/0x6c0 [ 70.500025][ T5315] udf_file_write_iter+0x2d5/0x6c0 [ 70.500036][ T5315] iter_file_splice_write+0x937/0x1000 [ 70.500052][ T5315] ? __pfx_iter_file_splice_write+0x10/0x10 [ 70.500063][ T5315] ? rcu_read_lock_any_held+0xb3/0x120 [ 70.500071][ T5315] ? direct_splice_actor+0x10c/0x160 [ 70.500078][ T5315] ? __pfx_iter_file_splice_write+0x10/0x10 [ 70.500087][ T5315] direct_splice_actor+0xfe/0x160 [ 70.500097][ T5315] splice_direct_to_actor+0x5a5/0xcc0 [ 70.500110][ T5315] ? __pfx_direct_splice_actor+0x10/0x10 [ 70.500121][ T5315] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 70.500132][ T5315] ? __pfx_aa_file_perm+0x10/0x10 [ 70.500140][ T5315] do_splice_direct+0x181/0x270 [ 70.500147][ T5315] ? __pfx_do_splice_direct+0x10/0x10 [ 70.500154][ T5315] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 70.500162][ T5315] ? rw_verify_area+0x258/0x650 [ 70.500169][ T5315] do_sendfile+0x4da/0x7d0 [ 70.500179][ T5315] ? __pfx_do_sendfile+0x10/0x10 [ 70.500186][ T5315] ? rcu_is_watching+0x15/0xb0 [ 70.500195][ T5315] ? __rseq_handle_notify_resume+0x37e/0x11f0 [ 70.500203][ T5315] __se_sys_sendfile64+0x13e/0x190 [ 70.500211][ T5315] ? rcu_is_watching+0x15/0xb0 [ 70.500219][ T5315] ? __pfx___se_sys_sendfile64+0x10/0x10 [ 70.500227][ T5315] ? do_syscall_64+0xba/0x210 [ 70.500235][ T5315] do_syscall_64+0xf6/0x210 [ 70.500241][ T5315] ? clear_bhb_loop+0x45/0xa0 [ 70.500248][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 70.500255][ T5315] RIP: 0033:0x7f65f318e969 [ 70.500263][ T5315] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 70.500268][ T5315] RSP: 002b:00007f65f408a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 70.500276][ T5315] RAX: ffffffffffffffda RBX: 00007f65f33b6160 RCX: 00007f65f318e969 [ 70.500281][ T5315] RDX: 0000000000000000 RSI: 0000000000000007 RDI: 0000000000000006 [ 70.500285][ T5315] RBP: 00007f65f3210ab1 R08: 0000000000000000 R09: 0000000000000000 [ 70.500290][ T5315] R10: 0001000000201005 R11: 0000000000000246 R12: 0000000000000000 [ 70.500295][ T5315] R13: 0000000000000000 R14: 00007f65f33b6160 R15: 00007ffc5acee848 [ 70.500301][ T5315] [ 71.173266][ T4659] Bluetooth: hci0: command tx timeout [ 73.250854][ T4659] Bluetooth: hci0: command tx timeout [ 75.330695][ T4659] Bluetooth: hci0: command tx timeout