last executing test programs:

8.451242799s ago: executing program 3 (id=1509):
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xc8)
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0)
mkdir(&(0x7f0000000080)='./file1\x00', 0x0)
mkdir(&(0x7f00000004c0)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})

8.391432313s ago: executing program 3 (id=1511):
r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x400, 0x2)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller1\x00', 0xc201})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000240)=ANY=[@ANYBLOB="000086dd0500560008005400000060ec970001983a00fc000018c6ba35000000000000000700ff02000000000000000000000000000100000000000000000000000000003b"], 0xfdef)
ioctl$vim2m_VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000380)={0x1, @win={{0x0, 0x0, 0x32314247, 0x1000}, 0x0, 0x0, 0x0, 0x0, 0x0}})
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)
syz_emit_vhci(&(0x7f00000002c0)=@HCI_ACLDATA_PKT={0x2, {0xc8, 0x1, 0x3, 0xa5}, @l2cap_cid_signaling={{0xa1}, [@l2cap_info_rsp={{0xb, 0x9, 0x30}, {0x9, 0xfffd, "a5533de5812514a59c3a1fe8f8c792df24ae44a0c04352bcf60f59f8b87803fd8aeac857a4e044ffe6786b36"}}, @l2cap_conf_req={{0x4, 0xd8, 0x13}, {0x4d, 0x2000, [@l2cap_conf_ews={0x7, 0x2, 0x5}, @l2cap_conf_flushto={0x2, 0x2, 0x200}, @l2cap_conf_ews={0x7, 0x2, 0xe}, @l2cap_conf_fcs={0x5, 0x1}]}}, @l2cap_cmd_rej_unk={{0x1, 0xfc, 0x2}, {0xbe}}, @l2cap_info_req={{0xa, 0xa, 0x2}, {0x82}}, @l2cap_move_chan_req={{0xe, 0x7, 0x3}, {0x9c0, 0xff}}, @l2cap_conf_req={{0x4, 0x44, 0x37}, {0xf6d5, 0x8, [@l2cap_conf_flushto={0x2, 0x2, 0x9}, @l2cap_conf_fcs={0x5, 0x1, 0x1}, @l2cap_conf_ews={0x7, 0x2, 0x9}, @l2cap_conf_mtu={0x1, 0x2, 0x5}, @l2cap_conf_efs={0x6, 0x10, {0x1, 0x2, 0x1, 0x0, 0x400, 0x81}}, @l2cap_conf_efs={0x6, 0x10, {0x80, 0x2, 0x7, 0x0, 0x7, 0x7fffffff}}]}}, @l2cap_move_chan_cfm={{0x10, 0x1, 0x4}, {0x5, 0x1}}]}}, 0xaa)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0)
remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x20)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40400, 0x0)
fadvise64(r3, 0x92, 0x5, 0x2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r3, 0x5708e000)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff)
sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r4, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="51443dca", @ANYRES16=r5, @ANYBLOB="00012dbd7000fbdbdf25530000000c009900070000004b000000"], 0x20}}, 0x40)
ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r3, 0x8008f513, &(0x7f0000000000))

6.769081931s ago: executing program 3 (id=1524):
r0 = creat(&(0x7f0000000340)='./file0\x00', 0x14)
close(r0)
r1 = getpid()
socket$rxrpc(0x21, 0x2, 0xa) (async)
r2 = syz_pidfd_open(r1, 0x0)
mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f00000000c0), 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}}) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async)
r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="12010000b5403340861a22753635010203010902120001000000000904000000e4d6240009d5122cf9239464e038e74f07445834ba2893c468c2120d21bc11062ef6a4a36b999a9f7b88ae551a476f2babf3af7ff367782e50bb1deae4d543193588df55189d9907d303c08a5ea67c13329bef5a26832fbeac2a96262706bcc8d83776a3eb3247f7d4e7bf4c2d0e1bcab88abd4c4ae91488d51d3216e2d03ca36e3d3cc8053bebbc4332d6ca3fcb680a0d293bbae086f1a695c1d0f87485a54f3afb244c5bb3e202724a1c2e41e92bf917fe7d7c4476975eb272e14cd64bf42cb9715204d1f84376eb5182e53673a702c5f9e0a1fab50277fe51e35eeacd3b05a3455219e3a916b1939bcefc7409798a482306757fd058285b8e68199ef1cc00000000"], 0x0)
syz_usb_control_io$cdc_ecm(r5, 0x0, &(0x7f0000000040)={0x1c, &(0x7f00000005c0)=ANY=[@ANYBLOB="000300010000ac797fac9bd87d75b6d905ce804e000eae78ad2ac4a295840804290ea2aafe93b26667afd958b0b95c0f24040e6b8ddded061cb7701d5b3a60c89374fbe30df8da45118eb6b60baee5fad05a30de24d65c9f5327bb33336c2e4d27c4287a21e9fcb6fd5b8abd4306bb6ee6affcff669a310bb1b120b04abceeee99ad948eba8134f48b780adb6adb4e8f6e103c9b1f0955a6b11a947570a8fdf7392f0273629af1436f79f6973635cada532a9d9e618d1126654660abd8d2bda0b6a25f03a348545793fc6b0668f5de477a5dc7140286012475e27d2608092a8362b58059936a2917b2c73a5de3c3da40c15bb1132c9ae93ccf1b97039de28f87740afb1357d0"], 0x0, 0x0}) (async)
r6 = socket$kcm(0x10, 0x2, 0x0) (async)
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0xeb379000) (async)
madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18)
sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000040)="d8000000180081034e81f783db4cb9040a1d020006007c09e8fc55a10a002a000400142603600e120800060000000441a8000800a4001040040000000c5c04613e60a2a6c30942519c6f749229c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a707f4090000001fb71b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad9e3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5dd330d4e1ffffffffc1c9b6278754ca397cc87566388b0dd6e4edef3d9300", 0xd8}], 0x1}, 0x4000)
r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0)
ioctl$SNDRV_TIMER_IOCTL_SELECT(r7, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}})
ioctl$SNDRV_TIMER_IOCTL_PARAMS(r7, 0x40345410, &(0x7f0000000340)={0x1}) (async)
r8 = syz_init_net_socket$x25(0x9, 0x5, 0x0) (async)
unshare(0x22020600)
ioctl$sock_ifreq(r8, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='rose0\x00'}) (async)
ioctl$KVM_SET_IRQCHIP(r4, 0x4048aec9, &(0x7f0000000380)={0x3, 0x0, @ioapic={0x2, 0x2, 0x101, 0x5, 0x0, [{0xd, 0x9, 0x6, '\x00', 0x1}, {0x6, 0x2, 0x26, '\x00', 0xfc}, {0x2, 0xef, 0xd, '\x00', 0xee}, {0xfb, 0x7, 0xd}, {0x13, 0x9, 0x2, '\x00', 0x62}, {0x0, 0x3, 0x2, '\x00', 0xd3}, {0xf, 0x0, 0x8, '\x00', 0x4}, {0x9, 0xdb, 0x1}, {0x81, 0x23, 0x5, '\x00', 0x2}, {0xde, 0x20, 0x3}, {0x40, 0x4, 0xf8, '\x00', 0x1}, {0xf5, 0x5, 0x4, '\x00', 0xb5}, {0x7, 0x3, 0x2b, '\x00', 0x6}, {0x4, 0x0, 0x0, '\x00', 0xe9}, {0x10, 0x39, 0x40, '\x00', 0xcf}, {0x6c, 0x3f, 0x0, '\x00', 0x72}, {0x6e, 0x4, 0x4, '\x00', 0xe}, {0x7, 0x2, 0x8, '\x00', 0x7}, {0xf, 0x7, 0x5}, {0x1, 0x6, 0x9}, {0x4, 0x6, 0x1, '\x00', 0x49}, {0xee, 0x2, 0x91, '\x00', 0xba}, {0x2, 0x8, 0x2, '\x00', 0xc3}, {0x8, 0x9, 0x54, '\x00', 0x9}]}}) (async)
r9 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000040), 0x28200, 0x0)
personality(0x5400004)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async)
accept$inet(r0, &(0x7f0000000100)={0x2, 0x0, @local}, &(0x7f0000000140)=0x10) (async)
mount(&(0x7f00000001c0)=@loop={'/dev/loop', 0x0}, &(0x7f0000000200)='./file0\x00', &(0x7f0000000280)='nfsd\x00', 0x2000800, 0x0) (async)
r10 = socket$kcm(0x2d, 0x2, 0x0)
ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}) (async)
ioctl$sock_kcm_SIOCKCMCLONE(r10, 0x89e2, &(0x7f0000000340)={r10}) (async)
mmap(&(0x7f0000787000/0x4000)=nil, 0x4000, 0xb, 0x202812, r9, 0x7dfff000)

6.048697402s ago: executing program 3 (id=1529):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x20c700, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x20010, r0, 0x0)
sendfile(r0, r0, 0x0, 0x7ffff000)
mbind(&(0x7f000007c000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x3)

5.046825686s ago: executing program 3 (id=1531):
r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x3c3002, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04)
ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f00000000c0)={0xf0, 0x600, 0x30, 0x300, 0x401, 0xc, 0x1, 0x0, {0xd6, 0x10}, {0x748, 0x0, 0x1}, {0x59e, 0x4}, {0x1000, 0x7, 0x1}, 0x0, 0x40, 0x6, 0x7fffffff, 0x1, 0x9, 0xb97f, 0xf1c7, 0x8, 0x8, 0xbcaf, 0x4d, 0x14})
ioctl$FBIOGET_FSCREENINFO(r0, 0x4602, &(0x7f0000000040))
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = syz_usb_connect(0x2, 0x3f, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000016038308c5109a8146e40102230109022d0001000000000904000003030000000905be3b"], 0x0)
r3 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x20a02, 0x0)
pwritev(r3, &(0x7f0000001280)=[{0x0}, {0x0}, {&(0x7f0000001080)="2b97", 0x2}], 0x3, 0x0, 0xfffffffe)
syz_usb_control_io(r2, 0x0, &(0x7f0000000680)={0x9b, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r2, 0x0, &(0x7f0000001c80)={0x34, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001c00)={0x20, 0x1, 0x1, 0x4}, 0x0})
syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0)
syz_usb_control_io$printer(r2, 0x0, 0x0)
syz_usb_control_io$hid(r2, 0x0, 0x0)
chdir(0x0)
r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
fanotify_init(0x200, 0x0)
syz_usb_control_io(r2, &(0x7f00000003c0)={0x2c, &(0x7f00000012c0)=ANY=[@ANYBLOB="40032900000c2924b6f0461e9a9c7f8148086979d6a94a304b8b7f37b76d0510d7884587c4edf5a5550e98c0a170a44151f7b73814b5846137f2b53cbdb75ad26486c3b85e6970d08b255f21"], &(0x7f0000000240)={0x0, 0x3, 0x58, @string={0x58, 0x3, "0ec5b254012795ba4876f2793c4ef2339e8e1259771cbcc89a4badc34f2676de2b5cfeee3442f706684e7238200f5feee6b51d0a62806a3d53c03acecf52fa2229b0957e3fb4e1802baeb5243fc8592a9a0cd09e4c0c"}}, &(0x7f0000000300)={0x0, 0xf, 0x5, {0x5, 0xf, 0x5}}, &(0x7f0000000340)={0x20, 0x29, 0xf, {0xf, 0x29, 0x1, 0x4, 0x2, 0x68, "cb8f3a0d", "f0999fdb"}}, &(0x7f0000000380)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfc, 0x80, 0x5, 0x0, 0x2, 0x8, 0x3}}}, &(0x7f00000011c0)={0x84, &(0x7f0000000400)={0x0, 0x15, 0xb3, "b6eaad8aa1476abefef4069e4f97cf68eae979b1e682d5af4dbd53f2a2b06673f970a3cd15f854716f0b574e6f75033167312300696ba06bc9a85ee155ba9d5967917d19a9107a296c367d361d9f1e653c9df75c748570e5dae2f271b21440170c479eda613cbada35af64c055703e3943298d6eac84c72f79ff35ab733c272b0321188ec6b05167af44b5280c69f1a9eaad10dc122b57bd35ad338fe9e8a8f8785bd545d7d3d8354b03b4d63a6f32060558e1"}, &(0x7f00000004c0)={0x0, 0xa, 0x1, 0xc0}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x6}}, &(0x7f0000000580)=ANY=[@ANYBLOB="2000040000680010b7"], &(0x7f00000005c0)={0x40, 0x7, 0x2, 0x2}, &(0x7f0000000600)={0x40, 0x9, 0x1, 0x1}, &(0x7f0000000640)={0x40, 0xb, 0x2, "9e54"}, &(0x7f0000000740)={0x40, 0xf, 0x2, 0x8eb}, &(0x7f0000000780)={0x40, 0x13, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, &(0x7f00000007c0)={0x40, 0x17, 0x6, @link_local}, &(0x7f0000000800)={0x40, 0x19, 0x2, "75fe"}, &(0x7f0000000840)={0x40, 0x1a, 0x2}, &(0x7f0000001100)={0x40, 0x1c, 0x1, 0xa}, &(0x7f0000001140)={0x40, 0x1e, 0x1, 0xe}, &(0x7f0000001180)={0x40, 0x21, 0x1}})
ioctl$FS_IOC_GETVERSION(r4, 0x80087601, &(0x7f0000000180))

3.365464116s ago: executing program 1 (id=1541):
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x21) (async)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) (async)
r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async)
r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async)
r5 = syz_open_dev$vcsn(&(0x7f00000000c0), 0x4, 0x0)
mknodat(r5, &(0x7f0000000200)='./cgroup.cpu/cgroup.procs\x00', 0x8000, 0x3)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000100)={0x1b, "5660359c3245d1c42317afad7d48ed51000000000000002100", <r6=>0xffffffffffffffff})
poll(&(0x7f0000000180)=[{r6, 0x51}], 0x1, 0x402)
close_range(r4, 0xffffffffffffffff, 0x0) (async)
r7 = openat$cgroup_procs(r3, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
write$cgroup_pid(r7, &(0x7f00000001c0), 0x12) (async)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x120)
read$FUSE(r8, &(0x7f0000002080)={0x2020}, 0x2020) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000161000/0x18000)=nil, &(0x7f0000005700)=[@text64={0x40, 0x0}], 0x1, 0x4, 0x0, 0x0) (async)
ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000003680)={{0x0, 0x0, 0x80}, "cb31455c9ea4288a70a2a6bb8068fd95dd041cf5b177a3bffe992dfbbdf959487337b92336ce1de32e7695c411c0bf9f852d2d71192f33001fd51f5b396a55cb98699a09d21648c4cb30d9d7e3e397c7a3c041c76c72385a46c48c5302848c3696facce956952c2a85822ddf20434ccee5806294ed563ff3a972cddf6ef16ddace933d8a5adea40cd3ad40c9873c29368838e815ff59723519154856b2d5cd9cd79a97dc2fa08dada1175817886e5f9e7aa3dca783a44c667a4806826570ec6acb57d65efc313a384e11fb633dee17ee600145f2cb3103384606140021be766fcb7fa029f0513b99466177ca1068192550bbf4e6f5694aec747a16e27688a988fa595bca1761b8e88a7dbcaeaf97a8b7b53058b1faf880dd6f1b6eb4c7beb0582b4007f1a67db1352407adbe1456bf762c94fd825b9419d74f63cdeb6c6976de1890d773f0c8088d2bd48a838cf5b87f5ddf926352960fb978874b0f175acfa55ddfe84de3fc9f75b58bf7a35f33d3c43ed5e3224e92751fa1b43f94f64b681163ef1360a3f3bb7403afc67a188b2104b45c5814aaa9e218552498bf85f4b221d9acc32a331f5f8c109cc9f335ff4e418ab30b54b99d5376cd928c431fc8211fcbaf64716afdc4b6d0417e04d5723e4675d282b36bef3a3a19e855029ec7c33830a6df19332b63e9d8a0f22d96ac230c67657a4e7f7afab91dc0ce751b68980e5a4f6d9d6d9b98802ba9d8576640eea61b8c308a1745df61560e56108bececa3016d93246fdc8b768634e8319b1ffde103c07378f8f4927baba05e992a4b5af0958a7e495e7ce53f7917451d15a963ca14f5cdc4563775688b6533a4b97e0f84b0a33c30077b20805c1f42cc7815efada97ad59ac486bc9e0ee386b49cb97b47fbf8f919f06c75a49636795054b5ebee3e91602c90d7f4db49220affe56d56b96e4f662b2bf36dae482ffc7ba21cbc55e21b73309d6b7aa5509defcb77c236e43b579c61eae5c8d8f8fa71ad876b96069f2e4352c8aaf16e299d21edf5434c0cd9b25cdc9210fb0de759b1dd3fc7fe4c7118bbde72a5617dff21f7a5036448fba7fe41aaee0c289cd076d757e47b0713b236f6f141ba0112c9312b3ec853aabafdf1eb2cbb517d2d7352725f557214d27d9a340af0128fc960a4ea64c933b0d8dd226b6e024471aaac8a7074b2a8695ab990fabba5bf315d246fbfe4260f1fffe54814e33b6235c5b4095437298858909bcbd40a8a286d1bedb06b7b1775bce0a5bca19b0a5c2fa8dbf87b55ae0a43c5086422e5bacb94047e150451f5996420b0d4a697f59decb49900b2b9c13aade536933e14d672c21a35cb68572c3de02f3147414eff4b8674b91f7aebf35f056a8d388f67f8ef7cfaf6b28fe745831ef41def1839791647016932c70685752851327f1837d2f1e9d8f93443eefed2317119c8152ca451a5d3aeb253fb484283f52e5db9f61f059ad3c217a860ee0571d254483501b00699208c7fa5571cf58b9715c954115bc2db0af28361938bb95ced7370c8cbb6141ef62fdbf369dfc4eccd98ab9886d79a52cbf91a27dd0f4b29940492e860fb94654dea54fad6290570760e3b59a0cf28053732472dc313b5fedfc583fc702a880971dc61286370aaf167810455cce7654dc4325a41d9d1944abcdc4d81378f1e96a8f94cd95b886a01f086e379601504219d57d531ba34e1ba0905785fb629c61f6b940a652cdee9dbef12b7fcde087b92816db3386a5769049ba00788e31de4ddbb8b56de1fbe3a5e671728effda7cfd0b650cf5df2faf22470812efbbb548e47cbf36c64e05a7877820f08948ceedb35e12a4a143ee0101a7bf0a00a4062b50c39020669700adf739a6f75352a45fd1373d3e85c3867170373f0c7a794d8590f4c22ae62d438ec365b0f6a15cb2ffe0fc6f57185e1760761bd4370027c01dfad0502f00b6898115df3c530d0b0b4a64e623fd580b528a733e4c881cf5843a975a97f92a7833527887c79fa8eec82b9526a15c6c5f2972083ce8aec735810580ffa4ea2cef4823aee044dd70927f7c07bba18b930006aa86ae7399ac6b4c24bc9d6a6ab0c5b428d7255d4d983eadf97e10c1b00867da29ac981acb453073a37236e7ae808e7759b2e0cffc3ec43afb1e95cd090a7d4b9225a0e3cbebfe49b93846ab603891e2da7d85a04bf42d12d16a97c965bc4911d3ba7a9ca505794d8744fef00a436089de67aa8b480070230dfb002eb91edaff428d4908a87afae418dff7ca59aefe1ad8f6935f309fe7985c2310881659c60a66a5e50242497ba1cd5d2bd79496ccd23f9fd901afc6622829cb3701caa50f96e09e3b23bfa3181b74ec7dae2e42c9caab43e49ae1d922a1a1eb3682de026323d9215fcec42c54401a1af81450830a4b784ed1c7922734bf3632409147680dd3fabcef296353705bb5c0e650e12905a05db1e7923923a96ddc783fc1ed46e2010416c37d9d169ad73e808bd6e4464f62893024a8501803b6c88fc55c8bbc1da7cbf580b5a81fb7c61455ae3a8aaec303fba12e0f2b51ed5e8bd31db40e8bdbd00e7b1ddd364766c974d813d86fc88a27bf82bba60c62e5f0f6af6bda3390f8e72a2811baf3d6325e70d9a3b59cab1abe95290ecb87985567e1243504c038de9d4d100ea64eec45208cd8d2474e646f7d81eed6d59b8b0859552b6fc088d874cde3e75ee30243dc9d88ed5b577851a5bd9e2a453287025777fcac19ac33e1c94b4ad272f1055b16b842a6bd6168fb45f1f74ed2467020df5431068a5f2cbeaa6ac1841308c7c9f752aa06927f91fdf18ef9d9e942367e5ecac0abf4d3b8fc7b80238c0e7faf2ea7d3f5271028fc558a44799bde63168becc67c5531e843336fb16ab618d37f95a91937b824bf896b044146bc3a5e264a8f23ddd00729cd9aa56d9a9a24b7ab96ae021b193d8874d43ff4b723d86b7564e550378599c3e0c7a2b3d447ad76eb4cd699733d970a5ab218429a1af81df9c8013d6d16a6bcb019f6ace4461cdaa785d20ea027cfa53d521bb91ad2c04aaa6c0f268b14924803977633280c7b7beb14c88fae542b7a13e96253259e7296e37276da88891c14664340e84ae732edbd71e67047e476735b220ca231de31a380ece372db632ec3cb3ef5ac97ec41148febd2acb15cde1ee5e990ea0aaa95c2df39e2111dd1185d14a194e22d34fda8f54e99d3a73e5a231682c726d40816e048c1d059bf3bb9ee2b5f895365d95aa28f6adbf6e16469926b4d8ee7f04c7dbafaa444df5b88596c17874f0efe35e5ada1a69634f4b430f852d33b032f823c5deb54f47a7a4adb1adf56d5440b7a917580004c13e0b36c8e0a203a2be3f8fffd9efef3af19389a12c67859d4381ac0a02da18e25931b41216b731de25e1245482c84d45de1cddbce2109322a3428bff692012573fe9efd02109dbf35c5d3a287dec105cf3f1a2e5f0b1cc08c7b4759766d25d0f7b42c3ea8bf8101e61159a2ba7602e9c7947cf936ac39bf59b24084709fd61d704bbdba7d282aac778b7ec1dcaf984527c8112d56e75ab774d1598d9816abc77b0e693880beca5f330c626774ab5cb6967fb0ea8e14efce120947092c3b6f8a22f07cad22e971418092481fcad36ecf0cfd6bc3864115b8507c13554584f1f6fee5ee07eb6a091638d8e7781c1c006166e0f987f9f4de535e9f3df1db8c9328e9a19a73c76059ab4edfe9eda7f16cc6b869229bafb179d194e20ccc6f9338183b673de8138ddab9a0907278f6eaacc55bf59a450ebc10e0b88c82d9f0deca800f771f46509250fde94e0c94256b77616d099862ddc9b341838d634a9dc4b55a88fcc6248901135f6aa76365433e7e534e0e5ae8eec2a63df62c3e244a40481189ff54122698c7e2da2c829b2eec9efc9894ee05be04ae6dd48406eaace17827e38bf38b414059aded0343e0711a8d864ff41a8d9ed40fb2aa1a3f4014f691cd0e8af62445a021820ff03afa8a192ee255862f306851df1de96ce36cafb6a60b7069db7aa96fd1ffb2fb01e6247f770304dffe4b1c8d0eeb336dd6806d6ab5d418953b1cae7cbbf53766b61e4aad5cfce8255b78af26f9bd11283a9c7d12cd63b82bb04506fd4061d1e16fc7c713d80763c3b0aa0faadcd9b7d676101aad80e1ca00369297e1f714003ab8d0b545c335014a522a25a767950963ef821425b79b521076166d0df3ef358c7d60d99cc85463c186e8faf16af79785680382e4cc93f6594f8c4461e0988c08717640df24a5f357db22432fcae21702dc792d201212fb3791e0164bb3d433a8268ec96df73766fdba42965e00e619246cba5d96eb853a7c22c34d2fe5e5d3f3ccf9c627d069517b743cd07f6f7b444074bb9a50269f2e03309c58930e56a9583eb00c37fbcdd391972261f41756c10c8899fcd036e2017e088ef9e6ec31f795d55b3bba214c53c98fc9318e4ade0e7e6fd259aa277fed54c27e5210787a5f6937f56fdbe1da5113f059061ca590ddf536a55cb91ac6ed41cb9c0418b115b29f5e823c1b0ee7c2b3982087763545b34e2c945d587ebce69bbe299a7f52b674f351977370fc700474bc15d7e6ef98c14258ecf401a4f3bba1a9aa76c5ab0b8819fe6efe3fba1899909e5e48554299150ee272451b56142d12ae2bb4942db430239701d494917f2c939a6fb9d98d4751a6f2c4537ec870342d223343a9bd7b8d8c99aff8cbfa298395551185f35dec120228073a1e496a58b59d9ac5986249a7c6db9398395cbf341c08ee910700e2daa042dba1846fef59c72ce872bba2046a14fcf9a47a5686d62bfba76309a9865c26e5fa41dd872fc749fdc57953105ace4978f9eb788c8d061c853ad0313e51e732c5d7bc05e752443c8e99b8e81c688befdb5b14c3cc2f96eb8ce8290303e483992fcbece1ff278d0dc036ad437b6cbc695c7741ba4556e242146d40843c73deaf8fceba40e4a4acd739b3031848b17a210a1ff0dc1908b77c4bb94543af52e1fe2a090c8f217428d02336303f7952c3ddefa7c81850676e7f4cc3d32c3937281fa5ab279c3fe39f92ba077dadb8c2c3df17cc511bd33c41cb161d24aea154f0f5902c94b56fe072d321a983668bd9f4838878e66ec44cb233d7d0ca908a794c844ff8b3ba4c57f6c5fc2f3a54db448b013f0c4998bbc6ed0409b3368391cb28c6df4a909fff90f308ff38c758ff7d8a2920bc221236d89b3b76de44e8ce649b32f5135a0217ba9036a8edddee97d7ba15f2c21fb7d3cae3eb6ef09dd03eed650489c83b5ba5dd9daf7a86cf0544fb8a58e46b860e3e42e10cd6f1c4f81179eb2c3ba611793a32abb4c0768db90e8bdd1694efaa9c2b45c89d203fdfb8b926b6a0d666d91b93065a83184fc2065961f2308056241b66f427c0f0aabc75852c90f0624cf036d537032ca8d73325d2ae2a79a7292c240c34584bb881fe5d468a051cbc0bde061f9eddfb758cd2dfba296eef549e5c4ede097111216a0ec60f90e8d6f5dd843c82e15f505f8c74e854ba9cd386249d552978eb8135a5f8c79c3ceb8dd5828b0218ffe40f375d6cf3ff2f47c276c8169ab98336582a852c1535018fb2306aca6b8c9f9e38d64c66a722762b76c69d4ca6c14bd6992549e4eec17287fce194467f972d9200c3d1ac4fd4a8f2620e2e4281d28c099946ed90789ba122705326390d3e058ceed24044e542efb36416272eadf6304f30efa0b7bc1ae5be92fe50e591ee6f725726e917ec113506920beb2aa53b39f1d76b31500", "cfb220c7d481332f3f1f8079dfe27e23185fd67a407358db7892789f96b7fa9b14daa48617a10d8a91b820ecbaa470ec0bb1f3cbce7f70ec70b19a4cad082229c2788f8611d7dc306d9a45761a97828c36ed87ebde5d4a3e1609c1422a8ae2f7cca428ebdb0dd38b90b9598a353b18a600bf35a369e6e3e5abb0a1c5c0c0e48e014e7ef1b7d768b3c5657f1adfbb7ff2985082b16c99eb83ec3660990dcf1106efa6b7f8a4798fec811c2c85faec0235c83b7093b3d02367421abc40a554e0b0d7fc1bcaece4222c594f8d20e368fe625ca433c75486fe5c94103cd17291349ee12b877602936688666f82ecd8f4f83d50bb1650e08b96cd25ad147c4c956c98649806a3736d072c8d97c6e3a46a7c18535df8d828b86662400d8e9cc861fa1dd5dc193892d3168396c499e07b279fb76c7e289f2fd955691363bc1de74536dc571817615c88b0d594a136966c129e424ccb7ef1c7c7461eac7ca5f03d72ea4c9c3d1156ee4cb1bb70e097357588b5c49f6716bbae1bd118104b42786f09a3b9f7cb80f383cadfd0c462096ff2bb637b7cf79764b6a4b7ffc5d87c1f063fb48e7f08ad5af534c70079f12f28e8921abbd4280801cdf6101ea494768b1274afd0eea5939843d56022a83590920fe446d52dfe699c33977d5592dbf7e0e236b8175d7faae06e0c50f7402174023ce4b996564e945c416fa823f2f9c3213ac50b20bd1fd55bb8d9fe70ee31ea2f404ae0fcbf857bebcc9196c8c622059fea2e248e4058905b69fb98be312d3193ea1d8ff653173e8c2371371b77a5bea45b3cd6fba19b6336f94ec04c8f86d24e9ca959874577d7ca0baf3c4ff30b554bc3ccc06df46d925373fbf7863e2cf684d3bc9603ab72b851ca4728294de87f2dec6f23ca9e43ed2e5cbba662d13137fc1ce0f6ae6aeb974f72f4b750825fafb67715e425f40c7da83b92d4249a0a4e96b789cceb7b07f38cb83f72dd093a345ab3cb8ae760fc14e40ea182a0d7fe1facc62a1ab0902349fd7e27bb0cd349fb5053f4734823abf020739b4b43bb11f5d69b61295068df31177959903c2ea1bb82d24eeaa93d0d4738d5d15b2a401e7ebe0d3cfbd45b2db2882cdb41408aaa718f8320fbb7f9da4f68d0eebeef175442e807e9908132731fe5e268582dcf6dffa4251ebb7121db8e412089fa9d8af9919799547a26b6b8eb44c28f1ce5f9a3021fe30841be204c1b4b3813dccae6baeef9b53fe413cbec46bb0cd95d3793cdc9bfe6cdd96ce0c4aa4a25e1cbbeeee6c9fa558b279048c7e31d07b125bac68d4e1f4253bd4dc7824cf3d722c94cf2b8f61bc8155731f072fd447082b181a13ffb8c08a1d568298c5de2d969fae2bea070a9e2688f294e76b8c200dfb993ec19778eb56ae3127c1116ccc85ef8806fdcb9ee0cb66ff03fbb0fa6c52b9b101b3830fc1650efa859163a264b4059092e5dc9a415ec09bfd1460f142fe5ef00beb6aa9032bd0de97aefc6f65e8cfeea761b3d8174caf528b6627682ff4d4450cb0f34251fc000ed01dd538ef13260984f44703b89dfb511bfb538d0b1c8aded964e1bcc5ca57437468b14a31ec0000a17e4d24369c40500449c37e7dccedba3eceb59d827dace246b5c48afb6a5988e64c560b3dc76c32d831f51cdbc5cfc4364ac8b25372b87c92bacfedc6bc8feb44098dbebc89cda03c59e4c58a31372bd574704b9e788834b9f83c6703f6709efad97c4ce499ea580dae1de282a019247cb3dce5c1906322e6d3ca5157ea6428bc42416936fac194efe136089c07faf7adf1e923003f1dc63fcbc634b389a4f351a6acee785e23c6bb04ca2f265be1e634362b87c6f9fd369bbe62a1db6b286c7ffde6370bb4d6e9e27c3ec451e1a99d134726c9075e71319d3a683e91e4b900061c0e6d086481069cd32f4cde7816f8e3a0ac6428a7488f31f06ee0da10df3ed0c150d29085879d064f914407f60018bb588735663647bfeda930407d69abef3f72fd461c2b85b00988b412a180fd267fc646a86d297e7e40912607157b6fa873df6442579b1523d8117f0c06c87adf75843b8bff30a5bfb4fe1e9846b7fdd58774641baf9cc9c4e38e53ed24a9d9e9dbc7657aa9b220a8545852b0409f5c0812e953823e841967bf55059acc7a4600818134359e72cfae0d04a0738ac8acca133d6395a455b22cdd6f901d4cdea1cf17415f7d7895a4b65f80d2f7c5c60a0dc04b40c9ae5ffc922e074a82afd704673e1766d19db9f60eab0238fb4a3169a08aded607847e5d752d4e24c4914b95bac3892bcfc2076f16a7f07583f0d418b9dec03afdb2e93335a392e1b1ef2910eb2a4b6a63fe61641f3c02bef73cd7e4a77a6f30ae821598c3160511603541bea89022b54f321c2a55cdeeb19335d78a821ab6ca0f36588a9a79a41e2123905a491d658c2a1caeee998c995bb0f816c92c5dc2b862183f80b9f9786c9c5524723c944d11f6894c7f008ab8194f577e22c03631d2a33205f508ea49653e7600639242dbaba704f700ac227f32dc575c559a0a1f4fe0cf6c22fbf7e1ca2ab4b1e4724e8379021e3c9a7c1509c6a413bd7d9c98938e440762eda2546d636597defa86c1ad31126a1182d365f858927d140fb0a97f80adcc5f4ed5efe11ac503453917a263f1d64692348d30f382e85e464ef7616067a42df5de1a1b622fabefe2ca4ceffa4801f7a02fdef40644cd1d079590d900727628d54b44db7ac700d8d664f7eea12837fcf347360d8e43a354fe51b4c49e8fcda3c322b738ed2b800b5cc06e22c72af2a67ee7bc8ae894e841f2cf2b0a7e381caf944bf4e91ded63b6f82f7474e4f81e986fff7e5339b8e9f60103a1af81833e120f0c88893ecabac044a4a2867cda4fdcb084459a00507aa9e5a8e761a72df3322a1ae8cd918b4994c23bdb1e459b4f21651bd7fa067a00e2a2877bf6b29f289ed8018e0a78f6fb4ded9749640e0e37f6381b320ab72da404f3d70d60152f6fa6738932387b83250cb3148141edb52f109bfd4bda8054959db01f4c550609a63c08cf01ecd110cfc6f0055638c0dde039d2ac2daafe59e561f9f08a8830c3f661e4325de63e98f4a4216ec3b83fd200201ed3f647147611424286ffc6c4a8aca64a6874743242d4feeaa9153de06e51c512d9cab7ae712c6424069f3e5db4ddebe9b48b5f6caa741162edf97674d2368e03a387f798151a4b9b9fa9e3a5838a343133158364a9fe3bb4b9a3c464c0c54a4c64ca774ad200925ac6bf59508c10a8574afde9b821741af43ec64cedc13aa220b39772195283506dfe899dd6a7b37eb21f154056a2df3564ef2bb918a928651de88c3613b84e7960bddd7b46b1304deb30f57b6fe5a3b4788629e91bcc2456a72fabb16b47da71624d2e9081de748b3387f52da4bb094782326dcfde0827e2d674e41bb375247d749cade9c704e5431785009b0e53f1b45c70b237c9432e07e4c7a8464ed11608a3d2184338dd9e6f6ef4b3d751e979667b6a3953c89aff4eead7a978071a912b3de21a85a5849c57933cf53cd74a610f3e60f699766fbc7e0bb8a891a429c77bb6f3b6f9f8eb0b1bd9588ef2ce98fdf0a0838e4b0bed807d8b673093c717feec8d697e32542274887d039db7a2daed5d52c8e9767443229f8003c5d67e907376ea2f393484fa70deee159cb56f8d097b8fe2736e95f540137e20725f0940a8d049068ead4c46bb3771a671bb00de88931e03445a55868de0c220db05cbda9f996d5fe7c1070efe5e718fed4d4cb4ecacad3d6b643bc0ffe9a71b720ba7b5adbbdefe29106ef6a6ffe4547f5d02bec312147df0abe80efb2d5e598fc7c8b268e58b59e0d75728e9a18126f013c963ddc92d251405f857fe3a5cbacf443be7772975b7bf4f6d7ed6f80dfcc47a88c6d19120942adb5385be6ef3c0d7e396bcac5affc8f9276d6cd1a0b069aed72a98cde8ea7aabe6cc091b19efcfaf9368dfeb3087a05a42e3b893dae5ffeb72e6ac06e995a2a75ea0b5f7876247bb4c38cf3f0153f1f7473b522f1c440b632270e2b1d654d3a5ae16cb788482760d34ca79c8951b29c628e21029715683a3e6f8f77c5d89ecdae37e0190f79c4c1dbc9d0160e359cd6c94d6662ed53bb01a83374ff593c823acc59241b11f020902069fc0054a9b26cb320bef4fb1f8cc5bd8ae76eb029afab731b9876bc4e8708a8315512823cff1f9375d284ce66e53d4efad6c76d17bb532fc938b8f80c13ce86b5ba3e540164bc5a5d47cd321c241d8740f453ef95bd3878d578561ad6ce20877ffbd44062dce8df1d048d8d5e4045be647886108cbb1f0b26a8b74b66858afedb830a161bb02bde4c46a688a0ea3a7018ce24666aab0f422ede2f78ea29f77e28d87c744cba0285ce33d0d9ac45774829699de6d725a9b6db6e7d03ad4ec9d075c386e68ca0bcd9e9911d741ed0168cbddb87a7918a964d206629da4e887277b0ef7d3f9c7082f3f15f29a0dfb39f3b0877a5ec3ac4343e0d808f5aee8f1869923aab6dfc3016821c013109f34aece6183994b853d0e9561375c02cdd26b1b55194757341929a8038864cedd6b5a3b8b51ade44637044c4ebddb190f173969a0ca4cf5d42153763a0b91da0110ae7a25204850927d81b00176d4568a3d444d8029bd010df784e3f673fe855601ec4f1b26b2df58841e6a65f0db66373f63cc14a8b07dfc52ac9957eb542d05ed687c79519609de96df18b63cb294b534ddf7d2e8f41bcc1e5a006191c4db057b6709f0a967e8f67b8be2a19c015b9c4b0b3f42e4de366b71f8da8888809473c3c7a02a1158e375f29997a43bc7118ca4d1abb8f8f21972fc589aaa3d73a4d40a1e1705e169ac6e56cff50d89fc45b6863c8fc67bb2b5939a7f33072539ba4c24077be5711ba368bf7efd4897931531d388eb5c2e56bef337777150dd59518652145c9594e110e41d2615196c6b197916c88cc2814e13a3a922b4ecb044bf31cc90e0bfe0ce07de29188bbcb0ec1a12b509f52582fbb948c3cbe0c6964f46991cec0704bfac08aec6ad8ddfc36dc68c7f547c5ee6af4a8d55c79e3dc1c49b045379811f81e9a185a92cd37ae4ee32c5d3c82d36d6202a6c84fd231fe467071d42072827fd77afa5d757e6f37247f783ef09bdfd7536b666e84bc4bb878005b7829293a04ba090272dec844f4ef0e934617c08518bdc6b915ac6f3f03e4a6ab88e21c3f21f93b31d95ea3b9228e0031cb69795de5abd19c4cb4a0cf2984e53ca391cc66e33ee0d510151670331fa264753704fea5e4b1760f74890c49a74a47e0da13155c5470013d53dea0f05b5e088f1511c209f5be940232318af2757951d399e32eb862d915784713baa8ba93645caf04ba78fa3cf600ff92b9c5be58ad87438a340bac00a5ea9fb17e39478ba61fe36335e48d8c5a0b25f024cbd2ec7f217d0f260951da396dc13a2a74cd90df4b52db686e3b34d27cfa4cebd7bf59cbcfaf4007dc943a1da6e0bd1799a21ab449d7bb42935e50c839c5b567c59742436af15bc8d46095520dcd9273ae2b6f3c1cc2b4311ac9e5d297f0940b1552c5955adb302022022bb7457978998b56328629b7725dfbe3dedb37f37af0697a4471d1d6ff6bec633a38540adeba903f3eaaec5785fbb3c6a598f49dbd9ff93c67dea1ef39a614331b119fa8efccc8bac01595fb95a2a57eec9fc6c6fe82782aa89ea971866fd9a3bca4010182092ab6d1e2b49b964be9e3bb13bd6b77850e435f55bdd46e5bcb3330c7edefd31c33f61275e51600"})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000156000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="65660fc736b9230200000f320fc5b0040040000f0f10970fe8fa6466baf80cb82cf59b88ef66bafc0cb000eec4e21d4501c744240000000000c74424021c320000c744240600000000c4e17de69222ad2eec0fc76e04b8200fae8266bafc0c66ba004066ef66b8296c", 0x69}], 0x1, 0x0, 0x0, 0x0) (async)
ioctl$KVM_RUN(r2, 0xae80, 0x0) (async)
r9 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000440), 0x2) (async)
r10 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000201b4510fc0428155d6d01020301090212000100000000090401"], 0x0)
syz_usb_control_io$printer(r10, 0x0, 0x0)
syz_usb_control_io(r10, 0x0, 0x0) (async)
syz_usb_control_io$cdc_ncm(r10, 0x0, 0x0)
r11 = memfd_create(&(0x7f00000009c0)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdbU\xb1\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\x90i\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14O\xf8\xb5C\x1f\xb6b8b\x06A2@D\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\x05\x00\x00\x00\x00\x00\x00\x00\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\x88\xd1\x1eQB\x18\xc1-\xc4\x8fK\xf8\xfa\xb6\xf8\v;\xaa\x8fW\xcc\n\x17\x7f\x98\xb7\xcdqV\xd4\xf0)\xfa\x0fG\xc8\xbf\xfd\xe8>K\f\xcd+\xb0\x99Q\xba/\xa8\xb9`k\b\xd1\xcc\xfc\xeaA\"\v=\x83fC\x90%\xa1d\x91\xf8:\x16<\xad\xc2\x18\xdf\x01\xe2\x96\xfcj\xe9\xa4\x065m\x03\x05Np\xda\"\xf1\xb6\xbcP\x8fP\x8d\x89%\xf2\x12T\xd0\xc3\x15W\x9c\x87\x1b\x8c\xc9\xd9\xc6\xad\x96-d\xa2wFB\xcaB\xa5\x15\xf8,\x04\x1c*\xd98\x8bG\x90\x81`\x03\xe0\xde\x9c\x9a\x0f\x1b\x8f\xd2%*&$Wc\xb3\xa6\xc4TK1}2\xb3\xab\xf4\xb7\xb7\x85\apa\xaf\x1c\x10i\xb9\x9f\x06\xff4%\"7f \x0e\xf5Bk\r\xac\"\x13tNx\xc0$\x85\x9f', 0x3)
ftruncate(r11, 0xffff)
fcntl$addseals(r11, 0x409, 0x7) (async)
ioctl$UDMABUF_CREATE_LIST(r9, 0x40087543, &(0x7f0000000500)=ANY=[@ANYBLOB="000100000b000000", @ANYRES32=r11, @ANYBLOB="0000000000000000000000000080"])

3.259633778s ago: executing program 1 (id=1542):
r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x800, 0x2)
writev(r0, &(0x7f0000000240)=[{&(0x7f0000000140)='\x00', 0x1}], 0x1)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
ioctl$sock_bt_hci(r1, 0x400448e1, &(0x7f0000000080))
ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000540)={0x3ff, 0x9, 0x2, {0x2, @win={{0x80000000, 0x5, 0xfffff7a4, 0xffffffff}, 0x0, 0x47, 0x0, 0x8, 0x0}}, 0x8})
r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xfb7349290c86be9a, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x1ff, 0x4a, 0x0, 0x9}, {0x9, 0x6, 0x3, 0x7}, {0x1ff, 0xb8, 0xa5, 0x61}, {0x7, 0x3, 0xd, 0x95}, {0x81, 0xf, 0x6, 0xffff}]})
ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f00000000c0)={<r3=>0x0})
ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r2, 0x40182103, &(0x7f0000000180)={r3, 0x4, r1, 0x4, 0x80000})

3.160970643s ago: executing program 1 (id=1543):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0xa00, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x20011, r0, 0x6c3ca000) (async)
openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2000002, 0x31, 0xffffffffffffffff, 0x890da000)

2.861125199s ago: executing program 1 (id=1546):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000008c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0902000000000000000001000000050002000a00000014000700ff00000000000000000000000000000108000b00", @ANYRES8], 0x38}}, 0x0)
r2 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0)
ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000140)={0x16, 0x1, 0x0, "18e889d15b38429faa8ff62438eaed752e68f3a6d09382b392b049e33958b16c"})
r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
lseek(r3, 0x0, 0x1)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r2, 0x8ee4a000)
memfd_create(&(0x7f0000000000)='\xfb\"a&\x8fe\x11\x8c\xd64\xf9 \x00\x00\x00\x00\x00\x12\x1a\'<\xf5\xbeV\x12\xaal\xfa\xf0o\xd8\xb1,\xbd>M\xe3\x98?\xd9\x96\xab\xc7\x06F\x9b\xab\xc8\x1e\x89]\x13bZ\x8d /#k\x95\x9eLV(\x8a\x0e\x93\x93Vc]mP\xbativ\xce\xa4K\xfb\xf2\xe0\xbf\x9d\xa1\xa2\xcd\xb39\xb4\x17a9\x1c\x82\x1aLT\xd0\xb9\x1a\xafB\x95\xb4\xcf\x91X\x8c\x87\xc2\xa1\x1b\xfe\xe7\xbc\xf7\xeb\xdeL\x1d\x98Zq\xcc%\x98\xb0Yc\xec\xb7\xb5m(9\xde\xd3\xefB\xd4\xee\xb5\xee\xe0\xaa\xdd\x00\xb1jOB\xdas\xe3\xb47}%)\xb9\xbf{\xce\x94^\xec\xdf\xbcW\xe0I\x0e\xa4\x1e}\x06\vK\xed\x11\x880\x0e\x9c\xaeVU\x88\xb0\x842kgA]\x1e\x88\xecif\xee\xba\x8b\xc6\"\xcej\x84\x06\x8a\x99\x80\xd7\xcf\x96\xed\x89\x1e6\x93+\xec#\x1d2\xb8\x80Z\xf7\x06\xbe\xc9[L\xc5\xc9\xb5\xd6{\xee\xce\x17\x89\xa6r\xc5j\xec\x1b\xaa\x996\x14e\xcf\x8axQ\x8fXeT\'0.\x85\xa2\xc8\xb3c\t\xe8\x1a\x89\xecL\xcf\xd8\xb5\xfb\xbc\tX\x88\xbe\xf4@[\xb2\xd5\x8c\xb9\x0e\x17\x8b\xce\xd09\xd2\xfb\x9e\xef\xabR\x88\x17\x9et\xf7\x9c\x01\x91\xacH\xdb\xf9\xcb\x7fh\x83>\x8e\xe1=\xedR\xc9\xe68h\x19\xafLD\x94\x93\xebT\x15\x817\x9d#\xea\xd2\xa8\xfb^\x8c\x87#\x10', 0x7)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0)

2.474702601s ago: executing program 3 (id=1547):
r0 = socket(0x2, 0x2, 0x0)
setsockopt$inet_int(r0, 0x0, 0xb, 0x0, 0x0)
r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x77, 0x29, 0x4, 0x20, 0x424, 0x9901, 0xc257, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x43, 0x0, 0x2, 0x31, 0x7d, 0x55, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$uac1(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000400)={0x44, &(0x7f0000000200)=ANY=[@ANYBLOB="401504"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, 0x0)
syz_usb_control_io(r1, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000640)={0x20, 0x3, 0x4, "5905d900"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac1(r1, 0x0, 0x0)
syz_usb_control_io$cdc_ecm(r1, 0x0, &(0x7f0000000080)={0x1c, &(0x7f0000000140)={0x0, 0x12, 0x3, "c7a1a9"}, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0)
syz_usb_control_io(r1, &(0x7f00000003c0)={0x2c, &(0x7f0000000280)={0x20, 0x8, 0xd3, {0xd3, 0x11, "48150105f9ee0402ff8560b6fe6bf174d6e77be955aa7dd9aa01733b69a207b0af8211beee03e49dfd80f2b06e25d7e6db9d42088762ee4c1cb5066f3f4303ab2a9593b008c00eefdcdd93bf0a6a57dc7337098a3172c8f701d06b03295f89c826c66eac4ab048f099f573e6abf4f74b352d3ba53da874d6b1071bc8d8003379f547e85b88ac5a3b146996e1847f78c9d0b79c4a7b1e609545059ceca913d58c13f459bbd639187fc3ba7e3832e15d5fd64de6f3478cf77ccf070e8081559f45ef2e78d0756f53db23bebceac38c5b1b7b"}}, &(0x7f0000000100)={0x0, 0x3, 0xe, @string={0xe, 0x3, "5a277bdfc327dff9cca3c996"}}, &(0x7f0000000180)={0x0, 0xf, 0x38, {0x5, 0xf, 0x38, 0x3, [@wireless={0xb, 0x10, 0x1, 0x4, 0x0, 0x5, 0x38, 0x8, 0xf7}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "361266cf04fa49410d759cab41dd5155"}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "248f5079cb197181d9b6a2046cbb67ff"}]}}, &(0x7f00000001c0)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7f, 0x1, 0x9, 0x1c, "de21ab25", "3dddb05b"}}, &(0x7f0000000380)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x6, 0x80, 0xd6, 0x10, 0x6, 0x24, 0x92}}}, &(0x7f0000000a40)={0x84, &(0x7f0000000500)={0x20, 0xb, 0xa8, "29244e17777d0a32ea810380d136251c1ee9bf10d191296ebfbd4759b52d7e11e16a805219d3f76e0c5856f3430c41383ecabd9c2cb3de8f81cfead640dfd51a563ea90c5fe19a9e659a5df41b21e8f3da01d06afbf02d20dfc86559099ee1b1c873ef0189fc7f78eeb26d54726a3e38817feeaa48c39345e216617f8cf438deed29702fd00c258482b352bf77ba03b3c11cf05e576dc6305df1d4ecf98e39cfeee001cbeecc889b"}, &(0x7f0000000480)={0x0, 0xa, 0x1, 0x3}, &(0x7f00000005c0)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000600)={0x20, 0x0, 0x4, {0x1}}, &(0x7f0000000680)={0x20, 0x0, 0x4, {0x140, 0x40}}, &(0x7f00000006c0)={0x40, 0x7, 0x2, 0xe}, &(0x7f0000000700)={0x40, 0x9, 0x1, 0x4}, &(0x7f0000000740)={0x40, 0xb, 0x2, 'jI'}, &(0x7f0000000840)={0x40, 0xf, 0x2, 0x100}, &(0x7f0000000880)={0x40, 0x13, 0x6}, &(0x7f00000008c0)={0x40, 0x17, 0x6, @random="25c67a9360d1"}, &(0x7f0000000900)={0x40, 0x19, 0x2, "07a4"}, &(0x7f0000000940)={0x40, 0x1a, 0x2, 0x5328}, &(0x7f0000000980)={0x40, 0x1c, 0x1, 0x6}, &(0x7f00000009c0)={0x40, 0x1e, 0x1}, &(0x7f0000000a00)={0x40, 0x21, 0x1, 0x9}})

1.964087119s ago: executing program 1 (id=1551):
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x800000000, 0xf, &(0x7f0000006680))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
syz_usb_connect(0x2, 0x36, 0x0, 0x0)
ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000440)={'sit0\x00', &(0x7f0000000400)={'syztnl0\x00', <r1=>0x0, 0x700, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x7, 0x0, 0x0, @remote, @private}}}})
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f3, &(0x7f0000000940)={'syztnl0\x00', &(0x7f0000000340)={'ip_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x2, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x29, 0x0, @local, @empty}}}})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff})
ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f00000001c0))
syz_emit_vhci(&(0x7f0000000000)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x3, 0xc}, @l2cap_cid_le_signaling={{0x8}, @l2cap_disconn_req={{0x6, 0x0, 0x4}, {0xb, 0xe}}}}, 0x11)
r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0x800, 0x2)
writev(r3, &(0x7f0000000240)=[{&(0x7f0000000140)='\x00', 0x1}], 0x1)
mkdir(&(0x7f0000000140)='./control\x00', 0x8)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000180)='./control\x00', 0xa4000960)
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
mkdir(&(0x7f0000000100)='./file1\x00', 0x13b)
mkdir(&(0x7f0000000000)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]})
chdir(&(0x7f0000000140)='./bus\x00')
r5 = socket(0x10, 0x803, 0x0)
sendto(r5, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
recvmmsg(r5, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x321}, {&(0x7f0000000280)=""/85, 0x21}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000580)=""/106, 0x659}, {&(0x7f0000000980)=""/73, 0xd}, {&(0x7f0000000200)=""/77, 0x69}, {&(0x7f00000007c0)=""/141, 0xc4}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}, 0x5}], 0x4000000000003b4, 0x2000, &(0x7f0000003700)={0x77359400})
ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000000280)={'gre0\x00', &(0x7f0000000040)={'syztnl1\x00', r1, 0x7800, 0x700, 0x7, 0xa3b, {{0x8, 0x4, 0x2, 0x2, 0x20, 0x66, 0x0, 0x82, 0x4, 0x0, @rand_addr=0x64010100, @remote, {[@generic={0x82, 0x5, "d7be15"}, @ra={0x94, 0x4}]}}}}})
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x7ff, 0xffffffff, &(0x7f0000000300))
r6 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f)
write$FUSE_CREATE_OPEN(r6, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x4, 0x3, 0x5, 0x6, 0x3, 0x1, {0x0, 0x9, 0x20ff, 0x5, 0x89, 0xd615, 0x9, 0x7fffffff, 0xfffffffe, 0x8000, 0x0, 0x0, 0x0, 0x3ff, 0x1}}, {0x0, 0x13}}}, 0xa0)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r3, 0xc100565c, &(0x7f0000000540)={0x3ff, 0x9, 0x2, {0x2, @win={{0x80000000, 0x5, 0xfffff7a4, 0xffffffff}, 0x0, 0x47, 0x0, 0x8, 0x0}}, 0x8})
dup(r3)

1.651157209s ago: executing program 0 (id=1553):
ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x401}}, './file0\x00'})
ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000080)=<r1=>0x0)
sendmsg$NFC_CMD_DEP_LINK_DOWN(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8184880}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, 0x0, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0xffffffffffffffff}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0xffffffffffffffff}, @NFC_ATTR_TARGET_INDEX={0x8, 0x4, 0x1}, @NFC_ATTR_TARGET_INDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040}, 0x41)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), r2)
ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000240)={'wpan1\x00', <r4=>0x0})
ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000280)={'wpan3\x00', <r5=>0x0})
sendmsg$NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x4c, r3, 0xa00, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24004081}, 0x0) (async)
sendmsg$NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x4c, r3, 0xa00, 0x70bd26, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24004081}, 0x0)
r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000400), r2)
sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r6, 0x400, 0x70bd2c, 0x10000, {}, [@NL802154_ATTR_SEC_KEY={0x28, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "e2e8ffe3cc9dd73053ff40ef12f779f8fb00fca83656b8a0defddd7551fabb75"}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x40041) (async)
sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x3c, r6, 0x400, 0x70bd2c, 0x10000, {}, [@NL802154_ATTR_SEC_KEY={0x28, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "e2e8ffe3cc9dd73053ff40ef12f779f8fb00fca83656b8a0defddd7551fabb75"}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x40041)
sendmsg$NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x78, r3, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000080}, 0x4) (async)
sendmsg$NL802154_CMD_GET_SEC_LEVEL(r2, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x78, r3, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000080}, 0x4)
sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x74, r3, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@NL802154_ATTR_SEC_KEY={0x60, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "5e36a1267a077fc8c5aee7b04655292302bb6a83c22295a0ffedb0f1962b1717"}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "f60fbf67c66443250c88666e7053beb8"}, @NL802154_KEY_ATTR_USAGE_CMDS={0x24, 0x3, "d24400473e963664395475a7f129c0eae5cd57c32f500523896e22cdc6ffcddd"}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x4004}, 0x0)
ioprio_set$pid(0x1, 0x0, 0x4000) (async)
ioprio_set$pid(0x1, 0x0, 0x4000)
ioctl$PPPIOCSNPMODE(r0, 0x4008744b, &(0x7f0000000780)={0x80fd, 0x3}) (async)
ioctl$PPPIOCSNPMODE(r0, 0x4008744b, &(0x7f0000000780)={0x80fd, 0x3})
sendmsg$NLBL_CALIPSO_C_ADD(r2, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x34, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x8004}, 0x4000)
add_key$keyring(&(0x7f0000001940), &(0x7f0000001980)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) (async)
r7 = add_key$keyring(&(0x7f0000001940), &(0x7f0000001980)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe)
add_key(&(0x7f00000008c0)='keyring\x00', &(0x7f0000000900)={'syz', 0x2}, &(0x7f0000000940)="3a070caafde33d112e606acb474f4ff2bd7892fcf56d1b92a4e4c81b0c56a2a366624a28fbbb177dc9c2577aa89d7cb401394674e2359e1a4c89f8748e154bd318cbdefc08798daf66c3e177a585e56a4c022d15d4e7d180157b5f81f01431d7199ad376dc21b31f07810c38145ef870786c5722b1939ca50defa2b08c6f1d0c62e1c835d7200926fb1f14541ee4e529067d84351027de3daa00580b8d3542f4feec5c61b7278f52ebb5d597a5de6f8b974fb6fb61881fc26a51b2df6e5e807b9c703394bf6321127914b402d122a2b1069270d7ab258b9f47633b11ea7ede809404c5a389bca1020396ac9f68bf253495d7dfd153283b6ba1d839e71ae51b37d19f412f7e3d8668325e4c4578605aa16def08e437ab5457642e5bc162b1dda1272d548011850eef82679712be19b50bf9a497f4167e9894bd2d77f9fecae3fb2ab366c1d9b3c71810125e4245a4a0c8f796605a824b896c99a5d4cb772184ee17ea16924602ce220373b101a86a1cb09fdf49ba262277dd43093d77bbd6808d107759081347beb4bd8d70e9bf5c26750372a130fc3b642f32848683c572a39ddf92dbba895f5eb082ab4896a2c4997b4974944d8b7711741f437805e8ab01f9faba1d7dfa2f65bc66d9ee0e0501c96543d59f1d482dbf6129f0bd48ec40b2ee84e3dd699122e2219008d648d6160aafbe0f841fe479a425bd592ec8a5607d7a3400a53a1116e10be5f187782519add568862e693235b54e942088b3cc941f0f745f3a706038496a46458402cb07ac9875e0bc189e5d98c8ac47bf98a520689c57544ef36b8b97934911c1c1931dca9337891e6762b8c12e2073291690c4d8dad004415e3ebf5cb8cd04711c1bc6144166aae60bff62947206cb8ebe574b0e8313ea0745763ea0419f9a84e514388a81c757ec3c3eb2610b3db502feff0b2f3f40e26fa9aa8aeacbf213fb2b09aadcefa00ca7afa15ae0732be22d38abd39bb3161dea706f3e9719f62c7b8c63e01b796551ddce1097d573ab088a7a7e230d2b470c0a773e5154ba813d45db2cd169b86c0919ed916f608d22e914637d180b089b1a713b4774cc90da93f0d4a615ec14c9ebfb07c330d94b5c97d1f5d6a59449469b1aedcd54482e6249235ad56e4525a2e437e696ebd790ce82576f81a988419c3b8346d440609b5f59e72857ca54fd743626a11ba6f7386c83f8dba7af559c3278b89ca5e821f48c6db9a177ea6546c9d8e878099217c1e728c5d3cdf8683c6fbb2af7910d5117d99ddd4dd70d560727aade1ec40fd25d6e179382aff734b4352d18c6ef06cb721d9bf847a39fd327d5a13cf1f533f68470c7df724c8d99f4d9b69eeeb26f7de3e6dde3d5a3c7843b9260d81192e71bda2233a33662e36e2cf1bf5af016cf4b92011cf249d7a499119ee83c07b2a280863e07c10a4dcf6f494a47c3a34def1fe2386a80b6271694547d2f67fcb358e9ebd35398d87fa70fe6cfe669f63628ec3f254ba6d7f79f0bd81ee6b9621b8cb6711f1f91109a875dca097f4dc808790d6899a4cb2d858b584651215b68c079651df48d218c89d44489fe197137b8fcb2dc2af3fb1df45485bd2261e2ebd25a36b6151520853596fad9a5044949b052fd5e066b2b90db7a91de1c2bd3c85529d6fe5e9935826d40a9ae5c759d4aa95ba21c6f30d827a07a8b6b3e53957b7eb134ece546b2880b7b7aa42c17ff7bb151ecc388e1e3fb3961cfff9ec0c29d5047e283af759b3b21b14a97269aa64e4f3328bb74a719b76fed653584defc99a378da8948031af15407e3daf30d92e6919d6d739a3a33cab52abf0f55f2f765fe2e634bc565a22b89c3caab7267a0d73b4a71df174edffcb99a217438acb5798e0c9c9848afc524fa04cb52e4295df7b46f4737af64fbbee20440c9d3236ddf3769062f51ad0848469094f460c25da2dc8c093fb1e561c7a275e90e74fa20346891480f73fce9d1c3889ecb593d4eb03f1a8899ff386ff6f47abc9dbedceadf3588e3cbe15ddbac3a63bc2e199f72a808b6c4365745c28d4cc23e1de48217b9f1a0940e9f670b80d7f516bde4f6ef3a64a0a5c1599fe72a7371c1437c158f090ec812d3ec4eb5b0f4a19d3ebac8b853aba25ebc208dc2734878b9724205b86a5e229097d2082ac8afa3a19a639da4eb9f6eeaf825404bbe91282eb97c30ff871a8821de3a7aac80584e1e99c5f3e0aad57b124a28a83b46f30dff5d0b4a7832be57249413bb8542df27c71334929dcb49d99f9db43af89cc89316693a2131109935f6853f706f488e514d8b1097c6bbcf574b3f99d1632f5fdbe51124c8bf10fac678dc9349bde16fb15bb8f4ddf0575d54d16d5a19d3e071ce60bdb212a0693df58ba7b991480a7e5145c51d0ca5f35842f07c6fac8b603893a90d4f740832216ed4b9c479d24b61914b3c3656bacfb6a47cbf029a85ffd55cb3391ec7e2c1949b56bad77a251dc16e4b6748c55e405c0b26193e18de912b857fb96a8e910d7c82a0bd55560f30b3f12616e7e04f61c6003e00c7ab30ca433a0fdfedf818239cd45bd03fd8c957390bcc5bd17cabb0d9064baac01d76e5e1274dbd59889131f1b7fec2bfc4e35cf73ea525f7b199c765e613993b2c72f42f455d4bf2302c40432363e7a1cf2c4da3ac6d0977cd07c2ad07a891bf723a24734d60a27d08fcc4ea32a310a43cfdedf329865779c49ffa5a6ca5902b7245777c91269364aa577e63f9ed1a1d1f3dcee53d2045e60f0954d8842d3a0cb44f2b0ebe1b19e88bebdd5c5e71412977f4d1f1cd8709cfac16e5be2aae859e254174c14b9fc037578b2261feb3f0bbeb6c498873270d776d7821dc1d3456f346701a987d0b094432a593c93fd607761ac419f4e7b49859dc369ac341b8f80317e45cf2f20e0b99ff9941025a0fdd68d22b07c05af8f3d6dc337dc44295b46f27023dc8fb4f49706085b978ecd938f876ce6a877f65088511db3dd350731f4f82372bd4b1b1e72aaf1bf7eaf67de5a265f52297d1dfc0e9961ccbaf2e1b8928ec8dbe75d266e9397654224acee6e20b6cf3937392e726965eb2d13ffd7ccbb9e082f0fbf28691a2f1f75d517f01b84bb1b5259f43a45a260175a0580397a25416bc0661fba65b66171fa38acf0a6cab7bfddd7c5b4a2bb0af46ba34a89d0b138da754add7deacd18ebc11ab360741ce5c07b0251d03949e27aee877336c0d098fcbdd17e930da1f17d6b51768c4eee73c50ef6bdd432915e926fdd6babc46b3027bfdac9df4030d610e570897fb7c71d56346ee3e2f456153ce4fe57e1a1278edd20163749317bbb89ec8181afc6c2f9444c3ab1362970fcfa1e2c49f051850d707faf00738cf96161f58bf730dc9765eb2eb1cfbc899c77a11e2f828f64591d230385da6b1cdb901bab99f0afe5a61f143c7c9412d3765e5262e289679a6ff8252d4bac14f41af2890a4893dbf3c909c3c792fa0177e433bb95d4364183ce5bea5e56afc8f968b5242b9c4bcea3872816360b3cf051e286edaccab3260cadfe6a0702bddfec734ad7331edd8b94247107a9b7d332f57707189177e51c632b414d483424bb1683ef6a612e2654d892d475db11b382f17e9296caf3a44a2d1a237675fae86f62cb401c6835c47fce5bea8d46cca33a7c4af2347cd82b61d9aa2b24a25918eff669ced76304d996fd5fde4365b748b810a8433da7ae54d70f0b3a0aedc41b71da6cab4636b229ba67c3215f0fce1a4a091abcdb0e39a786b10e15abba5de2b06619861bc133c08065e18bddaf092559a87aaec7e7efb35be6d81642e0bc2188b9e98eb9f9f1a02ce721dceedda531fc9d4538a6563f5fc5c0ebec8c8112be088422e5e32a354c14abaa2dae03db64abc782da71ef1e7df451224ff3fd83219b93e947d90249b91146c36d279130213049526e77fb22e69a37223c901758d04c5d14968cedb967f0a12e3693973c6e6a6d76ab496ff157a07a2a0ea4ebfacc293952f09ccf67e44b14e4ca014e4baf8b2a7dbfabbfb2bfa530f7366fc8144a8df79526c34f20389f7ebf7a963704294229d8e4ad6ed63baa67964c9c24e45a565a0225be8f1e3aa3b582c048f1aba84e0328ff0b13925dee25a7fad129c9ad6a8adf3ba25b87b95f4dde644a0a9e40d7068b566b0a192561a7e4ceabe3d64256c564048b59799f8a2ed02c627da1f25af9a6e3ace643f201b1f4924c8dde18cef60eb72e325d702c5d36c70b3e50cf37950bc40412bcc4b06dc8dd2123de46817757ae860befbe63aa70468c7091a60511f24bbabb9bb153714ee89a733d45254b3bdb68c08f0eda5340f5f433116a583080c03c51240afbbefd0894ea46f567d312aac6e5bbcffb27923034a018fb1e0bb0309d67728df0f9034ed1140c1b9c0e7544e2ca9d3e53c9a1fee017ab4730050eadc83b243cabcabffcb2da5bbf3fc6193355db852b044d4c0c27add8674bc4fca8e0b2336867cde8f93633da1b0b0943356730e8121c4a002531adcd0419a57d03b87a76f982f979030693138e3740d552b96fe3a022c1763834633c9e630f1891bc39be40ae8568eb1a269923ccb794fd2a5f0ffe69d4e343a21a982811e9b2d9c567d9d4313a62d28169210135511b178537e33d2aa1e9967c2a4937ff0c162f9675cf4ba54bc0b33748921a6ffe90bc35bc5bc8a8755e2db63fb539e26a73e221a81054dfb63fcd7716e119ee7b1673fa71ad38a6a5dc9b1c705ee2bceabd9499d563a0212d77962dc7c1b48f07538942e72083d4b4563ad001453c64ee6ced4015a127758606321648e7e79444ab8b9b71a324ddca015393ef38c62cb67162a3572335a52e4be0f8127a0190aeb5996858a68e8d4c87ea4771e3554578c8fef519f08d4303706fed45e85b0bbedc4052d8b3166842741f3a0acc65b8102582b19fab8e17b91e126d28cd82f87524d720da6461f62145a1dcb5ced736f5b6a010ccacee2401cfb46d6bb7f2a2f11555254d1139220faebced2fa9f817b0a78621ae6d54d51f70958a527ca00d5300a1790005496a85682330e93aed1406d24d9279ae6d7a9d07aaab9448742fe12192247f184ca2068d4b0bc7e628befa4f1a86a7365da67f830dbeeab6d05a149933907983c75a91640406cf7dd6d681530e34de987405139cf0ae1d566a7790b9d5bdcf147b8ab67c0a7527a330181514d7ecbf7caed3dad2963dead4a0994f5138485f172e6d476e7081110d980d50ef4300eae69777908b68fe439d7f63bacdabb982584456f5026077889d28600a6c948b87156ed1284f26e995c9fc3bc1538b5e46caafdb63c535c045801947f51e15895432cc2fdf1a8be5b6c0d9e07a3b1dd0f8deb9282436f1623a7fd1a82004dddfac469432ab02a55000add148ed1360f6055e90165b57a508b6f0efbf15e4bcdb3740a3ded3607259ca0d07a4b8f40c9c927808325de0b9b543bc6a5de2cae6fa0e53498714e90ea42cd91b79da01d45269d460ff9015ff280822b5ec70342fa96fb529031b54ab4c98e9ddc5673d88ba90a730f953314320534738d4eb82eb7dce13f431ca83f311664191bb3e890f5989f82354b065ef069ccd918b46d3eb0dac0f385be4dd9c4852c59caf50ea222a217ebb4bddcb6b6a3380026dc0a80dc16ab9cdca5d2718a96f70217d1b95f8063eabf338e27bd306225be6a2ad3406d2818c6fde1744bd583a4720b7fd9e866e2fd2b018b7b9620dc91c1652a9793037d17621cca89414375a957b80747067a692b2bed6a6ba4cb01c6655f17e6", 0x1000, r7)
r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001a00), r2)
sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r2, &(0x7f0000001ac0)={&(0x7f00000019c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001a40)={0x38, r8, 0x4, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_MIN_BE={0x5, 0x11, 0x9}]}, 0x38}, 0x1, 0x0, 0x0, 0x20004081}, 0x20048845)
r9 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001b00), 0x402000, 0x0)
sendmsg$NL802154_CMD_SET_SHORT_ADDR(r2, &(0x7f0000001c40)={&(0x7f0000001b40)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001c00)={&(0x7f0000001b80)={0x60, r8, 0x300, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xfffe}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x60}, 0x1, 0x0, 0x0, 0x4}, 0x40041) (async)
sendmsg$NL802154_CMD_SET_SHORT_ADDR(r2, &(0x7f0000001c40)={&(0x7f0000001b40)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001c00)={&(0x7f0000001b80)={0x60, r8, 0x300, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xfffe}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x60}, 0x1, 0x0, 0x0, 0x4}, 0x40041)
ioctl$USBDEVFS_ALLOW_SUSPEND(r0, 0x5522) (async)
ioctl$USBDEVFS_ALLOW_SUSPEND(r0, 0x5522)
openat$kvm(0xffffffffffffff9c, &(0x7f0000001c80), 0x2, 0x0) (async)
r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001c80), 0x2, 0x0)
fcntl$getownex(r10, 0x10, &(0x7f0000001cc0)={0x0, <r11=>0x0})
ioprio_set$pid(0x0, r11, 0x0)
sendmsg$NL802154_CMD_SET_SHORT_ADDR(r2, &(0x7f0000001e00)={&(0x7f0000001d00)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001dc0)={&(0x7f0000001d40)={0x68, 0x0, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@NL802154_ATTR_SHORT_ADDR={0x6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xaaa1}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xaaa2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xaaa1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_SHORT_ADDR={0x6, 0xa, 0xfffe}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x68}}, 0x0)
r12 = syz_genetlink_get_family_id$nfc(&(0x7f0000001e80), r2)
sendmsg$NFC_CMD_DEV_DOWN(r2, &(0x7f0000001f40)={&(0x7f0000001e40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001f00)={&(0x7f0000001ec0)={0x2c, r12, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000050}, 0x40000) (async)
sendmsg$NFC_CMD_DEV_DOWN(r2, &(0x7f0000001f40)={&(0x7f0000001e40)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001f00)={&(0x7f0000001ec0)={0x2c, r12, 0x4, 0x70bd2d, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000050}, 0x40000)
syz_clone3(&(0x7f0000002280)={0x1a8180, &(0x7f0000002000), &(0x7f0000002040)=<r13=>0x0, &(0x7f0000002080), {0x1}, &(0x7f00000020c0)=""/160, 0xa0, &(0x7f0000002180)=""/139, &(0x7f0000002240)=[r11], 0x1, {r0}}, 0x58)
sendmsg$netlink(r0, &(0x7f0000002480)={&(0x7f0000001f80)=@proc={0x10, 0x0, 0x25dfdbfe, 0x20000000}, 0xc, &(0x7f0000001fc0), 0x0, &(0x7f00000023c0)=[@cred={{0x1c, 0x1, 0x2, {r13, 0xee01}}}, @rights={{0x38, 0x1, 0x1, [r0, r9, 0xffffffffffffffff, r10, r0, r0, r10, r9, r10, r10]}}, @rights={{0x14, 0x1, 0x1, [r9]}}, @rights={{0x24, 0x1, 0x1, [r9, r10, r0, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x98, 0x401}, 0x20004000)

1.509065633s ago: executing program 0 (id=1554):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0)
r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x400040, 0x0)
r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000)
ioctl$SNDRV_TIMER_IOCTL_PVERSION(r2, 0x80045400, &(0x7f0000000100))
ioctl$IOC_PR_PREEMPT(r1, 0x401870cb, &(0x7f0000000000)={0x1, 0x1, 0x4, 0x87})
sendfile(r1, r1, 0x0, 0x7ffff000)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000)

1.38883966s ago: executing program 0 (id=1555):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async)
r1 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async)
write$tun(r0, &(0x7f00000003c0)={@val={0x6f01, 0x19}, @val={0x1, 0x0, 0x0, 0x0, 0x14}, @mpls={[], @ipv4=@generic={{0x5, 0x4, 0x1, 0x35, 0x16, 0x65, 0x0, 0xe2, 0x2f, 0x0, @rand_addr=0x64010100, @multicast1}, "8401"}}}, 0x24) (async)
r2 = syz_open_dev$vbi(&(0x7f00000000c0), 0x2, 0x2)
ioctl$VIDIOC_ENUM_FREQ_BANDS(r2, 0xc0285628, &(0x7f0000000040)={0x3, 0x2})
mknod$loop(&(0x7f0000000200)='./file0\x00', 0x6000, 0x1)
mount(&(0x7f0000001400)=@rnullb, &(0x7f0000001440)='./file0\x00', &(0x7f0000000040)='cpuset\x00', 0x8000, 0x0)

1.20757242s ago: executing program 2 (id=1558):
syz_io_uring_setup(0x18d7, &(0x7f0000000040)={0x0, 0xd9f6, 0x2000, 0x1, 0x25b}, 0x0, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0)
r1 = socket$igmp6(0xa, 0x3, 0x2)
bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0xb}, 0xd}, 0x1c)
connect$inet6(r1, &(0x7f0000000600)={0xa, 0x4e22, 0x80000001, @remote, 0x57}, 0x1c)
r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0)
ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82)
r3 = syz_open_dev$dri(&(0x7f0000000180), 0x6, 0x80)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000440)={&(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000003c0)=[0x0, 0x0, <r4=>0x0, 0x0, 0x0, 0x0], &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x4, 0x4, 0x6, 0x9})
syz_usb_connect$uac1(0x2, 0x99, &(0x7f00000006c0)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902870003010070040904000000010100000a2401e70000020102072408040f00000904010000010200000904010101010200000c24020140040503161e7de1090501092000ff0802072501800904000904020000010200000904020101010200000e2402010903bd023cc15440a8290724010000021009056c33a1"], 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000580)={&(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000500)=[<r5=>0x0, 0x0, 0x0], &(0x7f0000000540)=[0x0], 0x4, 0x4, 0x3, 0x1})
r6 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r6, &(0x7f0000002140)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(michael_mic-generic,xchacha20-generic)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000100)="6500eae7288f7590af37bbbba40255e6b18cee5cf400aecbb8d84f2190279e322318a8fb04261aaff9e200622569b8e5549cd363def00c69d1825c7b06a0d352ba09169f15ad8081c865879b1c05656746eeee5aa2db0204aff28f4711861df602971bfffb", 0x65)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000700)={&(0x7f00000005c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000640)=[0x0, 0x0, 0x0], &(0x7f0000000680)=[0x0, 0x0, <r7=>0x0], &(0x7f00000006c0)=[0x0], 0xa, 0x3, 0x3, 0x1})
r8 = syz_open_procfs(0x0, &(0x7f0000000940)='timerslack_ns\x00')
write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0xa, {"a2e39b214fc752f91b2909094bf70e0dd038e7ff7fc6e5539b324d078b089b3b0838681a0890e0878f0e1ac6e7049b3d6d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b343b0d076c0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0d9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c30900004288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef7becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda930b000000cbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe505003d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6ae4effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d71eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d471c8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949d9a92587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15aa82000000000000a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000", 0x1000}}, 0x1006)
syz_usb_connect(0x0, 0x64, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000002ffa9400819151300000102030109025200010000000009040000042513bf000a2401000000"], 0x0)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15)
ioctl$DRM_IOCTL_MODE_LIST_LESSEES(r8, 0xc01064c7, &(0x7f00000009c0)={0x4, 0x0, &(0x7f0000000980)=[0x0, 0x0, 0x0, 0x0]})
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000840)={&(0x7f0000000740)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000007c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0, 0x0, 0x0], &(0x7f0000000800)=[0x0, 0x0, 0x0, 0x0], 0x5, 0x8, 0x9, 0x4})
r10 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(r10, 0xc04064a0, &(0x7f0000000040)={0x0, &(0x7f0000000140)=[<r11=>0x0], 0x0, 0x0, 0x0, 0x1})
ioctl$DRM_IOCTL_MODE_SETCRTC(r10, 0xc06864a2, &(0x7f00000002c0)={0x0, 0x0, r11, 0x0, 0x80, 0x5, 0x9, 0x0, {0x9, 0x8000, 0x1c, 0xd, 0x8, 0x401, 0xa929, 0xa, 0x0, 0x52, 0x8000, 0x7e9, 0x401, 0x9aa1, "cb630dab3a0338057401a192419598961f50dc45c87d55a52a28b8f01c0e0e7a"}})
ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, &(0x7f00000008c0)={&(0x7f0000000880)=[r4, r5, r7, r9], 0x4, r11, 0x0, 0x81, 0x8, 0x2, 0x7, {0x5, 0x5, 0x9, 0x4, 0x703, 0x0, 0x101, 0x2, 0x1, 0x1, 0x40, 0x1, 0x5, 0x5, "9992db0acf876742444e72c3bcd3cd6425ff152133f2d40b514d52fab83e5d48"}})
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b04000000000000000002000000de61541254000480500001800a0001006d6174636800000040000280080002400000000028000300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316330b00010068656c70657200000900010073797a3000000000090002030000003200000000140000001100010000000000000000000000000a"], 0xa8}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800)
close(0x4)
r12 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000001e00010a030000000000009b2d"], 0x28}}, 0x0)

1.20558132s ago: executing program 0 (id=1559):
r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x0, 0x2)
ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x0, 0x6})
r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3)
connect$bt_rfcomm(r1, &(0x7f0000000040)={0x1f, @any, 0x2}, 0xa)
shutdown(r1, 0x1)
fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000080), &(0x7f00000000c0)=@v1={0x1000000, [{0x4, 0x6}]}, 0xc, 0x2)

1.151058615s ago: executing program 0 (id=1560):
socket$inet6_sctp(0xa, 0x1, 0x84)
r0 = open(&(0x7f0000000100)='./file0\x00', 0x80ff, 0x36)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=000000000100000,user', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r1, &(0x7f0000006300)={0x2020, 0x0, <r2=>0x0, <r3=>0x0, <r4=>0x0}, 0x2020)
write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x0, 0x10408, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}}, 0x50)
syz_fuse_handle_req(r1, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_fuse_handle_req(r1, 0x0, 0x0, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x78, 0x0, 0x6, {0x0, 0x25, 0x0, {0x4, 0x10000000, 0x0, 0x0, 0x9, 0x0, 0x0, 0x3966, 0x3, 0x8000, 0x0, r3, r4, 0xe, 0x6}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r5 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000380), 0x101202, 0x0)
read$nci(r5, &(0x7f0000000100)=""/107, 0x6b)
write$nci(r5, &(0x7f00000024c0)=ANY=[], 0x4)
r6 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0)
write$tcp_congestion(r6, &(0x7f00000000c0)='lp\x00', 0xfffffdef)
write$FUSE_INIT(r0, &(0x7f0000000200)={0x50, 0x0, r2, {0x7, 0x2b, 0x2, 0x40c0412, 0xd5, 0xfff, 0x12, 0xd8ad, 0x0, 0x0, 0x40, 0x4}}, 0x50)
dup2(r6, r1)
r7 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x88b80, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x22052, r7, 0x5708e000)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0)

996.760266ms ago: executing program 1 (id=1561):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
r4 = socket$inet_mptcp(0x2, 0x1, 0x106)
bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10)
connect$inet(r4, &(0x7f0000000480)={0x2, 0x4e24, @loopback}, 0x10)
sendmmsg$inet(r4, &(0x7f0000002ec0)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000d40)="a92b94d1e1183012e6ad857779170dcc433ef70ec6ac99c45158447db78fe909f3e4475842fd859e38bab842ee8f6faef5a1f50caa90c39db7c7127793d535e154bcf692bb895644372d02068915e7546f224a7812e3a9a2ad37c21a75c9dcb836169bf2edc1e5e329802b55dcb3d65d09d3cfe2041352d8151a3951d8b3bb212da1b087376e9a8299dab12c22c2830ae8386c464fd3dfb0e163dbc3458f503c722e30bc0d5e0a834d7e34fc7dc98a4b7f6820e1b846d8b49e5a584d0708242cbf451ec193f29c1cad4450c99e5ec40e7ecb020b26f1945680ea1d86444f31ae7c91cad14ba1e095e22b775a6f9a2d8a996b3c73f411575b11890cf2657dc1fa30c3ad2dfd73ca8b7db23c83d08cce6b405e8513dee521cc0cfb85bde6d06fc4781a75ef4ca2f4492a161ca0a7799c5be7c48fef31f95e0152313c9b3dc4bcc6c2b1fb9ad46b9a67e283d01b7629617d42916b4aca7787a48bcb0a580a00000000000000340c719b0d4cef5822af6937528b8f47c006b8d8098ccfb9f1fe8fb444b4a02609e65588da8a5ca8ef490811398270f71ca87b1ed0916a5550a1310af2780d973aa62dff346b20d976042176707fe649bae1f34b756acc722ae8916d799190f67dbac24a75da22062bb6c25582e9477ecc6fedb5587e1b65a39146293c2d80ab678f6cc118c2836acc1de82d1d522583b285bb19b28aaac86b218a223a7b56333f9562e669d9f1aeb6760fefbcc27b79faa9dd09d44247062fdd9af054f6bc979d1bfad6e3be39c7ae2eb85d21c48462fff1fa43399b2b223e5dcc57f627fd182bac4dba7f13543c76997cff0cdc0c29759230a5b9b6d003a103880ba8d7624c62fb8a6d521042846f3fcbedb4ab141b4eced1c2f451c9a7e70cb95d1c99e4d24545a4f093c1cfbd4961ac855539c14ab7cc830c50ed01ef7e252a5ccd30142c8073ecb24bd397f36a37f5a02c3df01f7ae349db37f68595a353bd588d0c71d40aa0c51ccba0c0a82500469a404974940acf93d765ae2bfabae6d8eff632707eed67f2878f0aab3e27279b2e61a973cf7f46404e25f385c8fa1d5a5b5c4d0f32e2bd090998", 0x309}], 0x1}}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000000c0)="7da7ab", 0x3}], 0x1}}], 0x2, 0x400c0d4)
sendmsg$inet(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000280)='&s%', 0x3}], 0x1}, 0x40)
shutdown(r4, 0x1)
mount(&(0x7f0000001400)=@rnullb, 0x0, 0x0, 0x8002, 0x0)
mount$bind(&(0x7f0000000040)='./file0\x00', 0x0, &(0x7f00000000c0), 0x20000, 0x0)
ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r3, 0x4068aea3, &(0x7f00000003c0))
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15)
sendfile(r0, r0, 0x0, 0x7ffff000)
umount2(&(0x7f0000000100)='./file0\x00', 0x5)

597.008309ms ago: executing program 2 (id=1562):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}}, 0xb8}}, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r1, &(0x7f0000000280)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0xa, 0x0, 0x408d}, @mpls={[], @ipv6=@udp={0x4, 0x6, "c80f59", 0x64, 0x11, 0x0, @empty, @mcast2, {[], {0x4e24, 0x4e22, 0x64, 0x0, @wg=@response={0x2, 0x2, 0x1, "2737f19c7d3c3653289a9104c02dbfdc70bea0431a23b0f8063fce146e39b05c", "869bbd9cf785d23a9cebb43d614789da", {"f3f0cb8057706a65a051f8b0ad365751", "eea00bcb0bfb26a397f5a312ea0bb6b1"}}}}}}}, 0x9a)
mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='squashfs\x00', 0x200002, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6) (async)
sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}}, 0xb8}}, 0x0) (async)
openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) (async)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async)
socket$kcm(0x2, 0xa, 0x2) (async)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async)
write$tun(r1, &(0x7f0000000280)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0xa, 0x0, 0x408d}, @mpls={[], @ipv6=@udp={0x4, 0x6, "c80f59", 0x64, 0x11, 0x0, @empty, @mcast2, {[], {0x4e24, 0x4e22, 0x64, 0x0, @wg=@response={0x2, 0x2, 0x1, "2737f19c7d3c3653289a9104c02dbfdc70bea0431a23b0f8063fce146e39b05c", "869bbd9cf785d23a9cebb43d614789da", {"f3f0cb8057706a65a051f8b0ad365751", "eea00bcb0bfb26a397f5a312ea0bb6b1"}}}}}}}, 0x9a) (async)
mount(&(0x7f0000000000)=@rnullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000040)='squashfs\x00', 0x200002, 0x0) (async)

508.624454ms ago: executing program 2 (id=1563):
r0 = syz_open_dev$tty1(0xc, 0x4, 0x3)
setsockopt$RDS_FREE_MR(0xffffffffffffffff, 0x114, 0x3, &(0x7f0000000280)={{0x0, 0x3}, 0x78}, 0x10)
r1 = dup(0xffffffffffffffff)
fcntl$dupfd(r0, 0x406, r0)
r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0)
ioctl$SG_IO(r2, 0x2285, &(0x7f0000000440)={0x53, 0xfffffffffffffffe, 0x104, 0x1, @scatter={0x0, 0x0, 0x0}, &(0x7f00000004c0)="851666ce20db96ab0c7d83e114e7c41762249711e34f4ce12c6afeb7e6d77bd3b97644edd8e3a3b71fcd006b6237766e151f344afb2306455034ea7a31b1a48724e372a5a8a9ca040f5831f2eb11842a4b8ec9064fa439440f374355d9af754314ce445ac9bea7fac19cfdf9a82032d9fa225397b92d2e2193de6fe2f6b6c0bd0f80de3dc72890b6900c5b86752639bf37ab325c16dc2f3d4d01b4c3b71ebbfd6fc9b316f76a07144538506a68ae00df22f2fa9cbb0c9fa73c1dcf3eb2eb4fe3534fcee01e9ca0c66f27b8e05e7545cbc3511b3d086f51d58f9acd52eab032468cc8075451bcd5c081a8db84ff509a2f874daf6b3ddff977834d87fc0de3220a4041526a", 0x0, 0x10, 0x5bb727690d5f0ff6, 0x0, 0x0})
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)=0x5)
r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl802154(&(0x7f0000000640), 0xffffffffffffffff)
ioctl$BTRFS_IOC_SNAP_DESTROY(r1, 0x5000940f, &(0x7f0000000780)={{r2}, "c40b95a30de3d7958ed4df6c48b0bee8d594f0803cb12d2ebe1e0eb45674ceb0ae1a6bdedef0fcbc7f13fcfd3bd99da07933d739cc51085e102744ded97ed0f357de3d74fc4b0921d3226d1f6a3ccda51c7816bb1ebaa2708e0a19c1cd5fcdfbe8c265e99d84d575d30758fd8bee92886f444d3a6b122df4833c70a1c92d6307d560c1605ffd280f6a0007b5a0dbcb387ebc7ed6f5c5bd3f86a92aa05be3770a40926df88cbcdf6d3a763e0a4bd11c2e99dd33e53d6c80621641bf3df96cc53b70007a1afeb9b908dbcc4bb6353d1f25426273ef217a4db93d7d6175601d9148015e81ace07a9e02bbfe7f1fb18bc4a513a65ab245eaca6cb3cdac84e2ab0292e486548e6e224499e358bdae0ef68bef93bd6fd0dca998e4ec62b34abd59e7a4833c22d030135b7dcd25dcfeb2f131a8c003d60b302791f79fc4022e07627169b50790f725d8abd81ba55541a7923032958162e117d837149b45d3deedae4d4cab3b39de88dc8b24534c6c07f14b9aec0de0d0af518cd37022fd1454a6ac1ab73ab7be4c001eab3c2d9b84a076e90026f431adcab2d0299ea6929f21f3ba443663221d49b75592e12fc361597657c874f721d1750416405eac00f51b0c5daa23e1a9a0474ba4b75d8671c87f4e1b3ff0cbf94eaf63a6f08ec7840d9b1e9114d3d5ba38a62a44920e59db8a6191689c04a70de3242b07cffa94a6521fb85807c51cea26de1755dbc851ab49da16c068450e979c629f353f04cd62208ca4bedbe9130391bae98fddf76034936cc0674e4723c408254a1fc4b663f28caab6734aeba59527ef10562f9e6b9d1eff525f2418c06feab09d0d68017fd4012fff4174f43d2a2470c5ef6dc5e87ab11b8eab9723e19cbb768fb60a49436100c37cc0fc490678bfaf9f4d4852841ffb502d444d93ea12f08a9d087dbc6371795e1f47dd570431a6a915bbf2fdc014b1095ec05f60ae7add3b0359c620eb48852fb84353b1365c0b6ffada8c136604fe810a9ee519682ee40b5a79983b99f71391acb22215518c5aadac8bb55a8ecf39ae77eaca928f54912e6be88418b8837ce5440873dc9614056fe10b750a70d2b09ef0d586a0a24fd0634a98b8f10910e94347dcfcd94689b29b1c583d1ad1181955c9c4e31e4c86f3b33437491b75c2a9f48952af50a5a570e9a0e92280b5e3123e357b195d9100476ddadbc2e36c182201ab54f2099e15fd59d3e1a74c5a3c830f258a3007b2adfb01195ed459289cc56e7476501a5f046deb8aeb33d86e1f60b3b4ae68bc4cdc84f0d63144e817874d02b29fad029b7b09166349e09861b8b220f14f7972d86613be814dd08d4293f29fb8ab0d0b9ce75865178e7e196d584f767a532f6192060b5cfbce4bae117a59a52e245620d0267be42906b5c6d71e988a7badd81646fe560c7dd5295ced2df02d68bb202db4ac9d4884fdc9b3db19ddf23d0d7d6afe688a09862269210b66eebcfc9bf9674a42971b0702f53f63d18f385e87cdc7d3943816410ce6049fdfb438e7dd97b9d8852c1df7c646a3f600233a5c2556575d88ca9cf16fe3b6260702cb963c403548b7de5fc3b5a3138eb6f338c2149a00a13b779c8e13e674af7ac928ce0174440b4367e590f755348ebb0885d6c3bd73de682ab70b4ea197cafbca1626ff990e5274cc944605d0b0853687a061d7b76d72852ba624cc4a606d63e8b1616544b69dfdd6d8adee12b907f4ae814a50ceeea7575ee81c22d8c17a6e1bcc37769c36d951b5aaa94420d0cd0cca86e97cb84133c1b119eca6c21937517cb7d15804dd48eca86cc870d3e9719f374eedc81ccea891e8a1a24a1eb5fb6049953691beb4c609d785e41235cf2609e8f85be2b461962e4ef195a03e8e3676633cea819c1e542d41e5a1f76775d3d98d2b22b170270d69b398067cdefe2673e66743cf02ed6c62f8aba767795489d6a6f3a01cdde384181b29f77ba6ad2378f93b15beede08a53d693f5cb2eb78dc8d093ecb11fc0cafef79b1cda12cbf738af92d7851362194f52caa12dce577adc390092405c2a0e99e1a76f09e93cc8a73832f454e056826fdfff88cc18a49df0720e3b926df66398fef03682483a55cd6223f79a6b2ef21443e8d350fa47e0db21d07a9f33e9125e418cdcee2c38581b0f7d26967f54bc3cd81462cd3f24d2ea716d074acbdd435bab29b998fd167d633ef0fafad3b8b601f7003020648b0d4bd7c3e866f250bbd165d3532fc1474a7faf161db1028488121277f74b6615adce01dfe9c398e31daa3abfbacb5354a3c406f5e642df25d4abb23896d02fba1804662474c13a0055f66c7fcd108985bb7792a28e9a8428251b34232becba0a7fb3b058c2e285c074c26a189fdcd0ce964200b871846af745f71cef62637d09cc1a730cb82edc71ebe4ec443984e4f45e7ca8d03dd275a4e2ecf9a55c131d78f3bce0fa468e548191fa0c6d126f41c71f66194110b0d6783acb7d8fe78cb7d7f65d5238e6b50e4a971ccc4e3775e7c543abf248cf13ad855ddff38792ac9eb16fdfbb7155dd04f1d9e8e3fde0ad2dac87bb9cd3d34b0168da1a345818cc52050a2be58940c8e97a1015e9142208e2dff929170e3a859dcca1717c0f1773008f5415069893d6f33546392bff1eba649e662986d238eea0e0d0c517022f8eb5c5f3db13f4bd031187b7bc4c5582b4852b1b62999cb53275000a2d7b509103e0af8ea370ee8442fc1b56740dc9c3697bf180e2ef9bd95e01d9eeb6a70c0f0651a4a7246d2269e1ab7861f990226b4161a47cb282b6dcba1b49d3e48f93abb3d96dcb056f49ec1ab5f9bdfd15f02003c141f0edf7f5b8336eded5688d01394026cf90f0fa05f22f70a17631679a69f958ae0fa5f02abefa18289ae9e66e7c05cc62a27cab84882c3ebc1f3f8662917be86759a711b0c535348761b9e76cc9f951ca9dfacad76640426401d90b6bdb6107a7d26d4fdd24acf6dc8f53fdbd641d4fc3ba1bf992ae6d6eaf2ae2fd58fe43ac58aa63922c2f122aaf721e4e8dcc5ede3788d8978d1d03cbe43c7befd09b2da4322931cb0def90bbc888aebc7c76e7409276f3258203a88330d26f00cf80534b2b2f3dba8da087c7842d69ec05142a7f28c081c2d85e72421e84287562d7635af469ae19546549068024143226f29afc7aa8e2d6f67816bb713f40635da4343894e45da7fee37042db15f12041dddb0d40f4a145bad83ef4e3a140812ddd0a0ebd1190a86b8a5d27b6999320c9fde70224c882b2a8589b6c040c862d20f260f92bde4a4ce856fdd120a818e4e376aef3dc2439a1583e1ab7c6816d26fadb0bc07131b73bda883cb87c307e68f2f79238fd0525a6369332f68df85ca234334be3926eac64c9a55cf3cc8f1d6a8f059df51b3866d4e70a34030498561c2f3bf90b65f224ac6ad81e6ca6ff71d4079ced32ae5e0eba0cd6d80bcbdd72c2df8558c639bb8e026008a07424a14e7f174380e29f4036d64d6393bd0dbe58680abf79c8e5524654fac6ff5212e49b2ba5f18d284ecf7da2d75776d1bd3d7069b5db78c518dc427f8b29ee17c59ebb90f46185e4c738544c2c40df8b994f23bbe4ab59cc8e23e43c1f19d918e299494c91342eaeb6e27eb3124d35d689b029b68b0a5f8b7fd64a398e6374e43fe89c19d8d4cccec4304e9339030cf78e1ebe0905e637efe4c91b2f5a8badf88d2e0f6f5f3a02da51612bbd2e0af8de2fae9719d2eb4f4148a2f54f6431ab5b9077dfca1e3a00ad850f1a30edf6e418120c1680fc0bee044fc249169a1d3fbb65bd7fc2e5288dc4a95fbdfc12ab1a836d7f0adcaf69a395051badecdfb8ccb49b1fdb3026fcd41b8055b520b0ce76509f079fa77d5befd98c02d363055f8d42302c0ce634699eb051bee9d371fd92e38f8dd36cc6d295bf517f9b8b9168123e596cfaeddf9c1b0a3c0b02c48233ac1ee9359e8a1148acb01305f2e2ecb30764b9023b29d00e2a828c10e5bd9b915bf89c0a0eac24f48f231865fcd2185b53b6fa9de24fa92607d93361ac41b2a41fe5247f4bfabe0d0d60b222d84d77a946e80d803f00e7e0f478e4850fd5089880909acdb03c4c6a49c0ebe10a96478b31af77c3cf6016baee7409cb559ea8009daf6716a400bd7f342b8cd05c0287ebc704c12af1f9f7aaffca288964a154b4d4053dd2e3799df0e9fef5609a97844e6497b3ece8fcd342a2a19a2ac2e47f11ae5aadf8c1106372e0678a2cb97fc60dc142dfbc722fad1a510b11f3d7bb6e396392db86483b212e7503a3766a54ac906a38e20061da08b405441e603aa7616a74de1bcc2fd972376255c6ca0d63cd22a8d1c038b4b6cd922a4bf14adb40457f701522116b46e94ad710d4d265df849ae46ddc3835b49db11dddf39607d3298e2c11f36b07972b21ec1fb675e0386ba0bbe484e010405b43f1d598076f048d5635df38303b23ab40ac839bc8c22eeee2b16229e41941717b1900a26a941ce37c62ba60a0795b6b75456d4a5405e3021ce4dd9804307dd5894df95cdb64950693e255237f34f6e02e99e39344b9be2d02ad61344c4243b49fca3a60201dc8a17d2c94464a05bbe82383ea43907a26152b6d3fd18dc3e04a631f6577a45ca675aa26d34ff63d6e3b9b1fa0ce5b0971d8adf5c84f5a482e64aef21e6360727cffc713d7b8eddc1043ac490a60cc4c19602e1e10fdf7fc56d64653e2aa7cebbe31437347d960e03111bd6bb74ec4ade19fd3c2a1422ef8a0b087fb29cfbda6d7dd167e73faafa4fc8633706f5d8f21993c3ccd867eed58e634462c292ab93a626c18bea519236a228807f405da8be95bb895bbeee274590c32d6c2399480855ec049db4d6c38903d36009f31659e3dad7837335c5842f02281724f79cef796b7882102085de3feee8be2ea001c3428db3f4c7bf0d5627f1cd6d4a67d69a31ac157ad92472fe4898eaefe5fb61c6bb76454d32da45715ab1c75d7978db6982f2327b2dbd556768d805f7e8fac36d3a6e3913cafe7fe40ef34193a65482932fd5e25adb2329b33d4e61f4eade77efdf8f7cb635fc6c3a1eab052e54de43522b0cc2b0e88cb08bf0760c8b6aedd0f64fbb2ccf28653044c8f8d4c62c87daa257f1b1b03659d278b6a1ace258b9e9f39115267474f60745b8aadb08b778fd098368203b01be952adc7ca1e969cf2f4381c078515e97fddced938b4b253e54fb6cb2fdb29abdd004eba43560ae7970cf96009f8a4b6b786a2ed2eee53dd93c76d72673ba44927c75fda1b436e9106efaf300157430686e86d2359327cb883078b38b632742cb42111862b5c835842462cd108a40810bc2b4825fa0ac7ff0220b1879be1b68e8d44d0701692bb45e2e2bb7c313f0b8f73d986f4630aad77eb879a69ad777491d2673336cf63b31ef98ce2f12b60d20fe67fdd778985ea890e089cc69975f8f7a511c95cd3d4d5d09174b049c6f7994e5959cba052c4e81c25816b0b705df2c6d54941bbca286b0397d8b49757c811ccb5f86fb9cfc9c043eeff12b5111a7a1e084e516cce5afa96d75b1db196b122c019e04f049e117278466edff74e4bf95cc3dfbd00ebf62069a1a9fc986b039dcaed0bf9ee6bca5133b654b2d03e207618b1672b9e73615fc33a22e906aea3092bc7141f460e616f97bcbf2a129d1916e820a95390ac612681920ef1e6f04bed630f287b1eb9021fbdecc3cc8a92527f567cf5bc865bfaa9f964a05d5e00d31413e6cf35f2f289e13414da787204524214ec56d7757f45f5ad9420"})
sendmsg$NL802154_CMD_NEW_INTERFACE(r3, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000)
r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x35, 0x1, 0x4, 0x0, 0x0)
r5 = socket$inet_sctp(0x2, 0x5, 0x84)
sendmsg$inet_sctp(r5, &(0x7f0000000400)={&(0x7f0000000000)=@in={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000280)='+', 0x1}], 0x1, &(0x7f0000000180)=[@prinfo={0x18, 0x84, 0x5, {0x30}}], 0x18, 0x4014}, 0x2c0408d0)
r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00')
setgroups(0x0, 0x0)
read$FUSE(r6, &(0x7f0000003440)={0x2020}, 0x2020)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, 0x0, 0x0)
socket$caif_stream(0x25, 0x1, 0xfffffffc)
ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, <r7=>0x0})
ioctl$IOMMU_IOAS_ALLOW_IOVAS(r4, 0x3b82, &(0x7f0000000200)={0x18, r7, 0x1, 0x0, &(0x7f00000001c0)=[{0x0, 0x3ea4}]})
cachestat(r0, &(0x7f0000000040)={0x80000001, 0x5}, &(0x7f0000000080), 0x0)
ioctl$SG_BLKSECTGET(0xffffffffffffffff, 0x1267, &(0x7f0000000000))
r8 = landlock_create_ruleset(&(0x7f00000000c0)={0x800, 0x3}, 0x18, 0x0)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r8, 0x1, &(0x7f0000000100)={0x8800, r0}, 0x0)

444.14665ms ago: executing program 0 (id=1564):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a"], 0x7c}}, 0x4040)
syz_clone(0x104c000, &(0x7f0000000000)="a0264b3f3106bec0f8f5b2a521790b8999e1fa13d4e65ad69fa71b45940d70a2d86c012118c089681bdba52cc7c0ea4b7d4c3ffd763f41c3854adc057f447657a1173126bf5a7b9553521e765a05f2c63dbe119c359efddd694bc6179e0b3b405589d2e5b017c8", 0x67, &(0x7f0000000080), &(0x7f0000000100), &(0x7f0000000140)="42e382efb9dc3c723ccf8f0628d7bfb443")
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
ioctl$KVM_SET_CPUID2(r2, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYBLOB="070000000000000007000000ffffffff"])

325.264889ms ago: executing program 2 (id=1565):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x66002, 0x0)
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0)
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000000)={0xc000003, 0x40000000000000eb, &(0x7f0000000180), 0x1, 0x4000007})
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(0xffffffffffffffff, 0xc040564b, &(0x7f00000000c0)={0x3, 0x0, 0x5037, 0x1, 0x73, {0xc, 0x5810}})
syz_open_procfs(0x0, &(0x7f0000001c00)='mountstats\x00')
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f00000002", 0x29}], 0x1}, 0x0)
r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r2)
sendmsg$NFC_CMD_VENDOR(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01052cbd7000fedbdf251d00000008001d000400000008001e00300b0000080001"], 0x2c}, 0x1, 0x0, 0x0, 0x4004005}, 0x8000)
ioctl$BTRFS_IOC_LOGICAL_INO_V2(r0, 0xc038943b, &(0x7f0000000080)={0x80000000, 0x8, '\x00', 0x1, &(0x7f0000000040)=[0x0]})
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='pids.current\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0)
ftruncate(r4, 0xc17a)
lseek(r4, 0x2000, 0x4)
statx(r4, 0x0, 0x6100, 0x200, &(0x7f0000004c40))
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3000001, 0x22052, r0, 0x2000)

192.364345ms ago: executing program 2 (id=1566):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x80981, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000004300), 0x0, 0x4000000)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x200002, 0x0)
r2 = openat$cgroup_int(r1, &(0x7f0000000080)='hugetlb.1GB.rsvd.limit_in_bytes\x00', 0x2, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'veth1_virt_wifi\x00', 0x6bf1c2d5adba8c32})
r4 = socket$kcm(0x2, 0xa, 0x2)
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
write$tun(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB="000060040180c2000002018088f500"/30], 0x1e)
write$cgroup_subtree(r2, &(0x7f00000007c0)=ANY=[], 0x8)
socket$key(0xf, 0x3, 0x2)
mmap(&(0x7f00004a0000/0x3000)=nil, 0x3000, 0x300000a, 0x12, r0, 0x8828a000)
openat$rnullb(0xffffffffffffff9c, &(0x7f0000000140), 0x80981, 0x0) (async)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000004300), 0x0, 0x4000000) (async)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) (async)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) (async)
openat$cgroup_int(r1, &(0x7f0000000080)='hugetlb.1GB.rsvd.limit_in_bytes\x00', 0x2, 0x0) (async)
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) (async)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'veth1_virt_wifi\x00', 0x6bf1c2d5adba8c32}) (async)
socket$kcm(0x2, 0xa, 0x2) (async)
ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) (async)
write$tun(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB="000060040180c2000002018088f500"/30], 0x1e) (async)
write$cgroup_subtree(r2, &(0x7f00000007c0)=ANY=[], 0x8) (async)
socket$key(0xf, 0x3, 0x2) (async)
mmap(&(0x7f00004a0000/0x3000)=nil, 0x3000, 0x300000a, 0x12, r0, 0x8828a000) (async)

0s ago: executing program 2 (id=1567):
r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x141342, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async)
mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x9, 0x15031, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000005, 0x6031, 0xffffffffffffffff, 0x0) (async)
mbind(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4006, &(0x7f0000000000)=0x4, 0x5, 0x2) (async)
socketpair$unix(0x1, 0x2, 0x0, 0x0) (async, rerun: 64)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) (rerun: 64)
sendfile(r0, r0, 0x0, 0x7ffff000)

kernel console output (not intermixed with test programs):

nt (1278839314 ns). Using initial count to start timer.
[  159.760635][ T5968] input: Generic X-Box pad as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:179.65/input/input12
[  159.925527][ T7603] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  159.935020][ T7603] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  160.233092][ T5912] usb 2-1: USB disconnect, device number 14
[  160.233126][    C1] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19
[  160.403222][ T7638] netlink: 16 bytes leftover after parsing attributes in process `syz.0.543'.
[  160.520581][ T5866] usb 4-1: new high-speed USB device number 20 using dummy_hcd
[  160.680559][ T5866] usb 4-1: Using ep0 maxpacket: 8
[  160.692459][ T5866] usb 4-1: config index 0 descriptor too short (expected 301, got 45)
[  160.702812][ T5866] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  160.714265][ T5866] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  160.734336][ T5866] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  160.760334][ T5866] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  160.781621][ T7643] PM: Enabling pm_trace changes system date and time during resume.
[  160.781621][ T7643] PM: Correct system time has to be restored manually after resume.
[  160.804523][ T5866] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23
[  160.825720][ T5866] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  161.061748][ T5866] usb 4-1: usb_control_msg returned -32
[  161.067835][ T5866] usbtmc 4-1:16.0: can't read capabilities
[  161.140389][   T24] usb 1-1: new high-speed USB device number 20 using dummy_hcd
[  161.290357][   T24] usb 1-1: Using ep0 maxpacket: 32
[  161.297275][   T24] usb 1-1: config 0 has an invalid interface number: 89 but max is 0
[  161.305570][ T5968] usb 2-1: new high-speed USB device number 15 using dummy_hcd
[  161.313676][   T24] usb 1-1: config 0 has no interface number 0
[  161.320188][   T24] usb 1-1: config 0 interface 89 has no altsetting 0
[  161.331135][   T24] usb 1-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e
[  161.342001][   T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  161.350014][   T24] usb 1-1: Product: syz
[  161.354293][   T24] usb 1-1: Manufacturer: syz
[  161.358905][   T24] usb 1-1: SerialNumber: syz
[  161.366647][   T24] usb 1-1: config 0 descriptor??
[  161.375193][   T24] em28xx 1-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89)
[  161.384897][   T24] em28xx 1-1:0.89: Video interface 89 found: bulk
[  161.415183][ T7654] openvswitch: netlink: ct_state flags 7fffffff unsupported
[  161.430095][ T7654] usbtmc 4-1:16.0: usb_control_msg returned -32
[  161.453735][   T43] usb 4-1: USB disconnect, device number 20
[  161.480425][ T5968] usb 2-1: Using ep0 maxpacket: 32
[  161.489176][ T5968] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  161.502597][ T5968] usb 2-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0
[  161.523376][ T5968] usb 2-1: config 0 interface 0 has no altsetting 0
[  161.531751][ T5968] usb 2-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00
[  161.547211][ T5968] usb 2-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
[  161.556173][ T5968] usb 2-1: Product: syz
[  161.582939][ T5968] usb 2-1: config 0 descriptor??
[  161.868376][ T5968] usbhid 2-1:0.0: can't add hid device: -71
[  161.879268][ T5968] usbhid 2-1:0.0: probe with driver usbhid failed with error -71
[  161.893932][ T5968] usb 2-1: USB disconnect, device number 15
[  161.985742][   T24] em28xx 1-1:0.89: unknown em28xx chip ID (0)
[  162.029516][ T7661] /dev/rnullb0: Can't open blockdev
[  162.124026][ T7663] netlink: 8 bytes leftover after parsing attributes in process `syz.3.552'.
[  162.380442][ T5866] usb 4-1: new high-speed USB device number 21 using dummy_hcd
[  162.550522][ T5866] usb 4-1: Using ep0 maxpacket: 16
[  162.567985][ T7666] netlink: 24 bytes leftover after parsing attributes in process `syz.1.554'.
[  162.568141][ T5866] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 65, using maximum allowed: 30
[  162.589718][ T5866] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  162.603299][ T5866] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 65
[  162.617386][ T5866] usb 4-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00
[  162.618445][   T24] em28xx 1-1:0.89: reading from i2c device at 0xa0 failed (error=-5)
[  162.639031][ T5866] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  162.653138][   T24] em28xx 1-1:0.89: board has no eeprom
[  162.661197][ T5866] usb 4-1: config 0 descriptor??
[  162.719237][ T7669] syz.1.555: attempt to access beyond end of device
[  162.719237][ T7669] loop1: rw=2048, sector=2, nr_sectors = 1 limit=0
[  162.734042][   T24] em28xx 1-1:0.89: Identified as Terratec Grabby (card=67)
[  162.743884][   T24] em28xx 1-1:0.89: analog set to bulk mode.
[  162.759428][ T5968] em28xx 1-1:0.89: Registering V4L2 extension
[  162.807102][   T24] usb 1-1: USB disconnect, device number 20
[  162.824838][   T24] em28xx 1-1:0.89: Disconnecting em28xx
[  162.912147][ T5968] em28xx 1-1:0.89: Config register raw data: 0xffffffed
[  162.945170][ T5968] em28xx 1-1:0.89: AC97 chip type couldn't be determined
[  162.955095][ T5968] em28xx 1-1:0.89: No AC97 audio processor
[  162.967152][ T5968] usb 1-1: Decoder not found
[  162.994302][ T5968] em28xx 1-1:0.89: failed to create media graph
[  163.003468][ T5968] em28xx 1-1:0.89: V4L2 device video103 deregistered
[  163.036871][ T5968] em28xx 1-1:0.89: Registering snapshot button...
[  163.049555][ T7677] netlink: 'syz.2.558': attribute type 11 has an invalid length.
[  163.051618][ T5968] input: em28xx snapshot button as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.89/input/input15
[  163.078530][ T5866] samsung 0003:0419:0001.0006: item fetching failed at offset 10/11
[  163.101647][ T5866] samsung 0003:0419:0001.0006: parse failed
[  163.107666][ T5866] samsung 0003:0419:0001.0006: probe with driver samsung failed with error -22
[  163.141641][ T5968] em28xx 1-1:0.89: Remote control support is not available for this card.
[  163.154521][   T24] em28xx 1-1:0.89: Closing input extension
[  163.162430][   T24] em28xx 1-1:0.89: Deregistering snapshot button
[  163.190367][ T7678] netlink: 'syz.2.558': attribute type 11 has an invalid length.
[  163.236493][   T24] em28xx 1-1:0.89: Freeing device
[  163.277504][ T7663] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  163.315488][ T7663] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  163.352496][ T5866] usb 4-1: USB disconnect, device number 21
[  163.441438][ T7685] qnx6: unable to read the first superblock
[  163.533608][ T7687] /dev/rnullb0: Can't open blockdev
[  163.926898][ T7697] __nla_validate_parse: 2 callbacks suppressed
[  163.926920][ T7697] netlink: 16 bytes leftover after parsing attributes in process `syz.1.565'.
[  164.129782][ T7699] netlink: 24 bytes leftover after parsing attributes in process `syz.3.566'.
[  164.151994][ T7699] netlink: 88 bytes leftover after parsing attributes in process `syz.3.566'.
[  164.360828][ T5968] usb 1-1: new high-speed USB device number 21 using dummy_hcd
[  164.520383][ T5968] usb 1-1: Using ep0 maxpacket: 32
[  164.527996][ T5968] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  164.540818][   T24] usb 2-1: new high-speed USB device number 16 using dummy_hcd
[  164.550394][ T5968] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0
[  164.560808][ T5968] usb 1-1: config 0 interface 0 has no altsetting 0
[  164.569028][ T5968] usb 1-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00
[  164.578877][ T5968] usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
[  164.587638][ T5968] usb 1-1: Product: syz
[  164.607433][ T5968] usb 1-1: config 0 descriptor??
[  164.670397][   T43] usb 4-1: new high-speed USB device number 22 using dummy_hcd
[  164.700514][   T24] usb 2-1: Using ep0 maxpacket: 16
[  164.722552][   T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  164.737373][   T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  164.749817][   T24] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
[  164.767831][   T24] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00
[  164.778019][   T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  164.798832][   T24] usb 2-1: config 0 descriptor??
[  164.830761][   T43] usb 4-1: Using ep0 maxpacket: 32
[  164.852823][   T43] usb 4-1: unable to get BOS descriptor or descriptor too short
[  164.864052][   T43] usb 4-1: config 4 has an invalid interface number: 75 but max is 0
[  164.873767][   T43] usb 4-1: config 4 has no interface number 0
[  164.880085][   T43] usb 4-1: too many endpoints for config 4 interface 75 altsetting 5: 174, using maximum allowed: 30
[  164.891897][   T43] usb 4-1: config 4 interface 75 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 174
[  164.906385][   T43] usb 4-1: config 4 interface 75 has no altsetting 0
[  164.929594][   T43] usb 4-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=31.1c
[  164.944182][ T5968] usbhid 1-1:0.0: can't add hid device: -71
[  164.952358][   T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  164.960989][ T5968] usbhid 1-1:0.0: probe with driver usbhid failed with error -71
[  164.970748][   T43] usb 4-1: Product: syz
[  164.975000][   T43] usb 4-1: Manufacturer: syz
[  164.984718][ T5968] usb 1-1: USB disconnect, device number 21
[  164.992394][   T43] usb 4-1: SerialNumber: syz
[  165.246213][   T24] hid_parser_main: 1 callbacks suppressed
[  165.246258][   T24] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0
[  165.275783][   T24] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0
[  165.284909][   T24] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0
[  165.293129][   T24] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0
[  165.300958][   T24] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0
[  165.308343][   T24] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0
[  165.316758][   T24] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0
[  165.324798][   T24] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0
[  165.335672][   T24] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0
[  165.347488][   T24] microsoft 0003:045E:07DA.0007: unknown main item tag 0x0
[  165.370984][   T24] microsoft 0003:045E:07DA.0007: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0
[  165.408821][   T24] microsoft 0003:045E:07DA.0007: no inputs found
[  165.428786][   T24] microsoft 0003:045E:07DA.0007: could not initialize ff, continuing anyway
[  165.478924][   T24] usb 2-1: USB disconnect, device number 16
[  165.504643][   T43] gspca_main: ALi m5602-2.14.0 probing 0402:5602
[  165.558543][   T43] gspca_m5602: Failed to find a sensor
[  165.578047][   T43] ALi m5602 4-1:4.75: ALi m5602 webcam failed
[  165.588352][ T7711] fido_id[7711]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory
[  165.614389][   T43] usb 4-1: USB disconnect, device number 22
[  165.774226][ T7716] /dev/rnullb0: Can't open blockdev
[  165.792772][ T7717] binder: 7714:7717 ioctl c018620c 200000000140 returned -22
[  165.886701][ T5185] block nbd0: Receive control failed (result -32)
[  165.980978][ T7726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  166.010621][ T7726] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  166.158974][ T7733] netlink: 16 bytes leftover after parsing attributes in process `syz.2.575'.
[  166.270479][ T5866] usb 1-1: new high-speed USB device number 22 using dummy_hcd
[  166.355882][ T7739] netlink: 24 bytes leftover after parsing attributes in process `syz.1.578'.
[  166.385501][ T7739] netlink: 88 bytes leftover after parsing attributes in process `syz.1.578'.
[  166.450497][ T5866] usb 1-1: Using ep0 maxpacket: 32
[  166.467616][ T5866] usb 1-1: config 111 has too many interfaces: 188, using maximum allowed: 32
[  166.483661][ T5866] usb 1-1: config 111 has an invalid descriptor of length 105, skipping remainder of the config
[  166.494885][ T5866] usb 1-1: config 111 has 0 interfaces, different from the descriptor's value: 188
[  166.514811][ T5866] usb 1-1: New USB device found, idVendor=04d8, idProduct=0a30, bcdDevice=e9.e9
[  166.527786][ T5866] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  166.548727][ T5866] usb 1-1: Product: syz
[  166.560375][   T10] usb 4-1: new high-speed USB device number 23 using dummy_hcd
[  166.570468][ T5866] usb 1-1: Manufacturer: syz
[  166.575105][ T5866] usb 1-1: SerialNumber: syz
[  166.580928][ T7743] /dev/rnullb0: Can't open blockdev
[  166.750556][   T10] usb 4-1: Using ep0 maxpacket: 16
[  166.768415][   T10] usb 4-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15
[  166.781829][   T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  166.792292][   T10] usb 4-1: Product: syz
[  166.797187][   T10] usb 4-1: Manufacturer: syz
[  166.815122][ T5866] usb 1-1: USB disconnect, device number 22
[  166.821992][   T10] usb 4-1: SerialNumber: syz
[  166.842655][   T10] usb 4-1: config 0 descriptor??
[  166.858917][   T10] ssu100 4-1:0.0: Quatech SSU-100 USB to Serial Driver converter detected
[  166.930775][ T5912] usb 3-1: new high-speed USB device number 13 using dummy_hcd
[  166.948495][ T7752] ./cgroup: Can't lookup blockdev
[  167.113810][ T5912] usb 3-1: Using ep0 maxpacket: 32
[  167.125070][ T5912] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  167.140620][ T5912] usb 3-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0
[  167.154964][ T5912] usb 3-1: config 0 interface 0 has no altsetting 0
[  167.163959][ T5912] usb 3-1: New USB device found, idVendor=1044, idProduct=7a4d, bcdDevice= 0.00
[  167.180146][ T5912] usb 3-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
[  167.197388][ T5912] usb 3-1: Product: syz
[  167.212057][ T5912] usb 3-1: config 0 descriptor??
[  167.402365][ T7763] netlink: 16 bytes leftover after parsing attributes in process `syz.0.588'.
[  167.517121][ T5912] usbhid 3-1:0.0: can't add hid device: -71
[  167.534043][ T5912] usbhid 3-1:0.0: probe with driver usbhid failed with error -71
[  167.581952][ T5912] usb 3-1: USB disconnect, device number 13
[  167.666015][ T7738] /dev/rnullb0: Can't open blockdev
[  167.773355][   T10] ssu100 4-1:0.0: probe with driver ssu100 failed with error -110
[  167.826447][   T10] usb 4-1: USB disconnect, device number 23
[  168.191149][   T43] usb 1-1: new high-speed USB device number 23 using dummy_hcd
[  168.323018][ T7784] netlink: 'syz.2.593': attribute type 4 has an invalid length.
[  168.329416][ T7785] netlink: 'syz.2.593': attribute type 4 has an invalid length.
[  168.372328][   T43] usb 1-1: config 0 has an invalid interface number: 117 but max is 0
[  168.385509][   T43] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  168.409028][   T43] usb 1-1: config 0 has no interface number 0
[  168.420504][   T10] usb 4-1: new high-speed USB device number 24 using dummy_hcd
[  168.425298][   T43] usb 1-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0
[  168.440179][   T43] usb 1-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  168.457570][   T43] usb 1-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0
[  168.487919][   T43] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  168.497060][   T43] usb 1-1: Product: syz
[  168.501722][   T43] usb 1-1: Manufacturer: syz
[  168.507268][   T43] usb 1-1: SerialNumber: syz
[  168.522026][   T43] usb 1-1: config 0 descriptor??
[  168.578516][ T7795] netlink: 8 bytes leftover after parsing attributes in process `syz.1.597'.
[  168.587795][   T10] usb 4-1: Using ep0 maxpacket: 8
[  168.598689][   T10] usb 4-1: config 0 has an invalid interface number: 186 but max is 0
[  168.600449][ T5968] usb 3-1: new high-speed USB device number 14 using dummy_hcd
[  168.610425][   T10] usb 4-1: config 0 has no interface number 0
[  168.624029][   T10] usb 4-1: config 0 interface 186 altsetting 0 has an invalid descriptor for endpoint zero, skipping
[  168.635080][   T10] usb 4-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A
[  168.647112][   T10] usb 4-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7
[  168.658387][   T10] usb 4-1: config 0 interface 186 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0
[  168.668758][   T10] usb 4-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3
[  168.693207][   T10] usb 4-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5
[  168.710479][   T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  168.718520][   T10] usb 4-1: Product: syz
[  168.730136][ T7780] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  168.750816][ T7780] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  168.755434][   T10] usb 4-1: Manufacturer: syz
[  168.766609][   T10] usb 4-1: SerialNumber: syz
[  168.778006][   T10] usb 4-1: config 0 descriptor??
[  168.783288][ T5968] usb 3-1: Using ep0 maxpacket: 8
[  168.788544][ T7780] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  168.804160][ T5968] usb 3-1: config 168 descriptor has 1 excess byte, ignoring
[  168.805401][ T7780] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  168.832399][ T5968] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11
[  168.850048][ T7780] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  168.866124][ T7780] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  168.866545][ T5968] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  168.881357][ T7780] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  168.897773][ T7780] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  168.909225][ T5968] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  168.918231][ T7780] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  168.943314][ T5968] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  168.945092][ T7780] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  168.956968][ T5968] usb 3-1: config 168 descriptor has 1 excess byte, ignoring
[  168.974804][ T5968] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11
[  168.986921][   T43] usbtouchscreen 1-1:0.117: probe with driver usbtouchscreen failed with error -71
[  168.999241][ T5968] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  169.007913][ T7800] netlink: 40 bytes leftover after parsing attributes in process `syz.1.599'.
[  169.020668][   T43] usb 1-1: USB disconnect, device number 23
[  169.031701][ T5968] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  169.044733][ T5968] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  169.058099][   T10] iowarrior 4-1:0.186: IOWarrior product=0x1505, serial=42424242 interface=186 now attached to iowarrior0
[  169.082700][ T5968] usb 3-1: config 168 descriptor has 1 excess byte, ignoring
[  169.095131][ T5968] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11
[  169.107736][ T5968] usb 3-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  169.120921][ T5968] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  169.132481][ T5968] usb 3-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[  169.146373][ T5968] usb 3-1: string descriptor 0 read error: -22
[  169.152882][ T5968] usb 3-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e
[  169.162150][ T5968] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  169.181425][ T5968] adutux 3-1:168.0: ADU100  now attached to /dev/usb/adutux1
[  169.226450][ T7782] overlayfs: failed lookup in lower (newroot/132, name='file0', err=-40): overlapping layers
[  169.238823][   T10] usb 4-1: USB disconnect, device number 24
[  169.302912][ T5866] usb 2-1: new high-speed USB device number 17 using dummy_hcd
[  169.377520][   T43] usb 3-1: USB disconnect, device number 14
[  169.443715][ T5866] usb 2-1: device descriptor read/64, error -71
[  169.690387][ T5866] usb 2-1: new high-speed USB device number 18 using dummy_hcd
[  169.797331][ T7818] netlink: 8 bytes leftover after parsing attributes in process `syz.2.606'.
[  169.840350][ T5866] usb 2-1: device descriptor read/64, error -71
[  169.950760][ T5866] usb usb2-port1: attempt power cycle
[  170.224949][ T5968] usb 4-1: new full-speed USB device number 25 using dummy_hcd
[  170.310433][ T5866] usb 2-1: new high-speed USB device number 19 using dummy_hcd
[  170.343004][ T5866] usb 2-1: device descriptor read/8, error -71
[  170.412265][ T5968] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  170.428995][ T5968] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  170.439714][ T5968] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2dbe, bcdDevice= 0.00
[  170.454808][ T5968] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  170.471377][ T5968] usb 4-1: config 0 descriptor??
[  170.610357][ T5866] usb 2-1: new high-speed USB device number 20 using dummy_hcd
[  170.641318][ T5866] usb 2-1: device descriptor read/8, error -71
[  170.767424][ T5866] usb usb2-port1: unable to enumerate USB device
[  170.941223][ T5968] konepure 0003:1E7D:2DBE.0008: unbalanced collection at end of report description
[  170.978109][ T5968] konepure 0003:1E7D:2DBE.0008: parse failed
[  170.986063][ T5968] konepure 0003:1E7D:2DBE.0008: probe with driver konepure failed with error -22
[  171.394094][ T7852] netlink: 8 bytes leftover after parsing attributes in process `syz.2.616'.
[  171.708867][ T7859] IPVS: sync thread started: state = BACKUP, mcast_ifn = batadv_slave_1, syncid = 3, id = 0
[  171.751253][ T7858] IPVS: set_ctl: invalid protocol: 29 255.255.255.255:20004
[  172.674807][   T24] usb 1-1: new full-speed USB device number 24 using dummy_hcd
[  172.872812][   T24] usb 1-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[  172.902297][   T24] usb 1-1: config 1 has an invalid descriptor of length 181, skipping remainder of the config
[  172.920747][   T24] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
[  172.933174][   T24] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  172.944977][   T24] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  172.960541][   T24] usb 1-1: Product: syz
[  172.968392][   T24] usb 1-1: Manufacturer: 꺢㿤ὓ喣謵賗쉈閕䚈ݺ�⯉ㄷㅧₚ䛠ꂨ̱￠��錎䙒⾡�ஸ鼥ᵿ奰�ި藸感⡥⶚꼹韃�䓳唦⓹꽗꒦⛗
[  173.034875][   T24] usb 1-1: SerialNumber: syz
[  173.073892][ T5866] usb 4-1: USB disconnect, device number 25
[  173.098139][ T7876] 9pnet_fd: Insufficient options for proto=fd
[  173.272930][ T7878] QAT: Invalid ioctl 1075883590
[  173.278193][ T7878] QAT: Invalid ioctl 1075883590
[  173.330818][ T7878] QAT: Invalid ioctl 1075883590
[  173.336031][ T7878] QAT: Invalid ioctl 1075883590
[  173.390748][ T7878] QAT: Invalid ioctl 1075883590
[  173.395781][ T7878] QAT: Invalid ioctl 1075883590
[  173.414729][ T7878] QAT: Invalid ioctl 1075883590
[  173.431915][ T7878] QAT: Invalid ioctl 1075883590
[  173.448437][ T7878] QAT: Invalid ioctl 1075883590
[  173.468453][ T7878] QAT: Invalid ioctl 1075883590
[  173.574960][ T7885] netlink: 24 bytes leftover after parsing attributes in process `syz.3.626'.
[  173.600389][ T7885] netlink: 88 bytes leftover after parsing attributes in process `syz.3.626'.
[  173.610657][ T7886] netlink: 8 bytes leftover after parsing attributes in process `syz.2.625'.
[  173.663751][ T7868] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  173.682904][ T7868] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  173.719697][   T24] usb 1-1: 0:2 : does not exist
[  173.767079][   T24] usb 1-1: USB disconnect, device number 24
[  173.867095][ T7892] hfs: can't find a HFS filesystem on dev rnullb0
[  173.903183][   T30] audit: type=1326 audit(1754583611.019:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7889 comm="syz.1.627" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd8cf38ebe9 code=0x0
[  174.213655][ T7904] pimreg: entered allmulticast mode
[  174.975064][ T7916] netlink: 24 bytes leftover after parsing attributes in process `syz.1.636'.
[  175.020562][ T7916] netlink: 88 bytes leftover after parsing attributes in process `syz.1.636'.
[  175.257235][ T7918] netlink: 8 bytes leftover after parsing attributes in process `syz.1.637'.
[  175.385611][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  175.410631][ T7923] /dev/rnullb0: Can't open blockdev
[  175.430891][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  175.537182][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  175.537182][ T7923] 
[  175.569045][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  175.590787][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  175.590787][ T7923] 
[  175.604314][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  175.623358][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  175.623358][ T7923] 
[  175.650977][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  175.668531][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  175.668531][ T7923] 
[  175.691217][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  175.698614][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  175.698614][ T7923] 
[  175.733607][ T7929] /dev/rnullb0: Can't open blockdev
[  175.739213][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  175.752979][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  175.752979][ T7923] 
[  175.774121][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  175.790937][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  175.790937][ T7923] 
[  175.800372][ T5968] usb 2-1: new high-speed USB device number 21 using dummy_hcd
[  175.837167][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  175.845825][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  175.845825][ T7923] 
[  175.871007][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  175.898744][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  175.898744][ T7923] 
[  175.926607][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  175.947247][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  175.947247][ T7923] 
[  175.983008][ T5968] usb 2-1: config 0 has an invalid interface number: 1 but max is 0
[  175.993814][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  176.010399][ T5968] usb 2-1: config 0 has no interface number 0
[  176.033821][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  176.033821][ T7923] 
[  176.050682][ T5968] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b
[  176.063693][ T5968] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  176.072378][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  176.083128][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  176.083128][ T7923] 
[  176.084958][ T5968] usb 2-1: Product: syz
[  176.104614][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  176.106772][ T5968] usb 2-1: Manufacturer: syz
[  176.112244][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  176.112244][ T7923] 
[  176.116627][ T5968] usb 2-1: SerialNumber: syz
[  176.136636][ T7923] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  176.150726][ T7923] VFS: Can't find a romfs filesystem on dev rnullb0.
[  176.150726][ T7923] 
[  176.161539][ T5968] usb 2-1: config 0 descriptor??
[  176.445216][ T5968] dvb_usb_ec168 2-1:0.1: probe with driver dvb_usb_ec168 failed with error -71
[  176.480043][ T5968] usb 2-1: USB disconnect, device number 21
[  176.487309][ T7936] hfs: can't find a HFS filesystem on dev rnullb0
[  176.618517][ T7938] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem
[  176.804608][ T7943] netlink: 8 bytes leftover after parsing attributes in process `syz.3.647'.
[  177.198369][ T7955] fuse: Unknown parameter 'user00000000000000000000'
[  177.229922][ T7953] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate.
[  177.250701][ T5968] usb 4-1: new full-speed USB device number 26 using dummy_hcd
[  177.425787][ T5968] usb 4-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config
[  177.466360][ T5968] usb 4-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b
[  177.470135][ T7963] exFAT-fs (rnullb0): invalid boot record signature
[  177.503295][ T7963] exFAT-fs (rnullb0): failed to read boot sector
[  177.521052][ T5968] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  177.525861][   T30] audit: type=1326 audit(1754583614.649:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7964 comm="syz.2.655" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f2af278ebe9 code=0x0
[  177.529352][ T5968] usb 4-1: Product: syz
[  177.529376][ T5968] usb 4-1: Manufacturer: syz
[  177.529390][ T5968] usb 4-1: SerialNumber: syz
[  177.561312][ T7963] exFAT-fs (rnullb0): failed to recognize exfat type
[  177.585128][ T5968] usb 4-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state
[  178.596254][ T5968] usb 4-1: dvb_usb_v2: this USB2.0 device cannot be run on a USB1.1 port (it lacks a hardware PID filter)
[  178.789393][ T7945] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  178.802054][ T7945] /dev/rnullb0: Can't open blockdev
[  178.808738][ T5968] usb 4-1: USB disconnect, device number 26
[  179.618637][ T8017] MTD: Couldn't look up '/dev/rnullb0': -15
[  181.096789][   T30] audit: type=1400 audit(1754583618.219:5): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=8048 comm="syz.1.680"
[  181.370448][ T5968] usb 4-1: new high-speed USB device number 27 using dummy_hcd
[  181.560424][ T5968] usb 4-1: Using ep0 maxpacket: 32
[  181.578539][ T5968] usb 4-1: config 0 has an invalid interface number: 184 but max is 0
[  181.598662][ T5968] usb 4-1: config 0 has no interface number 0
[  181.610549][ T5968] usb 4-1: config 0 interface 184 has no altsetting 0
[  181.641931][ T5968] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee
[  181.654530][ T8080] netlink: 24 bytes leftover after parsing attributes in process `syz.0.690'.
[  181.661861][ T5968] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  181.681192][ T5968] usb 4-1: Product: syz
[  181.682271][ T8080] netlink: 88 bytes leftover after parsing attributes in process `syz.0.690'.
[  181.691472][ T5968] usb 4-1: Manufacturer: syz
[  181.709538][ T5968] usb 4-1: SerialNumber: syz
[  181.722437][ T5968] usb 4-1: config 0 descriptor??
[  181.737834][ T5968] smsc75xx v1.0.0
[  181.891828][ T8089] /dev/rnullb0: Can't open blockdev
[  182.067241][ T8096] /dev/rnullb0: Can't lookup blockdev
[  182.141037][ T5968] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61
[  182.160435][ T5968] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61
[  182.170134][ T5968] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind
[  182.204669][ T5968] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -61
[  182.249473][ T8098] NILFS (rnullb0): couldn't find nilfs on the device
[  182.780786][ T5968] usb 1-1: new high-speed USB device number 25 using dummy_hcd
[  182.956573][ T5968] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  182.976207][ T5968] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  182.988621][ T5968] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  183.005929][ T5968] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  183.015305][ T5968] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  183.031413][ T5968] usb 1-1: config 0 descriptor??
[  183.406666][ T8132] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  183.415837][ T8132] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  183.426392][ T8132] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  183.436002][ T8132] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  183.560417][ T5912] usb 2-1: new high-speed USB device number 22 using dummy_hcd
[  183.715735][ T5912] usb 2-1: Using ep0 maxpacket: 16
[  183.723195][ T5912] usb 2-1: unable to get BOS descriptor or descriptor too short
[  183.736082][ T5912] usb 2-1: config 15 has an invalid interface number: 53 but max is 0
[  183.744533][ T5912] usb 2-1: config 15 has no interface number 0
[  183.750948][ T5912] usb 2-1: config 15 interface 53 altsetting 99 has an endpoint descriptor with address 0x2C, changing to 0xC
[  183.764260][ T5912] usb 2-1: config 15 interface 53 altsetting 99 endpoint 0xC has an invalid bInterval 144, changing to 11
[  183.775744][ T5912] usb 2-1: config 15 interface 53 altsetting 99 endpoint 0x9 has invalid maxpacket 1023, setting to 64
[  183.786957][ T5912] usb 2-1: config 15 interface 53 has no altsetting 0
[  183.796618][ T5912] usb 2-1: New USB device found, idVendor=2c7c, idProduct=0512, bcdDevice=91.ce
[  183.804027][ T8133] tmpfs: Unknown parameter 'noswap'
[  183.805797][ T5912] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  183.819518][ T8133] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  183.819851][ T5912] usb 2-1: Product: syz
[  183.834159][ T5912] usb 2-1: Manufacturer: syz
[  183.838830][ T5912] usb 2-1: SerialNumber: syz
[  183.846634][ T8133] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  183.928995][ T8135] /dev/rnullb0: Can't lookup blockdev
[  183.990800][ T5968] usbhid 1-1:0.0: can't add hid device: -71
[  183.997631][ T5968] usbhid 1-1:0.0: probe with driver usbhid failed with error -71
[  184.024289][ T5968] usb 1-1: USB disconnect, device number 25
[  184.058221][ T5912] option 2-1:15.53: GSM modem (1-port) converter detected
[  184.148359][ T5912] usb 2-1: USB disconnect, device number 22
[  184.188673][ T5912] option 2-1:15.53: device disconnected
[  184.334682][ T8150] /dev/rnullb0: Can't open blockdev
[  184.534599][ T8159] overlay: ./file0 is not a directory
[  184.914650][ T8163] netlink: 8 bytes leftover after parsing attributes in process `syz.2.715'.
[  184.929361][   T43] usb 4-1: USB disconnect, device number 27
[  185.065341][   T30] audit: type=1804 audit(1754583622.187:6): pid=8171 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.718" name="rnullb0" dev="tmpfs" ino=818 res=1 errno=0
[  185.243989][ T8179] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem
[  185.557166][ T8191] /dev/rnullb0: Can't lookup blockdev
[  185.565391][ T8192] Can't find a SQUASHFS superblock on rnullb0
[  185.874220][ T8200] MTD: Couldn't look up '/dev/rnullb0': -15
[  186.686585][   T43] Process accounting resumed
[  187.310447][   T43] usb 4-1: new high-speed USB device number 28 using dummy_hcd
[  187.460366][   T43] usb 4-1: Using ep0 maxpacket: 8
[  187.470198][   T43] usb 4-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2e.04
[  187.479664][   T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  187.488011][   T43] usb 4-1: Product: syz
[  187.493571][   T43] usb 4-1: Manufacturer: syz
[  187.498389][   T43] usb 4-1: SerialNumber: syz
[  187.505792][   T43] usb 4-1: config 0 descriptor??
[  187.726433][ T8239] omfs: Invalid superblock (0)
[  187.733476][   T43] dvb_usb_rtl28xxu 4-1:0.0: chip type detection failed -71
[  187.748403][   T43] dvb_usb_rtl28xxu 4-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71
[  187.768709][   T43] usb 4-1: USB disconnect, device number 28
[  187.983169][ T8259] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem
[  187.987442][ T8260] MTD: Couldn't look up '/dev/rnullb0': -15
[  187.998221][ T8257] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem
[  188.096035][ T8264] netlink: 830 bytes leftover after parsing attributes in process `syz.1.748'.
[  188.105516][ T8264] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported
[  188.512761][ T8280] /dev/rnullb0: Can't open blockdev
[  188.776097][ T8293] /dev/rnullb0: Can't open blockdev
[  188.827763][ T8295] /dev/rnullb0: Can't open blockdev
[  188.916595][ T8299] netlink: 4 bytes leftover after parsing attributes in process `syz.1.761'.
[  188.960451][ T5912] usb 4-1: new high-speed USB device number 29 using dummy_hcd
[  189.090402][ T5912] usb 4-1: device descriptor read/64, error -71
[  189.320538][ T8312] cgroup: Bad value for 'name'
[  189.327321][ T8312] MTD: Couldn't look up '/dev/rnullb0': -15
[  189.340555][ T5912] usb 4-1: new high-speed USB device number 30 using dummy_hcd
[  189.372999][ T5968] usb 2-1: new high-speed USB device number 23 using dummy_hcd
[  189.490398][ T5912] usb 4-1: device descriptor read/64, error -71
[  189.530349][ T5968] usb 2-1: Using ep0 maxpacket: 16
[  189.538045][ T5968] usb 2-1: unable to get BOS descriptor or descriptor too short
[  189.547929][ T5968] usb 2-1: config 250 has an invalid interface number: 88 but max is 0
[  189.556858][ T5968] usb 2-1: config 250 has no interface number 0
[  189.565009][ T5968] usb 2-1: config 250 interface 88 has no altsetting 0
[  189.575433][ T5968] usb 2-1: New USB device found, idVendor=413c, idProduct=819b, bcdDevice=cf.c9
[  189.586775][ T5968] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  189.595180][ T5968] usb 2-1: Product: syz
[  189.600939][ T5912] usb usb4-port1: attempt power cycle
[  189.603209][ T5968] usb 2-1: Manufacturer: syz
[  189.611653][ T5968] usb 2-1: SerialNumber: syz
[  189.837574][ T5968] qmi_wwan 2-1:250.88: bogus CDC Union: master=0, slave=0
[  189.853155][ T5968] qmi_wwan 2-1:250.88: probe with driver qmi_wwan failed with error -22
[  189.869745][ T5968] usb 2-1: USB disconnect, device number 23
[  189.960340][ T5912] usb 4-1: new high-speed USB device number 31 using dummy_hcd
[  189.993526][ T5912] usb 4-1: device descriptor read/8, error -71
[  190.253390][ T5912] usb 4-1: new high-speed USB device number 32 using dummy_hcd
[  190.292789][ T5912] usb 4-1: device descriptor read/8, error -71
[  190.402854][ T5912] usb usb4-port1: unable to enumerate USB device
[  190.415029][ T8335] /dev/rnullb0: Can't lookup blockdev
[  190.463460][ T8338] bridge0: port 3(hsr_slave_1) entered blocking state
[  190.475014][ T8338] bridge0: port 3(hsr_slave_1) entered disabled state
[  190.484395][ T8338] hsr_slave_1: entered allmulticast mode
[  190.496120][ T8338] hsr_slave_1: left allmulticast mode
[  190.583117][ T8341] /dev/rnullb0: Can't open blockdev
[  190.878391][ T8353] sp0: Synchronizing with TNC
[  191.197003][ T8370] fuse: blksize only supported for fuseblk
[  191.840929][ T8385] fuse: Unknown parameter 'user00000000000000000000'
[  192.085569][ T8395] No control pipe specified
[  192.293818][ T8409] /dev/rnullb0: Can't open blockdev
[  192.329731][ T8416] capability: warning: `syz.1.795' uses 32-bit capabilities (legacy support in use)
[  192.381544][ T8418] netlink: 88 bytes leftover after parsing attributes in process `syz.3.797'.
[  193.052579][ T8445] netlink: 'syz.3.807': attribute type 10 has an invalid length.
[  193.067402][ T8445] hsr_slave_0: entered allmulticast mode
[  193.074789][ T8445] team0: Device hsr_slave_0 is up. Set it down before adding it as a team port
[  193.108091][ T8446] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.807'.
[  193.178218][ T8448] /dev/rnullb0: Can't lookup blockdev
[  193.215743][ T8450] netlink: 88 bytes leftover after parsing attributes in process `syz.0.808'.
[  193.435725][ T8460] /dev/rnullb0: Can't open blockdev
[  193.712136][ T8480] /dev/rnullb0: Can't lookup blockdev
[  193.800365][ T5968] usb 2-1: new high-speed USB device number 24 using dummy_hcd
[  193.879943][ T8487] netlink: 88 bytes leftover after parsing attributes in process `syz.2.820'.
[  193.992188][ T5968] usb 2-1: Using ep0 maxpacket: 32
[  194.007065][ T5968] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be
[  194.022516][ T5968] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  194.051077][ T5968] usb 2-1: config 0 descriptor??
[  194.083441][ T5968] gspca_main: vc032x-2.14.0 probing 0ac8:0321
[  194.438095][ T1306] ieee802154 phy1 wpan1: encryption failed: -22
[  194.958070][ T8519] netlink: 24 bytes leftover after parsing attributes in process `syz.0.828'.
[  195.250632][ T5968] gspca_vc032x: reg_w err -110
[  195.255576][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.290331][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.300752][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.306180][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.329973][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.346564][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.360620][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.379214][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.396540][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.406662][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.426965][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.447213][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.460304][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.477574][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.487697][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.499628][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.518118][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.528278][ T5968] gspca_vc032x: I2c Bus Busy Wait 00
[  195.543504][ T5968] gspca_vc032x: Unknown sensor...
[  195.559059][ T5968] vc032x 2-1:0.0: probe with driver vc032x failed with error -22
[  196.285551][ T8554] vivid-000: disconnect
[  196.338235][ T8555] syzkaller1: entered promiscuous mode
[  196.344862][ T8555] syzkaller1: entered allmulticast mode
[  196.503430][ T8554] vivid-000: reconnect
[  196.604028][ T5866] usb 2-1: USB disconnect, device number 24
[  196.884733][ T8581] /dev/rnullb0: Can't lookup blockdev
[  197.130694][ T5866] usb 4-1: new high-speed USB device number 33 using dummy_hcd
[  197.290554][ T5866] usb 4-1: Using ep0 maxpacket: 16
[  197.302152][ T5866] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0
[  197.320659][ T5866] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 0
[  197.338111][ T5866] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0
[  197.348316][ T5866] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0
[  197.360993][ T5866] usb 4-1: New USB device found, idVendor=0586, idProduct=1500, bcdDevice=2e.97
[  197.370558][ T5866] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  197.378569][ T5866] usb 4-1: Product: syz
[  197.397120][ T5866] usb 4-1: Manufacturer: syz
[  197.412488][ T5866] usb 4-1: SerialNumber: syz
[  197.427952][ T5866] usb 4-1: config 0 descriptor??
[  197.444750][ T5866] omninet 4-1:0.0: ZyXEL - omni.net usb converter detected
[  197.463656][ T5866] usb 4-1: ZyXEL - omni.net usb converter now attached to ttyUSB0
[  197.667751][ T5968] usb 4-1: USB disconnect, device number 33
[  197.697999][ T5968] omninet ttyUSB0: ZyXEL - omni.net usb converter now disconnected from ttyUSB0
[  197.718590][ T5968] omninet 4-1:0.0: device disconnected
[  197.926530][ T5866] libceph: connect (1)[c::]:6789 error -101
[  197.941831][ T5866] libceph: mon0 (1)[c::]:6789 connect error
[  197.956625][ T5866] libceph: connect (1)[c::]:6789 error -101
[  197.963227][ T5866] libceph: mon0 (1)[c::]:6789 connect error
[  198.016993][ T8623] MTD: Couldn't look up '/dev/rnullb0': -15
[  198.224045][ T5866] libceph: connect (1)[c::]:6789 error -101
[  198.237980][ T5866] libceph: mon0 (1)[c::]:6789 connect error
[  198.253264][ T8637] fuse: Unknown parameter 'user00000000000000000000'
[  198.692521][ T8617] ceph: No mds server is up or the cluster is laggy
[  199.014243][ T8644] netlink: 88 bytes leftover after parsing attributes in process `syz.1.865'.
[  199.810002][ T8672] /dev/rnullb0: Can't lookup blockdev
[  199.868825][ T8676] netlink: 88 bytes leftover after parsing attributes in process `syz.2.874'.
[  200.330494][ T5866] usb 2-1: new full-speed USB device number 25 using dummy_hcd
[  200.350327][   T24] usb 4-1: new full-speed USB device number 34 using dummy_hcd
[  200.502097][   T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  200.512299][ T5866] usb 2-1: unable to get BOS descriptor or descriptor too short
[  200.512950][ T5866] usb 2-1: not running at top speed; connect to a high speed hub
[  200.520388][   T24] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E
[  200.532741][ T5866] usb 2-1: config 4 has an invalid interface number: 147 but max is 0
[  200.539953][   T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10
[  200.551336][ T5866] usb 2-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config
[  200.559820][   T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0
[  200.577496][ T5866] usb 2-1: config 4 has no interface number 0
[  200.579816][   T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  200.602680][ T5866] usb 2-1: string descriptor 0 read error: -22
[  200.604412][   T24] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46
[  200.609064][ T5866] usb 2-1: New USB device found, idVendor=04f2, idProduct=b746, bcdDevice=8e.6e
[  200.619510][   T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35
[  200.627188][ T5866] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  200.634696][ T5866] usb 2-1: Found UVC 0.00 device <unnamed> (04f2:b746)
[  200.645711][   T24] usb 4-1: Product: syz
[  200.651066][ T5866] usb 2-1: No valid video chain found.
[  200.662232][   T24] usb 4-1: Manufacturer: syz
[  200.673194][   T24] usb 4-1: SerialNumber: syz
[  200.683606][   T24] usb 4-1: config 0 descriptor??
[  200.857119][ T8706] netlink: 88 bytes leftover after parsing attributes in process `syz.2.887'.
[  200.901750][   T24] radio-si470x 4-1:0.0: DeviceID=0x0000 ChipID=0x0000
[  200.913475][   T24] radio-si470x 4-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0.
[  200.918380][ T5912] usb 2-1: USB disconnect, device number 25
[  200.952286][ T8708] netlink: 'syz.2.888': attribute type 33 has an invalid length.
[  200.960255][ T8708] netlink: 160 bytes leftover after parsing attributes in process `syz.2.888'.
[  200.974525][ T8708] netlink: 'syz.2.888': attribute type 33 has an invalid length.
[  200.983052][ T8708] netlink: 160 bytes leftover after parsing attributes in process `syz.2.888'.
[  201.102624][   T24] radio-si470x 4-1:0.0: software version 0, hardware version 0
[  201.110445][   T24] radio-si470x 4-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0.
[  201.122959][   T24] radio-si470x 4-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org
[  201.304171][   T24] radio-si470x 4-1:0.0: submitting int urb failed (-90)
[  201.510751][ T8716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.890'.
[  202.113634][ T8693] netlink: zone id is out of range
[  202.120820][ T8693] netlink: zone id is out of range
[  202.129757][ T8693] netlink: zone id is out of range
[  202.146791][ T8693] netlink: zone id is out of range
[  202.164025][ T8693] netlink: zone id is out of range
[  202.178895][ T8693] netlink: zone id is out of range
[  202.180812][ T8723] netlink: 40 bytes leftover after parsing attributes in process `syz.3.880'.
[  202.201611][ T8693] netlink: zone id is out of range
[  202.217053][ T8693] netlink: zone id is out of range
[  202.235533][ T8693] netlink: zone id is out of range
[  202.248433][ T8693] netlink: zone id is out of range
[  202.282629][   T24] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -71
[  202.314391][   T24] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -22
[  202.339099][   T24] usb 4-1: USB disconnect, device number 34
[  202.474794][ T8729] netlink: 88 bytes leftover after parsing attributes in process `syz.2.896'.
[  202.730660][ T8734] EXT4-fs (rnullb0): VFS: Can't find ext4 filesystem
[  202.855229][ T8746] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[  202.884815][ T8744] /dev/rnullb0: Can't lookup blockdev
[  203.136043][ T8762] netlink: 55 bytes leftover after parsing attributes in process `syz.2.906'.
[  203.388503][ T8768] netlink: 88 bytes leftover after parsing attributes in process `syz.0.908'.
[  203.532673][ T8770] /dev/rnullb0: Can't lookup blockdev
[  203.559622][ T8772] IPVS: set_ctl: invalid protocol: 58 172.20.20.48:20003
[  203.653464][ T8778] team0: No ports can be present during mode change
[  203.962142][ T5866] usb 4-1: new high-speed USB device number 35 using dummy_hcd
[  204.109705][ T5866] usb 4-1: device descriptor read/64, error -71
[  204.207622][   T30] audit: type=1804 audit(1754583641.327:7): pid=8799 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.918" name="rnullb0" dev="tmpfs" ino=818 res=1 errno=0
[  204.228302][ T8799] netlink: 4 bytes leftover after parsing attributes in process `syz.2.918'.
[  204.229149][ T8800] netlink: 4 bytes leftover after parsing attributes in process `syz.2.918'.
[  204.314055][ T8799] bond0: (slave bond_slave_0): Releasing backup interface
[  204.363894][ T5866] usb 4-1: new high-speed USB device number 36 using dummy_hcd
[  204.391494][ T5968] usb 2-1: new low-speed USB device number 26 using dummy_hcd
[  204.510470][ T5866] usb 4-1: device descriptor read/64, error -71
[  204.571988][ T5968] usb 2-1: config 168 descriptor has 1 excess byte, ignoring
[  204.579452][ T5968] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  204.601824][ T5968] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  204.620299][ T5968] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10
[  204.630707][ T5866] usb usb4-port1: attempt power cycle
[  204.651423][ T5968] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0
[  204.683114][ T5968] usb 2-1: config 168 descriptor has 1 excess byte, ignoring
[  204.694479][ T5968] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  204.704704][ T5968] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  204.730243][ T5968] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10
[  204.750319][ T5968] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0
[  204.764837][ T5968] usb 2-1: config 168 descriptor has 1 excess byte, ignoring
[  204.772820][ T5968] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 is Bulk; changing to Interrupt
[  204.795663][ T5968] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  204.807084][ T5968] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10
[  204.819091][ T5968] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0
[  204.834374][ T5968] usb 2-1: string descriptor 0 read error: -22
[  204.841299][ T5968] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e
[  204.850837][ T5968] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  204.895515][ T5968] adutux 2-1:168.0: ADU100  now attached to /dev/usb/adutux0
[  204.970685][ T5866] usb 4-1: new high-speed USB device number 37 using dummy_hcd
[  205.004907][ T5866] usb 4-1: device descriptor read/8, error -71
[  205.192357][ T5912] usb 2-1: USB disconnect, device number 26
[  205.260432][ T5866] usb 4-1: new high-speed USB device number 38 using dummy_hcd
[  205.291418][ T5866] usb 4-1: device descriptor read/8, error -71
[  205.402398][ T5866] usb usb4-port1: unable to enumerate USB device
[  205.424524][ T8846] netlink: 'syz.2.934': attribute type 1 has an invalid length.
[  205.434049][ T8846] netlink: 4 bytes leftover after parsing attributes in process `syz.2.934'.
[  206.036466][ T8860] netlink: 88 bytes leftover after parsing attributes in process `syz.0.939'.
[  206.306790][ T8865] loop2: detected capacity change from 0 to 7
[  206.314839][ T8865] Dev loop2: unable to read RDB block 7
[  206.322699][ T8865]  loop2: unable to read partition table
[  206.328665][ T8865] loop2: partition table beyond EOD, truncated
[  206.336414][ T8865] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5)
[  206.625160][ T8875] comedi comedi3: 8255: I/O port conflict (0x10003,4)
[  206.632154][ T8875] comedi comedi3: 8255: I/O port conflict (0x10000,4)
[  206.638972][ T8875] comedi comedi3: 8255: I/O port conflict (0x7f,4)
[  206.646431][ T8875] comedi comedi3: 8255: I/O port conflict (0x3,4)
[  206.653786][ T8875] comedi comedi3: 8255: I/O port conflict (0x7,4)
[  206.670447][ T8875] comedi comedi3: 8255: I/O port conflict (0x3,4)
[  206.715199][ T8880] netlink: 88 bytes leftover after parsing attributes in process `syz.2.948'.
[  206.750558][   T51] Bluetooth: hci2: command 0x0406 tx timeout
[  206.752798][ T5862] Bluetooth: hci0: command 0x0406 tx timeout
[  206.756653][   T51] Bluetooth: hci1: command 0x0406 tx timeout
[  206.781013][ T8882] netlink: 12 bytes leftover after parsing attributes in process `syz.1.947'.
[  207.016427][ T8897] tmpfs: Bad value for 'mpol'
[  207.230708][ T5868] Bluetooth: hci3: command 0x0405 tx timeout
[  207.453792][ T8915] /dev/rnullb0: Can't open blockdev
[  207.788978][ T8937] netlink: 8 bytes leftover after parsing attributes in process `syz.1.965'.
[  207.800861][ T8938] netlink: 'syz.1.965': attribute type 21 has an invalid length.
[  207.808738][ T8938] netlink: 4 bytes leftover after parsing attributes in process `syz.1.965'.
[  207.818548][ T8937] /dev/rnullb0: Can't open blockdev
[  208.145115][ T8946] /dev/rnullb0: Can't lookup blockdev
[  208.214450][ T8948] netlink: 12 bytes leftover after parsing attributes in process `syz.2.969'.
[  208.519701][   T30] audit: type=1326 audit(1754583645.637:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8960 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f419e38ebe9 code=0x7ff00000
[  208.547029][   T30] audit: type=1326 audit(1754583645.637:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8960 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f419e38ebe9 code=0x7ff00000
[  208.574164][   T30] audit: type=1326 audit(1754583645.637:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8960 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f419e38ebe9 code=0x7ff00000
[  208.605307][   T30] audit: type=1326 audit(1754583645.637:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8960 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f419e38ebe9 code=0x7ff00000
[  208.633748][   T30] audit: type=1326 audit(1754583645.637:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8960 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f419e38ebe9 code=0x7ff00000
[  208.680454][   T30] audit: type=1326 audit(1754583645.637:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8960 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=305 compat=0 ip=0x7f419e38ebe9 code=0x7ff00000
[  208.721305][   T30] audit: type=1326 audit(1754583645.637:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8960 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f419e38ebe9 code=0x7ff00000
[  208.744498][   T30] audit: type=1326 audit(1754583645.637:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8960 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f419e38ebe9 code=0x7ff00000
[  208.767707][   T30] audit: type=1326 audit(1754583645.637:16): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8960 comm="syz.3.975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f419e38ebe9 code=0x7ff00000
[  209.613133][ T8983] bond_slave_1: entered promiscuous mode
[  209.636916][ T8987] loop2: detected capacity change from 0 to 7
[  209.653478][ T5878] Dev loop2: unable to read RDB block 7
[  209.659154][ T5878]  loop2: unable to read partition table
[  209.672002][ T5878] loop2: partition table beyond EOD, truncated
[  209.681120][ T8987] Dev loop2: unable to read RDB block 7
[  209.690339][ T8987]  loop2: unable to read partition table
[  209.696217][ T8987] loop2: partition table beyond EOD, truncated
[  209.737130][ T8987] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5)
[  209.738281][ T8984] bond_slave_1: left promiscuous mode
[  210.132630][ T9007] netlink: 'syz.2.992': attribute type 10 has an invalid length.
[  210.154842][ T5866] IPVS: starting estimator thread 0...
[  210.250542][ T9008] IPVS: using max 34 ests per chain, 81600 per kthread
[  210.575182][ T9007] team0 (unregistering): Port device team_slave_0 removed
[  210.597139][ T9007] team0 (unregistering): Port device team_slave_1 removed
[  210.829768][ T9028] net_ratelimit: 168 callbacks suppressed
[  210.829789][ T9028] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  211.089929][ T9041] /dev/sg0: Can't lookup blockdev
[  211.640721][ T9065] NILFS (rnullb0): couldn't find nilfs on the device
[  212.709590][ T9104] FAULT_INJECTION: forcing a failure.
[  212.709590][ T9104] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  212.723415][ T9104] CPU: 1 UID: 0 PID: 9104 Comm: syz.1.1022 Not tainted 6.16.0-next-20250807-syzkaller #0 PREEMPT(full) 
[  212.723444][ T9104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  212.723458][ T9104] Call Trace:
[  212.723474][ T9104]  <TASK>
[  212.723483][ T9104]  dump_stack_lvl+0x189/0x250
[  212.723527][ T9104]  ? __pfx____ratelimit+0x10/0x10
[  212.723556][ T9104]  ? __pfx_dump_stack_lvl+0x10/0x10
[  212.723582][ T9104]  ? __pfx__printk+0x10/0x10
[  212.723620][ T9104]  should_fail_ex+0x414/0x560
[  212.723647][ T9104]  _copy_from_user+0x2d/0xb0
[  212.723670][ T9104]  sctp_setsockopt+0x19f/0x1200
[  212.723688][ T9104]  ? __pfx_sock_common_setsockopt+0x10/0x10
[  212.723717][ T9104]  do_sock_setsockopt+0x17c/0x1b0
[  212.723742][ T9104]  __x64_sys_setsockopt+0x13f/0x1b0
[  212.723768][ T9104]  do_syscall_64+0xfa/0x3b0
[  212.723785][ T9104]  ? lockdep_hardirqs_on+0x9c/0x150
[  212.723813][ T9104]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  212.723832][ T9104]  ? clear_bhb_loop+0x60/0xb0
[  212.723856][ T9104]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  212.723875][ T9104] RIP: 0033:0x7fd8cf38ebe9
[  212.723898][ T9104] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  212.723915][ T9104] RSP: 002b:00007fd8d0157038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  212.723935][ T9104] RAX: ffffffffffffffda RBX: 00007fd8cf5b5fa0 RCX: 00007fd8cf38ebe9
[  212.723950][ T9104] RDX: 000000000000007b RSI: 0000000000000084 RDI: 0000000000000003
[  212.723961][ T9104] RBP: 00007fd8d0157090 R08: 0000000000000008 R09: 0000000000000000
[  212.723972][ T9104] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001
[  212.723984][ T9104] R13: 00007fd8cf5b6038 R14: 00007fd8cf5b5fa0 R15: 00007ffecbec3a78
[  212.724015][ T9104]  </TASK>
[  212.909962][    C1] vkms_vblank_simulate: vblank timer overrun
[  213.019815][ T9107] netlink: 92 bytes leftover after parsing attributes in process `syz.3.1024'.
[  213.137469][ T9114] /dev/rnullb0: Can't open blockdev
[  213.355937][ T9123] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1029'.
[  213.412155][ T9127] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  213.436676][ T9127] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6)
[  213.443526][ T9127] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
[  213.475169][ T9127] vhci_hcd vhci_hcd.0: Device attached
[  213.512360][   T30] kauditd_printk_skb: 603 callbacks suppressed
[  213.512378][   T30] audit: type=1326 audit(1754583650.637:620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9126 comm="syz.3.1030" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f419e38ebe9 code=0x0
[  213.613043][ T9131] FAULT_INJECTION: forcing a failure.
[  213.613043][ T9131] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  213.631215][ T9131] CPU: 1 UID: 0 PID: 9131 Comm: syz.0.1031 Not tainted 6.16.0-next-20250807-syzkaller #0 PREEMPT(full) 
[  213.631241][ T9131] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  213.631253][ T9131] Call Trace:
[  213.631259][ T9131]  <TASK>
[  213.631267][ T9131]  dump_stack_lvl+0x189/0x250
[  213.631299][ T9131]  ? __pfx____ratelimit+0x10/0x10
[  213.631336][ T9131]  ? __pfx_dump_stack_lvl+0x10/0x10
[  213.631361][ T9131]  ? __pfx__printk+0x10/0x10
[  213.631400][ T9131]  should_fail_ex+0x414/0x560
[  213.631430][ T9131]  _copy_to_user+0x31/0xb0
[  213.631455][ T9131]  simple_read_from_buffer+0xe1/0x170
[  213.631484][ T9131]  proc_fail_nth_read+0x1b3/0x220
[  213.631507][ T9131]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  213.631529][ T9131]  ? rw_verify_area+0x2a6/0x4d0
[  213.631549][ T9131]  ? __lock_acquire+0xab9/0xd20
[  213.631568][ T9131]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  213.631589][ T9131]  vfs_read+0x1fd/0xa30
[  213.631610][ T9131]  ? fdget_pos+0x247/0x320
[  213.631640][ T9131]  ? __pfx___mutex_lock+0x10/0x10
[  213.631669][ T9131]  ? __pfx_vfs_read+0x10/0x10
[  213.631692][ T9131]  ? __fget_files+0x2a/0x420
[  213.631722][ T9131]  ? __fget_files+0x3a0/0x420
[  213.631746][ T9131]  ? __fget_files+0x2a/0x420
[  213.631780][ T9131]  ksys_read+0x145/0x250
[  213.631805][ T9131]  ? __pfx_ksys_read+0x10/0x10
[  213.631833][ T9131]  ? do_syscall_64+0xbe/0x3b0
[  213.631854][ T9131]  do_syscall_64+0xfa/0x3b0
[  213.631870][ T9131]  ? lockdep_hardirqs_on+0x9c/0x150
[  213.631896][ T9131]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  213.631916][ T9131]  ? clear_bhb_loop+0x60/0xb0
[  213.631938][ T9131]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  213.631956][ T9131] RIP: 0033:0x7f28b838d5fc
[  213.631974][ T9131] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48
[  213.631991][ T9131] RSP: 002b:00007f28b91cc030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  213.632011][ T9131] RAX: ffffffffffffffda RBX: 00007f28b85b5fa0 RCX: 00007f28b838d5fc
[  213.632026][ T9131] RDX: 000000000000000f RSI: 00007f28b91cc0a0 RDI: 0000000000000004
[  213.632038][ T9131] RBP: 00007f28b91cc090 R08: 0000000000000000 R09: 0000000000000000
[  213.632050][ T9131] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001
[  213.632062][ T9131] R13: 00007f28b85b6038 R14: 00007f28b85b5fa0 R15: 00007ffc74f03988
[  213.632094][ T9131]  </TASK>
[  213.877095][    C1] vkms_vblank_simulate: vblank timer overrun
[  214.033157][ T9136] MTD: Couldn't look up '/dev/rnullb0': -15
[  214.200255][ T5968] usb 39-1: new low-speed USB device number 2 using vhci_hcd
[  214.209871][ T9129] vhci_hcd: sendmsg failed!, ret=-32 for 48
[  214.217699][ T9128] vhci_hcd: connection closed
[  214.219523][ T1142] vhci_hcd: stop threads
[  214.255270][ T1142] vhci_hcd: release socket
[  214.262125][ T1142] vhci_hcd: disconnect device
[  214.329045][ T9145] loop2: detected capacity change from 0 to 7
[  214.342905][ T5878] Dev loop2: unable to read RDB block 7
[  214.349868][ T5878]  loop2: unable to read partition table
[  214.356398][ T5878] loop2: partition table beyond EOD, truncated
[  214.366905][ T9145] Dev loop2: unable to read RDB block 7
[  214.373231][ T9145]  loop2: unable to read partition table
[  214.379682][ T9145] loop2: partition table beyond EOD, truncated
[  214.389505][ T9145] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5)
[  214.491717][ T9149] exFAT-fs (rnullb0): invalid boot record signature
[  214.498329][ T9149] exFAT-fs (rnullb0): failed to read boot sector
[  214.505249][ T9149] exFAT-fs (rnullb0): failed to recognize exfat type
[  215.056070][ T9167] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1043'.
[  215.279873][ T9176] loop2: detected capacity change from 0 to 7
[  215.304284][ T9176] Dev loop2: unable to read RDB block 7
[  215.310044][ T9176]  loop2: unable to read partition table
[  215.317579][ T9176] loop2: partition table beyond EOD, truncated
[  215.327977][ T9173] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1045'.
[  215.328083][ T9176] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5)
[  215.351111][ T9178] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1045'.
[  215.574312][ T9194] netlink: 'syz.2.1053': attribute type 21 has an invalid length.
[  215.584596][ T9194] netlink: 128 bytes leftover after parsing attributes in process `syz.2.1053'.
[  215.926981][ T9210] Mount JFS Failure: -22
[  216.038588][ T9216] erofs (device rnullb0): cannot find valid erofs superblock
[  216.310793][   T10] usb 2-1: new high-speed USB device number 27 using dummy_hcd
[  216.509300][   T10] usb 2-1: unable to get BOS descriptor or descriptor too short
[  216.519281][   T10] usb 2-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config
[  216.534727][   T10] usb 2-1: string descriptor 0 read error: -22
[  216.541338][   T10] usb 2-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db
[  216.550738][   T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  216.570548][   T24] usb 4-1: new full-speed USB device number 39 using dummy_hcd
[  216.700472][   T10] usb 2-1: reset high-speed USB device number 27 using dummy_hcd
[  216.742188][   T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  216.753863][   T24] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E
[  216.774011][   T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10
[  216.786128][   T24] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0
[  216.798396][   T24] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  216.819719][   T24] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46
[  216.833171][   T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35
[  216.843936][   T24] usb 4-1: Product: syz
[  216.848316][   T24] usb 4-1: Manufacturer: syz
[  216.854356][   T24] usb 4-1: SerialNumber: syz
[  216.862540][   T24] usb 4-1: config 0 descriptor??
[  217.072282][   T24] radio-si470x 4-1:0.0: DeviceID=0x0000 ChipID=0x0000
[  217.079243][   T24] radio-si470x 4-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0.
[  217.278061][   T24] radio-si470x 4-1:0.0: software version 0, hardware version 0
[  217.285785][   T24] radio-si470x 4-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0.
[  217.298552][   T24] radio-si470x 4-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org
[  217.400440][   T10] usb 2-1: device descriptor read/64, error -71
[  217.478874][   T24] radio-si470x 4-1:0.0: submitting int urb failed (-90)
[  217.652605][   T10] usb 2-1: reset high-speed USB device number 27 using dummy_hcd
[  217.792726][   T10] usb 2-1: device descriptor read/64, error -71
[  218.043381][   T10] usb 2-1: reset high-speed USB device number 27 using dummy_hcd
[  218.071136][   T10] usb 2-1: device descriptor read/8, error -71
[  218.187698][ T9262] netlink: 5 bytes leftover after parsing attributes in process `syz.2.1074'.
[  218.292494][ T9233] netlink: zone id is out of range
[  218.298634][ T9233] netlink: zone id is out of range
[  218.305161][ T9233] netlink: zone id is out of range
[  218.310705][ T9233] netlink: zone id is out of range
[  218.311953][   T10] usb 2-1: reset high-speed USB device number 27 using dummy_hcd
[  218.315870][ T9233] netlink: zone id is out of range
[  218.332317][ T9233] netlink: zone id is out of range
[  218.337606][ T9233] netlink: zone id is out of range
[  218.344987][   T10] usb 2-1: device descriptor read/8, error -71
[  218.346212][ T9233] netlink: zone id is out of range
[  218.358050][ T9233] netlink: zone id is out of range
[  218.363389][ T9233] netlink: zone id is out of range
[  218.384188][   T24] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -71
[  218.397551][   T24] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -22
[  218.413198][   T24] usb 4-1: USB disconnect, device number 39
[  218.476309][   T10] usb 2-1: USB disconnect, device number 27
[  218.640847][   T10] usb 2-1: new high-speed USB device number 28 using dummy_hcd
[  218.785157][   T10] usb 2-1: device descriptor read/64, error -71
[  219.040663][   T10] usb 2-1: new high-speed USB device number 29 using dummy_hcd
[  219.500306][ T5968] vhci_hcd: vhci_device speed not set
[  220.347752][ T9309] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1090'.
[  220.374155][ T9313] netlink: 88 bytes leftover after parsing attributes in process `syz.1.1091'.
[  220.487588][ T9316] netlink: 'syz.1.1092': attribute type 4 has an invalid length.
[  220.498348][ T9316] ./cgroup: Can't lookup blockdev
[  220.602530][ T9322] FAT-fs (rnullb0): bogus number of reserved sectors
[  220.610251][ T9322] FAT-fs (rnullb0): Can't find a valid FAT filesystem
[  220.635195][ T9325] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  220.652392][ T9325] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  221.495169][ T9344] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1101'.
[  221.696382][ T9346] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  221.883899][ T9359] fuse: Unknown parameter 'rootmoNe'
[  221.893671][ T9360] fuse: Unknown parameter 'rootmoNe'
[  222.034312][ T9366] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it.
[  222.048197][ T9366] overlayfs: missing 'lowerdir'
[  222.190002][ T9372] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1108'.
[  222.205499][ T9372] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1108'.
[  222.215010][ T9372] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1108'.
[  222.310314][   T24] usb 2-1: new high-speed USB device number 30 using dummy_hcd
[  222.470620][   T24] usb 2-1: Using ep0 maxpacket: 32
[  222.481430][   T24] usb 2-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b
[  222.490741][   T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  222.498933][   T24] usb 2-1: Product: syz
[  222.503666][   T24] usb 2-1: Manufacturer: syz
[  222.508280][   T24] usb 2-1: SerialNumber: syz
[  222.527016][   T24] usb 2-1: config 0 descriptor??
[  222.724966][ T9392] ksmbd: Unknown IPC event: 3, ignore.
[  222.943809][ T9366] wg0 speed is unknown, defaulting to 1000
[  222.970392][ T9366] wg0 speed is unknown, defaulting to 1000
[  223.003981][ T9366] wg0 speed is unknown, defaulting to 1000
[  223.069310][ T9366] iwpm_register_pid: Unable to send a nlmsg (client = 2)
[  223.148394][ T9366] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98
[  223.216937][ T9400] XFS (rnullb0): Invalid superblock magic number
[  223.224286][ T9366] wg0 speed is unknown, defaulting to 1000
[  223.284161][ T9366] wg0 speed is unknown, defaulting to 1000
[  223.296297][ T9366] wg0 speed is unknown, defaulting to 1000
[  223.305317][ T9366] wg0 speed is unknown, defaulting to 1000
[  223.354078][   T24] peak_usb 2-1:0.0 can0: unable to request usb[type=2 value=5] err=-71
[  223.461096][   T24] peak_usb 2-1:0.0: probe with driver peak_usb failed with error -71
[  223.485602][   T24] usb 2-1: USB disconnect, device number 30
[  223.750401][ T5953] usb 4-1: new high-speed USB device number 40 using dummy_hcd
[  223.920319][ T5953] usb 4-1: Using ep0 maxpacket: 32
[  223.927476][ T5953] usb 4-1: config 0 has an invalid interface number: 67 but max is 0
[  223.951053][ T5953] usb 4-1: config 0 has no interface number 0
[  223.960884][ T5953] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57
[  223.970135][ T5953] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  223.990498][ T5953] usb 4-1: Product: syz
[  224.000253][ T5953] usb 4-1: Manufacturer: syz
[  224.006082][ T5953] usb 4-1: SerialNumber: syz
[  224.013938][ T5953] usb 4-1: config 0 descriptor??
[  224.026550][ T5953] smsc95xx v2.0.0
[  224.425245][ T5953] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32
[  224.439787][ T5953] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  224.773919][ T9453] xt_limit: Overflow, try lower: 271964/0
[  224.782173][ T9453] No control pipe specified
[  225.166550][ T9461] FAULT_INJECTION: forcing a failure.
[  225.166550][ T9461] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  225.172492][   T24] usb 2-1: new full-speed USB device number 31 using dummy_hcd
[  225.182620][ T9461] CPU: 0 UID: 0 PID: 9461 Comm: syz.0.1138 Not tainted 6.16.0-next-20250807-syzkaller #0 PREEMPT(full) 
[  225.182647][ T9461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  225.182659][ T9461] Call Trace:
[  225.182666][ T9461]  <TASK>
[  225.182674][ T9461]  dump_stack_lvl+0x189/0x250
[  225.182707][ T9461]  ? __pfx____ratelimit+0x10/0x10
[  225.182734][ T9461]  ? __pfx_dump_stack_lvl+0x10/0x10
[  225.182760][ T9461]  ? __pfx__printk+0x10/0x10
[  225.182787][ T9461]  ? __might_fault+0xb0/0x130
[  225.182817][ T9461]  should_fail_ex+0x414/0x560
[  225.182847][ T9461]  _copy_from_iter+0x1db/0x16f0
[  225.182870][ T9461]  ? rcu_is_watching+0x15/0xb0
[  225.182895][ T9461]  ? kmem_cache_alloc_node_noprof+0x217/0x3c0
[  225.182917][ T9461]  ? __pfx__copy_from_iter+0x10/0x10
[  225.182938][ T9461]  ? __build_skb_around+0x257/0x3e0
[  225.182959][ T9461]  ? netlink_sendmsg+0x642/0xb30
[  225.182975][ T9461]  ? skb_put+0x11b/0x210
[  225.182996][ T9461]  netlink_sendmsg+0x6b2/0xb30
[  225.183023][ T9461]  ? __pfx_netlink_sendmsg+0x10/0x10
[  225.183044][ T9461]  ? aa_sock_msg_perm+0xf1/0x1d0
[  225.183072][ T9461]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  225.183096][ T9461]  ? __pfx_netlink_sendmsg+0x10/0x10
[  225.183115][ T9461]  __sock_sendmsg+0x21c/0x270
[  225.183143][ T9461]  ____sys_sendmsg+0x505/0x830
[  225.183169][ T9461]  ? __pfx_____sys_sendmsg+0x10/0x10
[  225.183199][ T9461]  ? import_iovec+0x74/0xa0
[  225.183223][ T9461]  ___sys_sendmsg+0x21f/0x2a0
[  225.183246][ T9461]  ? __pfx____sys_sendmsg+0x10/0x10
[  225.183308][ T9461]  ? __fget_files+0x2a/0x420
[  225.183332][ T9461]  ? __fget_files+0x3a0/0x420
[  225.183366][ T9461]  __x64_sys_sendmsg+0x19b/0x260
[  225.183390][ T9461]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  225.183420][ T9461]  ? __pfx_ksys_write+0x10/0x10
[  225.183447][ T9461]  ? do_syscall_64+0xbe/0x3b0
[  225.183467][ T9461]  do_syscall_64+0xfa/0x3b0
[  225.183482][ T9461]  ? lockdep_hardirqs_on+0x9c/0x150
[  225.183507][ T9461]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.183526][ T9461]  ? clear_bhb_loop+0x60/0xb0
[  225.183548][ T9461]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.183566][ T9461] RIP: 0033:0x7f28b838ebe9
[  225.183583][ T9461] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  225.183600][ T9461] RSP: 002b:00007f28b91cc038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  225.183619][ T9461] RAX: ffffffffffffffda RBX: 00007f28b85b5fa0 RCX: 00007f28b838ebe9
[  225.183634][ T9461] RDX: 000000002000c000 RSI: 0000200000000200 RDI: 0000000000000003
[  225.183646][ T9461] RBP: 00007f28b91cc090 R08: 0000000000000000 R09: 0000000000000000
[  225.183658][ T9461] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  225.183669][ T9461] R13: 00007f28b85b6038 R14: 00007f28b85b5fa0 R15: 00007ffc74f03988
[  225.183699][ T9461]  </TASK>
[  225.624269][   T24] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  225.645518][   T24] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E
[  225.656939][ T9474] tipc: Enabling of bearer <udp:s> rejected, failed to enable media
[  225.657767][   T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10
[  225.677656][   T24] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0
[  225.688083][ T5953] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32
[  225.699775][ T5953] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -32
[  225.721261][   T24] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  225.748328][   T24] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46
[  225.760753][   T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35
[  225.773674][   T24] usb 2-1: Product: syz
[  225.778338][   T24] usb 2-1: Manufacturer: syz
[  225.783624][   T24] usb 2-1: SerialNumber: syz
[  225.791657][   T24] usb 2-1: config 0 descriptor??
[  226.001409][   T24] radio-si470x 2-1:0.0: DeviceID=0x0000 ChipID=0x0000
[  226.008967][   T24] radio-si470x 2-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0.
[  226.201981][   T24] radio-si470x 2-1:0.0: software version 0, hardware version 0
[  226.209832][   T24] radio-si470x 2-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0.
[  226.223889][   T24] radio-si470x 2-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org
[  226.262960][ T9504] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1156'.
[  226.402716][   T24] radio-si470x 2-1:0.0: submitting int urb failed (-90)
[  226.725395][ T5912] usb 4-1: USB disconnect, device number 40
[  226.760218][ T9513] /dev/rnullb0: Can't open blockdev
[  226.776184][ T9514] /dev/rnullb0: Can't open blockdev
[  227.079162][ T9527] overlayfs: failed to clone upperpath
[  227.127351][ T9529] /dev/rnullb0: Can't open blockdev
[  227.206683][ T9458] net_ratelimit: 168 callbacks suppressed
[  227.206703][ T9458] netlink: zone id is out of range
[  227.225614][ T9458] netlink: zone id is out of range
[  227.233960][ T9458] netlink: zone id is out of range
[  227.239186][ T9458] netlink: zone id is out of range
[  227.252044][ T9458] netlink: zone id is out of range
[  227.258730][ T9458] netlink: zone id is out of range
[  227.264470][ T9458] netlink: zone id is out of range
[  227.269766][ T9458] netlink: zone id is out of range
[  227.275592][ T9458] netlink: zone id is out of range
[  227.281832][ T9458] netlink: zone id is out of range
[  227.297150][   T24] radio-si470x 2-1:0.0: si470x_get_report: usb_control_msg returned -71
[  227.306376][   T24] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -22
[  227.322195][   T24] usb 2-1: USB disconnect, device number 31
[  227.490420][   T43] usb 4-1: new high-speed USB device number 41 using dummy_hcd
[  227.640387][   T43] usb 4-1: Using ep0 maxpacket: 32
[  227.650031][   T43] usb 4-1: config 0 has an invalid interface number: 67 but max is 0
[  227.658835][   T43] usb 4-1: config 0 has no interface number 0
[  227.672447][   T43] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57
[  227.684532][   T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  227.695956][   T43] usb 4-1: Product: syz
[  227.705229][   T43] usb 4-1: Manufacturer: syz
[  227.709915][   T43] usb 4-1: SerialNumber: syz
[  227.726987][   T43] usb 4-1: config 0 descriptor??
[  227.742395][   T43] smsc95xx v2.0.0
[  228.012427][ T9551] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1172'.
[  228.145025][   T43] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32
[  228.166599][   T43] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  228.197277][ T9555] UDF-fs: warning (device rnullb0): udf_load_vrs: No VRS found
[  228.209689][ T9555] UDF-fs: Scanning with blocksize 4096 failed
[  228.616490][ T9567] pimreg: entered allmulticast mode
[  229.452657][   T43] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32
[  229.464030][   T43] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -32
[  230.515117][   T10] usb 4-1: USB disconnect, device number 41
[  230.893875][ T9621] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1195'.
[  231.029784][ T9624] iommufd_mock iommufd_mock0: Adding to iommu group 0
[  231.055309][ T9624] iommufd_mock iommufd_mock1: Adding to iommu group 1
[  231.069774][ T9627] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1196'.
[  231.117985][ T9627] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1196'.
[  231.132427][ T9627] /dev/rnullb0: Can't lookup blockdev
[  231.306007][ T9636] /dev/rnullb0: Can't open blockdev
[  231.445858][ T9644] overlayfs: workdir and upperdir must reside under the same mount
[  231.471657][ T9643] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.
[  231.616507][ T9650] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1204'.
[  231.675285][ T9652] /dev/rnullb0: Can't open blockdev
[  231.768983][ T9656] wg0 speed is unknown, defaulting to 1000
[  232.091391][ T9662] netlink: 'syz.2.1209': attribute type 16 has an invalid length.
[  232.103502][ T9662] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1209'.
[  232.152721][ T9664] /dev/rnullb0: Can't lookup blockdev
[  232.165141][ T9662] bridge0: port 1(bridge_slave_0) entered disabled state
[  232.644958][ T9676] netlink: 88 bytes leftover after parsing attributes in process `syz.0.1214'.
[  232.744256][ T9678] loop2: detected capacity change from 0 to 7
[  232.759630][ T5878] Dev loop2: unable to read RDB block 7
[  232.766108][ T5878]  loop2: unable to read partition table
[  232.772516][ T5878] loop2: partition table beyond EOD, truncated
[  232.779801][ T9678] Dev loop2: unable to read RDB block 7
[  232.787870][ T9678]  loop2: unable to read partition table
[  232.796632][ T9678] loop2: partition table beyond EOD, truncated
[  232.805850][ T9678] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5)
[  233.080271][ T5968] usb 4-1: new high-speed USB device number 42 using dummy_hcd
[  233.097142][ T9689] sctp: [Deprecated]: syz.0.1219 (pid 9689) Use of int in max_burst socket option.
[  233.097142][ T9689] Use struct sctp_assoc_value instead
[  233.151690][ T9691] net_ratelimit: 171 callbacks suppressed
[  233.151711][ T9691] openvswitch: netlink: IP tunnel dst address not specified
[  233.165759][ T9692] /dev/rnullb0: Can't open blockdev
[  233.230751][ T5968] usb 4-1: Using ep0 maxpacket: 32
[  233.238470][ T5968] usb 4-1: config 0 has an invalid interface number: 67 but max is 0
[  233.247122][ T5968] usb 4-1: config 0 has no interface number 0
[  233.257429][ T5968] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57
[  233.267256][ T5968] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  233.275703][ T5968] usb 4-1: Product: syz
[  233.279985][ T5968] usb 4-1: Manufacturer: syz
[  233.285067][ T5968] usb 4-1: SerialNumber: syz
[  233.294305][ T5968] usb 4-1: config 0 descriptor??
[  233.302636][ T5968] smsc95xx v2.0.0
[  233.709437][ T5968] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32
[  233.730268][ T5968] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  234.636707][ T9700] loop2: detected capacity change from 0 to 7
[  234.647535][ T9702] NILFS (rnullb0): couldn't find nilfs on the device
[  234.664408][ T9700] Dev loop2: unable to read RDB block 7
[  234.670029][ T9700]  loop2: unable to read partition table
[  234.700894][ T9700] loop2: partition table beyond EOD, truncated
[  234.720457][ T9700] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5)
[  234.899829][ T9705] rtc_cmos 00:00: Alarms can be up to one day in the future
[  234.949390][ T5968] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32
[  234.982430][ T5968] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -32
[  235.045039][ T9712] openvswitch: netlink: IP tunnel dst address not specified
[  235.306707][ T9720] /dev/rnullb0: Can't open blockdev
[  235.798128][   T24] rtc_cmos 00:00: Alarms can be up to one day in the future
[  235.810626][   T24] rtc_cmos 00:00: Alarms can be up to one day in the future
[  235.818345][   T24] rtc_cmos 00:00: Alarms can be up to one day in the future
[  235.850530][   T24] rtc_cmos 00:00: Alarms can be up to one day in the future
[  235.858057][   T24] rtc rtc0: __rtc_set_alarm: err=-22
[  236.013948][   T10] usb 4-1: USB disconnect, device number 42
[  236.217714][ T9736] loop2: detected capacity change from 0 to 7
[  236.233524][ T9736] Dev loop2: unable to read RDB block 7
[  236.241728][ T9736]  loop2: unable to read partition table
[  236.247770][ T9736] loop2: partition table beyond EOD, truncated
[  236.263620][ T9736] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5)
[  236.832494][ T9755] comedi comedi3: comedi_config --init_data is deprecated
[  237.659745][ T9773] loop2: detected capacity change from 0 to 7
[  237.676970][ T9773] Dev loop2: unable to read RDB block 7
[  237.702940][ T9773]  loop2: unable to read partition table
[  237.709067][ T9773] loop2: partition table beyond EOD, truncated
[  237.718039][ T9773] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5)
[  237.851506][ T9783] /dev/rnullb0: Can't lookup blockdev
[  237.892565][ T9789] kAFS: unparsable volume name
[  238.207818][ T9807] netdevsim netdevsim1: Direct firmware load for I failed with error -2
[  238.217231][ T9807] netdevsim netdevsim1: Falling back to sysfs fallback for: I
[  238.269487][ T9812] hugetlbfs: Bad value for 'mode'
[  238.396215][ T9817] /dev/rnullb0: Can't lookup blockdev
[  238.454625][ T1142] Bluetooth: Error in BCSP hdr checksum
[  238.582325][   T24] usb 4-1: new full-speed USB device number 43 using dummy_hcd
[  238.609876][ T9827] delete_channel: no stack
[  238.622133][ T9827] delete_channel: no stack
[  238.676772][ T9831] MTD: Couldn't look up '/dev/rnullb0': -15
[  238.724296][   T49] Bluetooth: Error in BCSP hdr checksum
[  238.732918][ T9836] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  238.752242][   T24] usb 4-1: config 0 has an invalid interface number: 123 but max is 0
[  238.761050][   T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  238.772064][   T24] usb 4-1: config 0 has no interface number 0
[  238.782730][   T24] usb 4-1: New USB device found, idVendor=20df, idProduct=0001, bcdDevice=97.6d
[  238.792939][   T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  238.802567][   T24] usb 4-1: Product: syz
[  238.806951][   T24] usb 4-1: Manufacturer: syz
[  238.815116][   T24] usb 4-1: SerialNumber: syz
[  238.824339][   T24] usb 4-1: config 0 descriptor??
[  238.838026][   T24] cdc_acm 4-1:0.123: skipping garbage
[  239.044692][ T9815] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  239.059252][ T9815] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  239.078654][ T5912] usb 4-1: USB disconnect, device number 43
[  239.126545][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.133481][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.139802][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.146426][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.154198][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.161162][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.167561][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.174758][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.181263][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.187504][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.194704][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.202225][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.208564][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.215083][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.221433][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.227583][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.234353][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.243600][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.249867][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.256442][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.264367][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.271294][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.277501][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.284657][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.290979][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.297188][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.303837][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.310801][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.317179][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.323551][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.329940][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.336663][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.343101][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.349464][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.356237][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.362853][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.369786][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.376373][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.382831][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.389360][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.396277][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.402624][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.409395][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.416126][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.422835][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.429185][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.436095][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.443267][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.449572][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.456096][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.462431][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.469266][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.476154][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.482489][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.488845][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.495431][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.502227][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.508580][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.514967][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.521436][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.527607][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.534050][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.540424][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.546687][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  239.553308][ T9847] MTD: Couldn't look up '/dev/rnullb0': -15
[  240.197711][   T49] Bluetooth: hci5: Frame reassembly failed (-84)
[  240.214772][   T49] Bluetooth: hci5: Frame reassembly failed (-84)
[  240.225738][ T9872] fuse: Unknown parameter '
[  240.225738][ T9872] '
[  240.270471][ T5876] Bluetooth: hci4: command 0x1003 tx timeout
[  240.275572][ T5869] Bluetooth: hci4: Opcode 0x1003 failed: -110
[  240.419986][ T9878] netlink: 88 bytes leftover after parsing attributes in process `syz.1.1279'.
[  240.487451][ T9880] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  240.501565][ T9880] VFS: Can't find a romfs filesystem on dev rnullb0.
[  240.501565][ T9880] 
[  240.900292][   T10] usb 2-1: new high-speed USB device number 32 using dummy_hcd
[  241.050242][   T10] usb 2-1: Using ep0 maxpacket: 32
[  241.057276][   T10] usb 2-1: config 0 has an invalid interface number: 67 but max is 0
[  241.065690][   T10] usb 2-1: config 0 has no interface number 0
[  241.075324][   T10] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57
[  241.088621][   T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  241.096785][   T10] usb 2-1: Product: syz
[  241.101170][   T10] usb 2-1: Manufacturer: syz
[  241.106831][   T10] usb 2-1: SerialNumber: syz
[  241.114871][   T10] usb 2-1: config 0 descriptor??
[  241.124648][   T10] smsc95xx v2.0.0
[  241.526851][   T10] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32
[  241.542239][   T10] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  241.675140][ T9899] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1288'.
[  241.998917][ T9910] fuse: Unknown parameter 'user00000000000000000000'
[  242.271355][ T5869] Bluetooth: hci5: command 0x1003 tx timeout
[  242.271532][ T5868] Bluetooth: hci5: Opcode 0x1003 failed: -110
[  242.707393][ T9929] netlink: zone id is out of range
[  242.712834][ T9929] netlink: zone id is out of range
[  242.718054][ T9929] netlink: zone id is out of range
[  242.725943][ T9929] netlink: zone id is out of range
[  242.732184][ T9929] netlink: zone id is out of range
[  242.750082][ T9929] netlink: zone id is out of range
[  242.763267][   T10] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32
[  242.780631][ T9929] netlink: zone id is out of range
[  242.783404][   T10] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -32
[  242.790404][ T9929] netlink: zone id is out of range
[  242.801155][ T9929] netlink: zone id is out of range
[  242.813075][ T9929] netlink: zone id is out of range
[  243.333634][ T9935] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1299'.
[  243.854758][   T24] usb 2-1: USB disconnect, device number 32
[  243.987387][ T9956] Scaler: =================  START STATUS  =================
[  244.014824][ T9956] Scaler: ==================  END STATUS  ==================
[  244.233444][   T30] audit: type=1804 audit(1754583937.353:621): pid=9972 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1309" name="rnullb0" dev="tmpfs" ino=818 res=1 errno=0
[  244.400318][ T5968] usb 4-1: new full-speed USB device number 44 using dummy_hcd
[  244.572343][ T5968] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10
[  244.594292][ T5968] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0
[  244.625506][ T5968] usb 4-1: config 0 interface 0 has no altsetting 0
[  244.643813][ T5968] usb 4-1: New USB device found, idVendor=044e, idProduct=120b, bcdDevice= 0.00
[  244.670810][ T5968] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  244.693445][ T5968] usb 4-1: config 0 descriptor??
[  244.782724][   T10] usb 2-1: new high-speed USB device number 33 using dummy_hcd
[  244.888478][ T9988] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1313'.
[  244.950880][   T10] usb 2-1: Using ep0 maxpacket: 32
[  244.978683][   T10] usb 2-1: config 0 has an invalid interface number: 67 but max is 0
[  244.987819][   T10] usb 2-1: config 0 has no interface number 0
[  245.019383][   T10] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57
[  245.033561][   T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  245.050223][   T10] usb 2-1: Product: syz
[  245.054687][   T10] usb 2-1: Manufacturer: syz
[  245.059399][   T10] usb 2-1: SerialNumber: syz
[  245.083969][   T10] usb 2-1: config 0 descriptor??
[  245.111446][   T10] smsc95xx v2.0.0
[  245.128510][ T5968] hid-alps 0003:044E:120B.0009: unknown main item tag 0x0
[  245.146135][ T5968] hid-alps 0003:044E:120B.0009: unknown main item tag 0x0
[  245.181384][ T5968] hid-alps 0003:044E:120B.0009: unknown main item tag 0x0
[  245.188631][ T5968] hid-alps 0003:044E:120B.0009: unknown main item tag 0x0
[  245.202103][ T5968] hid-alps 0003:044E:120B.0009: unknown main item tag 0x0
[  245.209386][ T5968] hid-alps 0003:044E:120B.0009: unknown main item tag 0x0
[  245.219058][ T5968] hid-alps 0003:044E:120B.0009: unknown main item tag 0x0
[  245.229152][ T5968] hid-alps 0003:044E:120B.0009: unknown main item tag 0x0
[  245.239592][ T5968] hid-alps 0003:044E:120B.0009: unknown main item tag 0x0
[  245.248528][ T5968] hid-alps 0003:044E:120B.0009: unknown main item tag 0x0
[  245.272487][ T5968] hid-alps 0003:044E:120B.0009: hidraw0: USB HID v0.00 Device [HID 044e:120b] on usb-dummy_hcd.3-1/input0
[  245.386773][ T5968] usb 4-1: USB disconnect, device number 44
[  245.402671][ T9967] /dev/rnullb0: Can't open blockdev
[  245.456200][ T9996] fido_id[9996]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory
[  245.509102][   T10] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32
[  245.531116][   T10] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  247.108051][   T10] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61
[  247.119631][   T10] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -61
[  247.725743][T10053] netlink: 88 bytes leftover after parsing attributes in process `syz.3.1332'.
[  247.826732][T10059] hfs: can't find a HFS filesystem on dev rnullb0
[  248.639063][   T43] usb 2-1: USB disconnect, device number 33
[  248.748650][T10091] overlayfs: overlapping lowerdir path
[  249.246195][T10106] netlink: 'syz.2.1349': attribute type 1 has an invalid length.
[  249.255771][T10106] netlink: 'syz.2.1349': attribute type 1 has an invalid length.
[  249.589001][T10118] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1352'.
[  249.646866][T10120] bond0: (slave rose0): Error: Device is in use and cannot be enslaved
[  249.987567][T10132] /dev/rnullb0: Can't lookup blockdev
[  250.727606][T10153] netlink: 'syz.2.1363': attribute type 25 has an invalid length.
[  250.766066][T10155] FAULT_INJECTION: forcing a failure.
[  250.766066][T10155] name failslab, interval 1, probability 0, space 0, times 0
[  250.784250][T10155] CPU: 0 UID: 0 PID: 10155 Comm: syz.3.1364 Not tainted 6.16.0-next-20250807-syzkaller #0 PREEMPT(full) 
[  250.784280][T10155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  250.784305][T10155] Call Trace:
[  250.784313][T10155]  <TASK>
[  250.784322][T10155]  dump_stack_lvl+0x189/0x250
[  250.784355][T10155]  ? __pfx____ratelimit+0x10/0x10
[  250.784384][T10155]  ? __pfx_dump_stack_lvl+0x10/0x10
[  250.784412][T10155]  ? __pfx__printk+0x10/0x10
[  250.784442][T10155]  ? __pfx___might_resched+0x10/0x10
[  250.784467][T10155]  ? fs_reclaim_acquire+0x7d/0x100
[  250.784495][T10155]  should_fail_ex+0x414/0x560
[  250.784528][T10155]  should_failslab+0xa8/0x100
[  250.784552][T10155]  __kmalloc_noprof+0xcb/0x4f0
[  250.784572][T10155]  ? tomoyo_encode+0x28b/0x550
[  250.784604][T10155]  tomoyo_encode+0x28b/0x550
[  250.784637][T10155]  tomoyo_realpath_from_path+0x58d/0x5d0
[  250.784678][T10155]  ? tomoyo_path_number_perm+0x1bc/0x5a0
[  250.784701][T10155]  tomoyo_path_number_perm+0x1e8/0x5a0
[  250.784726][T10155]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[  250.784765][T10155]  ? __lock_acquire+0xab9/0xd20
[  250.784809][T10155]  ? __fget_files+0x2a/0x420
[  250.784839][T10155]  ? __fget_files+0x2a/0x420
[  250.784864][T10155]  ? __fget_files+0x3a0/0x420
[  250.784889][T10155]  ? __fget_files+0x2a/0x420
[  250.784919][T10155]  security_file_ioctl+0xcb/0x2d0
[  250.784944][T10155]  __se_sys_ioctl+0x47/0x170
[  250.784968][T10155]  do_syscall_64+0xfa/0x3b0
[  250.784991][T10155]  ? lockdep_hardirqs_on+0x9c/0x150
[  250.785019][T10155]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  250.785039][T10155]  ? clear_bhb_loop+0x60/0xb0
[  250.785063][T10155]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  250.785082][T10155] RIP: 0033:0x7f419e38ebe9
[  250.785099][T10155] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  250.785117][T10155] RSP: 002b:00007f419f1de038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  250.785139][T10155] RAX: ffffffffffffffda RBX: 00007f419e5b5fa0 RCX: 00007f419e38ebe9
[  250.785153][T10155] RDX: 0000200000000540 RSI: 00000000c100565c RDI: 0000000000000003
[  250.785167][T10155] RBP: 00007f419f1de090 R08: 0000000000000000 R09: 0000000000000000
[  250.785180][T10155] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  250.785192][T10155] R13: 00007f419e5b6038 R14: 00007f419e5b5fa0 R15: 00007ffe1e71ed88
[  250.785223][T10155]  </TASK>
[  250.785244][T10155] ERROR: Out of memory at tomoyo_realpath_from_path.
[  251.030674][T10166] /dev/rnullb0: Can't lookup blockdev
[  251.186557][T10172] nvme_fabrics: missing parameter 'transport=%s'
[  251.193675][T10172] nvme_fabrics: missing parameter 'nqn=%s'
[  251.467029][T10146] 9pnet_fd: p9_fd_create_tcp (10146): problem connecting socket to 127.0.0.1
[  251.518283][T10180] ubi0: attaching mtd0
[  251.523440][T10180] ubi0 error: ubi_attach_mtd_dev: bad VID header (1) or data offsets (65)
[  251.526295][T10181] ubi0: attaching mtd0
[  251.526314][T10181] ubi0 error: ubi_attach_mtd_dev: bad VID header (1) or data offsets (65)
[  251.685336][T10188] 9p: Unknown Cache mode or invalid value fsc
[  251.844509][T10196] FAULT_INJECTION: forcing a failure.
[  251.844509][T10196] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  251.858672][T10196] CPU: 1 UID: 0 PID: 10196 Comm: syz.3.1378 Not tainted 6.16.0-next-20250807-syzkaller #0 PREEMPT(full) 
[  251.858700][T10196] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  251.858713][T10196] Call Trace:
[  251.858720][T10196]  <TASK>
[  251.858727][T10196]  dump_stack_lvl+0x189/0x250
[  251.858762][T10196]  ? __pfx____ratelimit+0x10/0x10
[  251.858790][T10196]  ? __pfx_dump_stack_lvl+0x10/0x10
[  251.858818][T10196]  ? __pfx__printk+0x10/0x10
[  251.858846][T10196]  ? __might_fault+0xb0/0x130
[  251.858877][T10196]  should_fail_ex+0x414/0x560
[  251.858908][T10196]  _copy_from_user+0x2d/0xb0
[  251.858931][T10196]  video_usercopy+0x354/0x14f0
[  251.858963][T10196]  ? __pfx___video_do_ioctl+0x10/0x10
[  251.858989][T10196]  ? __pfx_video_usercopy+0x10/0x10
[  251.859021][T10196]  ? __fget_files+0x2a/0x420
[  251.859050][T10196]  ? __fget_files+0x2a/0x420
[  251.859074][T10196]  ? __fget_files+0x3a0/0x420
[  251.859104][T10196]  v4l2_ioctl+0x18d/0x1e0
[  251.859124][T10196]  ? __pfx_v4l2_ioctl+0x10/0x10
[  251.859143][T10196]  __se_sys_ioctl+0xf9/0x170
[  251.859165][T10196]  do_syscall_64+0xfa/0x3b0
[  251.859180][T10196]  ? lockdep_hardirqs_on+0x9c/0x150
[  251.859206][T10196]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  251.859224][T10196]  ? clear_bhb_loop+0x60/0xb0
[  251.859248][T10196]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  251.859266][T10196] RIP: 0033:0x7f419e38ebe9
[  251.859283][T10196] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  251.859300][T10196] RSP: 002b:00007f419f1de038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  251.859318][T10196] RAX: ffffffffffffffda RBX: 00007f419e5b5fa0 RCX: 00007f419e38ebe9
[  251.859333][T10196] RDX: 0000200000000540 RSI: 00000000c100565c RDI: 0000000000000003
[  251.859346][T10196] RBP: 00007f419f1de090 R08: 0000000000000000 R09: 0000000000000000
[  251.859359][T10196] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  251.859370][T10196] R13: 00007f419e5b6038 R14: 00007f419e5b5fa0 R15: 00007ffe1e71ed88
[  251.859401][T10196]  </TASK>
[  252.110023][T10204] net_ratelimit: 346 callbacks suppressed
[  252.110045][T10204] openvswitch: netlink: IP tunnel dst address not specified
[  252.231934][T10208] openvswitch: netlink: VXLAN extension message has 4 unknown bytes.
[  252.333162][T10216] trusted_key: encrypted key: instantiation of keys using provided decrypted data is disabled since CONFIG_USER_DECRYPTED_DATA is set to false
[  252.395923][T10216] openvswitch: netlink: IP tunnel dst address not specified
[  252.670646][T10229] openvswitch: netlink: IP tunnel dst address not specified
[  252.861595][T10236] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1395'.
[  252.879609][T10238] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1395'.
[  253.211963][  T120] usb 2-1: new full-speed USB device number 34 using dummy_hcd
[  253.270384][ T5866] usb 4-1: new full-speed USB device number 45 using dummy_hcd
[  253.372029][  T120] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64
[  253.383191][  T120] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A
[  253.396103][  T120] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8A has invalid maxpacket 121, setting to 64
[  253.412345][  T120] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10
[  253.418932][T10255] /dev/rnullb0: Can't open blockdev
[  253.421772][  T120] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  253.435262][  T120] usb 2-1: Product: syz
[  253.439581][  T120] usb 2-1: Manufacturer: syz
[  253.444604][  T120] usb 2-1: SerialNumber: syz
[  253.450973][ T5866] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  253.462116][ T5866] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E
[  253.475678][  T120] usb 2-1: config 0 descriptor??
[  253.481286][ T5866] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10
[  253.492494][ T5866] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0
[  253.494280][T10240] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  253.503831][ T5866] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  253.525682][ T5866] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46
[  253.527564][T10240] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  253.535196][ T5866] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35
[  253.551621][ T5866] usb 4-1: Product: syz
[  253.558484][  T120] usb 2-1: ucan: probing device on interface #0
[  253.565770][ T5866] usb 4-1: Manufacturer: syz
[  253.571528][ T5866] usb 4-1: SerialNumber: syz
[  253.591033][ T5866] usb 4-1: config 0 descriptor??
[  253.642374][T10257] IPVS: length: 254 != 24
[  253.804172][ T5866] radio-si470x 4-1:0.0: DeviceID=0x0000 ChipID=0x0000
[  253.811687][ T5866] radio-si470x 4-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0.
[  254.004921][ T5866] radio-si470x 4-1:0.0: software version 0, hardware version 0
[  254.014062][ T5866] radio-si470x 4-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0.
[  254.026704][ T5866] radio-si470x 4-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org
[  254.175906][T10263] openvswitch: netlink: IP tunnel dst address not specified
[  254.205727][ T5866] radio-si470x 4-1:0.0: submitting int urb failed (-90)
[  254.334607][  T120] ucan 2-1:0.0: probe with driver ucan failed with error -71
[  254.367678][  T120] usb 2-1: USB disconnect, device number 34
[  255.018224][ T5866] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -71
[  255.072444][ T5866] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -22
[  255.101702][ T5866] usb 4-1: USB disconnect, device number 45
[  255.239804][T10304] /dev/rnullb0: Can't open blockdev
[  255.254518][T10306] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1417'.
[  255.264039][T10306] openvswitch: netlink: Missing key (keys=40, expected=100)
[  255.298670][T10309] netlink: 144 bytes leftover after parsing attributes in process `syz.1.1418'.
[  255.315740][T10308] netlink: 144 bytes leftover after parsing attributes in process `syz.1.1418'.
[  255.765512][T10316] netlink: 2384 bytes leftover after parsing attributes in process `syz.3.1421'.
[  255.778944][T10317] /dev/rnullb0: Can't open blockdev
[  255.886029][ T1306] ieee802154 phy1 wpan1: encryption failed: -22
[  255.995073][   T30] audit: type=1326 audit(1754583949.113:622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10322 comm="syz.3.1423" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f419e38ebe9 code=0x0
[  256.054101][T10324] vxcan1: entered promiscuous mode
[  256.065801][T10324] vxcan1: entered allmulticast mode
[  256.338648][T10336] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1427'.
[  256.383669][T10338] netlink: 'syz.2.1428': attribute type 29 has an invalid length.
[  256.393985][T10338] netlink: 'syz.2.1428': attribute type 29 has an invalid length.
[  256.440348][ T5866] usb 2-1: new high-speed USB device number 35 using dummy_hcd
[  256.590636][ T5866] usb 2-1: Using ep0 maxpacket: 8
[  256.604087][ T5866] usb 2-1: unable to get BOS descriptor or descriptor too short
[  256.613621][ T5866] usb 2-1: config 1 interface 0 has no altsetting 0
[  256.623475][ T5866] usb 2-1: New USB device found, idVendor=05ac, idProduct=024e, bcdDevice= 0.40
[  256.633142][ T5866] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  256.641537][ T5866] usb 2-1: Product: syz
[  256.645796][ T5866] usb 2-1: Manufacturer: syz
[  256.650776][ T5866] usb 2-1: SerialNumber: syz
[  256.854400][T10344] FAULT_INJECTION: forcing a failure.
[  256.854400][T10344] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  256.869290][T10344] CPU: 1 UID: 0 PID: 10344 Comm: syz.3.1430 Not tainted 6.16.0-next-20250807-syzkaller #0 PREEMPT(full) 
[  256.869318][T10344] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  256.869330][T10344] Call Trace:
[  256.869338][T10344]  <TASK>
[  256.869345][T10344]  dump_stack_lvl+0x189/0x250
[  256.869377][T10344]  ? __pfx____ratelimit+0x10/0x10
[  256.869405][T10344]  ? __pfx_dump_stack_lvl+0x10/0x10
[  256.869433][T10344]  ? __pfx__printk+0x10/0x10
[  256.869472][T10344]  should_fail_ex+0x414/0x560
[  256.869502][T10344]  _copy_to_user+0x31/0xb0
[  256.869527][T10344]  simple_read_from_buffer+0xe1/0x170
[  256.869556][T10344]  proc_fail_nth_read+0x1b3/0x220
[  256.869579][T10344]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  256.869601][T10344]  ? rw_verify_area+0x2a6/0x4d0
[  256.869622][T10344]  ? __lock_acquire+0xab9/0xd20
[  256.869641][T10344]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  256.869662][T10344]  vfs_read+0x1fd/0xa30
[  256.869683][T10344]  ? fdget_pos+0x247/0x320
[  256.869713][T10344]  ? __pfx___mutex_lock+0x10/0x10
[  256.869742][T10344]  ? __pfx_vfs_read+0x10/0x10
[  256.869766][T10344]  ? __fget_files+0x2a/0x420
[  256.869796][T10344]  ? __fget_files+0x3a0/0x420
[  256.869820][T10344]  ? __fget_files+0x2a/0x420
[  256.869855][T10344]  ksys_read+0x145/0x250
[  256.869879][T10344]  ? __pfx_ksys_read+0x10/0x10
[  256.869907][T10344]  ? do_syscall_64+0xbe/0x3b0
[  256.869928][T10344]  do_syscall_64+0xfa/0x3b0
[  256.869944][T10344]  ? lockdep_hardirqs_on+0x9c/0x150
[  256.869970][T10344]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  256.869989][T10344]  ? clear_bhb_loop+0x60/0xb0
[  256.870013][T10344]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  256.870031][T10344] RIP: 0033:0x7f419e38d5fc
[  256.870049][T10344] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48
[  256.870066][T10344] RSP: 002b:00007f419f1de030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  256.870086][T10344] RAX: ffffffffffffffda RBX: 00007f419e5b5fa0 RCX: 00007f419e38d5fc
[  256.870100][T10344] RDX: 000000000000000f RSI: 00007f419f1de0a0 RDI: 0000000000000003
[  256.870111][T10344] RBP: 00007f419f1de090 R08: 0000000000000000 R09: 0000000000000000
[  256.870123][T10344] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  256.870134][T10344] R13: 00007f419e5b6038 R14: 00007f419e5b5fa0 R15: 00007ffe1e71ed88
[  256.870164][T10344]  </TASK>
[  256.878475][ T5866] input: bcm5974 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/input/input19
[  257.139919][ T5220] bcm5974 2-1:1.0: could not read from device
[  257.167663][ T5220] bcm5974 2-1:1.0: could not read from device
[  257.177941][ T5866] usb 2-1: USB disconnect, device number 35
[  257.186978][ T5220] bcm5974 2-1:1.0: could not read from device
[  257.305356][T10356] MTD: Attempt to mount non-MTD device "/dev/rnullb0"
[  257.313897][T10356] /dev/rnullb0: Can't open blockdev
[  257.425018][T10363] /dev/rnullb0: Can't open blockdev
[  257.479215][T10365] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1439'.
[  257.505449][T10367] overlayfs: upper fs does not support RENAME_WHITEOUT.
[  257.516746][T10367] overlayfs: failed to set xattr on upper
[  257.523257][T10367] overlayfs: ...falling back to redirect_dir=nofollow.
[  257.534768][T10367] overlayfs: ...falling back to index=off.
[  257.541994][T10367] overlayfs: ...falling back to uuid=null.
[  257.549458][T10367] overlayfs: failed to clone lowerpath
[  258.117830][T10387] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1447'.
[  258.128443][T10387] openvswitch: netlink: nsh attribute has 13 unknown bytes.
[  258.136390][T10387] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  258.147473][T10387] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  259.372373][T10403] /dev/rnullb0: Can't open blockdev
[  259.828367][T10415] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1458'.
[  259.906048][T10418] /dev/rnullb0: Can't lookup blockdev
[  260.994153][T10451] openvswitch: netlink: IP tunnel dst address not specified
[  261.694560][T10470] /dev/rnullb0: Can't open blockdev
[  261.787362][T10472] /dev/rnullb0: Can't open blockdev
[  261.933233][T10476] openvswitch: netlink: IP tunnel dst address not specified
[  262.319872][T10491] program syz.0.1487 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  263.011959][ T5866] usb 2-1: new full-speed USB device number 36 using dummy_hcd
[  263.192903][ T5866] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  263.219705][ T5866] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E
[  263.235282][ T5866] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10
[  263.247528][ T5866] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0
[  263.258724][ T5866] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  263.276276][ T5866] usb 2-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46
[  263.290455][ T5866] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35
[  263.309178][ T5866] usb 2-1: Product: syz
[  263.313781][ T5866] usb 2-1: Manufacturer: syz
[  263.318397][ T5866] usb 2-1: SerialNumber: syz
[  263.364743][ T5866] usb 2-1: config 0 descriptor??
[  263.513163][T10518] /dev/rnullb0: Can't open blockdev
[  263.590441][ T5866] radio-si470x 2-1:0.0: DeviceID=0x0000 ChipID=0x0000
[  263.619321][ T5866] radio-si470x 2-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0.
[  263.638963][T10527] loop2: detected capacity change from 0 to 7
[  263.649401][T10527] Dev loop2: unable to read RDB block 7
[  263.656224][T10527]  loop2: unable to read partition table
[  263.665585][T10527] loop2: partition table beyond EOD, truncated
[  263.673419][T10527] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5)
[  263.789461][ T5866] radio-si470x 2-1:0.0: software version 0, hardware version 0
[  263.807406][T10532] netlink: 88 bytes leftover after parsing attributes in process `syz.0.1501'.
[  263.809360][ T5866] radio-si470x 2-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0.
[  263.851180][ T5866] radio-si470x 2-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org
[  263.978820][T10539] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1504'.
[  263.990022][ T5866] radio-si470x 2-1:0.0: submitting int urb failed (-90)
[  264.170283][   T10] usb 4-1: new high-speed USB device number 46 using dummy_hcd
[  264.320297][   T10] usb 4-1: Using ep0 maxpacket: 16
[  264.330790][   T10] usb 4-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice=10.00
[  264.340003][   T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  264.348432][   T10] usb 4-1: Product: syz
[  264.354189][   T10] usb 4-1: Manufacturer: syz
[  264.358864][   T10] usb 4-1: SerialNumber: syz
[  264.367277][   T10] usb 4-1: config 0 descriptor??
[  264.375647][   T10] ftdi_sio 4-1:0.0: FTDI USB Serial Device converter detected
[  264.384869][   T10] usb 4-1: Detected FT-X
[  264.578545][   T10] ftdi_sio ttyUSB0: Unable to read latency timer: -71
[  264.587992][   T10] ftdi_sio ttyUSB0: Unable to write latency timer: -71
[  264.601171][   T10] ftdi_sio 4-1:0.0: GPIO initialisation failed: -71
[  264.608089][ T5866] radio-si470x 2-1:0.0: si470x_set_report: usb_control_msg returned -71
[  264.617509][ T5866] radio-si470x 2-1:0.0: probe with driver radio-si470x failed with error -22
[  264.628632][   T10] usb 4-1: FTDI USB Serial Device converter now attached to ttyUSB0
[  264.641713][   T10] usb 4-1: USB disconnect, device number 46
[  264.661787][ T5866] usb 2-1: USB disconnect, device number 36
[  264.671538][   T10] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0
[  264.696748][   T10] ftdi_sio 4-1:0.0: device disconnected
[  265.266695][T10559] loop2: detected capacity change from 0 to 7
[  265.277669][T10559] Dev loop2: unable to read RDB block 7
[  265.289466][T10559]  loop2: unable to read partition table
[  265.296922][T10559] loop2: partition table beyond EOD, truncated
[  265.305798][T10559] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5)
[  265.479457][T10566] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1513'.
[  265.618672][T10563] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  265.639030][T10563] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  265.690528][ T5866] usb 2-1: new high-speed USB device number 37 using dummy_hcd
[  266.598903][T10598] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1522'.
[  266.730399][ T5866] usb 2-1: device descriptor read/64, error -71
[  266.970661][ T5866] usb 2-1: new high-speed USB device number 38 using dummy_hcd
[  267.021275][T10607] /dev/rnullb0: Can't open blockdev
[  267.090399][   T43] usb 4-1: new high-speed USB device number 47 using dummy_hcd
[  267.133337][ T5866] usb 2-1: Using ep0 maxpacket: 32
[  267.140666][ T5866] usb 2-1: config 0 has an invalid interface number: 67 but max is 0
[  267.149294][ T5866] usb 2-1: config 0 has no interface number 0
[  267.164811][ T5866] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57
[  267.188132][ T5866] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  267.208410][ T5866] usb 2-1: Product: syz
[  267.213095][ T5866] usb 2-1: Manufacturer: syz
[  267.218993][ T5866] usb 2-1: SerialNumber: syz
[  267.231233][ T5866] usb 2-1: config 0 descriptor??
[  267.243466][ T5866] smsc95xx v2.0.0
[  267.246368][   T43] usb 4-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36
[  267.267953][   T43] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  267.284936][   T43] usb 4-1: Product: syz
[  267.292750][   T43] usb 4-1: Manufacturer: syz
[  267.299559][   T43] usb 4-1: SerialNumber: syz
[  267.308283][   T43] usb 4-1: config 0 descriptor??
[  267.316614][   T43] ch341 4-1:0.0: ch341-uart converter detected
[  267.564560][   T43] usb 4-1: failed to send control message: -71
[  267.600514][   T43] ch341-uart ttyUSB0: probe with driver ch341-uart failed with error -71
[  267.621668][   T43] usb 4-1: USB disconnect, device number 47
[  267.642449][   T43] ch341 4-1:0.0: device disconnected
[  267.649650][ T5866] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32
[  267.684111][ T5866] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  268.890429][ T5912] usb 4-1: new full-speed USB device number 48 using dummy_hcd
[  268.902888][ T5866] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61
[  268.915793][ T5866] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -61
[  269.062025][ T5912] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  269.073133][ T5912] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E
[  269.084911][ T5912] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10
[  269.096243][ T5912] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0
[  269.107179][ T5912] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  269.122455][ T5912] usb 4-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46
[  269.131864][ T5912] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35
[  269.139963][ T5912] usb 4-1: Product: syz
[  269.144410][ T5912] usb 4-1: Manufacturer: syz
[  269.149030][ T5912] usb 4-1: SerialNumber: syz
[  269.157326][ T5912] usb 4-1: config 0 descriptor??
[  269.368794][ T5912] radio-si470x 4-1:0.0: DeviceID=0x0000 ChipID=0x0000
[  269.377297][ T5912] radio-si470x 4-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0.
[  269.570035][ T5912] radio-si470x 4-1:0.0: software version 0, hardware version 0
[  269.578774][ T5912] radio-si470x 4-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0.
[  269.591488][ T5912] radio-si470x 4-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org
[  269.771135][ T5912] radio-si470x 4-1:0.0: submitting int urb failed (-90)
[  270.134979][ T5968] usb 2-1: USB disconnect, device number 38
[  270.586647][ T5912] radio-si470x 4-1:0.0: si470x_get_report: usb_control_msg returned -71
[  270.610716][ T5912] radio-si470x 4-1:0.0: probe with driver radio-si470x failed with error -22
[  270.625747][ T5912] usb 4-1: USB disconnect, device number 48
[  271.420361][ T5912] usb 4-1: new high-speed USB device number 49 using dummy_hcd
[  271.590458][ T5912] usb 4-1: Using ep0 maxpacket: 32
[  271.607592][ T5912] usb 4-1: config 0 has an invalid interface number: 67 but max is 0
[  271.623206][ T5912] usb 4-1: config 0 has no interface number 0
[  271.632031][ T5912] usb 4-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57
[  271.650410][ T5912] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  271.666617][ T5912] usb 4-1: Product: syz
[  271.676281][ T5912] usb 4-1: Manufacturer: syz
[  271.680980][ T5912] usb 4-1: SerialNumber: syz
[  271.694148][ T5912] usb 4-1: config 0 descriptor??
[  271.709862][ T5912] smsc95xx v2.0.0
[  271.916111][T10687] IPv6: syztnl0: Disabled Multicast RS
[  272.111600][ T5912] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32
[  272.142405][ T5912] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD
[  272.426569][T10712] netlink: 108 bytes leftover after parsing attributes in process `syz.2.1558'.
[  272.528835][T10717] fuse: Unknown parameter 'user00000000000000000000'
[  273.313243][ T5868] Bluetooth: hci3: command 0x0405 tx timeout
[  273.365088][ T5912] smsc95xx 4-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61
[  273.395909][ T5912] smsc95xx 4-1:0.67: probe with driver smsc95xx failed with error -61
[  273.694198][    C1] 
[  273.696565][    C1] =============================
[  273.701411][    C1] [ BUG: Invalid wait context ]
[  273.706349][    C1] 6.16.0-next-20250807-syzkaller #0 Not tainted
[  273.712672][    C1] -----------------------------
[  273.717497][    C1] modprobe/10744 is trying to lock:
[  273.722671][    C1] ffff88807cc9d410 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1fb/0x9b0
[  273.732149][    C1] other info that might help us debug this:
[  273.738381][    C1] context-{2:2}
[  273.741828][    C1] 2 locks held by modprobe/10744:
[  273.746833][    C1]  #0: ffff88807b6de2a0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x211/0x4d0
[  273.756229][    C1]  #1: ffff88807cc9d960 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1c3/0x9b0
[  273.766232][    C1] stack backtrace:
[  273.769943][    C1] CPU: 1 UID: 0 PID: 10744 Comm: modprobe Not tainted 6.16.0-next-20250807-syzkaller #0 PREEMPT(full) 
[  273.769962][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
[  273.769972][    C1] Call Trace:
[  273.769978][    C1]  <IRQ>
[  273.769985][    C1]  dump_stack_lvl+0x189/0x250
[  273.770009][    C1]  ? __pfx_dump_stack_lvl+0x10/0x10
[  273.770030][    C1]  ? __pfx__printk+0x10/0x10
[  273.770051][    C1]  ? print_lock_name+0xde/0x100
[  273.770072][    C1]  __lock_acquire+0xbcb/0xd20
[  273.770091][    C1]  ? kvm_xen_set_evtchn_fast+0x1fb/0x9b0
[  273.770110][    C1]  lock_acquire+0x120/0x360
[  273.770125][    C1]  ? kvm_xen_set_evtchn_fast+0x1fb/0x9b0
[  273.770148][    C1]  _raw_read_lock_irqsave+0xaf/0x100
[  273.770169][    C1]  ? kvm_xen_set_evtchn_fast+0x1fb/0x9b0
[  273.770188][    C1]  ? __pfx__raw_read_lock_irqsave+0x10/0x10
[  273.770209][    C1]  ? xa_load+0x1ea/0x210
[  273.770227][    C1]  kvm_xen_set_evtchn_fast+0x1fb/0x9b0
[  273.770247][    C1]  ? do_raw_spin_unlock+0x122/0x240
[  273.770268][    C1]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  273.770288][    C1]  ? kvm_xen_set_evtchn_fast+0x1c3/0x9b0
[  273.770310][    C1]  xen_timer_callback+0x109/0x220
[  273.770333][    C1]  ? __pfx_xen_timer_callback+0x10/0x10
[  273.770355][    C1]  __hrtimer_run_queues+0x4e0/0xc60
[  273.770384][    C1]  ? __pfx___hrtimer_run_queues+0x10/0x10
[  273.770406][    C1]  ? read_tsc+0x9/0x20
[  273.770428][    C1]  hrtimer_interrupt+0x45b/0xaa0
[  273.770459][    C1]  __sysvec_apic_timer_interrupt+0x108/0x410
[  273.770485][    C1]  sysvec_apic_timer_interrupt+0xa1/0xc0
[  273.770508][    C1]  </IRQ>
[  273.770514][    C1]  <TASK>
[  273.770519][    C1]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[  273.770535][    C1] RIP: 0010:lock_is_held_type+0x137/0x190
[  273.770557][    C1] Code: 01 75 44 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 75 4c 41 f7 c4 00 02 00 00 74 01 fb 65 48 8b 05 39 e7 61 07 <48> 3b 44 24 08 75 43 89 d8 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f
[  273.770570][    C1] RSP: 0018:ffffc90003edf478 EFLAGS: 00000206
[  273.770590][    C1] RAX: cb205fa98a929800 RBX: 0000000000000000 RCX: cb205fa98a929800
[  273.770601][    C1] RDX: 0000000000000000 RSI: ffffffff8de84af2 RDI: ffffffff8c04d300
[  273.770612][    C1] RBP: 00000000ffffffff R08: ffff8880793a5a00 R09: 0000000000000004
[  273.770622][    C1] R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000246
[  273.770631][    C1] R13: ffff8880793a5a00 R14: ffffffff8e539f40 R15: 0000000000000001
[  273.770650][    C1]  __might_resched+0xa6/0x610
[  273.770668][    C1]  ? mas_next_slot+0xc20/0xcf0
[  273.770687][    C1]  ? __pfx___might_resched+0x10/0x10
[  273.770710][    C1]  down_read+0x22/0x2e0
[  273.770725][    C1]  validate_mm+0x1d4/0x4b0
[  273.770745][    C1]  ? __pfx_validate_mm+0x10/0x10
[  273.770765][    C1]  ? __pfx_uprobe_mmap+0x10/0x10
[  273.770784][    C1]  ? vma_wants_writenotify+0xb3/0x2a0
[  273.770805][    C1]  ? vma_set_page_prot+0xc3/0x100
[  273.770827][    C1]  mmap_region+0x15a5/0x20c0
[  273.770854][    C1]  ? __pfx_mmap_region+0x10/0x10
[  273.770873][    C1]  ? unmapped_area_topdown+0x571/0x590
[  273.770914][    C1]  ? mm_get_unmapped_area_vmflags+0xb3/0xe0
[  273.770933][    C1]  ? bpf_lsm_mmap_addr+0x9/0x20
[  273.770946][    C1]  ? security_mmap_addr+0x71/0x270
[  273.770963][    C1]  ? shmem_mapping+0xd/0x50
[  273.770982][    C1]  ? memfd_check_seals_mmap+0xc5/0x200
[  273.771005][    C1]  do_mmap+0xc45/0x10d0
[  273.771022][    C1]  ? __pfx_do_mmap+0x10/0x10
[  273.771033][    C1]  ? down_write_killable+0x178/0x230
[  273.771049][    C1]  ? __pfx_down_write_killable+0x10/0x10
[  273.771063][    C1]  ? common_file_perm+0x1b5/0x230
[  273.771085][    C1]  vm_mmap_pgoff+0x2a6/0x4d0
[  273.771108][    C1]  ? __pfx_vm_mmap_pgoff+0x10/0x10
[  273.771129][    C1]  ? __fget_files+0x2a/0x420
[  273.771149][    C1]  ? __fget_files+0x3a0/0x420
[  273.771167][    C1]  ? __fget_files+0x2a/0x420
[  273.771187][    C1]  ksys_mmap_pgoff+0x51f/0x760
[  273.771202][    C1]  do_syscall_64+0xfa/0x3b0
[  273.771215][    C1]  ? lockdep_hardirqs_on+0x9c/0x150
[  273.771235][    C1]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  273.771249][    C1]  ? clear_bhb_loop+0x60/0xb0
[  273.771265][    C1]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  273.771279][    C1] RIP: 0033:0x7f4fd9bfb242
[  273.771292][    C1] Code: 08 00 04 00 00 eb e2 90 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 33 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5e 5b 5d c3 0f 1f 00 c7 05 46 40 01 00 16 00
[  273.771305][    C1] RSP: 002b:00007ffcc8a34688 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[  273.771319][    C1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4fd9bfb242
[  273.771329][    C1] RDX: 0000000000000001 RSI: 0000000000061018 RDI: 0000000000000000
[  273.771338][    C1] RBP: 0000000000000802 R08: 0000000000000000 R09: 0000000000000000
[  273.771347][    C1] R10: 0000000000000802 R11: 0000000000000246 R12: 0000000000000000
[  273.771356][    C1] R13: 00007f4fd98d26b0 R14: 00007ffcc8a34ac0 R15: 00000fff991468d4
[  273.771373][    C1]  </TASK>
[  274.606702][ T5912] usb 4-1: USB disconnect, device number 49