last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.4' (ED25519) to the list of known hosts.
[ 68.077860][ T5808] cgroup: Unknown subsys name 'net'
[ 68.169610][ T5808] cgroup: Unknown subsys name 'cpuset'
[ 68.178113][ T5808] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 69.587302][ T5808] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 71.474916][ T1298] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.481570][ T1298] ieee802154 phy1 wpan1: encryption failed: -22
[ 71.577585][ T5821] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 71.586129][ T5821] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 71.594179][ T5821] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 71.602355][ T5821] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 71.610151][ T5821] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 71.659972][ T5145] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 71.669167][ T5145] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 71.677577][ T5145] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 71.693502][ T5831] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 71.700913][ T5831] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 71.710258][ T5834] ==================================================================
[ 71.710637][ T5825] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 71.718367][ T5834] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 71.718402][ T5834] Read of size 2 at addr ffff88805deeb038 by task kworker/u9:5/5834
[ 71.718414][ T5834]
[ 71.718438][ T5834] CPU: 1 UID: 0 PID: 5834 Comm: kworker/u9:5 Not tainted syzkaller #0 PREEMPT(full)
[ 71.718456][ T5834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 71.718465][ T5834] Workqueue: hci2 hci_cmd_work
[ 71.718491][ T5834] Call Trace:
[ 71.718499][ T5834]
[ 71.718506][ T5834] dump_stack_lvl+0x189/0x250
[ 71.718525][ T5834] ? __virt_addr_valid+0x1c8/0x5c0
[ 71.718539][ T5834] ? rcu_is_watching+0x15/0xb0
[ 71.718553][ T5834] ? __pfx_dump_stack_lvl+0x10/0x10
[ 71.718574][ T5834] ? rcu_is_watching+0x15/0xb0
[ 71.718589][ T5834] ? lock_release+0x4b/0x3d0
[ 71.718607][ T5834] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 71.718624][ T5834] ? __virt_addr_valid+0x1c8/0x5c0
[ 71.718640][ T5834] ? __virt_addr_valid+0x4a5/0x5c0
[ 71.718656][ T5834] print_report+0xca/0x240
[ 71.718676][ T5834] ? hci_cmd_work+0x5d0/0x7b0
[ 71.718693][ T5834] kasan_report+0x118/0x150
[ 71.718714][ T5834] ? hci_cmd_work+0x5d0/0x7b0
[ 71.718734][ T5834] hci_cmd_work+0x5d0/0x7b0
[ 71.718754][ T5834] ? process_one_work+0x868/0x15e0
[ 71.718773][ T5834] process_one_work+0x93a/0x15e0
[ 71.718791][ T5834] ? __lock_acquire+0xab9/0xd20
[ 71.718817][ T5834] ? __pfx_process_one_work+0x10/0x10
[ 71.718839][ T5834] ? assign_work+0x3a1/0x410
[ 71.718860][ T5834] worker_thread+0x9b0/0xee0
[ 71.718890][ T5834] kthread+0x711/0x8a0
[ 71.718906][ T5834] ? __pfx_worker_thread+0x10/0x10
[ 71.718925][ T5834] ? __pfx_kthread+0x10/0x10
[ 71.718939][ T5834] ? _raw_spin_unlock_irq+0x23/0x50
[ 71.718955][ T5834] ? lockdep_hardirqs_on+0x9c/0x150
[ 71.718972][ T5834] ? __pfx_kthread+0x10/0x10
[ 71.718986][ T5834] ret_from_fork+0x599/0xb30
[ 71.719007][ T5834] ? __pfx_ret_from_fork+0x10/0x10
[ 71.719029][ T5834] ? __switch_to_asm+0x39/0x70
[ 71.719043][ T5834] ? __switch_to_asm+0x33/0x70
[ 71.719057][ T5834] ? __pfx_kthread+0x10/0x10
[ 71.719072][ T5834] ret_from_fork_asm+0x1a/0x30
[ 71.719095][ T5834]
[ 71.719101][ T5834]
[ 71.728102][ T5825] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 71.732886][ T5834] Allocated by task 52:
[ 71.742308][ T5825] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[ 71.743165][ T5834] kasan_save_track+0x3e/0x80
[ 71.754048][ T5825] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 71.762689][ T5834] __kasan_slab_alloc+0x6c/0x80
[ 71.762716][ T5834] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 71.762729][ T5834] __alloc_skb+0x112/0x2d0
[ 71.762748][ T5834] hci_cmd_sync_alloc+0x3d/0x3b0
[ 71.762762][ T5834] __hci_cmd_sync_sk+0x1a7/0xc70
[ 71.762776][ T5834] hci_dev_open_sync+0x163e/0x2dc0
[ 71.762788][ T5834] hci_power_on+0x1b4/0x720
[ 71.762803][ T5834] process_one_work+0x93a/0x15e0
[ 71.762819][ T5834] worker_thread+0x9b0/0xee0
[ 71.762836][ T5834] kthread+0x711/0x8a0
[ 72.010092][ T5834] ret_from_fork+0x599/0xb30
[ 72.014682][ T5834] ret_from_fork_asm+0x1a/0x30
[ 72.019439][ T5834]
[ 72.021752][ T5834] Freed by task 5826:
[ 72.025712][ T5834] kasan_save_track+0x3e/0x80
[ 72.030378][ T5834] kasan_save_free_info+0x46/0x50
[ 72.035396][ T5834] __kasan_slab_free+0x5c/0x80
[ 72.040151][ T5834] kmem_cache_free+0x197/0x640
[ 72.044906][ T5834] vhci_read+0x49a/0x5b0
[ 72.049137][ T5834] vfs_read+0x200/0xa30
[ 72.053278][ T5834] ksys_read+0x145/0x250
[ 72.057506][ T5834] do_syscall_64+0xfa/0xfa0
[ 72.062087][ T5834] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 72.067967][ T5834]
[ 72.070362][ T5834] The buggy address belongs to the object at ffff88805deeb000
[ 72.070362][ T5834] which belongs to the cache skbuff_head_cache of size 240
[ 72.084924][ T5834] The buggy address is located 56 bytes inside of
[ 72.084924][ T5834] freed 240-byte region [ffff88805deeb000, ffff88805deeb0f0)
[ 72.098624][ T5834]
[ 72.100938][ T5834] The buggy address belongs to the physical page:
[ 72.107344][ T5834] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5deeb
[ 72.116098][ T5834] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 72.123199][ T5834] page_type: f5(slab)
[ 72.127169][ T5834] raw: 00fff00000000000 ffff88801e2cea00 dead000000000122 0000000000000000
[ 72.135739][ T5834] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000
[ 72.144305][ T5834] page dumped because: kasan: bad access detected
[ 72.150716][ T5834] page_owner tracks the page as allocated
[ 72.156416][ T5834] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 52, tgid 52 (kworker/u9:0), ts 71709057102, free_ts 21611718672
[ 72.175333][ T5834] post_alloc_hook+0x240/0x2a0
[ 72.180090][ T5834] get_page_from_freelist+0x2365/0x2440
[ 72.185623][ T5834] __alloc_frozen_pages_noprof+0x181/0x370
[ 72.191419][ T5834] alloc_pages_mpol+0x232/0x4a0
[ 72.196260][ T5834] allocate_slab+0x86/0x3b0
[ 72.200757][ T5834] ___slab_alloc+0xf56/0x1990
[ 72.205424][ T5834] __slab_alloc+0x65/0x100
[ 72.209828][ T5834] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 72.215725][ T5834] __alloc_skb+0x112/0x2d0
[ 72.220146][ T5834] hci_cmd_sync_alloc+0x3d/0x3b0
[ 72.225077][ T5834] __hci_cmd_sync_sk+0x1a7/0xc70
[ 72.230013][ T5834] hci_dev_open_sync+0x163e/0x2dc0
[ 72.235110][ T5834] hci_power_on+0x1b4/0x720
[ 72.239606][ T5834] process_one_work+0x93a/0x15e0
[ 72.244535][ T5834] worker_thread+0x9b0/0xee0
[ 72.249114][ T5834] kthread+0x711/0x8a0
[ 72.253171][ T5834] page last free pid 1 tgid 1 stack trace:
[ 72.258960][ T5834] __free_frozen_pages+0xbc8/0xd30
[ 72.264064][ T5834] free_contig_range+0x1bd/0x4a0
[ 72.268993][ T5834] destroy_args+0x69/0x660
[ 72.273405][ T5834] debug_vm_pgtable+0x38f/0x3a0
[ 72.278247][ T5834] do_one_initcall+0x1fb/0x870
[ 72.283001][ T5834] do_initcall_level+0x104/0x190
[ 72.287932][ T5834] do_initcalls+0x59/0xa0
[ 72.292251][ T5834] kernel_init_freeable+0x334/0x4b0
[ 72.297440][ T5834] kernel_init+0x1d/0x1d0
[ 72.301761][ T5834] ret_from_fork+0x599/0xb30
[ 72.306341][ T5834] ret_from_fork_asm+0x1a/0x30
[ 72.311102][ T5834]
[ 72.313414][ T5834] Memory state around the buggy address:
[ 72.319030][ T5834] ffff88805deeaf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 72.327077][ T5834] ffff88805deeaf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 72.335125][ T5834] >ffff88805deeb000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 72.343179][ T5834] ^
[ 72.349055][ T5834] ffff88805deeb080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 72.357111][ T5834] ffff88805deeb100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[ 72.365169][ T5834] ==================================================================
[ 72.382045][ T5835] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[ 72.389814][ T5834] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 72.397047][ T5834] CPU: 1 UID: 0 PID: 5834 Comm: kworker/u9:5 Not tainted syzkaller #0 PREEMPT(full)
[ 72.406511][ T5834] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 72.416577][ T5834] Workqueue: hci2 hci_cmd_work
[ 72.421369][ T5834] Call Trace:
[ 72.424663][ T5834]
[ 72.427590][ T5834] dump_stack_lvl+0x99/0x250
[ 72.432180][ T5834] ? __asan_memcpy+0x40/0x70
[ 72.436768][ T5834] ? __pfx_dump_stack_lvl+0x10/0x10
[ 72.441962][ T5834] ? __pfx__printk+0x10/0x10
[ 72.446550][ T5834] vpanic+0x237/0x6d0
[ 72.450535][ T5834] ? __pfx_vpanic+0x10/0x10
[ 72.455029][ T5834] ? preempt_schedule+0xae/0xc0
[ 72.459871][ T5834] ? __pfx_preempt_schedule+0x10/0x10
[ 72.465240][ T5834] panic+0xb9/0xc0
[ 72.468950][ T5834] ? __pfx_panic+0x10/0x10
[ 72.473358][ T5834] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 72.479245][ T5834] ? is_module_address+0x17/0xf0
[ 72.484177][ T5834] ? hci_cmd_work+0x5d0/0x7b0
[ 72.488850][ T5834] check_panic_on_warn+0x89/0xb0
[ 72.493780][ T5834] ? hci_cmd_work+0x5d0/0x7b0
[ 72.498454][ T5834] end_report+0x6f/0x160
[ 72.502692][ T5834] kasan_report+0x129/0x150
[ 72.507190][ T5834] ? hci_cmd_work+0x5d0/0x7b0
[ 72.511861][ T5834] hci_cmd_work+0x5d0/0x7b0
[ 72.516359][ T5834] ? process_one_work+0x868/0x15e0
[ 72.521495][ T5834] process_one_work+0x93a/0x15e0
[ 72.526424][ T5834] ? __lock_acquire+0xab9/0xd20
[ 72.531277][ T5834] ? __pfx_process_one_work+0x10/0x10
[ 72.536653][ T5834] ? assign_work+0x3a1/0x410
[ 72.541237][ T5834] worker_thread+0x9b0/0xee0
[ 72.545831][ T5834] kthread+0x711/0x8a0
[ 72.549890][ T5834] ? __pfx_worker_thread+0x10/0x10
[ 72.554994][ T5834] ? __pfx_kthread+0x10/0x10
[ 72.559576][ T5834] ? _raw_spin_unlock_irq+0x23/0x50
[ 72.564764][ T5834] ? lockdep_hardirqs_on+0x9c/0x150
[ 72.569952][ T5834] ? __pfx_kthread+0x10/0x10
[ 72.574530][ T5834] ret_from_fork+0x599/0xb30
[ 72.579118][ T5834] ? __pfx_ret_from_fork+0x10/0x10
[ 72.584223][ T5834] ? __switch_to_asm+0x39/0x70
[ 72.589062][ T5834] ? __switch_to_asm+0x33/0x70
[ 72.593814][ T5834] ? __pfx_kthread+0x10/0x10
[ 72.598406][ T5834] ret_from_fork_asm+0x1a/0x30
[ 72.603169][ T5834]
[ 72.606650][ T5834] Kernel Offset: disabled
[ 72.610966][ T5834] Rebooting in 86400 seconds..