last executing test programs:

5.443712535s ago: executing program 3 (id=8):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x10000000000)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x109000, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_GET_MSRS_cpu(r3, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{0x1c4, 0x0, 0x3}]})
munmap(&(0x7f00003fe000/0xc00000)=nil, 0xc00000)
r4 = gettid()
timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)=<r5=>0x0)
r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0)
mmap(&(0x7f000045b000/0x1000)=nil, 0x1000, 0x5, 0x10, r2, 0xc8a9000)
writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0, 0xff2b}], 0x2)
ioctl$SNDCTL_SEQ_SYNC(0xffffffffffffffff, 0x5101)
ioctl$BLKTRACESETUP(r6, 0x2288, 0x0)
r7 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000040), 0x21041, 0x0)
ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000000)=0xe)
ioctl$TIOCSTI(r7, 0x5412, &(0x7f00000000c0)=0xe)
r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
connect$bt_l2cap(r8, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002b40)=[{{&(0x7f0000000040)={0x2, 0x4e64, @local}, 0x10, 0x0}}], 0x1, 0x4c044)
r9 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0)
ioctl$sock_bt_bnep_BNEPCONNADD(r9, 0x400442c8, &(0x7f0000000040)=ANY=[@ANYRES32=r8])
r10 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00')
preadv(r10, &(0x7f0000000700)=[{&(0x7f0000000140)=""/82, 0x52}], 0x1, 0x4782, 0x7)
timer_settime(r5, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0)
r11 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0xb48c2, 0x0)
ioctl$UFFDIO_POISON(r11, 0xc020aa08, &(0x7f0000000180)={{&(0x7f0000edb000/0x1000)=nil, 0x1000}})
getrandom(&(0x7f0000000040)=""/293, 0xfffffffffffffe2a, 0x2)

4.138956623s ago: executing program 3 (id=14):
r0 = socket$nl_sock_diag(0x10, 0x3, 0x4)
r1 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000006480)={0x30, 0x13, 0x1, 0x2, 0x25dfdbf6, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x13\x00\x00'}, @typed={0x8, 0x3fff, 0x0, 0x0, @fd}, @nested={0x10, 0x1a, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x22, 0x0, 0x0, @uid=0xffffffffffffffff}]}]}]}, 0x30}], 0x1}, 0x0)
r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$L2TP_CMD_NOOP(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r2, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x46d}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x9}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x80)
r3 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10)
listen(r3, 0x9)
r4 = socket$inet_sctp(0x2, 0x5, 0x84)
sendto$inet(r4, &(0x7f00000000c0)="ab", 0xfffd, 0xc1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10)
readv(r0, &(0x7f0000000e00)=[{&(0x7f00000003c0)=""/153, 0x99}], 0x1)
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000140011f225bd7000fddbcf250284", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0x40)
socket$nl_sock_diag(0x10, 0x3, 0x4) (async)
socket$netlink(0x10, 0x3, 0x0) (async)
sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000006480)={0x30, 0x13, 0x1, 0x2, 0x25dfdbf6, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x13\x00\x00'}, @typed={0x8, 0x3fff, 0x0, 0x0, @fd}, @nested={0x10, 0x1a, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x22, 0x0, 0x0, @uid=0xffffffffffffffff}]}]}]}, 0x30}], 0x1}, 0x0) (async)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async)
sendmsg$L2TP_CMD_NOOP(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r2, 0x100, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x46d}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x9}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x9}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) (async)
socket$inet_sctp(0x2, 0x1, 0x84) (async)
bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) (async)
listen(r3, 0x9) (async)
socket$inet_sctp(0x2, 0x5, 0x84) (async)
sendto$inet(r4, &(0x7f00000000c0)="ab", 0xfffd, 0xc1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10) (async)
readv(r0, &(0x7f0000000e00)=[{&(0x7f00000003c0)=""/153, 0x99}], 0x1) (async)
sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000140011f225bd7000fddbcf250284", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0x40) (async)

3.819553316s ago: executing program 3 (id=15):
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r0=>0xffffffffffffffff, {0x4}}, './file0\x00'})
ioctl$HIDIOCGPHYS(r0, 0x80404812, &(0x7f0000000040)) (async)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r0)
sendmsg$TIPC_NL_BEARER_GET(r0, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000400)={&(0x7f0000000100)={0x2fc, r1, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x10}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x16}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xc610bc2}]}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}]}, @TIPC_NLA_NODE={0x50, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3a4}, @TIPC_NLA_NODE_KEY={0x40, 0x4, {'gcm(aes)\x00', 0x18, "932235906a822724e66a9cc8272fc59d15e2d9d9807e03e4"}}]}, @TIPC_NLA_MEDIA={0xc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_BEARER={0xd4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x101, @dev={0xfe, 0x80, '\x00', 0xf}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4, @loopback}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x401}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe02}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xaaf8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4e2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}]}]}, @TIPC_NLA_NODE={0x14c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x1}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_KEY={0x42, 0x4, {'gcm(aes)\x00', 0x1a, "d535ffd0ad5d4fd44c273acfb9c3971bf0194b7f9aeae4a518a2"}}, @TIPC_NLA_NODE_ID={0x29, 0x3, "b5ecc9d6a264c3544948262dd02ca50d71347eadf6c516a87bacfe6c7d725cbe16eda1acf0"}, @TIPC_NLA_NODE_ID={0xb9, 0x3, "456a0c524d013a38f0ff0e673aa87990ebb500b73d2c298672384885a1e149c85ee1ff4b5648a5a0e089950aeb215c85e4d3d791bb7de3ca6141b49addfe29ecc39bb97876438588cb4fda3d1486e7bd6c0bf749bfcaf8599fe62124e7d944ffa29c1e691c4471a90efdb03f4beefe352a4b89b27dbe7ed5ea68ee8029570317e03597459b4c6e6b9162af524fcbb4be853e80dccd13d965d4ca54faca2aa8dd0882cbccc88a2bf85ee42fccecc73234fd709db625"}]}]}, 0x2fc}, 0x1, 0x0, 0x0, 0x20000800}, 0x8000) (async)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), r0) (async)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000500)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x34, r2, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x6, 0x45}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40) (async)
sendmsg$NL80211_CMD_ASSOCIATE(r0, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x74, r2, 0x8, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x3, 0x3}}}}, [@NL80211_ATTR_FILS_NONCES={0x24, 0xf3, [0x6, 0xffff, 0x7e, 0x49a, 0xf, 0xe, 0x3, 0x5, 0x8800, 0x0, 0x44, 0xa, 0xe0, 0x6, 0x8, 0x10]}, @NL80211_ATTR_MAC={0xa, 0x6, @random="2582665958c2"}, @NL80211_ATTR_FILS_NONCES={0x24, 0xf3, [0x8000, 0x209d, 0x5, 0x0, 0x0, 0x0, 0x8, 0xf, 0x84f1, 0x4, 0x800, 0x1, 0x6, 0xdf6, 0x4, 0xc3]}]}, 0x74}}, 0x0) (async)
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000780), r0)
sendmsg$TIPC_NL_NODE_GET(r0, &(0x7f0000000880)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000840)={&(0x7f00000007c0)={0x70, r4, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x18, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NET={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xa1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfffffffffffffffd}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xffffffffffff0c17}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xa5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3ff}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x801}, 0x24009010) (async)
r5 = openat$vmci(0xffffffffffffff9c, &(0x7f00000008c0), 0x2, 0x0) (async)
recvmsg$unix(r0, &(0x7f0000000a40)={&(0x7f0000000900)=@abs, 0x6e, &(0x7f00000009c0)=[{&(0x7f0000000980)=""/34, 0x22}], 0x1, &(0x7f0000000a00)=[@cred={{0x1c}}], 0x20}, 0x2)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000ac0)={'wlan1\x00', <r6=>0x0})
sendmsg$NL80211_CMD_SET_NOACK_MAP(r0, &(0x7f0000000bc0)={&(0x7f0000000a80), 0xc, &(0x7f0000000b80)={&(0x7f0000000b00)={0x54, r2, 0x20, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x2}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x9}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x9}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x8}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x6}, @NL80211_ATTR_NOACK_MAP={0x6, 0x95, 0x2d66}, @NL80211_ATTR_NOACK_MAP={0x6}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) (async)
ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000d00)={<r7=>r5, &(0x7f0000000c00)='[\x00', 0x894001, &(0x7f0000000c40)={@_ha_fsid={[0x4]}, {0x1, 0x1, 0x1, 0x2}}, 0xf, &(0x7f0000000c80)={@_ha_fsid}, &(0x7f0000000cc0)=0x7f})
sendmsg$NL80211_CMD_CONNECT(r7, &(0x7f0000000e00)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000d80)={0x30, r2, 0x200, 0x70bd25, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x7, 0x12}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@device_b}, @NL80211_ATTR_DISABLE_HT={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0xc800}, 0x800)
sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001040)={&(0x7f0000000e80)={0x184, r4, 0xe0e, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x50, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x4}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_LINK={0x78, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa5}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x530e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}]}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_BEARER_PROP={0x4}]}, @TIPC_NLA_BEARER={0x5c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x72}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'eth', 0x3a, 'wg2\x00'}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x168}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}]}, 0x184}, 0x1, 0x0, 0x0, 0x4004000}, 0x20000040)
mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x8)
r8 = syz_genetlink_get_family_id$smc(&(0x7f0000001100), 0xffffffffffffffff)
sendmsg$SMC_PNETID_ADD(r0, &(0x7f0000001200)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000011c0)={&(0x7f0000001140)={0x5c, r8, 0x10, 0x70bd25, 0x25dfdbff, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_macvtap\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_batadv\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0xc000) (async)
ioctl$FS_IOC_GETFSUUID(r0, 0x80111500, &(0x7f0000001240))
ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) (async)
sendmsg$NL80211_CMD_NEW_KEY(r7, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x74, r2, 0x800, 0x70bd26, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x2}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0xc, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x1c, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}]}, @NL80211_ATTR_KEY={0x10, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "836a4944a3"}]}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DEFAULT={0x4}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000000}, 0x200008d5)
setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000013c0)={0x3, 0x6}, 0x4)
setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000001400)={0x0, 0x2}, 0x4)
r9 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_SET_WOWLAN(r9, &(0x7f0000001700)={&(0x7f0000001440)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000016c0)={&(0x7f0000001480)={0x210, r2, 0x800, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x1, 0x1f}, @void, @val={0xc, 0x99, {0xda, 0x33}}}}, [@NL80211_ATTR_WOWLAN_TRIGGERS={0x10, 0x75, 0x0, 0x1, [@NL80211_WOWLAN_TRIG_ANY={0x4}, @NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE={0x4}, @NL80211_WOWLAN_TRIG_MAGIC_PKT={0x4}]}, @NL80211_ATTR_WOWLAN_TRIGGERS={0xac, 0x75, 0x0, 0x1, [@NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE={0x4}, @NL80211_WOWLAN_TRIG_ANY={0x4}, @NL80211_WOWLAN_TRIG_NET_DETECT={0x30, 0x12, 0x0, 0x1, [@NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_SCAN_FLAGS={0x8, 0x9e, 0x410}, @NL80211_ATTR_SCHED_SCAN_INTERVAL={0x8, 0x77, 0x94a}, @NL80211_ATTR_MEASUREMENT_DURATION={0x6, 0xeb, 0x8}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0x2}, @NL80211_ATTR_MEASUREMENT_DURATION={0x6, 0xeb, 0x9}]}, @NL80211_WOWLAN_TRIG_TCP_CONNECTION={0x70, 0xe, 0x0, 0x1, [@NL80211_WOWLAN_TCP_DST_IPV4={0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}, @NL80211_WOWLAN_TCP_DST_MAC={0xa}, @NL80211_WOWLAN_TCP_DST_MAC={0xa}, @NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN={0x4b, 0x8, {0x2, 0x2, "fd102eda954bd3f5ba3ea9c753c5edfa8a2a4a74e4daedfc29fa2bbe572188fc4f2124f985fd674e9d8378db16f0f467b4def839cb04017dff2457bde47c7d"}}]}]}, @NL80211_ATTR_WOWLAN_TRIGGERS={0x12c, 0x75, 0x0, 0x1, [@NL80211_WOWLAN_TRIG_NET_DETECT={0x20, 0x12, 0x0, 0x1, [@NL80211_ATTR_SCAN_FLAGS={0x8, 0x9e, 0x1120}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0x8000}, @NL80211_ATTR_BSSID={0xa}]}, @NL80211_WOWLAN_TRIG_TCP_CONNECTION={0x108, 0xe, 0x0, 0x1, [@NL80211_WOWLAN_TCP_SRC_PORT={0x6, 0x4, 0xa715}, @NL80211_WOWLAN_TCP_DATA_INTERVAL={0x8, 0x9, 0x6}, @NL80211_WOWLAN_TCP_DST_IPV4={0x8, 0x2, @rand_addr=0x64010102}, @NL80211_WOWLAN_TCP_DST_IPV4={0x8, 0x2, @multicast2}, @NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN={0xd9, 0x8, {0x3, 0x5, "9eee279da42062aa8aa58651039fd8c6cded36f7ee1c4a182a09e81789e157cc9a4308e9f6aa957e28e730c685e7c0443488cf2564c003b0b08df99edf998d44e73a198c94a5cab4ef0ed420f0a7b03b6dcabb6c4a7c5cde1408efdfb145df90763ad1aa25164de0cb5ed70f922d11a815a113e81e69eb007b42aeb31d7902be9ba7d4c3c33e5ad7bb6264e1f4202294139edcffe2d7134a492b034108b6fedf471c43264d869cde8d2eb2dae50a265210ca8e8087fa23b7950e68cd4ee418a5413a809bf7b9f6292d7340763f"}}, @NL80211_WOWLAN_TCP_SRC_PORT={0x6, 0x4, 0x98a6}]}]}]}, 0x210}, 0x1, 0x0, 0x0, 0x800}, 0x20001085) (async)
close(r0)
sendmsg$NL80211_CMD_TDLS_OPER(r0, &(0x7f0000001840)={&(0x7f0000001740)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001800)={&(0x7f0000001780)={0x50, r2, 0x10, 0x70bd27, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x20000, 0x63}}}}, [@NL80211_ATTR_TDLS_OPERATION={0x5}, @NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0x2}, @NL80211_ATTR_TDLS_OPERATION={0x5}, @NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0xaa0c8fb0602600a7}, @NL80211_ATTR_TDLS_OPERATION={0x5, 0x8a, 0xe10fdf0017c56d95}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x4) (async)
ioctl$sock_SIOCBRDELBR(r9, 0x89a1, &(0x7f0000001880)='veth1_to_batadv\x00')

3.756360594s ago: executing program 2 (id=16):
r0 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000000), 0x4)
r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000003600), 0x802, 0x0)
ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000003640))
r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ptrace(0x10, r2)
ptrace(0xffffffffffffffff, r2)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000000c0)=0x14)
r3 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}}, {{@in6=@mcast2, 0x404d3, 0x2b}, 0x0, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xe8)
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETFLOWTABLE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)={0x14, 0x17, 0xa, 0x301, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x44000}, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000300))
r5 = socket$key(0xf, 0x3, 0x2)
setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f00000001c0), 0x4)
sendmsg$key(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0)
sendmsg$key(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x1d, 0x301, 0x0, 0x0, {0xc}}, 0x14}}, 0x0)
close(r3)
socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[], 0xb8}}, 0x0)
r6 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000380), 0xffffffffffffffff)
sendmsg$NET_DM_CMD_STOP(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, r6, 0x20, 0x70bd27, 0x25dfdbff, {}, ["", "", "", ""]}, 0x14}}, 0x40005)
setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f0000000040)=0x6, 0x4)

3.606091172s ago: executing program 3 (id=17):
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async)
r0 = syz_open_procfs$pagemap(0x0, &(0x7f0000001080))
ioctl$PAGEMAP_SCAN(r0, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x4, &(0x7f00000002c0)=[{0x800000000}, {0xe, 0x7, 0xbc}], 0x2, 0xbff, 0x1e, 0x0, 0xc, 0x6e})
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
getsockopt$sock_int(r1, 0x1, 0x10, 0x0, &(0x7f0000000000))
r2 = syz_usb_connect(0x0, 0x81, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000a7420040ab0501030001010203010902240001000000000904000002aad45c0009058e02000000000009050a06"], 0x0)
syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000380)={0x2c, &(0x7f0000000000)=ANY=[@ANYBLOB="1f046ee4e9e38c9b58d06076a585fb400906000000be94252ea505"], 0x0, 0x0, 0x0, 0x0})

3.467981489s ago: executing program 2 (id=18):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000000), r0)
sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f0000002980)={0x4c, r1, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @loopback}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @empty}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x0)
syz_usb_connect(0x0, 0x24, &(0x7f00000000c0)={{0x12, 0x1, 0x0, 0xa8, 0x25, 0xe2, 0x8, 0xc98, 0x1140, 0xdbe6, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xf2, 0x4c, 0x54}}]}}]}}, 0x0)
syz_usb_connect(0x5, 0x0, 0x0, 0x0)

2.652135384s ago: executing program 1 (id=21):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
r1 = socket$igmp(0x2, 0x3, 0x2)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', <r2=>0x0})
sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf2500000000000000000000000000000001fc0000000000000000000008000000000004fffe4e2100020000000021000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe800000000000000000000000000037000004d232000000fc020000000000000000000000000000050000000000000000000000000000000000000000000000090000000000000001000000ffffffff00000000000000000300008000000000430500000000000004000000000000000100000000000080000100000000000001000000000000000000000000000000000000002cbd70040531000002000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRES32=r2], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014)

2.175786222s ago: executing program 1 (id=24):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
r2 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c)
setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4)
r3 = socket$inet6_udplite(0xa, 0x2, 0x88)
setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', <r4=>0x0})
setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4)
bind$xdp(r2, &(0x7f0000000100)={0x2c, 0x0, r4}, 0x10)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2002, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x1, 0xb, 0x7fffffff, 0x2, 0x8000b, 0x7b, 0x20000006, 0x4d, 0x6, 0x5f, 0xb, 0x5, 0xffff2d37, 0xffffff01, 0xb, 0x3, 0x0, 0x5, 0x24, 0x1, 0x0, 0x3c58, 0x1, 0x24, 0x6, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0x7, 0x89d2, 0xfffffff8, 0x4c76, 0x7, 0x40000, 0x3, 0x0, 0x0, 0x80008071, 0x7, 0x17, 0xd, 0x407, 0x5, 0x3a, 0x8f, 0x4006, 0x3, 0x80000000, 0x9, 0x100004, 0x8, 0x400, 0x6, 0x0, 0x4, 0x7, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000003, 0xf0000000, 0x8000012f, 0x8004, 0x7, 0x6, 0x129432e6, 0xc8, 0xf9, 0x800, 0x2bf, 0x6c7, 0x9, 0xfffffffe, 0x3, 0x0, 0x0, 0x5, 0x2f, 0x10, 0x315, 0xd, 0xea4, 0xffffffff, 0x4, 0x7, 0x7fff, 0x5a7c, 0x420, 0x8, 0x6, 0x0, 0x6, 0x1, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x8, 0x20009, 0x8, 0x9, 0x9, 0x47, 0x8000, 0x4001, 0xfe000000, 0xffff, 0xfffffffb, 0x7, 0x9, 0x5, 0x3, 0x4, 0x9b, 0x3, 0x6c0, 0xbc45, 0x48c93690, 0x42, 0x3], [0x3, 0x408, 0x8004, 0x0, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x5, 0x9, 0x5, 0x0, 0x4a61eab3, 0x5, 0x40000008, 0x10000, 0x3, 0x5, 0x2, 0xb, 0x5, 0x2, 0x2, 0x23, 0x20000008, 0x4, 0x26d01, 0x6, 0x1, 0x800003, 0x200, 0x5, 0x7, 0x4, 0x2950bfaf, 0xffe, 0xa2, 0x7, 0xa9, 0x5, 0x5, 0xac8, 0x2, 0x2, 0x7eb6, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x7ff, 0x5, 0x1c, 0x120000, 0x3, 0x2004, 0x80a2ed, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x8000b, 0x8, 0x938, 0x6, 0x6, 0x0, 0xb9, 0x8, 0x9, 0x2, 0x58, 0x44e, 0x3, 0x501, 0x10000, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x6, 0x2, 0x5, 0xe7, 0x4, 0x16, 0xfffffffe, 0x80000003, 0x6, 0x4, 0xc8, 0x9, 0xffffefff, 0x10003, 0x3, 0x7e, 0xfd, 0x9602, 0x7, 0x5, 0x7, 0x6, 0xffffffff, 0x5, 0x5, 0x8, 0x8d67, 0x5, 0xf40, 0x1, 0x1, 0x1000, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c)
ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0)
msgsnd(0x0, &(0x7f0000000200)={0x3}, 0x8, 0x800)
sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)={0x20, r1, 0x301, 0x70bd29, 0x25dfdbfc, {0x24}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x0)

2.003393454s ago: executing program 0 (id=25):
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff}, 0x0)
mmap(&(0x7f000028b000/0x1000)=nil, 0x1000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
vmsplice(r0, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15)
pipe2(&(0x7f0000000000), 0x0) (async)
mmap(&(0x7f000028b000/0x1000)=nil, 0x1000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async)
vmsplice(r0, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0) (async)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) (async)

1.925812459s ago: executing program 1 (id=26):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r0, 0x8008f511, &(0x7f0000000000)) (async)
r1 = shmget$private(0x0, 0x4000, 0x800, &(0x7f0000ffc000/0x4000)=nil)
shmctl$IPC_RMID(r1, 0x0)
r2 = socket$kcm(0x10, 0x2, 0x0) (async)
r3 = syz_open_dev$sndctrl(&(0x7f00000002c0), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r3, 0x40405515, 0x0) (async)
r4 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0)
r5 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r5, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(camellia)\x00'}, 0x58) (async)
setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async)
r6 = request_key(&(0x7f0000000540)='dns_resolver\x00', &(0x7f0000001ffb)={'syz', 0x0}, &(0x7f0000000580)='*\x00\x00\x00\x00\x00\x000\x00\xa5^y\xa9n\x00\xe3\xa3\x89\x90&)\bT\x91\x14\xba\x190\xb3\x00\x00:\xb2\xbe\x1d\x00', 0xfffffffffffffffe)
request_key(&(0x7f0000000040)='dns_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='y\xa9n::e\x00\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00', r6) (async)
r7 = accept4(r5, 0x0, 0x0, 0x800)
syz_usb_connect(0x0, 0x24, &(0x7f0000000680)={{0x12, 0x1, 0x310, 0xf3, 0xc6, 0x6a, 0x8, 0x10c4, 0xeac1, 0xabe0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x8, 0x30, 0xe5, [{{0x9, 0x4, 0x1, 0x9, 0x0, 0x78, 0xfc, 0x1b, 0xd}}]}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0}) (async)
sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3", 0xa3}], 0x3}], 0x1, 0x40800)
recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async)
setsockopt(0xffffffffffffffff, 0x3, 0x6, &(0x7f0000000700)="37557bf476e57e3ff487bcca92e2688783c7ffb106450c5928c0b26a8e08fbb2e3deb24243c76131", 0x28) (async)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$OSF_MSG_ADD(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=ANY=[@ANYBLOB="b80b000000050104000000000000000003000080540201"], 0xbb8}, 0x1, 0x0, 0x0, 0x2000}, 0x4004040) (async)
ioctl$VIDIOC_SUBSCRIBE_EVENT(r4, 0x4020565a, &(0x7f00000000c0)={0x3, 0x980900}) (async)
ioctl$VIDIOC_QUERYMENU(r4, 0xc008561c, &(0x7f0000000100)={0x980900, 0x7, @name="d2b5127577cd6ef26869f7d07b00896c29f892c742a147e124fa6f684c060fc3"}) (async)
sendmsg$kcm(r2, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000780)="d8000000180081064e81f782db44b904021d080400007c09e8fe55a10a0015c00500142603da0e1208000f0000000401a800160011000140030003000700000000000000008b6d3dd2dd0c61c1d6900094007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b4aa46db6a44f995922fe7c9f877d730d16a4683f5aeb4edbafb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbe75de6ccd40dd6e4edef3d93452a92", 0xd8}], 0x1}, 0x48080)

1.807999042s ago: executing program 1 (id=27):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)={0x20, 0x2c, 0x117, 0x0, 0x0, {0x3, 0x7c}, [@nested={0x8, 0x1, 0x0, 0x1, [@typed={0x4, 0x6}]}, @nested={0x4, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0xc000}, 0xc010)
sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x5) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async)
mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x2) (async)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
mbind(&(0x7f0000471000/0x3000)=nil, 0x3000, 0x8000, &(0x7f00000020c0)=0x94f, 0x5, 0x1) (async)
r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00')
read$FUSE(r1, &(0x7f0000000080)={0x2020}, 0x2020) (async)
r2 = socket$rds(0x15, 0x5, 0x0) (async)
r3 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000000)={0x0, 0x8}, &(0x7f0000000080)=0x8) (async)
ioctl$XFS_IOC_ERROR_INJECTION(0xffffffffffffffff, 0x40085874, &(0x7f0000002100)={r2, 0x787b})
setsockopt$RDS_GET_MR_FOR_DEST(r2, 0x114, 0x7, 0x0, 0xa0)

1.807372286s ago: executing program 2 (id=28):
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7fff}]})
r1 = socket(0x80000000000000a, 0x2, 0x0)
setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x4e23, 0x0, @mcast1={0xff, 0x7}, 0xfffffffd}}, {{0xa, 0x0, 0x0, @loopback, 0x3}}}, 0x108)
r2 = socket(0x80000000000000a, 0x2, 0x0)
setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xe}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_KEY_END={0x4}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc4}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
r4 = socket(0x80000000000000a, 0x2, 0x0)
r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
listen(r5, 0x90004)
syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{r5, 0x60}], 0x1, 0x0, 0x0, 0x0)
setsockopt$inet6_group_source_req(r4, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote, 0x1000}}}, 0x108)
close_range(r0, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0xc)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r6)
sendmsg$NLBL_MGMT_C_ADDDEF(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100253d7000fbdbdf2504000000080002004697028e59d749b40a000000070001002f2c0000"], 0x2c}, 0x1, 0x0, 0x0, 0x4044040}, 0x8842)
r8 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002)
timerfd_create(0x7, 0xc0000)
ioctl$SCSI_IOCTL_START_UNIT(r8, 0x5)
setsockopt$inet_sctp6_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, &(0x7f0000000080)={0x2, 0xe6, 0xffff}, 0x8)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000004540)=[{{&(0x7f0000000040)={0x2, 0x4e22, @multicast1}, 0x7e1f, 0x0}, 0xee0000b0}, {{0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000001100)="15b26f226e2966667482d50903b0a8d92ccd9e69d5cc4cb3d467a670b237a9225fb56c0f7ea725dee27c4bb43bb50c6748c83b71d59f0537405dfab648c096607340fac939a2efd31cbe2f8ca29c409e87ea0974b7bceff9afef5d07d691575f5115f2f961ad488e3386036913e98181a6034febaab853a3e928b9035b0e3a8e1cb393c70f6d0448970e0af2476f8b923ee09c19deca55d58f70e8eeff55dda6381cb96afe97196c0af0a8fd450a1447a1a521e2c211fb84cbcf4aebd31298972ec6bea1764fbde5500fa30c5f2459cff4d7f123ab94cfd5762d586ec7a28abc2f8c9e608f8f964b96ecb0883d60d444f317834a3d734cb304051a60d1a084a84da8f9a23a1b9d4951c0a81985c63ae193f40e9deb358b2f08553324fd6086be9e70e5061568abefebcda50e70f4dab2e4dc0cf6d85aced044d7005326922886194895267165f7f592036ebe11dcf1cad98f5cda766eaea90fb4cb5e793525126c7594f8599055192d63a81d3cd26aadd50983f1c3f1d4655c1b5f59e80f733e3abc4792b760729fd26298ef15141cf76cc4", 0xc3}, {&(0x7f0000000d80)="7d68e6de85f9b0cbc9d710267f321ec64eab043ecad9af7e01e9463218ec45924a99867163e468d36a682fadd749caa325e685d75559a87139e02fae7271be8f55671cfd32a09896278d1941370174720838039d0989bc3394b8a4c4f4a30f0496be313d6d60fe47966c634a3ee1f659e8ef310647725bda0130d5de5028220a4cf5fc808a75694738ee26cb21302b4bba4265b845a5d5dce706d9820c6936b122f9658446d74a9016b94424971dd443a6907eb5c73b6b200e92b23f2c36a214729b0bc231511e4c", 0xc8}, {&(0x7f0000000380)="73fd71361e8d6c80ae1bc9953e2a4aeac7a314273066fc7f65a51969b46df1774bb0be94ccd4824f2d57ad2cd37242b1258402395481f9f07e067652e52aa8ccefcd0962ba0c48757b68d493f3ad702e65d4daa7dfc1605a173185472ae12470eea64c70ef4e64793b8a830447de0f423bef3964934eef4243cac42939ba6fa68d821b9373b5f3e2c26e7ca75ed8fb3203aef3a6637cecdd0251532b99537e02f604058f50e66c8a657d59beeed127695475f082d3d2b9790181fc987ad000ac00887d1506be89f388ecb405660b4ea196ee8f5a92b12ec43bbf49567db613d478ebe2358364f7600bf4f80ef4b2756fb13416c4fa22880cc96a03f07888575aedb001d5a74bb2f906797912b5ac080a0a3d361425f1a92ab03bbe65d5dcb235f43b5ad1162a16ebdc647baac013bf076945126cdd5a080853976a97ad55184601102fbb8df86b21aa8162858d74465c5fb7dc766602a3567f6eaf441f85ec50ca7fb3a4fdb450d1420531da25d01a412958a5e3895c59542238cf8e188e7fb5641eb24a5f1819bf8d2e9dd6c1d0e93564d723e311db9cd268bb1e477036e822b135cdbaf40f812aa7db01d22c829ab01ae24997dae96ddeed49e62d285701d5419e3f94a8b95790cf5a296ed15bffae1f71470c6a6eda872528844a2df42590d898630263cab5cccec57b7cea365ad8c91bfbe7cb419635ce6bf340a56115c0ad922b6fade9538e543bc5def2a85d35ab16d20c219c4733837be2c14ba4d3d32c3a6882ce6857626f55109b4cdcb634425d710bf3108f9b31b4af0cc17a58e49e871a56126dd8bed08e038ba64008587237b3442d28032e52fc9fae1a5784ba59d0edfa03d38352724903ed6f6970b3f4dfa6e40bf933b6765c6ee648174765f1e8ec71b80cac86abd065a3005b40a43a665707cc590997c5048183006a9dd8026d39def05950183b3d4f12f4e1644ef78cddac7c5569985c2c232bb350f28857675339e53f63a868704d2e0b38993dc57a02d3e297fc9a5b9384622841018c303a05bac25d509df5a2d0e3232927283fcc3ec67e4fa7b71d22f115cf693851dcceab4bce38cbfbb32829e211cdcb6a359e14fe416663541050d340aef2555dbd292bd9cbab8fcf20378149cc994569c2bc95fb33fd2d9321b8ac8e5160b02e202492f470eb719a8f2ac3a4be37ea0918b54b14789b7aa228d47f7b13fd9af608740c5a8fe02109a7cc0e555b22628ef790e513ecadfd338d30aed8ca219e64ee4fb0bd0e21e5101bf2072ffa071eb1aa0454caccc015ff1e166813f819a142b56a22e4ff387bb319288a0ef747c6fc8fdee3a0e193b0d086eb816e97e0322fcdaa30da61cd26ac9d8d0748fccd911ce0fd4adc953e9486e137fe66bc8aedfd5b78c562ebfc578ac9f96a453311766564541e16955e30b95914e9411a0b4cd95e0d8732d5ff7a4f921ef41d986a195334266585353b16b9449955523913a30c087532bcb899f733af3abea59baea174cf04359547a633b5f8a582ae3ef12a1d0125bef8c6e8c9fb589d3597c5ab3879491b0c5e3607203f06836a6805d3f7979c4325f9fecb2aceddedb272237132460cda812ef7d613a585898d59f92ef68ec95f12b47b440f6d899ecbfab48055e0c1605ba4cd9dbc17c4cbfec8a953ebbd38c45a6737a57ee58e21a20e530171137968ae4f0d0366cdb0b9d6a4667b011fcd7cd9e77364e5221989d8f0d80793260e748e3bd394849c090c744f6044328304cd6f02e941c5405647daffc1fd2f2864b37f92bbf4931c8e4a7c6bafd0ea79d39d330e70e6776bf6a926de227e5a43653bba04883e98d67bb64aa86e8bf271ba87604bc598e47f2992c7618ad25068860a481554b53352c7339de7e79c3bd1aed5bef8f398432858c888a5d8651969ea40eb3d486e9fe61d49b20500fdfd1548f567da970103d36730657c35d03d2c36b142665f62203b1fb12d616478cfef6f38b34cda87a634dd06d359f33e98b94a5e5b46b2a8d73126352d1d5b65af75055455cc903e384c41876fbdff935d047284d9d203b147a6ba0e9cb50beef7798886c33d2f2f0c0d9abe0e32c7c809f8b0b28fc59471987353c862a311776b8275bf319d5cb9a59f8f103b6e567ef5dd8859973cc3fe41e356bf5bd3186240e49286977eca36a8ad44185973b276cd7958b73e14a221b7fd567818bebf54ad27ee95161bd2aeeb356482ff467500a7d36f0464f58a591ec6b728f984ec78d0abe14c6d3411ac3ffc4c3179d1f95d029f26cceb545723519d3d4209a2b1243e78767273c13dc2bd320512674b6f1a50313bae7b9d16aebb476dbc829e8fd8dd46a1696efaff5795cf75de57c90f05ed9ef4a5cdfbf20d3d9ed95fb4114b1d5c9ade0856212e7ba330ce5bccf2c993dff89112b28bd3b17d3fcfacef7590f62bf948977dd79e2d8025946c80bf263e34035409b5ba1443d4929727180761bd56d258c3670a0aa4de21111fc3172367582de2d164ff3a18d0696b8dd8e5c1423b2ea1e2c0cfe141e4cf04f8cdaed48976b94c40d6a581300458661bbdbfeeb4969af6319eb1798843d0872f68f0c6537bbc9c7dd1e9b0564bf442d8d25f8aa884aba1df074d374f99750d9227bb821ba0355f60de2829a5c8cd47c89d29a2e3d7d53d59db5c3ace8f484664202c210c68a3b33076fb00d59938e84fbad6d6618c0bb89cf94035fa2de4da351e0d71df416450ea7ec3af33aa5c0313c63e654bd79c73b39dc1933636956761058d76648746daca469f8fce62c17a8160cdefc6a927eef9ec4a8dd684e46f35282546ce2362ab8afedd39bf699fd7c2cde538f52ea43c08558f42ba77b2986b800c45fa76a130b30919b3e1d504573e3c1e7dd2dc5d81379df53d736511f1da4ad8791e46adb27bb5c38129e89edda0aed99dcc03fe400f7d05d48e3e9e17744e8487f8ac464c86f7332211fb9799e9d27a6832d5f17ccd1a2da255f6da047e4728dd80860c04391bca4b7833f0346866401ec20033bcf6dfa85fd1520de5a03b4f9f6f5d2f8d7b6e7d7df1cbe5c05e23e080cf335639c94c48aaeb0bfebbe79530d67d35fb101c91839954c0e50dd4b90a86428b22b0be1e906fee30f68d7ce4bf9c68eafe695f07f5e4e4d473d77104b7b1b5dcfeb84e8c83624c0068d4e1cccfe740f8e5d5699603f8481ef2a1f2d4b8fd2314c5cb1985fe34cf8ede7d2e8bddea269422490903489c7f5951114d7ccb29a19455a987d538955712a460243105b25ccb6e6f34c370a6bbb234bee150dbcea5188e45305253f1014f7c0b5d60d517d2d05707f5ca9249a921d6c5307caf41deca0509b49102d801320db65c00f6e1c05fb8c2e1cc554673bf6168dd64086b19af28eec508fd0c304837e802173ac9947c4d73929c61d9632ab929a25f2a04350954612c2de705c1c25215284fe933fc8ccfd30ab3fc9ff5e04dd68d4720d95a29d6da176ac9d332c9ce77358f3c262777ea828fe6473638bc77be2aa586a3733e275744bc42c3742c1ad8f89d25c31958902f2f498c58fc85e9b78fb7a331734cb081cfa9ccfd262df927c0ff46983f8765af4add3532de2b91f2436df028", 0x9fd}], 0x3}}, {{0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)="a6", 0x1}], 0x300}}], 0x3, 0x0)

1.77788923s ago: executing program 1 (id=29):
syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$IPVS_CMD_SET_CONFIG(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)={0x1c, r1, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x50}, 0x800)
r2 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x14, r2, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@void, @void}}}, 0x14}}, 0x4000054)
sendmsg$NL80211_CMD_DEAUTHENTICATE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000040)={&(0x7f00000000c0)={0x6c, r2, 0x122, 0x70bd25, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x58, 0x2a, [@sec_chan_ofs={0x3e, 0x1, 0x1}, @prep={0x83, 0x25, {{0x0, 0x1}, 0xa3, 0x2, @device_b, 0xa21f, @value, 0x200, 0x0, @device_a, 0x4}}, @prep={0x83, 0x25, {{0x0, 0x1}, 0x2, 0xad, @device_b, 0x3ff, @value, 0x4, 0xd, @device_b, 0x3d2e}}, @challenge={0x10, 0x1, 0x27}]}]}, 0x6c}}, 0x2008010)

1.729389483s ago: executing program 3 (id=30):
r0 = syz_open_dev$sndpcmp(&(0x7f0000000100), 0x0, 0x220000)
mmap$snddsp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x8010, r0, 0x7000)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
r1 = fsopen(&(0x7f0000000000)='omfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000280)='uid', &(0x7f00000008c0)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\bb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xd7\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80=\x8a\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\x1f\x03\x00\x00\x00\x00\x00\x00\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9ak\x00\x00\x00\x00\x00\x00\x00\n\xa72\xa3\xef^\xe7\x8f', 0x0)
syz_usb_connect$uac1(0x2, 0xba, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa8, 0x3, 0x1, 0x7, 0x70, 0x8, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x2, 0x11}, [@processing_unit={0xc, 0x24, 0x7, 0x3, 0x6, 0xf, "f36d7e187a"}, @extension_unit={0x7, 0x24, 0x8, 0x6, 0x2, 0x32}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0xf8c, 0x460, 0x4, 'O'}, @format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x2, 0x3, 0x0, 0x3, "bf02af"}, @format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x8, 0x3, 0x6, 0x0, "", "f106f1"}]}, {{0x9, 0x5, 0x1, 0x9, 0x3ff, 0xf8, 0xff, 0xb, {0x7, 0x25, 0x1, 0x1, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x4, 0x1, 0x2}, @format_type_i_discrete={0x8, 0x24, 0x2, 0x1, 0xe9, 0x1, 0x40, 0x90}, @as_header={0x7, 0x24, 0x1, 0xc}]}, {{0x9, 0x5, 0x82, 0x9, 0x40, 0x8, 0x4, 0xd, {0x7, 0x25, 0x1, 0x2, 0x3, 0xffff}}}}}}}]}}, &(0x7f0000008600)={0x0, 0x0, 0x0, 0x0})
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x8)
ioctl$KVM_SET_BOOT_CPU_ID(r3, 0xae78, &(0x7f00000000c0)=0x2)

1.381793993s ago: executing program 2 (id=31):
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000e80)=[{{&(0x7f00000000c0)={0x2, 0x4e20, @multicast2}, 0x10, 0x0}}], 0x1, 0x44045)
r0 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe)
r1 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd)
r2 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x1}, &(0x7f00000009c0)="3e12d23d346cfdeb1716f738374bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e43eba0b67b516be14a8b51a75bfd611b2d7ae6a21d056c2c5116a416a76b1a03dc55ea62d43c809e0ed6e56163fdab317afd5c34d614367e4425bb9a97e38b8beb84ef6d549eed5aaa86dbe646fc95b4b88e17fb55ae6f1221bcf13ecff7a597f452bed6b6fb4c812df9be8e35d8d15086609c033a5d2a42d5dcb0d103098f", 0xc1, 0xfffffffffffffffe)
keyctl$dh_compute(0x17, &(0x7f0000000100)={r0, r1, r2}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha256\x00'}})
r3 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe)
keyctl$restrict_keyring(0x1d, r3, 0x0, 0x0)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000001c0)='asymmetric\x00', &(0x7f0000000240))
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0)
mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000080)='tmpfs\x00', 0x0, &(0x7f00000001c0)='grpquota')
add_key(&(0x7f0000000000)='syzkaller\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, r3)
quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0)

1.187760127s ago: executing program 2 (id=32):
r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000040)={0x0, @reserved}) (async)
ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, &(0x7f0000000040)={0x0, @reserved})
r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x8, 0x88040)
ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, &(0x7f0000000140))
ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000180)={0x3, 'veth1_virt_wifi\x00', {0xd64}, 0xe7b4})
fsetxattr$security_evm(r0, &(0x7f00000001c0), &(0x7f0000000200)=@v2={0x3, 0x0, 0x3, 0x7, 0x8b, "17bc5618832427f70de55905f6abd8d2192f08dd1734b30bf7915e70f3ebfc3efe33632d548b3adfd11b91fd53e3735589a6daec6bf10da78978c029dcf1ef11bb2fcaea0b13c551cc5d16dbdaf02027708c7299dcc58cecc59dafe30e0cc9c91e0018308b19764625bf4a2b9d7613bd10a98984cce1a2db5c36576daa6a57ba27bf5a7775ef8e53cb11d3"}, 0x94, 0x4)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000002c0), 0x42000, 0x0)
dup(r2) (async)
r3 = dup(r2)
write$uinput_user_dev(r3, &(0x7f0000000300)={'syz0\x00', {0x6, 0x504, 0x4, 0x4000}, 0x4a, [0x7ff, 0xffffffff, 0xea, 0x543, 0x2, 0x1, 0x2, 0x200, 0x1, 0x7, 0xfffffffe, 0x1, 0x1, 0x10, 0x37c8522, 0x8001, 0x9, 0x2, 0x10000, 0xffffffff, 0x0, 0x4, 0xf0000000, 0x1, 0x9af, 0x8, 0xfffffff8, 0x8001, 0x6, 0x8, 0x3, 0x1ff, 0x6, 0xffff2d17, 0x2c5, 0x81, 0x104f, 0x10, 0x6, 0x3, 0x0, 0x3ff, 0x5, 0x8, 0x5, 0x4, 0xfff, 0x7, 0x2, 0x6, 0x7, 0x2fd5, 0x9, 0x63, 0x1, 0x6, 0x4, 0x1, 0x8000, 0x8, 0x5, 0x8, 0x4, 0x1], [0xe, 0xe, 0x6, 0x8, 0x0, 0x8, 0x1ff, 0x76, 0x7ea, 0x7ca59fdf, 0x9, 0x400, 0x8, 0x4, 0x2, 0x200, 0x7, 0x31a, 0x9, 0x6, 0xe679, 0x5, 0xefd, 0x80000000, 0x6, 0x40, 0x74, 0xe, 0x6, 0x5, 0x3, 0x2a1a0e69, 0xc, 0xfffffff9, 0x9, 0x2, 0xe85, 0x1, 0x80, 0x0, 0x7, 0x1, 0x6c6f, 0x6, 0x0, 0x10001, 0x699, 0x10, 0x5, 0x3, 0x7dad, 0x1, 0x1f, 0x0, 0x8, 0x81, 0x5, 0x1ff, 0x5, 0x4c11, 0x26, 0x50c, 0x0, 0x4], [0x7, 0x0, 0x1, 0x83, 0x4, 0xd6d7, 0x0, 0x2, 0x3, 0x9, 0x9beb, 0x7, 0x4, 0x0, 0x3, 0x1000000, 0xfffffffd, 0x4, 0x0, 0x5, 0x0, 0x7, 0x7f, 0x2, 0x6, 0x301c, 0x637b, 0x50, 0x80000001, 0x1000, 0x5, 0x4, 0x3, 0xffffffff, 0x5, 0x101, 0x1, 0x3, 0x1, 0x800, 0x1, 0x9, 0x2, 0x9, 0x0, 0x3, 0x81, 0x6, 0xffff21cf, 0x8001, 0x0, 0x7, 0x0, 0x0, 0x9, 0x3, 0x48cd39de, 0x401, 0x4, 0x10000, 0x0, 0x81, 0x4b, 0x9], [0x7fff, 0xfffffffd, 0x0, 0x0, 0x2, 0x2, 0x10001, 0x8001, 0x9, 0xdbdc, 0x90, 0xf, 0x7, 0x2, 0x4, 0x8, 0x4, 0x7, 0x3ff, 0x3, 0x3, 0x5, 0x8, 0x2, 0x8, 0x101, 0x5, 0x401, 0x4, 0x6, 0x6, 0x1, 0xffffffff, 0x3, 0x2, 0x0, 0x3, 0x5, 0x2, 0x9, 0x9, 0x9, 0x7, 0x8, 0x5, 0x2, 0x5, 0x9b5, 0x5, 0xf064, 0x8, 0x4, 0x7, 0x7, 0x3, 0x6, 0x53d14386, 0x8, 0x9, 0x4, 0x4, 0x7, 0xfffffff9, 0x6c]}, 0x45c) (async)
write$uinput_user_dev(r3, &(0x7f0000000300)={'syz0\x00', {0x6, 0x504, 0x4, 0x4000}, 0x4a, [0x7ff, 0xffffffff, 0xea, 0x543, 0x2, 0x1, 0x2, 0x200, 0x1, 0x7, 0xfffffffe, 0x1, 0x1, 0x10, 0x37c8522, 0x8001, 0x9, 0x2, 0x10000, 0xffffffff, 0x0, 0x4, 0xf0000000, 0x1, 0x9af, 0x8, 0xfffffff8, 0x8001, 0x6, 0x8, 0x3, 0x1ff, 0x6, 0xffff2d17, 0x2c5, 0x81, 0x104f, 0x10, 0x6, 0x3, 0x0, 0x3ff, 0x5, 0x8, 0x5, 0x4, 0xfff, 0x7, 0x2, 0x6, 0x7, 0x2fd5, 0x9, 0x63, 0x1, 0x6, 0x4, 0x1, 0x8000, 0x8, 0x5, 0x8, 0x4, 0x1], [0xe, 0xe, 0x6, 0x8, 0x0, 0x8, 0x1ff, 0x76, 0x7ea, 0x7ca59fdf, 0x9, 0x400, 0x8, 0x4, 0x2, 0x200, 0x7, 0x31a, 0x9, 0x6, 0xe679, 0x5, 0xefd, 0x80000000, 0x6, 0x40, 0x74, 0xe, 0x6, 0x5, 0x3, 0x2a1a0e69, 0xc, 0xfffffff9, 0x9, 0x2, 0xe85, 0x1, 0x80, 0x0, 0x7, 0x1, 0x6c6f, 0x6, 0x0, 0x10001, 0x699, 0x10, 0x5, 0x3, 0x7dad, 0x1, 0x1f, 0x0, 0x8, 0x81, 0x5, 0x1ff, 0x5, 0x4c11, 0x26, 0x50c, 0x0, 0x4], [0x7, 0x0, 0x1, 0x83, 0x4, 0xd6d7, 0x0, 0x2, 0x3, 0x9, 0x9beb, 0x7, 0x4, 0x0, 0x3, 0x1000000, 0xfffffffd, 0x4, 0x0, 0x5, 0x0, 0x7, 0x7f, 0x2, 0x6, 0x301c, 0x637b, 0x50, 0x80000001, 0x1000, 0x5, 0x4, 0x3, 0xffffffff, 0x5, 0x101, 0x1, 0x3, 0x1, 0x800, 0x1, 0x9, 0x2, 0x9, 0x0, 0x3, 0x81, 0x6, 0xffff21cf, 0x8001, 0x0, 0x7, 0x0, 0x0, 0x9, 0x3, 0x48cd39de, 0x401, 0x4, 0x10000, 0x0, 0x81, 0x4b, 0x9], [0x7fff, 0xfffffffd, 0x0, 0x0, 0x2, 0x2, 0x10001, 0x8001, 0x9, 0xdbdc, 0x90, 0xf, 0x7, 0x2, 0x4, 0x8, 0x4, 0x7, 0x3ff, 0x3, 0x3, 0x5, 0x8, 0x2, 0x8, 0x101, 0x5, 0x401, 0x4, 0x6, 0x6, 0x1, 0xffffffff, 0x3, 0x2, 0x0, 0x3, 0x5, 0x2, 0x9, 0x9, 0x9, 0x7, 0x8, 0x5, 0x2, 0x5, 0x9b5, 0x5, 0xf064, 0x8, 0x4, 0x7, 0x7, 0x3, 0x6, 0x53d14386, 0x8, 0x9, 0x4, 0x4, 0x7, 0xfffffff9, 0x6c]}, 0x45c)
ioctl$USBDEVFS_FREE_STREAMS(r2, 0x8008551d, &(0x7f0000000780)={0x2827, 0x8, [{0xb}, {0x2}, {0x3}, {0x6}, {0x1}, {0x8, 0x1}, {0xc}, {0x5, 0x1}]})
ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r0, 0xc0845658, &(0x7f00000007c0)={0x0, @reserved}) (async)
ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r0, 0xc0845658, &(0x7f00000007c0)={0x0, @reserved})
r4 = syz_open_dev$usbfs(&(0x7f0000000880), 0x5, 0x2080)
ioctl$USBDEVFS_CONNECTINFO(r4, 0x40085511, &(0x7f00000008c0))
ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f0000000980)={0x60, 0x0, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, 0x5, &(0x7f0000000900)=[{0x47c, 0x7, 0x6}, {0x7, 0x9, 0xe3e}, {0xfff, 0x1, 0x7}, {0x3, 0xfffffffffffffffc, 0x4}, {0x7fffffffffffffff, 0x6}], 0x5, 0x4, 0x2, 0x8, 0x60, 0x41})
openat$dsp(0xffffffffffffff9c, &(0x7f0000000a00), 0x400000, 0x0) (async)
r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000a00), 0x400000, 0x0)
ppoll(&(0x7f0000000a40)=[{r2, 0x80}, {r0, 0xa040}, {r4, 0x140}, {r0, 0x110}, {r4, 0x2}, {r5, 0x620}], 0x6, &(0x7f0000000a80), &(0x7f0000000ac0)={[0x400]}, 0x8)
socket$inet6_tcp(0xa, 0x1, 0x0) (async)
socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r3, 0x4058534c, &(0x7f0000000b00)={0x0, 0x3, 0x6, 0x1, 0x2, 0x2})
ioctl$USBDEVFS_WAIT_FOR_RESUME(r3, 0x5523)
openat$nullb(0xffffffffffffff9c, &(0x7f0000000b80), 0x400000, 0x0) (async)
openat$nullb(0xffffffffffffff9c, &(0x7f0000000b80), 0x400000, 0x0)
r6 = pidfd_getfd(r3, r5, 0x0)
ioctl$UI_SET_EVBIT(r6, 0x40045564, 0x10)
getsockopt$inet_IP_IPSEC_POLICY(r6, 0x0, 0x10, &(0x7f0000000bc0)={{{@in6=@loopback, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in6=@private0}, 0x0, @in=@multicast1}}, &(0x7f0000000cc0)=0xe8)
setreuid(0xee00, r7) (async)
setreuid(0xee00, r7)
syz_open_dev$usbfs(&(0x7f0000000d00), 0x6, 0x40000) (async)
r8 = syz_open_dev$usbfs(&(0x7f0000000d00), 0x6, 0x40000)
ioctl$USBDEVFS_ALLOW_SUSPEND(r8, 0x5522)
ioctl$UI_DEV_CREATE(r3, 0x5501)
accept4$tipc(r3, &(0x7f0000000d40), &(0x7f0000000d80)=0x10, 0x80800) (async)
r9 = accept4$tipc(r3, &(0x7f0000000d40), &(0x7f0000000d80)=0x10, 0x80800)
bind$tipc(r9, &(0x7f0000000dc0)=@nameseq={0x1e, 0x1, 0x1, {0x0, 0x2, 0x3}}, 0x10)
ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000e00)={0x1e0, 0x10, 0x300, 0x600, 0x6, 0x0, 0x20, 0x1, {0x7, 0xeb2}, {0x2, 0x6}, {0x800, 0x1, 0x1}, {0x809, 0x3}, 0x2, 0x100, 0xfff, 0x8000, 0x1, 0x2, 0xd6, 0x2, 0x2, 0xb, 0x29d, 0xa9, 0x2, 0x200, 0x0, 0x3})

1.166076264s ago: executing program 2 (id=33):
r0 = syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000751c0110e60f00989ad1010203010902240001000000000904290202b48cbb0009050402100000fa"], 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000500)={0x44, &(0x7f0000000480)=ANY=[@ANYBLOB="201019"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, &(0x7f0000000080)={0x0, 0x6, 0xa8, {0xa8, 0x7, "136573da0f6d3ec39714a5f675490782df78a327a7c80aeb1b7fc08832a2ef005cb62459e2c68516383db26d440c2263b5e7dc07ed38e50329aee143977d5d2e41b92976bebe443cf3c1e47a61e25fee913f3baecdafa4388a599e447864d362a9bfe8a36b1c2dfc4697ed03b61a8baa795da60c6b7eb821b349e47aacace50eb090a8b6c21b21a0f25189215659681dcae8e3c2e8519f843cb05efe6b75cead63ccfd006888"}}, &(0x7f0000000000)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1401}}, &(0x7f0000000140)={0x0, 0x22, 0x2, {[@global=@item_012={0x1, 0x1, 0xa, '4'}]}}, &(0x7f0000000180)={0x0, 0x21, 0x9, {0x9, 0x21, 0x4000, 0x7f, 0x1, {0x22, 0xc52}}}}, &(0x7f00000003c0)={0x2c, &(0x7f0000000200)={0x60, 0x7, 0x76, "979ffd7df49dc751639fc544000224a004f59264070e23fe95b895a2fc810f0e3a4b89bfb6d61277163aec44daffb0d373fd058602e8e15b05470a4f58c7ca96315fe4cf23cd19d872329baf6683d92db72939217086fdae068f45d355b9b5a6181a35beb4d845ecdb26c5b5526292ff0a863b7a19bc"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x6}, &(0x7f00000002c0)={0x0, 0x8, 0x1, 0xb5}, &(0x7f0000000300)={0x20, 0x1, 0x54, "187096064a30cc20944cc0e8ef23ef544b8fb3db6f6c3de7f8fc6a2cc31b6f6d20728a81dc4e991a4ac77b46470c956621bffe79370d6042f8c9ec542f44ae8c9a922fd9ced043aa6b5ecc485851f14fdb4fcc54"}, &(0x7f0000000380)={0x20, 0x3, 0x1, 0x9}})
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)

1.081171397s ago: executing program 0 (id=34):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000740)={'wlan1\x00', <r3=>0x0})
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003a00000008000300", @ANYRES32=r3, @ANYBLOB="05005b"], 0x24}}, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r7=>0x0})
r8 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_REGISTER_FRAME(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x28, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6, 0x65, 0x40}]}, 0x28}}, 0x0)
syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff)
sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x70}, 0x1, 0x0, 0x0, 0x850}, 0x0)

974.682856ms ago: executing program 0 (id=35):
r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000011c0), 0x8000, 0x0)
r1 = fsopen(&(0x7f0000000080)='fuse\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x8, 0x0, 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000840)={0xc, 0x0, <r2=>0x0})
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='io.stat\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x12, r3, 0x0)
ftruncate(r3, 0xa)
newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, <r4=>0x0}, 0x4000)
setresuid(r4, r4, 0x0)
mincore(&(0x7f0000185000/0x3000)=nil, 0x3000, &(0x7f0000000240)=""/68)
r5 = socket(0x40000000015, 0x5, 0x0)
recvmmsg$unix(r5, &(0x7f00000077c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x63, 0x0)
ioctl$IOMMU_IOAS_MAP(r0, 0x3b85, &(0x7f0000000800)={0x28, 0x4, r2, 0x0, 0x0, 0x0, 0x5})
socket$inet6_mptcp(0xa, 0x1, 0x106)
r6 = socket(0x10, 0x3, 0x0)
write(r6, &(0x7f0000000000)="2400000011005f0414f9f4070009040081000000400000000000000008000f0001000000", 0x24)

853.595286ms ago: executing program 0 (id=36):
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='setgroups\x00')
r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x3, 0x2)
r2 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
listen(r2, 0x0)
accept4(r2, 0x0, 0x0, 0x0)
timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000))
r3 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000340)="d80000001c0081044e81f782db44b904021d080201000000070000a1180002000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93", 0xcb}], 0x1, 0x0, 0x0, 0x7400}, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x4, 0x0, 0x7fff0000}]})
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_int(r5, 0x29, 0x4, &(0x7f0000000000)=0xfffffffe, 0x4)
bind$inet6(r5, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c)
connect$inet6(r5, &(0x7f0000000140)={0xa, 0x4e22, 0x23, @loopback, 0x23}, 0x1c)
setsockopt$inet6_opts(r5, 0x29, 0x3b, &(0x7f0000000700)=ANY=[], 0x8)
close_range(r4, 0xffffffffffffffff, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
ioctl$vim2m_VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000000c0)={0x0, @pix={0x0, 0x0, 0x47524247, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4}})
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x0)
r6 = syz_open_dev$admmidi(&(0x7f0000000280), 0x2, 0x0)
ioctl$SNDRV_RAWMIDI_IOCTL_STATUS64(r6, 0xc0385720, &(0x7f0000000080))

131.214611ms ago: executing program 0 (id=37):
ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x3, 0x0, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) (async)
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) (async)
munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) (async)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
sendmmsg$inet(r1, &(0x7f0000000900)=[{{&(0x7f0000000080)={0x2, 0x4, @rand_addr=0xac1414bb}, 0x10, 0x0}, 0x20000000}, {{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000ac0)="6cb76def2c36dab0f366cf47ad785ed2fb5e1fa5fb56d566acdc377060c4ba50a58104620df72c3004bfbc77173110e163f7d8ad60c34cdb064852353438fea809e390e392afbf35311690cd8286a6c49668aee29b7537078dba77963d15c085d7343c1012135d361ac15c082b7ac8db87cc10fe3ffc374c8be18fc53437100a11dddb9981072ec036d513870a5bbf62ce9e39f790f61ef997af390b9f5fc8a699e001c59077c459eb40ee80a3ffeb35737da668ef974592faf129325cd9ad0dc5663950a329804c9f5d261f71165b05dac212cc2afc40f980ddef8773f1045e75de4ec606aef87052e9ac784bb0f5a43f9cac5e44ae1a6dd575ce17a4749dc7cd4d7f76a40676e792e5b31a25703b1f35b48a89ed84582ef8f4ac046695f402c25da1fa6bc732a7016edf093b4c31193130b3bc143702e2b1d23743ca797b24495dc4979b81413701c0597dcd5e3bcc9c2050c18cfe03814d358e0f795e990dc44d2c1b9890514bd5ea94a3f3a1e25a8cdc67133e9176d76dc54c31274cff0101d8a42c103bad1b8b57362446f2c2ed8a69daf3d7306ef3fa2015e4ee1ef3392120b82671d73b07f3082ea69ffa0ebc7b53c78862a3e1ece518c1f0abbe4053b4dfafe815c1fe4b0d079446e80d13af972e00644a0188605d7309812e24cd1158677f94a16a5eb0c5d48b60329fc522026efa596ac913540f2a9b0345f279329bfba29a7dfc8894e6a08eeee3dd974c3de9e0602cfd1e3e584b10dd26cd13f7fb432e72ea85fd1d3a872061bc967d7a67a3a7f09f34cc825db5d9ef3ce0ff9873f8eff342eb30fa970007e2f591f07dc9bc5141a9679a2f7c69aa50894353a7830a0f7cf766aff6e81d7c3b88d730946ce3f327716ef6fd270d5bf467aef288db903f740b6ac27b962a3c6462372e63f8da8505f05d17b364dd8c6b5d449accd01b4c6da297669f098bee986b95e389a2d003539ca9dec8c26b9f6bbb5f7fe6f0b764d99bc0dafcad4121ed6a749ac71fc5deeee54d0e8a2d9dccc87df818258d73c8816b78c1be3670fb14dded879caf925e0f8abf63f55ffee02bbffb465f0303338bd12e22fe94fdaa3f033127ecaf41649232c38e83850fd3ebc890ea5db2763a8389ac49bd9b7f6b81f381d3eeb90d0f596e2b7f7dfa2a0e9453c1f5f359b56aae9e97a51f6c092d25a031843e351f5733a25c5905706618ab569359bdca4932f6471f4f2d152f84cfc0c563885b0d93fd015095a8eb9422e3d17ddaf3f20dde5eeea415f76c0617964198c824b98f4d53ab0d4d734dcd6d07dddd5b77c1bd71208632941973bd5b5aca981137ec21dcd86ba518b3d4979b68f704a2a7d7cfeb9be3edf4b4b3560e930d9dba0bc358cba36a129748c1fa73483a69759ba0c4f2ee2a936899e163c213bb3fe5a28e68669fb2da6bbcdf4c55e933d127a8bc68b8d0e6c6c757fe8ea47f26ceb7c1b3ca8b962eb31a081756ed56fe4385dccc5e2a7a53300e9c8a1a55bcf8db3f828cb3db8485110da631a50199a5c1932b5538a2b1c3cddb4451868a413418e3f761530fd477b2ebb449070c73171964203ad7bad4302af13fa6fe55fb88ede096a7aba95ef3665da778250daa9dd4bd5ecb8a807d83fe6dcf2f0cf5de7a4ef742979afd7d93bb2672ad45f6537640313b1ca8838f3fdc08e57455af6398ce5b253312fe1a88206210831e0de59d1e3f9442fb9dd43f1b9c00d151d3234028990f8bcaf65c0ad9ea1bc20e4b7641ff26969b02ccd60d2d8d2d72fe5fd58068cd6d7525c9e24c4246cd776ecf1f57550bb6bddad5093618797547cde5c07e165bc979bfbb5479c58e89c29efa5fdfa5b4a87917a4275609afc849384458ca980ba5a2aa4d10c761bb3b3a57e3d3b41001cdf6", 0x541}], 0x1}}], 0x2, 0x8080)
ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x15) (async)
writev(r0, &(0x7f0000001540)=[{&(0x7f00000001c0)="a0d4bc47a554d388104ca08a0eea11b59c202eae0776f2fc384c874c306328331d0762077b5ea1511b02cf6448c5bc69b5ff4a26964df4c5", 0x38}, {&(0x7f0000000200)="f8cc4bb6738c17995d1fb34074e7371ec3a2cc9deb43f528bc24fcfa1d26411ebe9a656a0884cb1a4776c9b0c41a7bc5b1f9ddfd59e6c51c9dc72ce05b84783076edbcdb333729e658e349250df88156d438e98944a78d8211049e2734c83009cae04deffb93fd2c8e45a8eaeb6696b4b355991b75d8", 0x76}, {&(0x7f0000000280)}, {&(0x7f0000000340)="c03fa3276f815850f9653628862b8d0a763906819580f4f401e9a347336a5e2c48e79656dc1ee83275735a7ca0c8f5c63d806d7e3b3e2f5636a886a65c9ab7f692bdab094b731bbe2d3676da9850e4ae2ee7fbfcce000589db5f4aa43ba6388e675aabcf32594eea29e20f58d339e4fb70bbce0aee0d9fb23b2c32e4b99018647bcac5774949517d771987028a877be45a09478dc9e76b25d784f5879ef2e82767510b5194b67e52f5231cef902983d72f66663cb504d4e8e10094d63983f89e5a02d0090cf20f3dfd95565044c4451ab91c736ef7de0c90", 0xd8}, {&(0x7f00000002c0)="7157cdbf630327fa7780573ee1182dc3f3aad14b009d4d564bf2a910d84c877480a3bbb2335dfc569e", 0x29}, {&(0x7f0000000440)="25f807213a5964904204db99af562181287a35bacd6dbd365b586484f5fae3914c881c6c686e03c6239a5d19ca297d3f2cb05860e2d8ecd980325e05ad7fcc57ae3711c2010aa81cd550d604dc46109bbd7051ac9e9e90ad6eae28aadb621c14efa29cf92362836ecc0b24a4faef534375375bcb04e4e4fb1f9e4a96ffe621d790001cadd4e5d8f471fc4f7ac8ad870c6396126292fc995dbeea99b3fae6aecba3c5ab403c2cf3c67137b3f196607ec833ee1651caf6071c80107bedb36c192c0806e9639c51982549b95cd23452d2ae79f2fde07ce792b90a8ca1936c3b4295", 0xe0}, {&(0x7f0000000540)="ff86900b0d344a3b46bd1a4cf429240d557f18a6cc6927de6c14e55713195d18a1bcf76c6b774ed9c20897fe60390cbe23bf018644ebc77d0b0f9c12fdb45fa41c13b1b6e24453d9bb582ee46cd6f3159f7d6c0d2afaeccb66e3ab766c3abfae84ef2880d6c4e7c913b80319e7cd872e9cbf1ca981dd15f4fd735e9f609423a77a32ca2c9a24a7b4aa3f5c571015d946e32c8dc0afb7b3a17b8119d885b8e992d76bcddaaa39a00cc8d23d15780d3887c2096e9dcf872ea858c63bc9463a9a0cedfae3e0478ba6e69682fbec37a6030f4f7ce364822ecce38324efae69f216fe6e2404da028c3cde85dcc00bcb683438ce1c2c69fca0147fd41c7da34f25927aff6a0462761313d42e5d54a7676c0412d19d7979327485558cda74999fea4c41fce5a89c7efbcf8d1b2118ba40f51af1eeda3fef0bc67a1ee2cefaa73b5ecf620e678446a0fe083bec03eea9a32f1a881574e07119e66c4e513bb06cc58403b709494fb80ec7484316588dbc4fb9c1332f27aadbb434c13e67331be33edfd4a968f623adeb86b8aea35495dfc7dacade74e7ef0187f2892ba9a423eda3993245ae523053e44a14cd6ca5ff590435104975b058a65bdd97a5b9489e95c4af1ffb88cdb18a721f5d33859fd6d787b78c46ab8c8b914ef6b450c1f99e10dcda43fd32b2ff51308d5270de72773324a04de102530900faa1d6d3de6bfe989bcc84e10cb4f521daf9ef8f4781a38a07e538f40dfb04612160adc7ce150b1f4b2d18454efd913fea6a2877ecec593dcd8e009e0bf2edc51d8e77bd41873a45c246df7d8d40726439c5224c5334a0a8202e5bafdff5fa3d502d9f9ba727458329bf7a1a0fa57feda56421b20c6c88a496e992583621f01c2235a6b457fbb0a0d5add263ef26941652030d8346ff327b1d4a9df8696a7c6898b303c4bd40679293267ee7f1269ed245dbcc4484d88990c497afd1c31b5f5a4ed1157bb1171c6c94c4e495399d312f6a42a6ab5ebd6186624cddbbbaa576336788135ba6e33e376caa5e067875b826b6f5aa5e901d51ae26b520262ac072af08e42fcef2f74bfceb0e33254dd02eb4399aae9ea61b8176a6d45347ea7b51c4a809a14855824aeac4a1f225eff0dc4cedc7464449ca0143c64f3c68c23262136db74eab9cdc9bc22fe38c6fc310cdf051596dfd9a019306aef77fad9abaaa6f044e44f668d1d8f0ceb3a95a1ae35870516401cdf9fbcfadf02dd24cb8881eb2622bbaad8d8105278fe22a8e3edfbd6e18f1c3c2d670b5f096ef9ec13d2f16a0dccd21f05240a66dd9edadac5fedb01d67a1eeefc7abea0ac2aeaf945bd197b8b8b2291e8035444e14c74fb81b13d46e2296142cd43ed36c2555f713bde478e5632b800ddf79a0a06637f646b2de5262b92036b7af3cc205113688d3ed68763f193f215403b40bf54858fbcf785a1457f91db29b73f1505032fc58a8d5a5768991d14067e645b14526c5cfdc159c06c4e4053c26e72b5ad1a150e79db17a812a42a118083ee8dadd1d094c6f1ac28493a0c0272c1e130fc0637dc58fc3cc10c791282d4c6999992fd233d88c628fdb8568f4dd8b780c5bdfd506a8b6561f457ad0fe2bd0e3041b1bda0873214a49c8091d8ba3a69ae7bed2b68f8036802ba4dafd8faf044911b57837756d2c01b0934f65ff197525f3e9c79b349d8ca25a2a014a063d95170d2e13ca3cc8be39dbbf3c1cd964358a09d9da38a62085da0b2ff6a3c94b6c2884dfa819f8b9e73952facbe971afc60c11f5beea042f5fb02e47eb15bde5f3f817ce562c901d7af98c3abc1ae584a62c8d44cf8df72abfead8b462290f9864b2905de4141691914606d4e1cc377c9e2548cb149204808a818bd06e4cf860e30a2562c67c0056601269a03720ed00a9268f9701933e3076308d718d78cf8f1a236a10face97a2125ff18149623fc6d367ea103f03267ac307b454838e093c320ec3f62080c72c97a6336c32421743759be448e16a17713553ac5c36c16c373f8235a9eeb542ff43474e1bf5346b8d4906dd18636fb62307e6ab1f989eaaf68246fde3b77b448fb86ffbca7b664cd43691e7ba1f409d888046588e2268d686f2b68f3169bd63355e64987947e8678b21dcde757598b8b9f7174ff2d6980a610107b37ecfac98b18f4c614cae8c04acad9fe2229005db24794b9044f26e440304db71db5997dcb045d2bf47d6f93d3b6ca285fc833a0c2a4f75beec380d4d455b18c5e8324b884b3268d4ed898e82b0101fcd2b74fc04d344c889a9b9774241045d3184df598f0da9d145e46baa2a6b030b74ba42f6273f78b7d67b121ba3a7ad1819303605d3028f600e783989cb30235e689598716864de12285dafd45b1f815e75c265eab7878bf7d73ffdf7e998555291f50d6b7ad1c2105715ad1e62b7f6e2a00ceb9648438597c231888c7c356e8ea2dcb9be23fbe6d7b5759b7a911db73bac029528b3bed2c90f62abad0b7d20d97561e7f93e99b58a097377d7976bd5339256aceb06e4bba7ab9f58d6b28086f4f07b1a03492453e9776296b5c99ac3bacef5edcdcd995e540acd60cbd3798e0db54b13ffb8618a5001b6eb9f44aa63f1822e157bf3f463a1708ad5a9bc14526d0e84d3377ae7fb61b0bf03467476a928ed2358051a7ecdd00345c49ffbe96e91a20111d6834ef88285a70d7a438f1d936958cf5987b8867e8cb7484a9742ccf5e42dc23b855d841b307cc532e9ae3a49c12e1199c8c87748b25f7e9cd5044510f57656a31a2db7186965b8cd8603bcc0628bc4a40e8d31b491a178ede4351fe1f2e01011110b4b39ec45bf91c9af443185c35d80ebbaa11943e7b7b2bd07b89c838d6cac99e9127f26452317e44aff5682641729f882e104a6ffa8e264e072b24cf6c6630e0dcb67c7433e02cc35c684d8a8f65f9301944eb3f2c8e389ff2bab75ed368a564de0b7e22c353752c5301d3f1e09763517c623ca499e522b66864266f8c7cd35ea0bb3934723e00bbe1b06ecdd306be809335cae5e4b07f321158b4b7e29332a93ca5d14f5b408a3ffc4df6dfb99ee86c920b7c95ca14bb6b031a38fec92db84d62e446bc4c4958ff35a92dd17794b86b8c65809ba0b48e2face0775352b166c0c9000f16cd6c1deda627795d5d0e5b1c3fefcfcd40fe238890e307ba582ebe48644072fa4bd1b94924e381229e5e314a16c59b226ce8bc2ec0dadc61e34c5e5c9ccc977f3bc12d23e662e5fe978233325e0eabf233c0cb03a9d904c90cf92fbbb92381a541d0a9a5bc312bf378d0ea694a58d984fd0ba383ac369619167195a79d949c44e6d5a00413ad8ad0a16ea492917ef1a8eda41b4739ea67f26174710eba1cf97422036be009a199813e3cdb2f092b653ec1dd56091b30c8106e17a8f3cf2aabf451415a1b7dbe481384bf6cd89e8d52b75c18882310d7a2b80fb514f1119226eb4fce5f51aa1b4d1a46886cfe7789ecf416d81a9e1606917b14ef332821a76170d017fbe8b22bb2bcd3b469539dd9346b50bd2aa4c6b0479a7ab5433a94584a40a4f5371561c77894aff0aa46a05d0bf77ee545d61883366d5656b4098bd9dd57758b839fc36cedcd8b7fc8e5d117f29f58f9117184f5ba5b58c9351eb3d4a4f77f0c20f6dfb001c1135de1f2c6f23da92410240b93cb6f2cf489f1af2ce91d357e199697c6c492cbe1252d4fc931d317b012b62b8debe6619b7afd35ba83d353da6bf8bb4c9210a975010c9f1ef48cf4025851730b2e60f5f77f2da7d5759fa91eee90a27168bb57866747b248ba69d87289d15cd6251d1b7c3a244ad40ca0260ad144db24e4d9934f730681635e46b0c06274b7c5c08ac98729d70db9b0ce6f222783fc5e74c46471c37fd66dec8d56314f4a0d4176d3a550165da5f97f289fbbeaed16f2cd8001295321d54600fe145550503a3f9ab641b2683e1d3af7195830c7d48b8f4664bdf20ec2407f0c658e1c03bb20704ab0408ee24091e5e03eb00b66d6b7a8fe530759a3d5750e83a1e5e5a294c1e9e76a59efc1a6464349ec797aed6948ef24fdfd8b35d40874b80b7a2e3a386772a33676084f81ba1c50a10ee8ed469c8e63da7de3debd4b4456861724a56fa284415b2da294ccb5b2a099cec4abfe0da42711d9d6d1e86800befa9cb4c2623ce90771c1c91c1ee546d4ff50ae228df4fa50f5ce8a20ccb5b9d5a58dca16287ec59ce73b07b071b0ae6cd268c43c527e595f41c9066248e0291eef803c8820af2d1695327c2ab73f0109d0ee978b6ac7cb999a6864bceeec234c2684b8340dfdfe95759fb64e5443776cfc3dd2b4b1fa558cb50cca1f66b59727fb20204b65fa8210b179ad3526e3e7d07d359607fc7d5c330793f4e835de6b2a5b9f7d261bad77f098cdccacee79dd58d456eb1cc7f689627c0a5a8a1846a35f315b6ec0c371dc259244543f4f5fd2421f8105a1ca0bc45060b1f5d12552d20ef009f7fa5ecb9248bf334728fd712fe94df52355ac4f5296127e7b849783a7f059bdeee8a791d903541663c88105511de478a64b5a39018bc362f6e66bd81729fcbf73545e1bd0e0c29139775677499d298fe9c2d16510d6365c4c145f90a52b50d4c125af5dacba553938240a1e65c8c80e7ecd3aa217d86e1ba9c3dd0ff96ae2536878d840ecd8b5169288f7b2f8d3723155fd1f32e2c828c512bccfb791ce2dbca0577c77bae0464c26a12d106655872d57b447c47f5685333d1d1b94d07536ae84e0153de43fe857aa529e3f5d83ca077a5a4d0e6b07f1b220ee82247acb6d39a73b5707914fa42e6298a7434dbca77223434c42b830d39453167fbe5c47c02b84b0d24a5684a0ff9436731b4300cefb70deb207c9e54018e71c9dfbf4c1df33a7b8179626cceff23011daeadd9479c49b483196b6d700df4c37c0f5cd6c9812a2eeb2ccec3801dba278a07838c828d5acb9f0dc8fbb5eb67ff6c29addcfa44e35597565b67c03d8f108ca12313efa1570bf234384ce942c1b208c1add60657cc0d10a23a989aa3737b8a923e4e8bb9085f66dd2a1e2973f376f4eb198ae614c578e7be4cfda033085946d7e146436f1f8f2d5c5d70ca94cae6f91563f55e5b3a5886364db0498f15df45c1c9eb153de39efa7d0d78e984d14894eb17b8408724b78584ba3d0a7a8007521f99176f94fee6935ac84464c7e4dc94e3e6b38ecd7bd993dde6379aa80c989fa679ed97d6633712e3e8d6e28a5d7da14ee459e903c218c7c39f852a31cb5c5966b44d918ba506fbe90f892c74a8c58688e3a0effe8955eca0dcc491b551e9b87a347dced9dc47cfa872d4ce9f7bcd7db727728c220d00b7593154eee95df6d67e2841bb4d793e198c7fbc8ea7f6d889c72128afcd90e28410c56e8d4f7e49c25ed28c1d91bb82b1a0baf7ceca11da390c04dd1a82ef4d4024eb36473d0a69de6885eb23e5b0f38e38ccaf6265f44d52512a97538f817985072802c45e170b88df71ef7645470e02a7b4d492032c53af445778114cc47023094b98c953ad61c4c3794edc56e7f6abb4b03dc95ba64c03cc3c7cf33a9975ad0e08cda92732f6ae9b493e256349c055dad34e8ace79dd51ecaecd588025648bf126e65c5c2f8660972720fa60a966e9ad731ea14d40b47fa0126a202cfe5a7675fd0acc139d323abb64ad171132be1a1723eafed6e6b8e49e3eb1808724e96b7410bde3c8e2e2fe31e73462442ff92034f786557c5b27d596cb4535f6c9fbb77cf94ebbb2a9148636a068c5f98213fcf07d367c8212fb591e349c", 0x1000}], 0x7) (async)
ioctl$TCSETS(r0, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) (async)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x0, 0x0, 0x7, 0x0, 0x0, 0x2, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x4004) (async)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="b8000000150001000000800000030000e000000200000000000000000000000000000000000000000000ffff0a01010100000007000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000ffffff7f000000000000000000000000fcffffffffffffff05000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c689562a22310d543a098abc9679144e6cdc4abeeb914185f5e8da61933d900b7491faf39534f07e1307d485ce3762fda1661b92c954"], 0xb8}}, 0x90)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180)=0xf9)
ioctl$TIOCSTI(r0, 0x5412, &(0x7f00000000c0)=0x2)
get_mempolicy(0x0, 0x0, 0x6, &(0x7f0000075000/0x4000)=nil, 0x1) (async)
r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r5 = syz_pidfd_open(0xffffffffffffffff, 0x0)
process_madvise(r5, &(0x7f0000000040)=[{&(0x7f0000000000)="1f", 0x1}], 0x1, 0x1, 0x0) (async)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) (async)
mount_setattr(0xffffffffffffffff, 0x0, 0x8100, &(0x7f0000000300)={0xb, 0xf4, 0x40000}, 0x20)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000100)={0x48, 0x17})

43.640112ms ago: executing program 1 (id=38):
mkdir(&(0x7f0000000300)='./bus\x00', 0x14)
mkdir(&(0x7f0000000000)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x80, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]})
chdir(&(0x7f0000000100)='./bus\x00')
sendmsg$RDMA_NLDEV_CMD_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0)
lseek(0xffffffffffffffff, 0x3, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x0, 0xffff, 0x3, 0x0, {0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}}}, 0x32)
writev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x34000}], 0x1)
ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000340))
r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
r3 = socket(0x2, 0x80805, 0x0)
r4 = dup3(r1, r3, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x13, &(0x7f00000003c0)=[@in6={0xa, 0x4e21, 0x200, @dev={0xfe, 0x80, '\x00', 0x1e}, 0x4}, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10)
mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1)
setsockopt(0xffffffffffffffff, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8)
read$msr(r2, &(0x7f0000001a40)=""/102392, 0x18ff8)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x5)
r5 = getpid()
sched_setscheduler(r5, 0x2, &(0x7f0000001700)=0x4)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300))
connect$unix(r4, &(0x7f0000000280)=@abs={0x0, 0x0, 0x4e24}, 0x6e)

40.10251ms ago: executing program 3 (id=39):
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7fff}]})
r1 = socket(0x80000000000000a, 0x2, 0x0)
setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x4e23, 0x0, @mcast1={0xff, 0x7}, 0xfffffffd}}, {{0xa, 0x0, 0x0, @loopback, 0x3}}}, 0x108)
r2 = socket(0x80000000000000a, 0x2, 0x0)
setsockopt$inet6_group_source_req(r2, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xe}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_KEY_END={0x4}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xc4}, 0x1, 0x0, 0x0, 0x8000}, 0x0)
r4 = socket(0x80000000000000a, 0x2, 0x0)
r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0)
bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe)
listen(r5, 0x90004)
syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16)
ppoll(&(0x7f00000000c0)=[{r5, 0x60}], 0x1, 0x0, 0x0, 0x0)
setsockopt$inet6_group_source_req(r4, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote, 0x1000}}}, 0x108)
close_range(r0, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0xc)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r6)
sendmsg$NLBL_MGMT_C_ADDDEF(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100253d7000fbdbdf2504000000080002004697028e59d749b40a000000070001002f2c0000"], 0x2c}, 0x1, 0x0, 0x0, 0x4044040}, 0x8842)
r8 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002)
timerfd_create(0x7, 0xc0000)
ioctl$SCSI_IOCTL_START_UNIT(r8, 0x5)
setsockopt$inet_sctp6_SCTP_INITMSG(0xffffffffffffffff, 0x84, 0x2, &(0x7f0000000080)={0x2, 0xe6, 0xffff}, 0x8)
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000004540)=[{{&(0x7f0000000040)={0x2, 0x4e22, @multicast1}, 0x7e1f, 0x0}, 0xee0000b0}, {{0x0, 0x0, &(0x7f00000012c0)=[{&(0x7f0000001100)="15b26f226e2966667482d50903b0a8d92ccd9e69d5cc4cb3d467a670b237a9225fb56c0f7ea725dee27c4bb43bb50c6748c83b71d59f0537405dfab648c096607340fac939a2efd31cbe2f8ca29c409e87ea0974b7bceff9afef5d07d691575f5115f2f961ad488e3386036913e98181a6034febaab853a3e928b9035b0e3a8e1cb393c70f6d0448970e0af2476f8b923ee09c19deca55d58f70e8eeff55dda6381cb96afe97196c0af0a8fd450a1447a1a521e2c211fb84cbcf4aebd31298972ec6bea1764fbde5500fa30c5f2459cff4d7f123ab94cfd5762d586ec7a28abc2f8c9e608f8f964b96ecb0883d60d444f317834a3d734cb304051a60d1a084a84da8f9a23a1b9d4951c0a81985c63ae193f40e9deb358b2f08553324fd6086be9e70e5061568abefebcda50e70f4dab2e4dc0cf6d85aced044d7005326922886194895267165f7f592036ebe11dcf1cad98f5cda766eaea90fb4cb5e793525126c7594f8599055192d63a81d3cd26aadd50983f1c3f1d4655c1b5f59e80f733e3abc4792b760729fd26298ef15141cf76cc4", 0xc3}, {&(0x7f0000000d80)="7d68e6de85f9b0cbc9d710267f321ec64eab043ecad9af7e01e9463218ec45924a99867163e468d36a682fadd749caa325e685d75559a87139e02fae7271be8f55671cfd32a09896278d1941370174720838039d0989bc3394b8a4c4f4a30f0496be313d6d60fe47966c634a3ee1f659e8ef310647725bda0130d5de5028220a4cf5fc808a75694738ee26cb21302b4bba4265b845a5d5dce706d9820c6936b122f9658446d74a9016b94424971dd443a6907eb5c73b6b200e92b23f2c36a214729b0bc231511e4c", 0xc8}, {&(0x7f0000000380)="73fd71361e8d6c80ae1bc9953e2a4aeac7a314273066fc7f65a51969b46df1774bb0be94ccd4824f2d57ad2cd37242b1258402395481f9f07e067652e52aa8ccefcd0962ba0c48757b68d493f3ad702e65d4daa7dfc1605a173185472ae12470eea64c70ef4e64793b8a830447de0f423bef3964934eef4243cac42939ba6fa68d821b9373b5f3e2c26e7ca75ed8fb3203aef3a6637cecdd0251532b99537e02f604058f50e66c8a657d59beeed127695475f082d3d2b9790181fc987ad000ac00887d1506be89f388ecb405660b4ea196ee8f5a92b12ec43bbf49567db613d478ebe2358364f7600bf4f80ef4b2756fb13416c4fa22880cc96a03f07888575aedb001d5a74bb2f906797912b5ac080a0a3d361425f1a92ab03bbe65d5dcb235f43b5ad1162a16ebdc647baac013bf076945126cdd5a080853976a97ad55184601102fbb8df86b21aa8162858d74465c5fb7dc766602a3567f6eaf441f85ec50ca7fb3a4fdb450d1420531da25d01a412958a5e3895c59542238cf8e188e7fb5641eb24a5f1819bf8d2e9dd6c1d0e93564d723e311db9cd268bb1e477036e822b135cdbaf40f812aa7db01d22c829ab01ae24997dae96ddeed49e62d285701d5419e3f94a8b95790cf5a296ed15bffae1f71470c6a6eda872528844a2df42590d898630263cab5cccec57b7cea365ad8c91bfbe7cb419635ce6bf340a56115c0ad922b6fade9538e543bc5def2a85d35ab16d20c219c4733837be2c14ba4d3d32c3a6882ce6857626f55109b4cdcb634425d710bf3108f9b31b4af0cc17a58e49e871a56126dd8bed08e038ba64008587237b3442d28032e52fc9fae1a5784ba59d0edfa03d38352724903ed6f6970b3f4dfa6e40bf933b6765c6ee648174765f1e8ec71b80cac86abd065a3005b40a43a665707cc590997c5048183006a9dd8026d39def05950183b3d4f12f4e1644ef78cddac7c5569985c2c232bb350f28857675339e53f63a868704d2e0b38993dc57a02d3e297fc9a5b9384622841018c303a05bac25d509df5a2d0e3232927283fcc3ec67e4fa7b71d22f115cf693851dcceab4bce38cbfbb32829e211cdcb6a359e14fe416663541050d340aef2555dbd292bd9cbab8fcf20378149cc994569c2bc95fb33fd2d9321b8ac8e5160b02e202492f470eb719a8f2ac3a4be37ea0918b54b14789b7aa228d47f7b13fd9af608740c5a8fe02109a7cc0e555b22628ef790e513ecadfd338d30aed8ca219e64ee4fb0bd0e21e5101bf2072ffa071eb1aa0454caccc015ff1e166813f819a142b56a22e4ff387bb319288a0ef747c6fc8fdee3a0e193b0d086eb816e97e0322fcdaa30da61cd26ac9d8d0748fccd911ce0fd4adc953e9486e137fe66bc8aedfd5b78c562ebfc578ac9f96a453311766564541e16955e30b95914e9411a0b4cd95e0d8732d5ff7a4f921ef41d986a195334266585353b16b9449955523913a30c087532bcb899f733af3abea59baea174cf04359547a633b5f8a582ae3ef12a1d0125bef8c6e8c9fb589d3597c5ab3879491b0c5e3607203f06836a6805d3f7979c4325f9fecb2aceddedb272237132460cda812ef7d613a585898d59f92ef68ec95f12b47b440f6d899ecbfab48055e0c1605ba4cd9dbc17c4cbfec8a953ebbd38c45a6737a57ee58e21a20e530171137968ae4f0d0366cdb0b9d6a4667b011fcd7cd9e77364e5221989d8f0d80793260e748e3bd394849c090c744f6044328304cd6f02e941c5405647daffc1fd2f2864b37f92bbf4931c8e4a7c6bafd0ea79d39d330e70e6776bf6a926de227e5a43653bba04883e98d67bb64aa86e8bf271ba87604bc598e47f2992c7618ad25068860a481554b53352c7339de7e79c3bd1aed5bef8f398432858c888a5d8651969ea40eb3d486e9fe61d49b20500fdfd1548f567da970103d36730657c35d03d2c36b142665f62203b1fb12d616478cfef6f38b34cda87a634dd06d359f33e98b94a5e5b46b2a8d73126352d1d5b65af75055455cc903e384c41876fbdff935d047284d9d203b147a6ba0e9cb50beef7798886c33d2f2f0c0d9abe0e32c7c809f8b0b28fc59471987353c862a311776b8275bf319d5cb9a59f8f103b6e567ef5dd8859973cc3fe41e356bf5bd3186240e49286977eca36a8ad44185973b276cd7958b73e14a221b7fd567818bebf54ad27ee95161bd2aeeb356482ff467500a7d36f0464f58a591ec6b728f984ec78d0abe14c6d3411ac3ffc4c3179d1f95d029f26cceb545723519d3d4209a2b1243e78767273c13dc2bd320512674b6f1a50313bae7b9d16aebb476dbc829e8fd8dd46a1696efaff5795cf75de57c90f05ed9ef4a5cdfbf20d3d9ed95fb4114b1d5c9ade0856212e7ba330ce5bccf2c993dff89112b28bd3b17d3fcfacef7590f62bf948977dd79e2d8025946c80bf263e34035409b5ba1443d4929727180761bd56d258c3670a0aa4de21111fc3172367582de2d164ff3a18d0696b8dd8e5c1423b2ea1e2c0cfe141e4cf04f8cdaed48976b94c40d6a581300458661bbdbfeeb4969af6319eb1798843d0872f68f0c6537bbc9c7dd1e9b0564bf442d8d25f8aa884aba1df074d374f99750d9227bb821ba0355f60de2829a5c8cd47c89d29a2e3d7d53d59db5c3ace8f484664202c210c68a3b33076fb00d59938e84fbad6d6618c0bb89cf94035fa2de4da351e0d71df416450ea7ec3af33aa5c0313c63e654bd79c73b39dc1933636956761058d76648746daca469f8fce62c17a8160cdefc6a927eef9ec4a8dd684e46f35282546ce2362ab8afedd39bf699fd7c2cde538f52ea43c08558f42ba77b2986b800c45fa76a130b30919b3e1d504573e3c1e7dd2dc5d81379df53d736511f1da4ad8791e46adb27bb5c38129e89edda0aed99dcc03fe400f7d05d48e3e9e17744e8487f8ac464c86f7332211fb9799e9d27a6832d5f17ccd1a2da255f6da047e4728dd80860c04391bca4b7833f0346866401ec20033bcf6dfa85fd1520de5a03b4f9f6f5d2f8d7b6e7d7df1cbe5c05e23e080cf335639c94c48aaeb0bfebbe79530d67d35fb101c91839954c0e50dd4b90a86428b22b0be1e906fee30f68d7ce4bf9c68eafe695f07f5e4e4d473d77104b7b1b5dcfeb84e8c83624c0068d4e1cccfe740f8e5d5699603f8481ef2a1f2d4b8fd2314c5cb1985fe34cf8ede7d2e8bddea269422490903489c7f5951114d7ccb29a19455a987d538955712a460243105b25ccb6e6f34c370a6bbb234bee150dbcea5188e45305253f1014f7c0b5d60d517d2d05707f5ca9249a921d6c5307caf41deca0509b49102d801320db65c00f6e1c05fb8c2e1cc554673bf6168dd64086b19af28eec508fd0c304837e802173ac9947c4d73929c61d9632ab929a25f2a04350954612c2de705c1c25215284fe933fc8ccfd30ab3fc9ff5e04dd68d4720d95a29d6da176ac9d332c9ce77358f3c262777ea828fe6473638bc77be2aa586a3733e275744bc42c3742c1ad8f89d25c31958902f2f498c58fc85e9b78fb7a331734cb081cfa9ccfd262df927c0ff46983f8765af4add3532de2b91f2436df028", 0x9fd}], 0x3}}, {{0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001700)="a6", 0x1}], 0x300}}], 0x3, 0x0)

0s ago: executing program 0 (id=40):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_int(r1, 0x29, 0x4a, 0x0, 0x0)
r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), 0xffffffffffffffff)
sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x34, r2, 0x200, 0xfffffffe, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0x17, 0x0, @udp='udp:syz2\x00'}}}}, 0x34}, 0x1, 0x0, 0x0, 0x8040}, 0x20000000)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.1.132' (ED25519) to the list of known hosts.
[   82.150052][ T5808] cgroup: Unknown subsys name 'net'
[   82.262851][ T5808] cgroup: Unknown subsys name 'cpuset'
[   82.271812][ T5808] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   83.878401][ T5808] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   86.083453][   T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   86.099440][   T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   86.107162][   T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   86.115445][   T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   86.123245][   T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   86.158079][ T5140] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   86.171916][ T5140] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   86.180854][ T5140] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   86.188860][ T5140] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   86.197003][ T5140] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   86.206328][ T5140] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   86.215317][ T5140] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   86.233123][   T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   86.246573][   T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   86.256914][   T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   86.279818][ T5140] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   86.291587][ T5837] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   86.300679][ T5837] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   86.309833][ T5837] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   86.318075][ T5837] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   86.833840][ T5829] chnl_net:caif_netlink_parms(): no params data found
[   86.891553][ T5824] chnl_net:caif_netlink_parms(): no params data found
[   87.135957][ T5831] chnl_net:caif_netlink_parms(): no params data found
[   87.235449][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state
[   87.242960][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state
[   87.250374][ T5829] bridge_slave_0: entered allmulticast mode
[   87.258879][ T5829] bridge_slave_0: entered promiscuous mode
[   87.286694][ T5824] bridge0: port 1(bridge_slave_0) entered blocking state
[   87.294070][ T5824] bridge0: port 1(bridge_slave_0) entered disabled state
[   87.302235][ T5824] bridge_slave_0: entered allmulticast mode
[   87.310928][ T5824] bridge_slave_0: entered promiscuous mode
[   87.334174][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state
[   87.342037][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state
[   87.349543][ T5829] bridge_slave_1: entered allmulticast mode
[   87.357519][ T5829] bridge_slave_1: entered promiscuous mode
[   87.365965][ T5833] chnl_net:caif_netlink_parms(): no params data found
[   87.379040][ T5824] bridge0: port 2(bridge_slave_1) entered blocking state
[   87.388212][ T5824] bridge0: port 2(bridge_slave_1) entered disabled state
[   87.395892][ T5824] bridge_slave_1: entered allmulticast mode
[   87.404058][ T5824] bridge_slave_1: entered promiscuous mode
[   87.529951][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   87.559078][ T5824] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   87.586868][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   87.607255][ T5824] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   87.616841][ T5831] bridge0: port 1(bridge_slave_0) entered blocking state
[   87.624910][ T5831] bridge0: port 1(bridge_slave_0) entered disabled state
[   87.632459][ T5831] bridge_slave_0: entered allmulticast mode
[   87.640487][ T5831] bridge_slave_0: entered promiscuous mode
[   87.680720][ T5831] bridge0: port 2(bridge_slave_1) entered blocking state
[   87.688067][ T5831] bridge0: port 2(bridge_slave_1) entered disabled state
[   87.695503][ T5831] bridge_slave_1: entered allmulticast mode
[   87.703655][ T5831] bridge_slave_1: entered promiscuous mode
[   87.762797][ T5829] team0: Port device team_slave_0 added
[   87.801149][ T5824] team0: Port device team_slave_0 added
[   87.813949][ T5829] team0: Port device team_slave_1 added
[   87.837272][ T5831] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   87.851995][ T5831] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   87.877086][ T5824] team0: Port device team_slave_1 added
[   87.910167][ T5833] bridge0: port 1(bridge_slave_0) entered blocking state
[   87.917881][ T5833] bridge0: port 1(bridge_slave_0) entered disabled state
[   87.925421][ T5833] bridge_slave_0: entered allmulticast mode
[   87.933622][ T5833] bridge_slave_0: entered promiscuous mode
[   87.956776][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0
[   87.963881][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   87.990290][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   88.005121][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1
[   88.012616][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   88.038836][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   88.064584][ T5833] bridge0: port 2(bridge_slave_1) entered blocking state
[   88.072288][ T5833] bridge0: port 2(bridge_slave_1) entered disabled state
[   88.080020][ T5833] bridge_slave_1: entered allmulticast mode
[   88.087944][ T5833] bridge_slave_1: entered promiscuous mode
[   88.121214][ T5831] team0: Port device team_slave_0 added
[   88.141857][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_0
[   88.148834][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   88.175620][ T5837] Bluetooth: hci0: command tx timeout
[   88.181403][ T5824] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   88.197563][ T5831] team0: Port device team_slave_1 added
[   88.218601][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_1
[   88.225862][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   88.252307][ T5824] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   88.291588][ T5833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   88.305254][ T5833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   88.314899][ T5837] Bluetooth: hci2: command tx timeout
[   88.319517][   T51] Bluetooth: hci1: command tx timeout
[   88.389380][   T51] Bluetooth: hci3: command tx timeout
[   88.401138][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_0
[   88.408243][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   88.434367][ T5831] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   88.480698][ T5829] hsr_slave_0: entered promiscuous mode
[   88.487876][ T5829] hsr_slave_1: entered promiscuous mode
[   88.496982][ T5831] batman_adv: batadv0: Adding interface: batadv_slave_1
[   88.504212][ T5831] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   88.530303][ T5831] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   88.544685][ T5833] team0: Port device team_slave_0 added
[   88.558290][ T5824] hsr_slave_0: entered promiscuous mode
[   88.565501][ T5824] hsr_slave_1: entered promiscuous mode
[   88.572672][ T5824] debugfs: 'hsr0' already exists in 'hsr'
[   88.578524][ T5824] Cannot create hsr debugfs directory
[   88.622779][ T5833] team0: Port device team_slave_1 added
[   88.756659][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_0
[   88.763906][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   88.790252][ T5833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   88.834081][ T5833] batman_adv: batadv0: Adding interface: batadv_slave_1
[   88.841262][ T5833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   88.867423][ T5833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   88.898060][ T5831] hsr_slave_0: entered promiscuous mode
[   88.905461][ T5831] hsr_slave_1: entered promiscuous mode
[   88.912818][ T5831] debugfs: 'hsr0' already exists in 'hsr'
[   88.918578][ T5831] Cannot create hsr debugfs directory
[   89.140458][ T5833] hsr_slave_0: entered promiscuous mode
[   89.148015][ T5833] hsr_slave_1: entered promiscuous mode
[   89.155185][ T5833] debugfs: 'hsr0' already exists in 'hsr'
[   89.160973][ T5833] Cannot create hsr debugfs directory
[   89.471083][ T5824] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   89.493009][ T5824] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   89.524172][ T5824] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   89.546122][ T5824] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   89.596797][ T5829] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   89.634693][ T5829] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   89.646697][ T5829] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   89.659110][ T5829] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   89.738986][ T5831] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   89.753007][ T5831] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   89.771558][ T5831] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   89.786567][ T5831] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   89.920487][ T5833] netdevsim netdevsim3 netdevsim0: renamed from eth0
[   89.947140][ T5833] netdevsim netdevsim3 netdevsim1: renamed from eth1
[   89.967929][ T5833] netdevsim netdevsim3 netdevsim2: renamed from eth2
[   89.979625][ T5833] netdevsim netdevsim3 netdevsim3: renamed from eth3
[   90.067544][ T5824] 8021q: adding VLAN 0 to HW filter on device bond0
[   90.171697][ T5824] 8021q: adding VLAN 0 to HW filter on device team0
[   90.197445][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0
[   90.225580][   T35] bridge0: port 1(bridge_slave_0) entered blocking state
[   90.234104][   T35] bridge0: port 1(bridge_slave_0) entered forwarding state
[   90.246157][   T51] Bluetooth: hci0: command tx timeout
[   90.270157][   T35] bridge0: port 2(bridge_slave_1) entered blocking state
[   90.277322][   T35] bridge0: port 2(bridge_slave_1) entered forwarding state
[   90.325294][ T5829] 8021q: adding VLAN 0 to HW filter on device team0
[   90.380302][ T5831] 8021q: adding VLAN 0 to HW filter on device bond0
[   90.390375][   T35] bridge0: port 1(bridge_slave_0) entered blocking state
[   90.392285][   T51] Bluetooth: hci1: command tx timeout
[   90.397771][   T35] bridge0: port 1(bridge_slave_0) entered forwarding state
[   90.411204][   T51] Bluetooth: hci2: command tx timeout
[   90.438749][   T35] bridge0: port 2(bridge_slave_1) entered blocking state
[   90.446062][   T35] bridge0: port 2(bridge_slave_1) entered forwarding state
[   90.470568][   T51] Bluetooth: hci3: command tx timeout
[   90.498554][ T5833] 8021q: adding VLAN 0 to HW filter on device bond0
[   90.543135][ T5831] 8021q: adding VLAN 0 to HW filter on device team0
[   90.566769][   T94] bridge0: port 1(bridge_slave_0) entered blocking state
[   90.574044][   T94] bridge0: port 1(bridge_slave_0) entered forwarding state
[   90.602060][   T94] bridge0: port 2(bridge_slave_1) entered blocking state
[   90.609405][   T94] bridge0: port 2(bridge_slave_1) entered forwarding state
[   90.674147][ T5833] 8021q: adding VLAN 0 to HW filter on device team0
[   90.752148][   T61] bridge0: port 1(bridge_slave_0) entered blocking state
[   90.759434][   T61] bridge0: port 1(bridge_slave_0) entered forwarding state
[   90.812889][   T61] bridge0: port 2(bridge_slave_1) entered blocking state
[   90.820109][   T61] bridge0: port 2(bridge_slave_1) entered forwarding state
[   91.068721][ T5824] 8021q: adding VLAN 0 to HW filter on device batadv0
[   91.288602][ T5824] veth0_vlan: entered promiscuous mode
[   91.332060][ T5824] veth1_vlan: entered promiscuous mode
[   91.382931][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0
[   91.397499][ T5831] 8021q: adding VLAN 0 to HW filter on device batadv0
[   91.482052][ T5824] veth0_macvtap: entered promiscuous mode
[   91.496159][ T5824] veth1_macvtap: entered promiscuous mode
[   91.528952][ T5833] 8021q: adding VLAN 0 to HW filter on device batadv0
[   91.597962][ T5829] veth0_vlan: entered promiscuous mode
[   91.614044][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_0
[   91.652800][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_1
[   91.661587][ T5831] veth0_vlan: entered promiscuous mode
[   91.681501][ T5829] veth1_vlan: entered promiscuous mode
[   91.723789][   T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   91.733223][   T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   91.746108][ T5831] veth1_vlan: entered promiscuous mode
[   91.759093][   T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   91.769166][   T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   91.835564][   T10] cfg80211: failed to load regulatory.db
[   91.848588][ T5833] veth0_vlan: entered promiscuous mode
[   91.880767][ T5833] veth1_vlan: entered promiscuous mode
[   91.972732][ T5831] veth0_macvtap: entered promiscuous mode
[   91.988435][ T5829] veth0_macvtap: entered promiscuous mode
[   91.992238][   T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   92.008259][ T5831] veth1_macvtap: entered promiscuous mode
[   92.018902][   T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   92.046121][ T5829] veth1_macvtap: entered promiscuous mode
[   92.112664][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0
[   92.123721][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_0
[   92.141627][   T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   92.149917][   T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   92.174569][ T5831] batman_adv: batadv0: Interface activated: batadv_slave_1
[   92.186314][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1
[   92.222830][ T5833] veth0_macvtap: entered promiscuous mode
[   92.264618][ T5824] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   92.281534][   T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   92.293825][   T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   92.304924][   T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   92.314091][   T51] Bluetooth: hci0: command tx timeout
[   92.323195][ T5833] veth1_macvtap: entered promiscuous mode
[   92.346480][   T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   92.406041][   T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   92.425497][   T94] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   92.463523][   T94] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   92.475546][   T51] Bluetooth: hci2: command tx timeout
[   92.481117][   T51] Bluetooth: hci1: command tx timeout
[   92.486753][   T94] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   92.528671][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_0
[   92.549929][ T5837] Bluetooth: hci3: command tx timeout
[   92.562813][ T5833] batman_adv: batadv0: Interface activated: batadv_slave_1
[   92.621805][   T94] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   92.631127][   T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   92.655066][   T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   92.675470][   T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   92.688848][   T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   92.712064][ T5869] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[   92.722325][   T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   92.735024][   T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   92.742640][   T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   92.817855][   T94] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   92.842575][   T94] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   92.877937][   T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   92.887769][   T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   92.903614][ T5869] usb 2-1: config 0 has an invalid interface number: 207 but max is 0
[   92.923614][ T5869] usb 2-1: config 0 has no interface number 0
[   92.954469][ T5869] usb 2-1: New USB device found, idVendor=0421, idProduct=00ab, bcdDevice=b3.9a
[   92.976655][ T5869] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   92.985131][ T5869] usb 2-1: Product: syz
[   92.989882][ T5869] usb 2-1: Manufacturer: syz
[   93.004250][ T5869] usb 2-1: SerialNumber: syz
[   93.012845][ T1370] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   93.036188][ T1370] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   93.047706][ T5869] usb 2-1: config 0 descriptor??
[   93.072848][ T5869] usb 2-1: bad CDC descriptors
[   93.100953][ T5869] cdc_acm 2-1:0.207: Zero length descriptor references
[   93.107924][ T5869] cdc_acm 2-1:0.207: probe with driver cdc_acm failed with error -22
[   93.151193][   T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   93.161053][   T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   93.289891][ T5911] usb 2-1: USB disconnect, device number 2
[   93.353284][ T5915] 8021q: adding VLAN 0 to HW filter on device bond0
[   93.371463][ T5915] bond0: (slave sit0): The slave device specified does not support setting the MAC address
[   93.385232][ T5915] bond0: (slave sit0): Error -95 calling set_mac_address
[   93.408980][ T5919] netlink: 80 bytes leftover after parsing attributes in process `syz.3.4'.
[   93.434979][ T5919] netlink: 9 bytes leftover after parsing attributes in process `syz.3.4'.
[   93.445929][ T5915] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   93.461626][ T5919] 0�: renamed from hsr_slave_1 (while UP)
[   93.502845][ T5919] 0�: entered allmulticast mode
[   93.525100][ T5919] A link change request failed with some changes committed already. Interface 
c0� may have been left with an inconsistent configuration, please check.
[   93.683795][ T5930] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[   93.709673][ T5932] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[   94.001223][  T797] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[   94.200568][  T797] usb 1-1: Using ep0 maxpacket: 8
[   94.217677][ T5837] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201'
[   94.228658][ T5837] CPU: 1 UID: 0 PID: 5837 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) 
[   94.228694][ T5837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[   94.228709][ T5837] Workqueue: hci0 hci_rx_work
[   94.228749][ T5837] Call Trace:
[   94.228758][ T5837]  <TASK>
[   94.228771][ T5837]  dump_stack_lvl+0xe8/0x150
[   94.228804][ T5837]  sysfs_create_dir_ns+0x271/0x2a0
[   94.228835][ T5837]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[   94.228865][ T5837]  ? do_raw_spin_unlock+0xf5/0x210
[   94.228893][ T5837]  kobject_add_internal+0x62b/0xd00
[   94.228930][ T5837]  kobject_add+0x163/0x240
[   94.228962][ T5837]  ? __pfx_kobject_add+0x10/0x10
[   94.228990][ T5837]  ? _raw_spin_unlock+0x28/0x50
[   94.229015][ T5837]  ? get_device_parent+0x366/0x3a0
[   94.229050][ T5837]  device_add+0x408/0xb70
[   94.229084][ T5837]  hci_conn_add_sysfs+0xd5/0x210
[   94.229112][ T5837]  le_conn_complete_evt+0xf1d/0x1430
[   94.229155][ T5837]  ? __pfx_le_conn_complete_evt+0x10/0x10
[   94.229183][ T5837]  ? __mutex_unlock_slowpath+0x1bd/0x7d0
[   94.229210][ T5837]  ? __pfx___mutex_lock+0x10/0x10
[   94.229234][ T5837]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[   94.229257][ T5837]  ? skb_pull_data+0xfb/0x200
[   94.229295][ T5837]  hci_le_conn_complete_evt+0x187/0x470
[   94.229332][ T5837]  hci_event_packet+0x7af/0x12c0
[   94.229363][ T5837]  ? __pfx_hci_le_meta_evt+0x10/0x10
[   94.229391][ T5837]  ? __pfx_hci_event_packet+0x10/0x10
[   94.229420][ T5837]  ? kcov_remote_start+0x49a/0x7a0
[   94.229453][ T5837]  ? hci_send_to_monitor+0xe2/0x590
[   94.229487][ T5837]  hci_rx_work+0x3ee/0x1040
[   94.229523][ T5837]  ? process_one_work+0x87c/0x1650
[   94.229547][ T5837]  process_one_work+0x949/0x1650
[   94.229594][ T5837]  ? __pfx_process_one_work+0x10/0x10
[   94.229619][ T5837]  ? do_raw_spin_lock+0x12b/0x2f0
[   94.229656][ T5837]  worker_thread+0xb46/0x1140
[   94.229692][ T5837]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   94.229728][ T5837]  kthread+0x388/0x470
[   94.229749][ T5837]  ? __pfx_worker_thread+0x10/0x10
[   94.229772][ T5837]  ? __pfx_kthread+0x10/0x10
[   94.229793][ T5837]  ret_from_fork+0x51e/0xb90
[   94.229821][ T5837]  ? __pfx_ret_from_fork+0x10/0x10
[   94.229844][ T5837]  ? __switch_to+0xc7d/0x1450
[   94.229870][ T5837]  ? __pfx_kthread+0x10/0x10
[   94.229891][ T5837]  ret_from_fork_asm+0x1a/0x30
[   94.229939][ T5837]  </TASK>
[   94.461477][ T5837] kobject: kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory.
[   94.480332][ T5837] Bluetooth: hci0: failed to register connection device
[   94.489568][ T5837] Bluetooth: hci0: command tx timeout
[   94.512507][ T5957] program syz.1.10 is using a deprecated SCSI ioctl, please convert it to SG_IO
[   94.524961][ T5957] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0
[   94.557868][  T797] usb 1-1: config 0 has an invalid interface number: 52 but max is 0
[   94.566629][  T797] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[   94.576833][  T797] usb 1-1: config 0 has no interface number 0
[   94.578814][   T51] Bluetooth: hci1: command tx timeout
[   94.583006][  T797] usb 1-1: config 0 interface 52 altsetting 1 has an endpoint descriptor with address 0xFF, changing to 0x8F
[   94.583045][  T797] usb 1-1: config 0 interface 52 altsetting 1 endpoint 0x8F has an invalid bInterval 0, changing to 7
[   94.583071][  T797] usb 1-1: config 0 interface 52 altsetting 1 endpoint 0x8F has invalid maxpacket 59391, setting to 1024
[   94.590895][   T51] Bluetooth: hci2: command tx timeout
[   94.600722][  T797] usb 1-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[   94.600756][  T797] usb 1-1: config 0 interface 52 has no altsetting 0
[   94.600793][  T797] usb 1-1: New USB device found, idVendor=06cb, idProduct=0007, bcdDevice= 8.00
[   94.600816][  T797] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   94.608181][  T797] usb 1-1: config 0 descriptor??
[   94.631331][   T51] Bluetooth: hci3: command tx timeout
[   94.916790][  T797] input: USB Synaptics Device 06cb:0007 (Stick) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.52/input/input5
[   95.099874][ T5930] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[   95.108966][ T5930] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[   95.288345][ T5869] usb 1-1: USB disconnect, device number 2
[   95.299667][  T797] usb 2-1: new high-speed USB device number 3 using dummy_hcd
[   95.484540][  T797] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping
[   95.494641][  T797] usb 2-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config
[   95.523867][  T797] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3
[   95.552120][  T797] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[   95.569955][  T797] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   95.578093][  T797] usb 2-1: Product: 䐊
[   95.597314][  T797] usb 2-1: Manufacturer: 瓨スﾚ䓥욠㉪➾൘걽ཛ蒲購藧븻쥱冰曄飧솕ᐳ곎佁ⰰ뉎该ϻ⛙왟䓙螥휲㞧࢐ꮨ縱쑲撡⶘뻫䗞띃ﭡ衤䅱누镝伍獖砌罐貞튳邑䃕撊⸞狵ͱ鈡ᑒꁿ숯孹荶Շ•ₗ杀鼼놱ႈ再䆚ↁچ껔ῡ꽄隕땡ⶖ䅢⼮⭬墄봅齁方됊秧ࡕ厼ᑞ饠೨࠳쩒쎱
[   95.679596][ T5992] netlink: 4 bytes leftover after parsing attributes in process `syz.2.16'.
[   95.688734][  T797] usb 2-1: SerialNumber: у
[   95.952729][  T797] usb 2-1: 0:2 : does not exist
[   96.052970][   T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201'
[   96.056814][  T797] usb 2-1: USB disconnect, device number 3
[   96.065289][   T51] CPU: 0 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) 
[   96.065358][   T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[   96.065400][   T51] Workqueue: hci2 hci_rx_work
[   96.065477][   T51] Call Trace:
[   96.065499][   T51]  <TASK>
[   96.065522][   T51]  dump_stack_lvl+0xe8/0x150
[   96.065639][   T51]  sysfs_create_dir_ns+0x271/0x2a0
[   96.065733][   T51]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[   96.065810][   T51]  ? do_raw_spin_unlock+0xf5/0x210
[   96.065888][   T51]  kobject_add_internal+0x62b/0xd00
[   96.065986][   T51]  kobject_add+0x163/0x240
[   96.066074][   T51]  ? __pfx_kobject_add+0x10/0x10
[   96.066136][   T51]  ? _raw_spin_unlock+0x28/0x50
[   96.066194][   T51]  ? get_device_parent+0x366/0x3a0
[   96.066290][   T51]  device_add+0x408/0xb70
[   96.066378][   T51]  hci_conn_add_sysfs+0xd5/0x210
[   96.066446][   T51]  le_conn_complete_evt+0xf1d/0x1430
[   96.066554][   T51]  ? __pfx_le_conn_complete_evt+0x10/0x10
[   96.066625][   T51]  ? __mutex_unlock_slowpath+0x1bd/0x7d0
[   96.066701][   T51]  ? __pfx___mutex_lock+0x10/0x10
[   96.066767][   T51]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[   96.066830][   T51]  ? skb_pull_data+0xfb/0x200
[   96.066910][   T51]  hci_le_conn_complete_evt+0x187/0x470
[   96.067043][   T51]  hci_event_packet+0x7af/0x12c0
[   96.067151][   T51]  ? __pfx_hci_le_meta_evt+0x10/0x10
[   96.067237][   T51]  ? __pfx_hci_event_packet+0x10/0x10
[   96.067315][   T51]  ? kcov_remote_start+0x49a/0x7a0
[   96.067406][   T51]  ? hci_send_to_monitor+0xe2/0x590
[   96.067503][   T51]  hci_rx_work+0x3ee/0x1040
[   96.067593][   T51]  ? process_one_work+0x87c/0x1650
[   96.067658][   T51]  process_one_work+0x949/0x1650
[   96.067781][   T51]  ? __pfx_process_one_work+0x10/0x10
[   96.067845][   T51]  ? do_raw_spin_lock+0x12b/0x2f0
[   96.067951][   T51]  worker_thread+0xb46/0x1140
[   96.068085][   T51]  kthread+0x388/0x470
[   96.068132][   T51]  ? __pfx_worker_thread+0x10/0x10
[   96.068198][   T51]  ? __pfx_kthread+0x10/0x10
[   96.068254][   T51]  ret_from_fork+0x51e/0xb90
[   96.068340][   T51]  ? __pfx_ret_from_fork+0x10/0x10
[   96.068405][   T51]  ? __switch_to+0xc7d/0x1450
[   96.068481][   T51]  ? __pfx_kthread+0x10/0x10
[   96.068511][   T51]  ret_from_fork_asm+0x1a/0x30
[   96.068555][   T51]  </TASK>
[   96.068625][   T51] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory.
[   96.089687][   T42] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[   96.094542][   T51] Bluetooth: hci2: failed to register connection device
[   96.171323][ T5869] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[   96.337050][ T6005] program syz.0.19 is using a deprecated SCSI ioctl, please convert it to SG_IO
[   96.351489][ T6005] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0
[   96.441143][   T42] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0
[   96.451858][   T42] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0
[   96.466009][   T42] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0
[   96.496395][   T42] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0
[   96.511757][   T42] usb 4-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00
[   96.521169][   T42] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   96.532478][   T42] usb 4-1: Product: syz
[   96.536720][   T42] usb 4-1: Manufacturer: syz
[   96.550337][   T42] usb 4-1: SerialNumber: syz
[   96.569962][   T42] usb 4-1: config 0 descriptor??
[   96.579559][ T5869] usb 3-1: Using ep0 maxpacket: 8
[   96.591067][ T5869] usb 3-1: New USB device found, idVendor=0c98, idProduct=1140, bcdDevice=db.e6
[   96.601616][ T5869] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   96.612162][   T42] ums-isd200 4-1:0.0: USB Mass Storage device detected
[   96.643392][ T5869] usb 3-1: config 0 descriptor??
[   96.690416][ T5869] pcwd_usb: The device isn't a Human Interface Device
[   96.901652][ T5869] usb 3-1: USB disconnect, device number 2
[   96.987263][   T42] scsi host1: usb-storage 4-1:0.0
[   97.033217][   T42] usb 4-1: USB disconnect, device number 2
[   97.184981][ T6037] =======================================================
[   97.184981][ T6037] WARNING: The mand mount option has been deprecated and
[   97.184981][ T6037]          and is ignored by this kernel. Remove the mand
[   97.184981][ T6037]          option from the mount to silence this warning.
[   97.184981][ T6037] =======================================================
[   97.233079][ T6037] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[   97.577918][   T51] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201'
[   97.588223][   T51] CPU: 0 UID: 0 PID: 51 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) 
[   97.588252][   T51] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[   97.588266][   T51] Workqueue: hci1 hci_rx_work
[   97.588296][   T51] Call Trace:
[   97.588305][   T51]  <TASK>
[   97.588314][   T51]  dump_stack_lvl+0xe8/0x150
[   97.588346][   T51]  sysfs_create_dir_ns+0x271/0x2a0
[   97.588377][   T51]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[   97.588406][   T51]  ? do_raw_spin_unlock+0xf5/0x210
[   97.588432][   T51]  kobject_add_internal+0x62b/0xd00
[   97.588468][   T51]  kobject_add+0x163/0x240
[   97.588501][   T51]  ? __pfx_kobject_add+0x10/0x10
[   97.588528][   T51]  ? _raw_spin_unlock+0x28/0x50
[   97.588553][   T51]  ? get_device_parent+0x366/0x3a0
[   97.588588][   T51]  device_add+0x408/0xb70
[   97.588621][   T51]  hci_conn_add_sysfs+0xd5/0x210
[   97.588650][   T51]  le_conn_complete_evt+0xf1d/0x1430
[   97.588691][   T51]  ? __pfx_le_conn_complete_evt+0x10/0x10
[   97.588719][   T51]  ? __mutex_unlock_slowpath+0x1bd/0x7d0
[   97.588747][   T51]  ? __pfx___mutex_lock+0x10/0x10
[   97.588771][   T51]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[   97.588793][   T51]  ? skb_pull_data+0xfb/0x200
[   97.588824][   T51]  hci_le_conn_complete_evt+0x187/0x470
[   97.588873][   T51]  hci_event_packet+0x7af/0x12c0
[   97.588905][   T51]  ? __pfx_hci_le_meta_evt+0x10/0x10
[   97.588934][   T51]  ? __pfx_hci_event_packet+0x10/0x10
[   97.588964][   T51]  ? kcov_remote_start+0x49a/0x7a0
[   97.588996][   T51]  ? hci_send_to_monitor+0xe2/0x590
[   97.589031][   T51]  hci_rx_work+0x3ee/0x1040
[   97.589067][   T51]  ? process_one_work+0x87c/0x1650
[   97.589091][   T51]  process_one_work+0x949/0x1650
[   97.589140][   T51]  ? __pfx_process_one_work+0x10/0x10
[   97.589168][   T51]  ? do_raw_spin_lock+0x12b/0x2f0
[   97.589205][   T51]  worker_thread+0xb46/0x1140
[   97.589259][   T51]  kthread+0x388/0x470
[   97.589279][   T51]  ? __pfx_worker_thread+0x10/0x10
[   97.589303][   T51]  ? __pfx_kthread+0x10/0x10
[   97.589323][   T51]  ret_from_fork+0x51e/0xb90
[   97.589352][   T51]  ? __pfx_ret_from_fork+0x10/0x10
[   97.589375][   T51]  ? __switch_to+0xc7d/0x1450
[   97.589402][   T51]  ? __pfx_kthread+0x10/0x10
[   97.589422][   T51]  ret_from_fork_asm+0x1a/0x30
[   97.589468][   T51]  </TASK>
[   97.817657][   T51] kobject: kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory.
[   97.846711][   T51] Bluetooth: hci1: failed to register connection device
[   97.855431][ T6056] program syz.2.28 is using a deprecated SCSI ioctl, please convert it to SG_IO
[   97.876022][ T6056] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0
[   97.963661][ T6062] tmpfs: Unknown parameter 'grpquotaic'
[   98.159665][    T9] usb 4-1: new full-speed USB device number 3 using dummy_hcd
[   98.189333][   T42] usb 2-1: new high-speed USB device number 4 using dummy_hcd
[   98.321859][    T9] usb 4-1: unable to get BOS descriptor or descriptor too short
[   98.331652][    T9] usb 4-1: not running at top speed; connect to a high speed hub
[   98.340468][   T42] usb 2-1: Using ep0 maxpacket: 8
[   98.345907][    T9] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3
[   98.355660][    T9] usb 4-1: config 1 has no interface number 1
[   98.362929][   T42] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b
[   98.362951][    T9] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0
[   98.380753][   T42] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   98.411270][    T9] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[   98.420970][ T5911] usb 3-1: new full-speed USB device number 3 using dummy_hcd
[   98.428771][    T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   98.446596][    T9] usb 4-1: Product: syz
[   98.451545][    T9] usb 4-1: Manufacturer: syz
[   98.456201][    T9] usb 4-1: SerialNumber: syz
[   98.461753][   T42] pvrusb2: Hardware description: Terratec Grabster AV400
[   98.468862][   T42] pvrusb2: **********
[   98.499511][   T42] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental.
[   98.511639][   T42] pvrusb2: Important functionality might not be entirely working.
[   98.522148][   T42] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver.
[   98.533906][   T42] pvrusb2: **********
[   98.620831][ T5911] usb 3-1: config 0 has an invalid interface number: 41 but max is 0
[   98.628979][ T5911] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[   98.662626][ T2344] pvrusb2: Invalid write control endpoint
[   98.669954][ T5911] usb 3-1: config 0 has no interface number 0
[   98.676181][ T5911] usb 3-1: config 0 interface 41 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[   98.692867][   T42] usb 2-1: USB disconnect, device number 4
[   98.713103][    T9] usb 4-1: 2:1 : invalid UAC_FORMAT_TYPE desc
[   98.722081][ T5911] usb 3-1: config 0 interface 41 has no altsetting 0
[   98.745930][ T5911] usb 3-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a
[   98.779373][ T5911] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   98.787429][ T5911] usb 3-1: Product: syz
[   98.819784][ T5911] usb 3-1: Manufacturer: syz
[   98.824620][ T5911] usb 3-1: SerialNumber: syz
[   98.844225][ T5911] usb 3-1: config 0 descriptor??
[   98.850752][    T9] usb 4-1: USB disconnect, device number 3
[   98.861847][ T2344] pvrusb2: Invalid write control endpoint
[   98.867731][ T5911] CoreChips 3-1:0.41: probe with driver CoreChips failed with error -22
[   98.915239][ T2344] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work.
[   98.926047][ T2344] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device.
[   98.948524][ T2344] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups.
[   98.976212][ T2344] pvrusb2: Device being rendered inoperable
[   98.998926][ T5910] udevd[5910]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[   99.017205][ T2344] cx25840 1-0044: Unable to detect h/w, assuming cx23887
[   99.028007][ T2344] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a)
[   99.041898][ T2344] pvrusb2: Attached sub-driver cx25840
[   99.061395][ T2344] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[   99.079264][ T2344] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[   99.315311][ T6085] overlayfs: failed to resolve './file1': -2
[   99.348208][ T5837] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201'
[   99.359968][ T5837] CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) 
[   99.359989][ T5837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[   99.359999][ T5837] Workqueue: hci3 hci_rx_work
[   99.360021][ T5837] Call Trace:
[   99.360027][ T5837]  <TASK>
[   99.360034][ T5837]  dump_stack_lvl+0xe8/0x150
[   99.360057][ T5837]  sysfs_create_dir_ns+0x271/0x2a0
[   99.360080][ T5837]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[   99.360101][ T5837]  ? do_raw_spin_unlock+0xf5/0x210
[   99.360120][ T5837]  kobject_add_internal+0x62b/0xd00
[   99.360147][ T5837]  kobject_add+0x163/0x240
[   99.360169][ T5837]  ? __pfx_kobject_add+0x10/0x10
[   99.360189][ T5837]  ? _raw_spin_unlock+0x28/0x50
[   99.360206][ T5837]  ? get_device_parent+0x366/0x3a0
[   99.360237][ T5837]  device_add+0x408/0xb70
[   99.360261][ T5837]  hci_conn_add_sysfs+0xd5/0x210
[   99.360280][ T5837]  le_conn_complete_evt+0xf1d/0x1430
[   99.360310][ T5837]  ? __pfx_le_conn_complete_evt+0x10/0x10
[   99.360330][ T5837]  ? __mutex_unlock_slowpath+0x1bd/0x7d0
[   99.360357][ T5837]  ? __pfx___mutex_lock+0x10/0x10
[   99.360379][ T5837]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[   99.360396][ T5837]  ? skb_pull_data+0xfb/0x200
[   99.360418][ T5837]  hci_le_conn_complete_evt+0x187/0x470
[   99.360444][ T5837]  hci_event_packet+0x7af/0x12c0
[   99.360466][ T5837]  ? __pfx_hci_le_meta_evt+0x10/0x10
[   99.360487][ T5837]  ? __pfx_hci_event_packet+0x10/0x10
[   99.360508][ T5837]  ? kcov_remote_start+0x49a/0x7a0
[   99.360532][ T5837]  ? hci_send_to_monitor+0xe2/0x590
[   99.360558][ T5837]  hci_rx_work+0x3ee/0x1040
[   99.360583][ T5837]  ? process_one_work+0x87c/0x1650
[   99.360601][ T5837]  process_one_work+0x949/0x1650
[   99.360634][ T5837]  ? __pfx_process_one_work+0x10/0x10
[   99.360651][ T5837]  ? do_raw_spin_lock+0x12b/0x2f0
[   99.360683][ T5837]  worker_thread+0xb46/0x1140
[   99.360710][ T5837]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   99.360735][ T5837]  kthread+0x388/0x470
[   99.360749][ T5837]  ? __pfx_worker_thread+0x10/0x10
[   99.360767][ T5837]  ? __pfx_kthread+0x10/0x10
[   99.360781][ T5837]  ret_from_fork+0x51e/0xb90
[   99.360803][ T5837]  ? __pfx_ret_from_fork+0x10/0x10
[   99.360821][ T5837]  ? __switch_to+0xc7d/0x1450
[   99.360840][ T5837]  ? __pfx_kthread+0x10/0x10
[   99.360854][ T5837]  ret_from_fork_asm+0x1a/0x30
[   99.360888][ T5837]  </TASK>
[   99.360908][ T5837] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory.
[   99.608236][ T5837] Bluetooth: hci3: failed to register connection device
[   99.620814][ T5837] ==================================================================
[   99.628944][ T5837] BUG: KASAN: slab-use-after-free in l2cap_connect_cfm+0x86a/0x1390
[   99.637095][ T5837] Read of size 8 at addr ffff8880206cf480 by task kworker/u9:4/5837
[   99.645281][ T5837] 
[   99.647651][ T5837] CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) 
[   99.647678][ T5837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[   99.647693][ T5837] Workqueue: hci3 hci_rx_work
[   99.647721][ T5837] Call Trace:
[   99.647729][ T5837]  <TASK>
[   99.647737][ T5837]  dump_stack_lvl+0xe8/0x150
[   99.647767][ T5837]  print_report+0xba/0x230
[   99.647794][ T5837]  ? l2cap_connect_cfm+0x86a/0x1390
[   99.647822][ T5837]  kasan_report+0x117/0x150
[   99.647847][ T5837]  ? l2cap_connect_cfm+0x86a/0x1390
[   99.647882][ T5837]  l2cap_connect_cfm+0x86a/0x1390
[   99.647919][ T5837]  ? __pfx_l2cap_connect_cfm+0x10/0x10
[   99.647948][ T5837]  ? __pfx_bt_err+0x10/0x10
[   99.647971][ T5837]  ? __pfx_l2cap_connect_cfm+0x10/0x10
[   99.648000][ T5837]  hci_connect_cfm+0x95/0x140
[   99.648027][ T5837]  le_conn_complete_evt+0xf65/0x1430
[   99.648060][ T5837]  ? __pfx_le_conn_complete_evt+0x10/0x10
[   99.648086][ T5837]  ? __mutex_unlock_slowpath+0x1bd/0x7d0
[   99.648110][ T5837]  ? __pfx___mutex_lock+0x10/0x10
[   99.648132][ T5837]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[   99.648155][ T5837]  ? skb_pull_data+0xfb/0x200
[   99.648180][ T5837]  hci_le_conn_complete_evt+0x187/0x470
[   99.648210][ T5837]  hci_event_packet+0x7af/0x12c0
[   99.648234][ T5837]  ? __pfx_hci_le_meta_evt+0x10/0x10
[   99.648259][ T5837]  ? __pfx_hci_event_packet+0x10/0x10
[   99.648284][ T5837]  ? kcov_remote_start+0x49a/0x7a0
[   99.648315][ T5837]  ? hci_send_to_monitor+0xe2/0x590
[   99.648347][ T5837]  hci_rx_work+0x3ee/0x1040
[   99.648376][ T5837]  ? process_one_work+0x87c/0x1650
[   99.648398][ T5837]  process_one_work+0x949/0x1650
[   99.648430][ T5837]  ? __pfx_process_one_work+0x10/0x10
[   99.648452][ T5837]  ? do_raw_spin_lock+0x12b/0x2f0
[   99.648482][ T5837]  worker_thread+0xb46/0x1140
[   99.648512][ T5837]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   99.648540][ T5837]  kthread+0x388/0x470
[   99.648558][ T5837]  ? __pfx_worker_thread+0x10/0x10
[   99.648583][ T5837]  ? __pfx_kthread+0x10/0x10
[   99.648601][ T5837]  ret_from_fork+0x51e/0xb90
[   99.648626][ T5837]  ? __pfx_ret_from_fork+0x10/0x10
[   99.648660][ T5837]  ? __switch_to+0xc7d/0x1450
[   99.648682][ T5837]  ? __pfx_kthread+0x10/0x10
[   99.648700][ T5837]  ret_from_fork_asm+0x1a/0x30
[   99.648737][ T5837]  </TASK>
[   99.648745][ T5837] 
[   99.871692][ T5837] Allocated by task 5837:
[   99.876048][ T5837]  kasan_save_track+0x3e/0x80
[   99.880754][ T5837]  __kasan_kmalloc+0x93/0xb0
[   99.885369][ T5837]  __kmalloc_cache_noprof+0x31c/0x660
[   99.890760][ T5837]  l2cap_chan_create+0x51/0x790
[   99.895642][ T5837]  l2cap_sock_new_connection_cb+0x182/0x2e0
[   99.901566][ T5837]  l2cap_connect_cfm+0x368/0x1390
[   99.906654][ T5837]  hci_connect_cfm+0x95/0x140
[   99.911505][ T5837]  le_conn_complete_evt+0xf65/0x1430
[   99.916841][ T5837]  hci_le_conn_complete_evt+0x187/0x470
[   99.922417][ T5837]  hci_event_packet+0x7af/0x12c0
[   99.927388][ T5837]  hci_rx_work+0x3ee/0x1040
[   99.931924][ T5837]  process_one_work+0x949/0x1650
[   99.936920][ T5837]  worker_thread+0xb46/0x1140
[   99.941650][ T5837]  kthread+0x388/0x470
[   99.945754][ T5837]  ret_from_fork+0x51e/0xb90
[   99.950369][ T5837]  ret_from_fork_asm+0x1a/0x30
[   99.955268][ T5837] 
[   99.957718][ T5837] Freed by task 6087:
[   99.961713][ T5837]  kasan_save_track+0x3e/0x80
[   99.966415][ T5837]  kasan_save_free_info+0x46/0x50
[   99.971472][ T5837]  __kasan_slab_free+0x5c/0x80
[   99.976428][ T5837]  kfree+0x1c1/0x630
[   99.980349][ T5837]  l2cap_sock_cleanup_listen+0xf0/0x440
[   99.985920][ T5837]  l2cap_sock_release+0x6a/0x230
[   99.990876][ T5837]  __sock_release+0xb9/0x250
[   99.995493][ T5837]  sock_close+0x1c/0x30
[   99.999713][ T5837]  __fput+0x44f/0xa70
[  100.003812][ T5837]  task_work_run+0x1d9/0x270
[  100.008414][ T5837]  exit_to_user_mode_loop+0xed/0x480
[  100.013722][ T5837]  do_syscall_64+0x32d/0xf80
[  100.018509][ T5837]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  100.024600][ T5837] 
[  100.026940][ T5837] The buggy address belongs to the object at ffff8880206cf000
[  100.026940][ T5837]  which belongs to the cache kmalloc-2k of size 2048
[  100.041058][ T5837] The buggy address is located 1152 bytes inside of
[  100.041058][ T5837]  freed 2048-byte region [ffff8880206cf000, ffff8880206cf800)
[  100.055150][ T5837] 
[  100.057510][ T5837] The buggy address belongs to the physical page:
[  100.064133][ T5837] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x206c8
[  100.073180][ T5837] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  100.081727][ T5837] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  100.089315][ T5837] page_type: f5(slab)
[  100.093334][ T5837] raw: 00fff00000000040 ffff88813ff1e000 dead000000000100 dead000000000122
[  100.101933][ T5837] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[  100.110585][ T5837] head: 00fff00000000040 ffff88813ff1e000 dead000000000100 dead000000000122
[  100.119309][ T5837] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[  100.128109][ T5837] head: 00fff00000000003 ffffea000081b201 00000000ffffffff 00000000ffffffff
[  100.136800][ T5837] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
[  100.145573][ T5837] page dumped because: kasan: bad access detected
[  100.152016][ T5837] page_owner tracks the page as allocated
[  100.157745][ T5837] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2710607707, free_ts 0
[  100.177391][ T5837]  post_alloc_hook+0x231/0x280
[  100.182191][ T5837]  get_page_from_freelist+0x24dc/0x2580
[  100.187759][ T5837]  __alloc_frozen_pages_noprof+0x18d/0x380
[  100.193588][ T5837]  allocate_slab+0x77/0x660
[  100.198115][ T5837]  refill_objects+0x331/0x3c0
[  100.202898][ T5837]  __pcs_replace_empty_main+0x2b9/0x620
[  100.208644][ T5837]  __kmalloc_noprof+0x474/0x760
[  100.213516][ T5837]  insert_header+0x342/0x1220
[  100.218221][ T5837]  __register_sysctl_table+0x11da/0x1340
[  100.223883][ T5837]  setup_userns_sysctls+0x24e/0x2d0
[  100.229115][ T5837]  user_namespace_sysctl_init+0x3c/0x120
[  100.234777][ T5837]  do_one_initcall+0x250/0x8d0
[  100.239583][ T5837]  do_initcall_level+0x104/0x190
[  100.244564][ T5837]  do_initcalls+0x59/0xa0
[  100.248930][ T5837]  kernel_init_freeable+0x2a6/0x3e0
[  100.254156][ T5837]  kernel_init+0x1d/0x1d0
[  100.258530][ T5837] page_owner free stack trace missing
[  100.263910][ T5837] 
[  100.266254][ T5837] Memory state around the buggy address:
[  100.271897][ T5837]  ffff8880206cf380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  100.280059][ T5837]  ffff8880206cf400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  100.288132][ T5837] >ffff8880206cf480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  100.296291][ T5837]                    ^
[  100.300456][ T5837]  ffff8880206cf500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  100.308578][ T5837]  ffff8880206cf580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  100.316742][ T5837] ==================================================================
[  100.335942][ T5837] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  100.343205][ T5837] CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:4 Not tainted syzkaller #0 PREEMPT(full) 
[  100.352875][ T5837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
[  100.363057][ T5837] Workqueue: hci3 hci_rx_work
[  100.367833][ T5837] Call Trace:
[  100.371239][ T5837]  <TASK>
[  100.374256][ T5837]  vpanic+0x56c/0xa60
[  100.378290][ T5837]  ? __pfx_vpanic+0x10/0x10
[  100.382930][ T5837]  panic+0xc5/0xd0
[  100.386719][ T5837]  ? __pfx_panic+0x10/0x10
[  100.391185][ T5837]  ? preempt_schedule_thunk+0x16/0x30
[  100.396848][ T5837]  ? l2cap_connect_cfm+0x86a/0x1390
[  100.402080][ T5837]  ? preempt_schedule_thunk+0x16/0x30
[  100.407561][ T5837]  ? l2cap_connect_cfm+0x86a/0x1390
[  100.412892][ T5837]  check_panic_on_warn+0x89/0xb0
[  100.418082][ T5837]  ? l2cap_connect_cfm+0x86a/0x1390
[  100.423326][ T5837]  end_report+0x73/0x180
[  100.427765][ T5837]  ? l2cap_connect_cfm+0x86a/0x1390
[  100.433008][ T5837]  kasan_report+0x128/0x150
[  100.437558][ T5837]  ? l2cap_connect_cfm+0x86a/0x1390
[  100.442813][ T5837]  l2cap_connect_cfm+0x86a/0x1390
[  100.447906][ T5837]  ? __pfx_l2cap_connect_cfm+0x10/0x10
[  100.453412][ T5837]  ? __pfx_bt_err+0x10/0x10
[  100.458158][ T5837]  ? __pfx_l2cap_connect_cfm+0x10/0x10
[  100.463653][ T5837]  hci_connect_cfm+0x95/0x140
[  100.468359][ T5837]  le_conn_complete_evt+0xf65/0x1430
[  100.473676][ T5837]  ? __pfx_le_conn_complete_evt+0x10/0x10
[  100.479428][ T5837]  ? __mutex_unlock_slowpath+0x1bd/0x7d0
[  100.485087][ T5837]  ? __pfx___mutex_lock+0x10/0x10
[  100.490143][ T5837]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  100.496204][ T5837]  ? skb_pull_data+0xfb/0x200
[  100.500932][ T5837]  hci_le_conn_complete_evt+0x187/0x470
[  100.506553][ T5837]  hci_event_packet+0x7af/0x12c0
[  100.511541][ T5837]  ? __pfx_hci_le_meta_evt+0x10/0x10
[  100.516873][ T5837]  ? __pfx_hci_event_packet+0x10/0x10
[  100.522470][ T5837]  ? kcov_remote_start+0x49a/0x7a0
[  100.527634][ T5837]  ? hci_send_to_monitor+0xe2/0x590
[  100.532891][ T5837]  hci_rx_work+0x3ee/0x1040
[  100.537431][ T5837]  ? process_one_work+0x87c/0x1650
[  100.542571][ T5837]  process_one_work+0x949/0x1650
[  100.547561][ T5837]  ? __pfx_process_one_work+0x10/0x10
[  100.552959][ T5837]  ? do_raw_spin_lock+0x12b/0x2f0
[  100.558053][ T5837]  worker_thread+0xb46/0x1140
[  100.562860][ T5837]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  100.568695][ T5837]  kthread+0x388/0x470
[  100.572792][ T5837]  ? __pfx_worker_thread+0x10/0x10
[  100.577932][ T5837]  ? __pfx_kthread+0x10/0x10
[  100.582536][ T5837]  ret_from_fork+0x51e/0xb90
[  100.587160][ T5837]  ? __pfx_ret_from_fork+0x10/0x10
[  100.592382][ T5837]  ? __switch_to+0xc7d/0x1450
[  100.597171][ T5837]  ? __pfx_kthread+0x10/0x10
[  100.601876][ T5837]  ret_from_fork_asm+0x1a/0x30
[  100.606877][ T5837]  </TASK>
[  100.610164][ T5837] Kernel Offset: disabled
[  100.614544][ T5837] Rebooting in 86400 seconds..