program:
r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'rti800\x00', [0x401, 0x10, 0x401, 0xa, 0x14000000, 0xfffffffc, 0x9, 0x2, 0xffd, 0xa, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3ff, 0x9, 0x200, 0xe2df, 0xaa14, 0x1, 0x4, 0x0, 0x7, 0xf58, 0x6]})
ioctl$COMEDI_INSN(r0, 0x8028640c, &(0x7f0000000000)={0xa000005, 0x0, 0x0, 0x40, 0x4eb3})
r1 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi0\x00', 0x2180, 0x0)
ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000300)={'pcl816\x00', [0x2f00, 0x5, 0xd097, 0xffffffff, 0x3, 0xfffffffe, 0x20000004, 0x6, 0xffe, 0x9, 0xc, 0x1, 0x7fff, 0x4, 0xfffe, 0x8, 0x5, 0x7, 0x830, 0x30000, 0x10000, 0x9, 0x800, 0x100101, 0x2, 0xffffffff, 0x7, 0x3, 0x4, 0x4, 0x70f]})
r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0)
write$UHID_CREATE2(r2, &(0x7f0000000180)=ANY=[], 0x118)
socket(0x10, 0x803, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x6)
socket$nl_generic(0x10, 0x3, 0x10)
socket$rds(0x15, 0x5, 0x0)
r4 = socket$netlink(0x10, 0x3, 0x0)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x11, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010800000000000000850a603f00000000000500000014000500200100000000000000000100000000001c00090008000000", @ANYRES32=r5], 0x4c}}, 0x0)
r6 = socket$netlink(0x10, 0x3, 0x0)
writev(r6, &(0x7f0000000000)=[{&(0x7f0000000080)="390000001300090468fe0700000000000000ff3f08000000480100100000000019002b000a0001000500000000000072080003000500000000", 0x39}], 0x1)
sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x9, 0x12, r2, 0x0)
getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f0000000140), &(0x7f0000000180)=0x4)

[   85.270669][ T5305] Bluetooth: hci0: command tx timeout
[   85.351855][ T5327] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[   85.355019][ T5327] IPv6: NLM_F_CREATE should be set when creating new route
[   85.358250][ T5327] IPv6: NLM_F_CREATE should be set when creating new route
[   85.365525][ T5327] ------------[ cut here ]------------
[   85.368032][ T5327] WARNING: CPU: 0 PID: 5327 at drivers/net/netdevsim/fib.c:831 nsim_fib_event_nb+0xed8/0x1080
[   85.372727][ T5327] Modules linked in:
[   85.374558][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   85.378803][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[   85.383903][ T5327] RIP: 0010:nsim_fib_event_nb+0xed8/0x1080
[   85.386503][ T5327] Code: fa be 02 00 00 00 eb 0a e8 85 0f e0 fa be 01 00 00 00 4c 89 f7 e8 58 31 ab fd 4c 8b 64 24 08 e9 91 f4 ff ff e8 69 0f e0 fa 90 <0f> 0b 90 e9 70 fb ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 35
[   85.395217][ T5327] RSP: 0018:ffffc9000d3e7008 EFLAGS: 00010283
[   85.397817][ T5327] RAX: ffffffff86e003f7 RBX: 0000000000000001 RCX: 0000000000100000
[   85.401434][ T5327] RDX: ffffc9000ddc2000 RSI: 0000000000000f57 RDI: 0000000000000f58
[   85.404969][ T5327] RBP: dffffc0000000000 R08: ffff888042d73c2f R09: 1ffff110085ae785
[   85.408331][ T5327] R10: dffffc0000000000 R11: ffffed10085ae786 R12: ffff888051791000
[   85.411796][ T5327] R13: ffffc9000d3e7180 R14: 0000000000000000 R15: ffffc9000d3e7198
[   85.415287][ T5327] FS:  00007ff8960db6c0(0000) GS:ffff88808d72f000(0000) knlGS:0000000000000000
[   85.419241][ T5327] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   85.422340][ T5327] CR2: 00007ff8953bb558 CR3: 0000000041ed0000 CR4: 0000000000352ef0
[   85.425808][ T5327] Call Trace:
[   85.427379][ T5327]  <TASK>
[   85.428763][ T5327]  notifier_call_chain+0x1b6/0x3e0
[   85.431219][ T5327]  ? atomic_notifier_call_chain+0x26/0x180
[   85.433849][ T5327]  atomic_notifier_call_chain+0xda/0x180
[   85.436413][ T5327]  call_fib_notifiers+0x31/0x60
[   85.438666][ T5327]  call_fib6_multipath_entry_notifiers+0xe6/0x150
[   85.441591][ T5327]  ? __pfx_call_fib6_multipath_entry_notifiers+0x10/0x10
[   85.444521][ T5327]  ? inet6_rtm_newroute+0xe8b/0x18c0
[   85.446745][ T5327]  inet6_rtm_newroute+0x12f5/0x18c0
[   85.449028][ T5327]  ? kmem_cache_free+0x19b/0x690
[   85.451255][ T5327]  ? __pfx_inet6_rtm_newroute+0x10/0x10
[   85.453626][ T5327]  ? __local_bh_enable_ip+0x12d/0x1c0
[   85.455891][ T5327]  ? __dev_queue_xmit+0x27b/0x3b50
[   85.458009][ T5327]  ? __dev_queue_xmit+0x1d79/0x3b50
[   85.460452][ T5327]  ? kasan_save_track+0x3e/0x80
[   85.462628][ T5327]  ? __kasan_slab_alloc+0x6c/0x80
[   85.464689][ T5327]  ? __pfx_inet6_rtm_newroute+0x10/0x10
[   85.467027][ T5327]  rtnetlink_rcv_msg+0x7cf/0xb70
[   85.469143][ T5327]  ? rtnetlink_rcv_msg+0x1ab/0xb70
[   85.471451][ T5327]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[   85.473785][ T5327]  ? ref_tracker_free+0x63a/0x7d0
[   85.475971][ T5327]  ? __asan_memcpy+0x40/0x70
[   85.477988][ T5327]  ? __pfx_ref_tracker_free+0x10/0x10
[   85.481051][ T5327]  ? __skb_clone+0x63/0x7a0
[   85.483340][ T5327]  netlink_rcv_skb+0x208/0x470
[   85.485410][ T5327]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[   85.487761][ T5327]  ? __pfx_netlink_rcv_skb+0x10/0x10
[   85.490103][ T5327]  ? netlink_deliver_tap+0x2e/0x1b0
[   85.492671][ T5327]  netlink_unicast+0x82f/0x9e0
[   85.494806][ T5327]  ? __pfx_netlink_unicast+0x10/0x10
[   85.497062][ T5327]  ? netlink_sendmsg+0x642/0xb30
[   85.499300][ T5327]  ? skb_put+0x11b/0x210
[   85.501280][ T5327]  netlink_sendmsg+0x805/0xb30
[   85.503431][ T5327]  ? __pfx_netlink_sendmsg+0x10/0x10
[   85.505882][ T5327]  ? aa_sock_msg_perm+0xf1/0x1d0
[   85.507981][ T5327]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[   85.510485][ T5327]  ? __pfx_netlink_sendmsg+0x10/0x10
[   85.512764][ T5327]  __sock_sendmsg+0x21c/0x270
[   85.514819][ T5327]  ____sys_sendmsg+0x505/0x830
[   85.516886][ T5327]  ? __pfx_____sys_sendmsg+0x10/0x10
[   85.519122][ T5327]  ? import_iovec+0x74/0xa0
[   85.521194][ T5327]  ___sys_sendmsg+0x21f/0x2a0
[   85.523301][ T5327]  ? __pfx____sys_sendmsg+0x10/0x10
[   85.525621][ T5327]  ? __fget_files+0x2a/0x420
[   85.527744][ T5327]  ? __fget_files+0x3a0/0x420
[   85.529939][ T5327]  __x64_sys_sendmsg+0x19b/0x260
[   85.532122][ T5327]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[   85.534457][ T5327]  ? do_syscall_64+0xbe/0xfa0
[   85.536557][ T5327]  do_syscall_64+0xfa/0xfa0
[   85.538646][ T5327]  ? lockdep_hardirqs_on+0x9c/0x150
[   85.541038][ T5327]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   85.543880][ T5327]  ? clear_bhb_loop+0x60/0xb0
[   85.546040][ T5327]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   85.548654][ T5327] RIP: 0033:0x7ff89518f749
[   85.550737][ T5327] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   85.559044][ T5327] RSP: 002b:00007ff8960db038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   85.562797][ T5327] RAX: ffffffffffffffda RBX: 00007ff8953e5fa0 RCX: 00007ff89518f749
[   85.566183][ T5327] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 000000000000000b
[   85.569593][ T5327] RBP: 00007ff895213f91 R08: 0000000000000000 R09: 0000000000000000
[   85.573032][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   85.576403][ T5327] R13: 00007ff8953e6038 R14: 00007ff8953e5fa0 R15: 00007ffc6b842378
[   85.580063][ T5327]  </TASK>
[   85.581711][ T5327] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   85.584776][ T5327] CPU: 0 UID: 0 PID: 5327 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
[   85.588626][ T5327] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
[   85.593312][ T5327] Call Trace:
[   85.594763][ T5327]  <TASK>
[   85.596073][ T5327]  dump_stack_lvl+0x99/0x250
[   85.598165][ T5327]  ? __asan_memcpy+0x40/0x70
[   85.600691][ T5327]  ? __pfx_dump_stack_lvl+0x10/0x10
[   85.603625][ T5327]  ? __pfx__printk+0x10/0x10
[   85.606175][ T5327]  vpanic+0x237/0x6d0
[   85.608163][ T5327]  ? __pfx_vpanic+0x10/0x10
[   85.610172][ T5327]  panic+0xb9/0xc0
[   85.611827][ T5327]  ? __pfx_panic+0x10/0x10
[   85.613774][ T5327]  __warn+0x31b/0x4b0
[   85.615483][ T5327]  ? nsim_fib_event_nb+0xed8/0x1080
[   85.617634][ T5327]  ? nsim_fib_event_nb+0xed8/0x1080
[   85.619870][ T5327]  report_bug+0x2be/0x4f0
[   85.621763][ T5327]  ? nsim_fib_event_nb+0xed8/0x1080
[   85.623994][ T5327]  ? nsim_fib_event_nb+0xed8/0x1080
[   85.626230][ T5327]  ? nsim_fib_event_nb+0xeda/0x1080
[   85.628437][ T5327]  handle_bug+0x84/0x160
[   85.630321][ T5327]  exc_invalid_op+0x1a/0x50
[   85.632280][ T5327]  asm_exc_invalid_op+0x1a/0x20
[   85.634415][ T5327] RIP: 0010:nsim_fib_event_nb+0xed8/0x1080
[   85.636914][ T5327] Code: fa be 02 00 00 00 eb 0a e8 85 0f e0 fa be 01 00 00 00 4c 89 f7 e8 58 31 ab fd 4c 8b 64 24 08 e9 91 f4 ff ff e8 69 0f e0 fa 90 <0f> 0b 90 e9 70 fb ff ff 44 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c 35
[   85.644747][ T5327] RSP: 0018:ffffc9000d3e7008 EFLAGS: 00010283
[   85.647400][ T5327] RAX: ffffffff86e003f7 RBX: 0000000000000001 RCX: 0000000000100000
[   85.651183][ T5327] RDX: ffffc9000ddc2000 RSI: 0000000000000f57 RDI: 0000000000000f58
[   85.654590][ T5327] RBP: dffffc0000000000 R08: ffff888042d73c2f R09: 1ffff110085ae785
[   85.657985][ T5327] R10: dffffc0000000000 R11: ffffed10085ae786 R12: ffff888051791000
[   85.661415][ T5327] R13: ffffc9000d3e7180 R14: 0000000000000000 R15: ffffc9000d3e7198
[   85.664793][ T5327]  ? nsim_fib_event_nb+0xed7/0x1080
[   85.667057][ T5327]  ? nsim_fib_event_nb+0xed7/0x1080
[   85.669348][ T5327]  notifier_call_chain+0x1b6/0x3e0
[   85.671629][ T5327]  ? atomic_notifier_call_chain+0x26/0x180
[   85.674323][ T5327]  atomic_notifier_call_chain+0xda/0x180
[   85.676725][ T5327]  call_fib_notifiers+0x31/0x60
[   85.678896][ T5327]  call_fib6_multipath_entry_notifiers+0xe6/0x150
[   85.681659][ T5327]  ? __pfx_call_fib6_multipath_entry_notifiers+0x10/0x10
[   85.685469][ T5327]  ? inet6_rtm_newroute+0xe8b/0x18c0
[   85.687793][ T5327]  inet6_rtm_newroute+0x12f5/0x18c0
[   85.690137][ T5327]  ? kmem_cache_free+0x19b/0x690
[   85.692402][ T5327]  ? __pfx_inet6_rtm_newroute+0x10/0x10
[   85.694933][ T5327]  ? __local_bh_enable_ip+0x12d/0x1c0
[   85.697457][ T5327]  ? __dev_queue_xmit+0x27b/0x3b50
[   85.699695][ T5327]  ? __dev_queue_xmit+0x1d79/0x3b50
[   85.701814][ T5327]  ? kasan_save_track+0x3e/0x80
[   85.703758][ T5327]  ? __kasan_slab_alloc+0x6c/0x80
[   85.705780][ T5327]  ? __pfx_inet6_rtm_newroute+0x10/0x10
[   85.707960][ T5327]  rtnetlink_rcv_msg+0x7cf/0xb70
[   85.709965][ T5327]  ? rtnetlink_rcv_msg+0x1ab/0xb70
[   85.711965][ T5327]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[   85.714156][ T5327]  ? ref_tracker_free+0x63a/0x7d0
[   85.716262][ T5327]  ? __asan_memcpy+0x40/0x70
[   85.718283][ T5327]  ? __pfx_ref_tracker_free+0x10/0x10
[   85.720579][ T5327]  ? __skb_clone+0x63/0x7a0
[   85.722562][ T5327]  netlink_rcv_skb+0x208/0x470
[   85.724599][ T5327]  ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[   85.727006][ T5327]  ? __pfx_netlink_rcv_skb+0x10/0x10
[   85.729415][ T5327]  ? netlink_deliver_tap+0x2e/0x1b0
[   85.731727][ T5327]  netlink_unicast+0x82f/0x9e0
[   85.733768][ T5327]  ? __pfx_netlink_unicast+0x10/0x10
[   85.736094][ T5327]  ? netlink_sendmsg+0x642/0xb30
[   85.738284][ T5327]  ? skb_put+0x11b/0x210
[   85.740163][ T5327]  netlink_sendmsg+0x805/0xb30
[   85.742291][ T5327]  ? __pfx_netlink_sendmsg+0x10/0x10
[   85.744552][ T5327]  ? aa_sock_msg_perm+0xf1/0x1d0
[   85.746723][ T5327]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[   85.749001][ T5327]  ? __pfx_netlink_sendmsg+0x10/0x10
[   85.751371][ T5327]  __sock_sendmsg+0x21c/0x270
[   85.753452][ T5327]  ____sys_sendmsg+0x505/0x830
[   85.755560][ T5327]  ? __pfx_____sys_sendmsg+0x10/0x10
[   85.757858][ T5327]  ? import_iovec+0x74/0xa0
[   85.759919][ T5327]  ___sys_sendmsg+0x21f/0x2a0
[   85.761979][ T5327]  ? __pfx____sys_sendmsg+0x10/0x10
[   85.764329][ T5327]  ? __fget_files+0x2a/0x420
[   85.766411][ T5327]  ? __fget_files+0x3a0/0x420
[   85.768460][ T5327]  __x64_sys_sendmsg+0x19b/0x260
[   85.770628][ T5327]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[   85.773018][ T5327]  ? do_syscall_64+0xbe/0xfa0
[   85.775111][ T5327]  do_syscall_64+0xfa/0xfa0
[   85.777124][ T5327]  ? lockdep_hardirqs_on+0x9c/0x150
[   85.779392][ T5327]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   85.782065][ T5327]  ? clear_bhb_loop+0x60/0xb0
[   85.784181][ T5327]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   85.786862][ T5327] RIP: 0033:0x7ff89518f749
[   85.788972][ T5327] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[   85.797712][ T5327] RSP: 002b:00007ff8960db038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[   85.802253][ T5327] RAX: ffffffffffffffda RBX: 00007ff8953e5fa0 RCX: 00007ff89518f749
[   85.805862][ T5327] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 000000000000000b
[   85.809438][ T5327] RBP: 00007ff895213f91 R08: 0000000000000000 R09: 0000000000000000
[   85.813034][ T5327] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   85.816579][ T5327] R13: 00007ff8953e6038 R14: 00007ff8953e5fa0 R15: 00007ffc6b842378
[   85.820110][ T5327]  </TASK>
[   85.821862][ T5327] Kernel Offset: disabled
[   85.823738][ T5327] Rebooting in 86400 seconds..