last executing test programs:
kernel console output (not intermixed with test programs):
Warning: Permanently added '10.128.0.192' (ED25519) to the list of known hosts.
[ 69.952498][ T5811] cgroup: Unknown subsys name 'net'
[ 70.088530][ T5811] cgroup: Unknown subsys name 'cpuset'
[ 70.097306][ T5811] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 71.361183][ T1297] ieee802154 phy0 wpan0: encryption failed: -22
[ 71.367763][ T1297] ieee802154 phy1 wpan1: encryption failed: -22
[ 71.498263][ T5811] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 74.742456][ T5830] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 74.751211][ T5830] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[ 74.759289][ T5838] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 74.767887][ T5838] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[ 74.768536][ T5830] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[ 74.776199][ T5839] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[ 74.783645][ T5830] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 74.796321][ T5839] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[ 74.798007][ T5830] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[ 74.811960][ T5839] ==================================================================
[ 74.812950][ T5830] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[ 74.820047][ T5839] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[ 74.820076][ T5839] Read of size 2 at addr ffff88805e4fbb78 by task kworker/u9:7/5839
[ 74.820090][ T5839]
[ 74.820114][ T5839] CPU: 0 UID: 0 PID: 5839 Comm: kworker/u9:7 Not tainted syzkaller #0 PREEMPT(full)
[ 74.820131][ T5839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 74.820142][ T5839] Workqueue: hci1 hci_cmd_work
[ 74.820169][ T5839] Call Trace:
[ 74.820177][ T5839]
[ 74.820184][ T5839] dump_stack_lvl+0x189/0x250
[ 74.820207][ T5839] ? __virt_addr_valid+0x1c8/0x5c0
[ 74.820223][ T5839] ? rcu_is_watching+0x15/0xb0
[ 74.820239][ T5839] ? __pfx_dump_stack_lvl+0x10/0x10
[ 74.820259][ T5839] ? rcu_is_watching+0x15/0xb0
[ 74.820274][ T5839] ? lock_release+0x4b/0x3d0
[ 74.820292][ T5839] ? _raw_spin_lock_irqsave+0xb3/0xf0
[ 74.820311][ T5839] ? __virt_addr_valid+0x1c8/0x5c0
[ 74.820327][ T5839] ? __virt_addr_valid+0x4a5/0x5c0
[ 74.820344][ T5839] print_report+0xca/0x240
[ 74.820363][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 74.820386][ T5839] kasan_report+0x118/0x150
[ 74.820407][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 74.820429][ T5839] hci_cmd_work+0x5d0/0x7b0
[ 74.820448][ T5839] ? process_one_work+0x868/0x15e0
[ 74.820467][ T5839] process_one_work+0x93a/0x15e0
[ 74.820486][ T5839] ? __lock_acquire+0xab9/0xd20
[ 74.820513][ T5839] ? __pfx_process_one_work+0x10/0x10
[ 74.820536][ T5839] ? assign_work+0x3a1/0x410
[ 74.820556][ T5839] worker_thread+0x9b0/0xee0
[ 74.820586][ T5839] kthread+0x711/0x8a0
[ 74.820601][ T5839] ? __pfx_worker_thread+0x10/0x10
[ 74.820620][ T5839] ? __pfx_kthread+0x10/0x10
[ 74.820635][ T5839] ? _raw_spin_unlock_irq+0x23/0x50
[ 74.820652][ T5839] ? lockdep_hardirqs_on+0x9c/0x150
[ 74.820669][ T5839] ? __pfx_kthread+0x10/0x10
[ 74.820684][ T5839] ret_from_fork+0x599/0xb30
[ 74.820703][ T5839] ? __pfx_ret_from_fork+0x10/0x10
[ 74.820722][ T5839] ? __switch_to_asm+0x39/0x70
[ 74.820736][ T5839] ? __switch_to_asm+0x33/0x70
[ 74.820750][ T5839] ? __pfx_kthread+0x10/0x10
[ 74.820765][ T5839] ret_from_fork_asm+0x1a/0x30
[ 74.820787][ T5839]
[ 74.820794][ T5839]
[ 74.829259][ T5830] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[ 74.835232][ T5839] Allocated by task 52:
[ 74.835245][ T5839] kasan_save_track+0x3e/0x80
[ 74.835263][ T5839] __kasan_slab_alloc+0x6c/0x80
[ 74.835277][ T5839] kmem_cache_alloc_node_noprof+0x43c/0x710
[ 74.835291][ T5839] __alloc_skb+0x112/0x2d0
[ 74.835309][ T5839] hci_cmd_sync_alloc+0x3d/0x3b0
[ 74.835325][ T5839] __hci_cmd_sync_sk+0x1a7/0xc70
[ 74.844532][ T5830] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 74.845601][ T5839] hci_read_buffer_size_sync+0x2c/0x120
[ 74.845624][ T5839] hci_dev_open_sync+0x2057/0x2dc0
[ 74.845636][ T5839] hci_power_on+0x1b4/0x720
[ 74.845652][ T5839] process_one_work+0x93a/0x15e0
[ 74.856283][ T5830] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[ 74.865188][ T5839] worker_thread+0x9b0/0xee0
[ 74.865220][ T5839] kthread+0x711/0x8a0
[ 74.865233][ T5839] ret_from_fork+0x599/0xb30
[ 74.865248][ T5839] ret_from_fork_asm+0x1a/0x30
[ 74.865262][ T5839]
[ 74.865266][ T5839] Freed by task 5827:
[ 74.865275][ T5839] kasan_save_track+0x3e/0x80
[ 74.865291][ T5839] kasan_save_free_info+0x46/0x50
[ 74.871723][ T5830] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[ 74.873298][ T5839] __kasan_slab_free+0x5c/0x80
[ 74.876924][ T5830] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 74.880913][ T5839] kmem_cache_free+0x197/0x640
[ 74.888424][ T5830] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[ 74.890758][ T5839] vhci_read+0x49a/0x5b0
[ 74.896596][ T5836] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[ 74.900696][ T5839] vfs_read+0x200/0xa30
[ 74.908967][ T5830] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[ 74.910618][ T5839] ksys_read+0x145/0x250
[ 75.199667][ T5839] do_syscall_64+0xfa/0xfa0
[ 75.204161][ T5839] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.210035][ T5839]
[ 75.212342][ T5839] The buggy address belongs to the object at ffff88805e4fbb40
[ 75.212342][ T5839] which belongs to the cache skbuff_head_cache of size 240
[ 75.226896][ T5839] The buggy address is located 56 bytes inside of
[ 75.226896][ T5839] freed 240-byte region [ffff88805e4fbb40, ffff88805e4fbc30)
[ 75.240587][ T5839]
[ 75.242898][ T5839] The buggy address belongs to the physical page:
[ 75.249295][ T5839] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e4fb
[ 75.258047][ T5839] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 75.265137][ T5839] page_type: f5(slab)
[ 75.269102][ T5839] raw: 00fff00000000000 ffff888140af6a00 dead000000000122 0000000000000000
[ 75.277666][ T5839] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[ 75.286226][ T5839] page dumped because: kasan: bad access detected
[ 75.292626][ T5839] page_owner tracks the page as allocated
[ 75.298320][ T5839] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 15, tgid 15 (ksoftirqd/0), ts 74790232972, free_ts 74766802191
[ 75.317139][ T5839] post_alloc_hook+0x240/0x2a0
[ 75.321894][ T5839] get_page_from_freelist+0x2365/0x2440
[ 75.327421][ T5839] __alloc_frozen_pages_noprof+0x181/0x370
[ 75.333210][ T5839] alloc_pages_mpol+0x232/0x4a0
[ 75.338043][ T5839] allocate_slab+0x86/0x3b0
[ 75.342531][ T5839] ___slab_alloc+0xf56/0x1990
[ 75.347191][ T5839] __slab_alloc+0x65/0x100
[ 75.351591][ T5839] kmem_cache_alloc_node_noprof+0x4ce/0x710
[ 75.357469][ T5839] __alloc_skb+0x112/0x2d0
[ 75.361872][ T5839] arp_create+0x189/0x990
[ 75.366182][ T5839] arp_send_dst+0xa5/0x340
[ 75.370586][ T5839] arp_process+0x13ab/0x17a0
[ 75.375157][ T5839] NF_HOOK+0x310/0x3a0
[ 75.379209][ T5839] __netif_receive_skb_list_core+0x75a/0x800
[ 75.385174][ T5839] netif_receive_skb_list_internal+0x96f/0xcb0
[ 75.391317][ T5839] napi_complete_done+0x2aa/0x790
[ 75.396330][ T5839] page last free pid 2 tgid 2 stack trace:
[ 75.402112][ T5839] __free_frozen_pages+0xbc8/0xd30
[ 75.407203][ T5839] __kasan_populate_vmalloc+0x1b2/0x1d0
[ 75.412728][ T5839] alloc_vmap_area+0xdca/0x1500
[ 75.417560][ T5839] __get_vm_area_node+0x1f8/0x300
[ 75.422564][ T5839] __vmalloc_node_range_noprof+0x365/0x1640
[ 75.428438][ T5839] __vmalloc_node_noprof+0xc2/0x110
[ 75.433617][ T5839] dup_task_struct+0x3d4/0x830
[ 75.438371][ T5839] copy_process+0x4ea/0x3930
[ 75.442947][ T5839] kernel_clone+0x21e/0x850
[ 75.447436][ T5839] kernel_thread+0x10d/0x160
[ 75.452014][ T5839] kthreadd+0x575/0x770
[ 75.456156][ T5839] ret_from_fork+0x599/0xb30
[ 75.460732][ T5839] ret_from_fork_asm+0x1a/0x30
[ 75.465483][ T5839]
[ 75.467790][ T5839] Memory state around the buggy address:
[ 75.473403][ T5839] ffff88805e4fba00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 75.481447][ T5839] ffff88805e4fba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[ 75.489490][ T5839] >ffff88805e4fbb00: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
[ 75.497532][ T5839] ^
[ 75.505488][ T5839] ffff88805e4fbb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 75.513530][ T5839] ffff88805e4fbc00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
[ 75.521570][ T5839] ==================================================================
[ 75.531487][ T5839] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 75.538710][ T5839] CPU: 0 UID: 0 PID: 5839 Comm: kworker/u9:7 Not tainted syzkaller #0 PREEMPT(full)
[ 75.548176][ T5839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[ 75.558238][ T5839] Workqueue: hci1 hci_cmd_work
[ 75.563026][ T5839] Call Trace:
[ 75.566310][ T5839]
[ 75.569254][ T5839] dump_stack_lvl+0x99/0x250
[ 75.573855][ T5839] ? __asan_memcpy+0x40/0x70
[ 75.578447][ T5839] ? __pfx_dump_stack_lvl+0x10/0x10
[ 75.583654][ T5839] ? __pfx__printk+0x10/0x10
[ 75.588262][ T5839] vpanic+0x237/0x6d0
[ 75.592256][ T5839] ? __pfx_vpanic+0x10/0x10
[ 75.596768][ T5839] ? preempt_schedule+0xae/0xc0
[ 75.601626][ T5839] ? __pfx_preempt_schedule+0x10/0x10
[ 75.607006][ T5839] panic+0xb9/0xc0
[ 75.610734][ T5839] ? __pfx_panic+0x10/0x10
[ 75.615158][ T5839] ? _raw_spin_unlock_irqrestore+0xfd/0x110
[ 75.621054][ T5839] ? is_module_address+0x17/0xf0
[ 75.625988][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 75.630655][ T5839] check_panic_on_warn+0x89/0xb0
[ 75.635576][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 75.640240][ T5839] end_report+0x6f/0x160
[ 75.644469][ T5839] kasan_report+0x129/0x150
[ 75.648960][ T5839] ? hci_cmd_work+0x5d0/0x7b0
[ 75.653627][ T5839] hci_cmd_work+0x5d0/0x7b0
[ 75.658119][ T5839] ? process_one_work+0x868/0x15e0
[ 75.663217][ T5839] process_one_work+0x93a/0x15e0
[ 75.668143][ T5839] ? __lock_acquire+0xab9/0xd20
[ 75.672987][ T5839] ? __pfx_process_one_work+0x10/0x10
[ 75.678352][ T5839] ? assign_work+0x3a1/0x410
[ 75.682944][ T5839] worker_thread+0x9b0/0xee0
[ 75.687530][ T5839] kthread+0x711/0x8a0
[ 75.691585][ T5839] ? __pfx_worker_thread+0x10/0x10
[ 75.696683][ T5839] ? __pfx_kthread+0x10/0x10
[ 75.701256][ T5839] ? _raw_spin_unlock_irq+0x23/0x50
[ 75.706439][ T5839] ? lockdep_hardirqs_on+0x9c/0x150
[ 75.711631][ T5839] ? __pfx_kthread+0x10/0x10
[ 75.716222][ T5839] ret_from_fork+0x599/0xb30
[ 75.720817][ T5839] ? __pfx_ret_from_fork+0x10/0x10
[ 75.725923][ T5839] ? __switch_to_asm+0x39/0x70
[ 75.730672][ T5839] ? __switch_to_asm+0x33/0x70
[ 75.735423][ T5839] ? __pfx_kthread+0x10/0x10
[ 75.739998][ T5839] ret_from_fork_asm+0x1a/0x30
[ 75.744750][ T5839]
[ 75.748090][ T5839] Kernel Offset: disabled
[ 75.752403][ T5839] Rebooting in 86400 seconds..