================================================================================
UBSAN: array-index-out-of-bounds in drivers/input/tablet/aiptek.c:741:31
index 261 is out of range for type 'const int[34]'
CPU: 0 PID: 16629 Comm: kworker/u4:27 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xdf/0xf0 lib/ubsan.c:282
 aiptek_irq+0x1eaa/0x28f0 drivers/input/tablet/aiptek.c:741
 __usb_hcd_giveback_urb+0x35f/0x520 drivers/usb/core/hcd.c:1675
 dummy_timer+0x8d0/0x3330 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x54a/0xd50 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x183/0x2a0 kernel/time/hrtimer.c:1832
 handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:fmul2 arch/x86/crypto/curve25519-x86_64.c:296 [inline]
RIP: 0010:curve25519_ever64_base arch/x86/crypto/curve25519-x86_64.c:1578 [inline]
RIP: 0010:curve25519_base_arch+0xb42/0x2fc0 arch/x86/crypto/curve25519-x86_64.c:1609
Code: 54 24 18 f3 4d 0f 38 f6 f5 48 c7 c0 00 00 00 00 f3 48 0f 38 f6 c2 48 8b 51 08 c4 42 bb f6 0c 24 45 31 d2 66 4c 0f 38 f6 46 08 <4c> 89 46 08 c4 42 ab f6 5c 24 08 f3 4d 0f 38 f6 d1 66 4c 0f 38 f6
RSP: 0018:ffffc900036574a0 EFLAGS: 00000247
RAX: 2396fcb91d4107ec RBX: 4b85be13af931b36 RCX: ffffc90003657580
RDX: bda01822df88179b RSI: ffffc90003657640 RDI: ffffc90003657640
RBP: ffffc90003657790 R08: 2f224b737a2e4086 R09: 45eb68a12f3f0cbb
R10: 0000000000000000 R11: 301a1690310c743e R12: ffffc900036575c0
R13: 2aa680a4a04d85a9 R14: 02bb136996ee88e9 R15: ffffc90003657540
 curve25519_generate_public include/crypto/curve25519.h:55 [inline]
 wg_noise_handshake_create_initiation+0x395/0x910 drivers/net/wireguard/noise.c:542
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:34 [inline]
 wg_packet_handshake_send_worker+0x18b/0x340 drivers/net/wireguard/send.c:51
 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
================================================================================
----------------
Code disassembly (best guess):
   0:	54                   	push   %rsp
   1:	24 18                	and    $0x18,%al
   3:	f3 4d 0f 38 f6 f5    	adox   %r13,%r14
   9:	48 c7 c0 00 00 00 00 	mov    $0x0,%rax
  10:	f3 48 0f 38 f6 c2    	adox   %rdx,%rax
  16:	48 8b 51 08          	mov    0x8(%rcx),%rdx
  1a:	c4 42 bb f6 0c 24    	mulx   (%r12),%r8,%r9
  20:	45 31 d2             	xor    %r10d,%r10d
  23:	66 4c 0f 38 f6 46 08 	adcx   0x8(%rsi),%r8
* 2a:	4c 89 46 08          	mov    %r8,0x8(%rsi) <-- trapping instruction
  2e:	c4 42 ab f6 5c 24 08 	mulx   0x8(%r12),%r10,%r11
  35:	f3 4d 0f 38 f6 d1    	adox   %r9,%r10
  3b:	66                   	data16
  3c:	4c                   	rex.WR
  3d:	0f                   	.byte 0xf
  3e:	38 f6                	cmp    %dh,%dh