------------[ cut here ]------------
wlan1: Dropped data frame as no usable bitrate found while scanning and associated. Target station: 08:02:11:00:00:00 on 5 GHz band
WARNING: net/mac80211/tx.c:750 at ieee80211_tx_h_rate_ctrl+0x12bb/0x1a20 net/mac80211/tx.c:750, CPU#0: kworker/u8:0/12
Modules linked in:
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:ieee80211_tx_h_rate_ctrl+0x12cb/0x1a20 net/mac80211/tx.c:750
Code: 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 e9 05 00 00 48 8d 3d d5 17 e2 05 48 8b 75 68 89 d9 4c 89 e2 48 81 c6 48 0a 00 00 <67> 48 0f b9 3a bb 01 00 00 00 e9 2a f8 ff ff e8 01 60 02 f7 e8 3c
RSP: 0018:ffffc900001175d8 EFLAGS: 00010286
RAX: dffffc0000000000 RBX: 0000000000000005 RCX: 0000000000000005
RDX: ffff888022709d84 RSI: ffff888025f91888 RDI: ffffffff90e837b0
RBP: ffffc90000117850 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888022709d84
R13: ffffc900001178c0 R14: 0000000000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888124386000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d222ff8 CR3: 0000000087ee4000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 invoke_tx_handlers_late+0xfb4/0x2750 net/mac80211/tx.c:1859
 ieee80211_tx+0x304/0x460 net/mac80211/tx.c:1983
 ieee80211_xmit+0x30f/0x3e0 net/mac80211/tx.c:2076
 __ieee80211_tx_skb_tid_band+0x2c2/0x720 net/mac80211/tx.c:6369
 ieee80211_tx_skb_tid_band net/mac80211/ieee80211_i.h:2456 [inline]
 ieee80211_send_scan_probe_req net/mac80211/scan.c:685 [inline]
 ieee80211_scan_state_send_probe+0x33d/0xac0 net/mac80211/scan.c:713
 ieee80211_scan_work+0x750/0x1ff0 net/mac80211/scan.c:1174
 cfg80211_wiphy_work+0x410/0x570 net/wireless/core.c:513
 process_one_work+0xa0e/0x1980 kernel/workqueue.c:3314
 process_scheduled_works kernel/workqueue.c:3397 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess), 5 bytes skipped:
   0:	48 c1 ea 03          	shr    $0x3,%rdx
   4:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   8:	0f 85 e9 05 00 00    	jne    0x5f7
   e:	48 8d 3d d5 17 e2 05 	lea    0x5e217d5(%rip),%rdi        # 0x5e217ea
  15:	48 8b 75 68          	mov    0x68(%rbp),%rsi
  19:	89 d9                	mov    %ebx,%ecx
  1b:	4c 89 e2             	mov    %r12,%rdx
  1e:	48 81 c6 48 0a 00 00 	add    $0xa48,%rsi
* 25:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2a:	bb 01 00 00 00       	mov    $0x1,%ebx
  2f:	e9 2a f8 ff ff       	jmp    0xfffff85e
  34:	e8 01 60 02 f7       	call   0xf702603a
  39:	e8                   	.byte 0xe8
  3a:	3c                   	.byte 0x3c