------------[ cut here ]------------
hook not found, pf 5 num 0
WARNING: net/netfilter/core.c:514 at __nf_unregister_net_hook+0x2c5/0x6f0 net/netfilter/core.c:514, CPU#0: syz.0.5068/22581
Modules linked in:
CPU: 0 UID: 0 PID: 22581 Comm: syz.0.5068 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__nf_unregister_net_hook+0x2dc/0x6f0 net/netfilter/core.c:514
Code: 24 30 48 8b 5c 24 08 44 8b 6c 24 04 48 8d 3d db 52 11 06 48 8b 44 24 10 0f b6 04 28 84 c0 0f 85 f1 02 00 00 41 8b 17 44 89 ee <67> 48 0f b9 3a e9 db 01 00 00 e8 45 24 da 01 89 c3 31 ff 89 c6 e8
RSP: 0018:ffffc900045df638 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888079a93080 RCX: ffff88802a7ebd00
RDX: 0000000000000000 RSI: 0000000000000005 RDI: ffffffff8f90c4e0
RBP: dffffc0000000000 R08: ffffffff8f822277 R09: 1ffffffff1f0444e
R10: dffffc0000000000 R11: fffffbfff1f0444f R12: ffff88807aaba5c0
R13: 0000000000000005 R14: ffff88807ed84488 R15: ffff88802770ce3c
FS:  0000000000000000(0000) GS:ffff888125e1f000(0063) knlGS:00000000f5436b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000567ad4c0 CR3: 0000000042fc0000 CR4: 00000000003526f0
DR0: 00000000000000b3 DR1: 0000200000001000 DR2: 0000000100000001
DR3: 0000000080000001 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 nft_unregister_flowtable_ops net/netfilter/nf_tables_api.c:9038 [inline]
 nft_flowtable_event net/netfilter/nf_tables_api.c:9817 [inline]
 __nf_tables_flowtable_event+0x5bf/0x8c0 net/netfilter/nf_tables_api.c:9862
 nf_tables_flowtable_event+0x103/0x160 net/netfilter/nf_tables_api.c:9893
 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
 call_netdevice_notifiers net/core/dev.c:2282 [inline]
 unregister_netdevice_many_notify+0x1867/0x2340 net/core/dev.c:12381
 unregister_netdevice_many net/core/dev.c:12444 [inline]
 unregister_netdevice_queue+0x317/0x350 net/core/dev.c:12258
 unregister_netdevice include/linux/netdevice.h:3405 [inline]
 __tun_detach+0x6d9/0x15d0 drivers/net/tun.c:621
 tun_detach drivers/net/tun.c:637 [inline]
 tun_chr_close+0x10a/0x1c0 drivers/net/tun.c:3436
 __fput+0x44c/0xa70 fs/file_table.c:468
 task_work_run+0x1d4/0x260 kernel/task_work.c:233
 get_signal+0x11ec/0x1340 kernel/signal.c:2807
 arch_do_signal_or_restart+0x9a/0x7a0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
 exit_to_user_mode_loop+0x87/0x4e0 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 __do_fast_syscall_32+0x38e/0x560 arch/x86/entry/syscall_32.c:310
 do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:332
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf7f44539
Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f543655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00000000400454ca
RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	24 30                	and    $0x30,%al
   2:	48 8b 5c 24 08       	mov    0x8(%rsp),%rbx
   7:	44 8b 6c 24 04       	mov    0x4(%rsp),%r13d
   c:	48 8d 3d db 52 11 06 	lea    0x61152db(%rip),%rdi        # 0x61152ee
  13:	48 8b 44 24 10       	mov    0x10(%rsp),%rax
  18:	0f b6 04 28          	movzbl (%rax,%rbp,1),%eax
  1c:	84 c0                	test   %al,%al
  1e:	0f 85 f1 02 00 00    	jne    0x315
  24:	41 8b 17             	mov    (%r15),%edx
  27:	44 89 ee             	mov    %r13d,%esi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	e9 db 01 00 00       	jmp    0x20f
  34:	e8 45 24 da 01       	call   0x1da247e
  39:	89 c3                	mov    %eax,%ebx
  3b:	31 ff                	xor    %edi,%edi
  3d:	89 c6                	mov    %eax,%esi
  3f:	e8                   	.byte 0xe8