// https://syzkaller.appspot.com/bug?id=f848329278cb6ee43d966eedc7ebc8319e1a9db4
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <arpa/inet.h>
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <net/if.h>
#include <netinet/in.h>
#include <pthread.h>
#include <sched.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/epoll.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <sys/swap.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/uio.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

#include <linux/capability.h>
#include <linux/falloc.h>
#include <linux/genetlink.h>
#include <linux/if_addr.h>
#include <linux/if_ether.h>
#include <linux/if_link.h>
#include <linux/in6.h>
#include <linux/neighbour.h>
#include <linux/net.h>
#include <linux/netlink.h>
#include <linux/nl80211.h>
#include <linux/rfkill.h>
#include <linux/rtnetlink.h>
#include <linux/veth.h>

#ifndef __NR_bpf
#define __NR_bpf 321
#endif

static unsigned long long procid;

static void sleep_ms(uint64_t ms)
{
  usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
  struct timespec ts;
  if (clock_gettime(CLOCK_MONOTONIC, &ts))
    exit(1);
  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static void use_temporary_dir(void)
{
  char tmpdir_template[] = "./syzkaller.XXXXXX";
  char* tmpdir = mkdtemp(tmpdir_template);
  if (!tmpdir)
    exit(1);
  if (chmod(tmpdir, 0777))
    exit(1);
  if (chdir(tmpdir))
    exit(1);
}

#define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len)               \
  *(type*)(addr) =                                                             \
      htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) |           \
            (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))

static bool write_file(const char* file, const char* what, ...)
{
  char buf[1024];
  va_list args;
  va_start(args, what);
  vsnprintf(buf, sizeof(buf), what, args);
  va_end(args);
  buf[sizeof(buf) - 1] = 0;
  int len = strlen(buf);
  int fd = open(file, O_WRONLY | O_CLOEXEC);
  if (fd == -1)
    return false;
  if (write(fd, buf, len) != len) {
    int err = errno;
    close(fd);
    errno = err;
    return false;
  }
  close(fd);
  return true;
}

struct nlmsg {
  char* pos;
  int nesting;
  struct nlattr* nested[8];
  char buf[4096];
};

static void netlink_init(struct nlmsg* nlmsg, int typ, int flags,
                         const void* data, int size)
{
  memset(nlmsg, 0, sizeof(*nlmsg));
  struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
  hdr->nlmsg_type = typ;
  hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags;
  memcpy(hdr + 1, data, size);
  nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size);
}

static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data,
                         int size)
{
  struct nlattr* attr = (struct nlattr*)nlmsg->pos;
  attr->nla_len = sizeof(*attr) + size;
  attr->nla_type = typ;
  if (size > 0)
    memcpy(attr + 1, data, size);
  nlmsg->pos += NLMSG_ALIGN(attr->nla_len);
}

static void netlink_nest(struct nlmsg* nlmsg, int typ)
{
  struct nlattr* attr = (struct nlattr*)nlmsg->pos;
  attr->nla_type = typ;
  nlmsg->pos += sizeof(*attr);
  nlmsg->nested[nlmsg->nesting++] = attr;
}

static void netlink_done(struct nlmsg* nlmsg)
{
  struct nlattr* attr = nlmsg->nested[--nlmsg->nesting];
  attr->nla_len = nlmsg->pos - (char*)attr;
}

static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type,
                            int* reply_len, bool dofail)
{
  if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting)
    exit(1);
  struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf;
  hdr->nlmsg_len = nlmsg->pos - nlmsg->buf;
  struct sockaddr_nl addr;
  memset(&addr, 0, sizeof(addr));
  addr.nl_family = AF_NETLINK;
  ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0,
                     (struct sockaddr*)&addr, sizeof(addr));
  if (n != (ssize_t)hdr->nlmsg_len) {
    if (dofail)
      exit(1);
    return -1;
  }
  n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
  if (reply_len)
    *reply_len = 0;
  if (n < 0) {
    if (dofail)
      exit(1);
    return -1;
  }
  if (n < (ssize_t)sizeof(struct nlmsghdr)) {
    errno = EINVAL;
    if (dofail)
      exit(1);
    return -1;
  }
  if (hdr->nlmsg_type == NLMSG_DONE)
    return 0;
  if (reply_len && hdr->nlmsg_type == reply_type) {
    *reply_len = n;
    return 0;
  }
  if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) {
    errno = EINVAL;
    if (dofail)
      exit(1);
    return -1;
  }
  if (hdr->nlmsg_type != NLMSG_ERROR) {
    errno = EINVAL;
    if (dofail)
      exit(1);
    return -1;
  }
  errno = -((struct nlmsgerr*)(hdr + 1))->error;
  return -errno;
}

static int netlink_send(struct nlmsg* nlmsg, int sock)
{
  return netlink_send_ext(nlmsg, sock, 0, NULL, true);
}

static int netlink_query_family_id(struct nlmsg* nlmsg, int sock,
                                   const char* family_name, bool dofail)
{
  struct genlmsghdr genlhdr;
  memset(&genlhdr, 0, sizeof(genlhdr));
  genlhdr.cmd = CTRL_CMD_GETFAMILY;
  netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr));
  netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name,
               strnlen(family_name, GENL_NAMSIZ - 1) + 1);
  int n = 0;
  int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail);
  if (err < 0) {
    return -1;
  }
  uint16_t id = 0;
  struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN +
                                         NLMSG_ALIGN(sizeof(genlhdr)));
  for (; (char*)attr < nlmsg->buf + n;
       attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) {
    if (attr->nla_type == CTRL_ATTR_FAMILY_ID) {
      id = *(uint16_t*)(attr + 1);
      break;
    }
  }
  if (!id) {
    errno = EINVAL;
    return -1;
  }
  recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0);
  return id;
}

static void netlink_add_device_impl(struct nlmsg* nlmsg, const char* type,
                                    const char* name, bool up)
{
  struct ifinfomsg hdr;
  memset(&hdr, 0, sizeof(hdr));
  if (up)
    hdr.ifi_flags = hdr.ifi_change = IFF_UP;
  netlink_init(nlmsg, RTM_NEWLINK, NLM_F_EXCL | NLM_F_CREATE, &hdr,
               sizeof(hdr));
  if (name)
    netlink_attr(nlmsg, IFLA_IFNAME, name, strlen(name));
  netlink_nest(nlmsg, IFLA_LINKINFO);
  netlink_attr(nlmsg, IFLA_INFO_KIND, type, strlen(type));
}

static void netlink_device_change(struct nlmsg* nlmsg, int sock,
                                  const char* name, bool up, const char* master,
                                  const void* mac, int macsize,
                                  const char* new_name)
{
  struct ifinfomsg hdr;
  memset(&hdr, 0, sizeof(hdr));
  if (up)
    hdr.ifi_flags = hdr.ifi_change = IFF_UP;
  hdr.ifi_index = if_nametoindex(name);
  netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr));
  if (new_name)
    netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name));
  if (master) {
    int ifindex = if_nametoindex(master);
    netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex));
  }
  if (macsize)
    netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize);
  int err = netlink_send(nlmsg, sock);
  if (err < 0) {
  }
}

static struct nlmsg nlmsg;

#define WIFI_INITIAL_DEVICE_COUNT 2
#define WIFI_MAC_BASE {0x08, 0x02, 0x11, 0x00, 0x00, 0x00}
#define WIFI_IBSS_BSSID {0x50, 0x50, 0x50, 0x50, 0x50, 0x50}
#define WIFI_IBSS_SSID {0x10, 0x10, 0x10, 0x10, 0x10, 0x10}
#define WIFI_DEFAULT_FREQUENCY 2412
#define WIFI_DEFAULT_SIGNAL 0
#define WIFI_DEFAULT_RX_RATE 1
#define HWSIM_CMD_REGISTER 1
#define HWSIM_CMD_FRAME 2
#define HWSIM_CMD_NEW_RADIO 4
#define HWSIM_ATTR_SUPPORT_P2P_DEVICE 14
#define HWSIM_ATTR_PERM_ADDR 22

#define IF_OPER_UP 6
struct join_ibss_props {
  int wiphy_freq;
  bool wiphy_freq_fixed;
  uint8_t* mac;
  uint8_t* ssid;
  int ssid_len;
};

static int set_interface_state(const char* interface_name, int on)
{
  struct ifreq ifr;
  int sock = socket(AF_INET, SOCK_DGRAM, 0);
  if (sock < 0) {
    return -1;
  }
  memset(&ifr, 0, sizeof(ifr));
  strcpy(ifr.ifr_name, interface_name);
  int ret = ioctl(sock, SIOCGIFFLAGS, &ifr);
  if (ret < 0) {
    close(sock);
    return -1;
  }
  if (on)
    ifr.ifr_flags |= IFF_UP;
  else
    ifr.ifr_flags &= ~IFF_UP;
  ret = ioctl(sock, SIOCSIFFLAGS, &ifr);
  close(sock);
  if (ret < 0) {
    return -1;
  }
  return 0;
}

static int nl80211_set_interface(struct nlmsg* nlmsg, int sock,
                                 int nl80211_family, uint32_t ifindex,
                                 uint32_t iftype, bool dofail)
{
  struct genlmsghdr genlhdr;
  memset(&genlhdr, 0, sizeof(genlhdr));
  genlhdr.cmd = NL80211_CMD_SET_INTERFACE;
  netlink_init(nlmsg, nl80211_family, 0, &genlhdr, sizeof(genlhdr));
  netlink_attr(nlmsg, NL80211_ATTR_IFINDEX, &ifindex, sizeof(ifindex));
  netlink_attr(nlmsg, NL80211_ATTR_IFTYPE, &iftype, sizeof(iftype));
  int err = netlink_send_ext(nlmsg, sock, 0, NULL, dofail);
  if (err < 0) {
  }
  return err;
}

static int nl80211_join_ibss(struct nlmsg* nlmsg, int sock, int nl80211_family,
                             uint32_t ifindex, struct join_ibss_props* props,
                             bool dofail)
{
  struct genlmsghdr genlhdr;
  memset(&genlhdr, 0, sizeof(genlhdr));
  genlhdr.cmd = NL80211_CMD_JOIN_IBSS;
  netlink_init(nlmsg, nl80211_family, 0, &genlhdr, sizeof(genlhdr));
  netlink_attr(nlmsg, NL80211_ATTR_IFINDEX, &ifindex, sizeof(ifindex));
  netlink_attr(nlmsg, NL80211_ATTR_SSID, props->ssid, props->ssid_len);
  netlink_attr(nlmsg, NL80211_ATTR_WIPHY_FREQ, &(props->wiphy_freq),
               sizeof(props->wiphy_freq));
  if (props->mac)
    netlink_attr(nlmsg, NL80211_ATTR_MAC, props->mac, ETH_ALEN);
  if (props->wiphy_freq_fixed)
    netlink_attr(nlmsg, NL80211_ATTR_FREQ_FIXED, NULL, 0);
  int err = netlink_send_ext(nlmsg, sock, 0, NULL, dofail);
  if (err < 0) {
  }
  return err;
}

static int get_ifla_operstate(struct nlmsg* nlmsg, int ifindex, bool dofail)
{
  struct ifinfomsg info;
  memset(&info, 0, sizeof(info));
  info.ifi_family = AF_UNSPEC;
  info.ifi_index = ifindex;
  int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
  if (sock == -1) {
    return -1;
  }
  netlink_init(nlmsg, RTM_GETLINK, 0, &info, sizeof(info));
  int n;
  int err = netlink_send_ext(nlmsg, sock, RTM_NEWLINK, &n, dofail);
  close(sock);
  if (err) {
    return -1;
  }
  struct rtattr* attr = IFLA_RTA(NLMSG_DATA(nlmsg->buf));
  for (; RTA_OK(attr, n); attr = RTA_NEXT(attr, n)) {
    if (attr->rta_type == IFLA_OPERSTATE)
      return *((int32_t*)RTA_DATA(attr));
  }
  return -1;
}

static int await_ifla_operstate(struct nlmsg* nlmsg, char* interface,
                                int operstate, bool dofail)
{
  int ifindex = if_nametoindex(interface);
  while (true) {
    usleep(1000);
    int ret = get_ifla_operstate(nlmsg, ifindex, dofail);
    if (ret < 0)
      return ret;
    if (ret == operstate)
      return 0;
  }
  return 0;
}

static int nl80211_setup_ibss_interface(struct nlmsg* nlmsg, int sock,
                                        int nl80211_family_id, char* interface,
                                        struct join_ibss_props* ibss_props,
                                        bool dofail)
{
  int ifindex = if_nametoindex(interface);
  if (ifindex == 0) {
    return -1;
  }
  int ret = nl80211_set_interface(nlmsg, sock, nl80211_family_id, ifindex,
                                  NL80211_IFTYPE_ADHOC, dofail);
  if (ret < 0) {
    return -1;
  }
  ret = set_interface_state(interface, 1);
  if (ret < 0) {
    return -1;
  }
  ret = nl80211_join_ibss(nlmsg, sock, nl80211_family_id, ifindex, ibss_props,
                          dofail);
  if (ret < 0) {
    return -1;
  }
  return 0;
}

static int hwsim80211_create_device(struct nlmsg* nlmsg, int sock,
                                    int hwsim_family,
                                    uint8_t mac_addr[ETH_ALEN])
{
  struct genlmsghdr genlhdr;
  memset(&genlhdr, 0, sizeof(genlhdr));
  genlhdr.cmd = HWSIM_CMD_NEW_RADIO;
  netlink_init(nlmsg, hwsim_family, 0, &genlhdr, sizeof(genlhdr));
  netlink_attr(nlmsg, HWSIM_ATTR_SUPPORT_P2P_DEVICE, NULL, 0);
  netlink_attr(nlmsg, HWSIM_ATTR_PERM_ADDR, mac_addr, ETH_ALEN);
  int err = netlink_send(nlmsg, sock);
  if (err < 0) {
  }
  return err;
}

static void initialize_wifi_devices(void)
{
  int rfkill = open("/dev/rfkill", O_RDWR);
  if (rfkill == -1)
    exit(1);
  struct rfkill_event event = {0};
  event.type = RFKILL_TYPE_ALL;
  event.op = RFKILL_OP_CHANGE_ALL;
  if (write(rfkill, &event, sizeof(event)) != (ssize_t)(sizeof(event)))
    exit(1);
  close(rfkill);
  uint8_t mac_addr[6] = WIFI_MAC_BASE;
  int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
  if (sock < 0)
    exit(1);
  int hwsim_family_id =
      netlink_query_family_id(&nlmsg, sock, "MAC80211_HWSIM", true);
  int nl80211_family_id =
      netlink_query_family_id(&nlmsg, sock, "nl80211", true);
  if (hwsim_family_id < 0 || nl80211_family_id < 0)
    exit(1);
  uint8_t ssid[] = WIFI_IBSS_SSID;
  uint8_t bssid[] = WIFI_IBSS_BSSID;
  struct join_ibss_props ibss_props = {.wiphy_freq = WIFI_DEFAULT_FREQUENCY,
                                       .wiphy_freq_fixed = true,
                                       .mac = bssid,
                                       .ssid = ssid,
                                       .ssid_len = sizeof(ssid)};
  for (int device_id = 0; device_id < WIFI_INITIAL_DEVICE_COUNT; device_id++) {
    mac_addr[5] = device_id;
    int ret = hwsim80211_create_device(&nlmsg, sock, hwsim_family_id, mac_addr);
    if (ret < 0)
      exit(1);
    char interface[6] = "wlan0";
    interface[4] += device_id;
    if (nl80211_setup_ibss_interface(&nlmsg, sock, nl80211_family_id, interface,
                                     &ibss_props, true) < 0)
      exit(1);
  }
  for (int device_id = 0; device_id < WIFI_INITIAL_DEVICE_COUNT; device_id++) {
    char interface[6] = "wlan0";
    interface[4] += device_id;
    int ret = await_ifla_operstate(&nlmsg, interface, IF_OPER_UP, true);
    if (ret < 0)
      exit(1);
  }
  close(sock);
}

static int runcmdline(char* cmdline)
{
  int ret = system(cmdline);
  if (ret) {
  }
  return ret;
}

#define MAX_FDS 30

#define BTPROTO_HCI 1
#define ACL_LINK 1
#define SCAN_PAGE 2

typedef struct {
  uint8_t b[6];
} __attribute__((packed)) bdaddr_t;

#define HCI_COMMAND_PKT 1
#define HCI_EVENT_PKT 4
#define HCI_VENDOR_PKT 0xff

struct hci_command_hdr {
  uint16_t opcode;
  uint8_t plen;
} __attribute__((packed));

struct hci_event_hdr {
  uint8_t evt;
  uint8_t plen;
} __attribute__((packed));

#define HCI_EV_CONN_COMPLETE 0x03
struct hci_ev_conn_complete {
  uint8_t status;
  uint16_t handle;
  bdaddr_t bdaddr;
  uint8_t link_type;
  uint8_t encr_mode;
} __attribute__((packed));

#define HCI_EV_CONN_REQUEST 0x04
struct hci_ev_conn_request {
  bdaddr_t bdaddr;
  uint8_t dev_class[3];
  uint8_t link_type;
} __attribute__((packed));

#define HCI_EV_REMOTE_FEATURES 0x0b
struct hci_ev_remote_features {
  uint8_t status;
  uint16_t handle;
  uint8_t features[8];
} __attribute__((packed));

#define HCI_EV_CMD_COMPLETE 0x0e
struct hci_ev_cmd_complete {
  uint8_t ncmd;
  uint16_t opcode;
} __attribute__((packed));

#define HCI_OP_WRITE_SCAN_ENABLE 0x0c1a

#define HCI_OP_READ_BUFFER_SIZE 0x1005
struct hci_rp_read_buffer_size {
  uint8_t status;
  uint16_t acl_mtu;
  uint8_t sco_mtu;
  uint16_t acl_max_pkt;
  uint16_t sco_max_pkt;
} __attribute__((packed));

#define HCI_OP_READ_BD_ADDR 0x1009
struct hci_rp_read_bd_addr {
  uint8_t status;
  bdaddr_t bdaddr;
} __attribute__((packed));

#define HCI_EV_LE_META 0x3e
struct hci_ev_le_meta {
  uint8_t subevent;
} __attribute__((packed));

#define HCI_EV_LE_CONN_COMPLETE 0x01
struct hci_ev_le_conn_complete {
  uint8_t status;
  uint16_t handle;
  uint8_t role;
  uint8_t bdaddr_type;
  bdaddr_t bdaddr;
  uint16_t interval;
  uint16_t latency;
  uint16_t supervision_timeout;
  uint8_t clk_accurancy;
} __attribute__((packed));

struct hci_dev_req {
  uint16_t dev_id;
  uint32_t dev_opt;
};

struct vhci_vendor_pkt_request {
  uint8_t type;
  uint8_t opcode;
} __attribute__((packed));

struct vhci_pkt {
  uint8_t type;
  union {
    struct {
      uint8_t opcode;
      uint16_t id;
    } __attribute__((packed)) vendor_pkt;
    struct hci_command_hdr command_hdr;
  };
} __attribute__((packed));

#define HCIDEVUP _IOW('H', 201, int)
#define HCISETSCAN _IOW('H', 221, int)

static int vhci_fd = -1;

static void rfkill_unblock_all()
{
  int fd = open("/dev/rfkill", O_WRONLY);
  if (fd < 0)
    exit(1);
  struct rfkill_event event = {0};
  event.idx = 0;
  event.type = RFKILL_TYPE_ALL;
  event.op = RFKILL_OP_CHANGE_ALL;
  event.soft = 0;
  event.hard = 0;
  if (write(fd, &event, sizeof(event)) < 0)
    exit(1);
  close(fd);
}

static void hci_send_event_packet(int fd, uint8_t evt, void* data,
                                  size_t data_len)
{
  struct iovec iv[3];
  struct hci_event_hdr hdr;
  hdr.evt = evt;
  hdr.plen = data_len;
  uint8_t type = HCI_EVENT_PKT;
  iv[0].iov_base = &type;
  iv[0].iov_len = sizeof(type);
  iv[1].iov_base = &hdr;
  iv[1].iov_len = sizeof(hdr);
  iv[2].iov_base = data;
  iv[2].iov_len = data_len;
  if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0)
    exit(1);
}

static void hci_send_event_cmd_complete(int fd, uint16_t opcode, void* data,
                                        size_t data_len)
{
  struct iovec iv[4];
  struct hci_event_hdr hdr;
  hdr.evt = HCI_EV_CMD_COMPLETE;
  hdr.plen = sizeof(struct hci_ev_cmd_complete) + data_len;
  struct hci_ev_cmd_complete evt_hdr;
  evt_hdr.ncmd = 1;
  evt_hdr.opcode = opcode;
  uint8_t type = HCI_EVENT_PKT;
  iv[0].iov_base = &type;
  iv[0].iov_len = sizeof(type);
  iv[1].iov_base = &hdr;
  iv[1].iov_len = sizeof(hdr);
  iv[2].iov_base = &evt_hdr;
  iv[2].iov_len = sizeof(evt_hdr);
  iv[3].iov_base = data;
  iv[3].iov_len = data_len;
  if (writev(fd, iv, sizeof(iv) / sizeof(struct iovec)) < 0)
    exit(1);
}

static bool process_command_pkt(int fd, char* buf, ssize_t buf_size)
{
  struct hci_command_hdr* hdr = (struct hci_command_hdr*)buf;
  if (buf_size < (ssize_t)sizeof(struct hci_command_hdr) ||
      hdr->plen != buf_size - sizeof(struct hci_command_hdr))
    exit(1);
  switch (hdr->opcode) {
  case HCI_OP_WRITE_SCAN_ENABLE: {
    uint8_t status = 0;
    hci_send_event_cmd_complete(fd, hdr->opcode, &status, sizeof(status));
    return true;
  }
  case HCI_OP_READ_BD_ADDR: {
    struct hci_rp_read_bd_addr rp = {0};
    rp.status = 0;
    memset(&rp.bdaddr, 0xaa, 6);
    hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp));
    return false;
  }
  case HCI_OP_READ_BUFFER_SIZE: {
    struct hci_rp_read_buffer_size rp = {0};
    rp.status = 0;
    rp.acl_mtu = 1021;
    rp.sco_mtu = 96;
    rp.acl_max_pkt = 4;
    rp.sco_max_pkt = 6;
    hci_send_event_cmd_complete(fd, hdr->opcode, &rp, sizeof(rp));
    return false;
  }
  }
  char dummy[0xf9] = {0};
  hci_send_event_cmd_complete(fd, hdr->opcode, dummy, sizeof(dummy));
  return false;
}

static void* event_thread(void* arg)
{
  while (1) {
    char buf[1024] = {0};
    ssize_t buf_size = read(vhci_fd, buf, sizeof(buf));
    if (buf_size < 0)
      exit(1);
    if (buf_size > 0 && buf[0] == HCI_COMMAND_PKT) {
      if (process_command_pkt(vhci_fd, buf + 1, buf_size - 1))
        break;
    }
  }
  return NULL;
}
#define HCI_HANDLE_1 200
#define HCI_HANDLE_2 201

#define HCI_PRIMARY 0
#define HCI_OP_RESET 0x0c03

static void initialize_vhci()
{
  int hci_sock = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
  if (hci_sock < 0)
    exit(1);
  vhci_fd = open("/dev/vhci", O_RDWR);
  if (vhci_fd == -1)
    exit(1);
  const int kVhciFd = 202;
  if (dup2(vhci_fd, kVhciFd) < 0)
    exit(1);
  close(vhci_fd);
  vhci_fd = kVhciFd;
  struct vhci_vendor_pkt_request vendor_pkt_req = {HCI_VENDOR_PKT, HCI_PRIMARY};
  if (write(vhci_fd, &vendor_pkt_req, sizeof(vendor_pkt_req)) !=
      sizeof(vendor_pkt_req))
    exit(1);
  struct vhci_pkt vhci_pkt;
  if (read(vhci_fd, &vhci_pkt, sizeof(vhci_pkt)) != sizeof(vhci_pkt))
    exit(1);
  if (vhci_pkt.type == HCI_COMMAND_PKT &&
      vhci_pkt.command_hdr.opcode == HCI_OP_RESET) {
    char response[1] = {0};
    hci_send_event_cmd_complete(vhci_fd, HCI_OP_RESET, response,
                                sizeof(response));
    if (read(vhci_fd, &vhci_pkt, sizeof(vhci_pkt)) != sizeof(vhci_pkt))
      exit(1);
  }
  if (vhci_pkt.type != HCI_VENDOR_PKT)
    exit(1);
  int dev_id = vhci_pkt.vendor_pkt.id;
  pthread_t th;
  if (pthread_create(&th, NULL, event_thread, NULL))
    exit(1);
  int ret = ioctl(hci_sock, HCIDEVUP, dev_id);
  if (ret) {
    if (errno == ERFKILL) {
      rfkill_unblock_all();
      ret = ioctl(hci_sock, HCIDEVUP, dev_id);
    }
    if (ret && errno != EALREADY)
      exit(1);
  }
  struct hci_dev_req dr = {0};
  dr.dev_id = dev_id;
  dr.dev_opt = SCAN_PAGE;
  if (ioctl(hci_sock, HCISETSCAN, &dr))
    exit(1);
  struct hci_ev_conn_request request;
  memset(&request, 0, sizeof(request));
  memset(&request.bdaddr, 0xaa, 6);
  *(uint8_t*)&request.bdaddr.b[5] = 0x10;
  request.link_type = ACL_LINK;
  hci_send_event_packet(vhci_fd, HCI_EV_CONN_REQUEST, &request,
                        sizeof(request));
  struct hci_ev_conn_complete complete;
  memset(&complete, 0, sizeof(complete));
  complete.status = 0;
  complete.handle = HCI_HANDLE_1;
  memset(&complete.bdaddr, 0xaa, 6);
  *(uint8_t*)&complete.bdaddr.b[5] = 0x10;
  complete.link_type = ACL_LINK;
  complete.encr_mode = 0;
  hci_send_event_packet(vhci_fd, HCI_EV_CONN_COMPLETE, &complete,
                        sizeof(complete));
  struct hci_ev_remote_features features;
  memset(&features, 0, sizeof(features));
  features.status = 0;
  features.handle = HCI_HANDLE_1;
  hci_send_event_packet(vhci_fd, HCI_EV_REMOTE_FEATURES, &features,
                        sizeof(features));
  struct {
    struct hci_ev_le_meta le_meta;
    struct hci_ev_le_conn_complete le_conn;
  } le_conn;
  memset(&le_conn, 0, sizeof(le_conn));
  le_conn.le_meta.subevent = HCI_EV_LE_CONN_COMPLETE;
  memset(&le_conn.le_conn.bdaddr, 0xaa, 6);
  *(uint8_t*)&le_conn.le_conn.bdaddr.b[5] = 0x11;
  le_conn.le_conn.role = 1;
  le_conn.le_conn.handle = HCI_HANDLE_2;
  hci_send_event_packet(vhci_fd, HCI_EV_LE_META, &le_conn, sizeof(le_conn));
  pthread_join(th, NULL);
  close(hci_sock);
}

static void mount_cgroups(const char* dir, const char** controllers, int count)
{
  if (mkdir(dir, 0777)) {
    return;
  }
  char enabled[128] = {0};
  int i = 0;
  for (; i < count; i++) {
    if (mount("none", dir, "cgroup", 0, controllers[i])) {
      continue;
    }
    umount(dir);
    strcat(enabled, ",");
    strcat(enabled, controllers[i]);
  }
  if (enabled[0] == 0) {
    if (rmdir(dir) && errno != EBUSY)
      exit(1);
    return;
  }
  if (mount("none", dir, "cgroup", 0, enabled + 1)) {
    if (rmdir(dir) && errno != EBUSY)
      exit(1);
  }
  if (chmod(dir, 0777)) {
  }
}

static void mount_cgroups2(const char** controllers, int count)
{
  if (mkdir("/syzcgroup/unified", 0777)) {
    return;
  }
  if (mount("none", "/syzcgroup/unified", "cgroup2", 0, NULL)) {
    if (rmdir("/syzcgroup/unified") && errno != EBUSY)
      exit(1);
    return;
  }
  if (chmod("/syzcgroup/unified", 0777)) {
  }
  int control = open("/syzcgroup/unified/cgroup.subtree_control", O_WRONLY);
  if (control == -1)
    return;
  int i;
  for (i = 0; i < count; i++)
    if (write(control, controllers[i], strlen(controllers[i])) < 0) {
    }
  close(control);
}

static void setup_cgroups()
{
  const char* unified_controllers[] = {"+cpu", "+io", "+pids"};
  const char* net_controllers[] = {"net", "net_prio", "devices", "blkio",
                                   "freezer"};
  const char* cpu_controllers[] = {"cpuset", "cpuacct", "hugetlb", "rlimit",
                                   "memory"};
  if (mkdir("/syzcgroup", 0777)) {
    return;
  }
  mount_cgroups2(unified_controllers,
                 sizeof(unified_controllers) / sizeof(unified_controllers[0]));
  mount_cgroups("/syzcgroup/net", net_controllers,
                sizeof(net_controllers) / sizeof(net_controllers[0]));
  mount_cgroups("/syzcgroup/cpu", cpu_controllers,
                sizeof(cpu_controllers) / sizeof(cpu_controllers[0]));
  write_file("/syzcgroup/cpu/cgroup.clone_children", "1");
  write_file("/syzcgroup/cpu/cpuset.memory_pressure_enabled", "1");
}

static void setup_cgroups_loop()
{
  int pid = getpid();
  char file[128];
  char cgroupdir[64];
  snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/unified/syz%llu", procid);
  if (mkdir(cgroupdir, 0777)) {
  }
  snprintf(file, sizeof(file), "%s/pids.max", cgroupdir);
  write_file(file, "32");
  snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir);
  write_file(file, "%d", pid);
  snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/cpu/syz%llu", procid);
  if (mkdir(cgroupdir, 0777)) {
  }
  snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir);
  write_file(file, "%d", pid);
  snprintf(file, sizeof(file), "%s/memory.soft_limit_in_bytes", cgroupdir);
  write_file(file, "%d", 299 << 20);
  snprintf(file, sizeof(file), "%s/memory.limit_in_bytes", cgroupdir);
  write_file(file, "%d", 300 << 20);
  snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/net/syz%llu", procid);
  if (mkdir(cgroupdir, 0777)) {
  }
  snprintf(file, sizeof(file), "%s/cgroup.procs", cgroupdir);
  write_file(file, "%d", pid);
}

static void setup_cgroups_test()
{
  char cgroupdir[64];
  snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/unified/syz%llu", procid);
  if (symlink(cgroupdir, "./cgroup")) {
  }
  snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/cpu/syz%llu", procid);
  if (symlink(cgroupdir, "./cgroup.cpu")) {
  }
  snprintf(cgroupdir, sizeof(cgroupdir), "/syzcgroup/net/syz%llu", procid);
  if (symlink(cgroupdir, "./cgroup.net")) {
  }
}

static void initialize_cgroups()
{
  if (mkdir("./syz-tmp/newroot/syzcgroup", 0700))
    exit(1);
  if (mkdir("./syz-tmp/newroot/syzcgroup/unified", 0700))
    exit(1);
  if (mkdir("./syz-tmp/newroot/syzcgroup/cpu", 0700))
    exit(1);
  if (mkdir("./syz-tmp/newroot/syzcgroup/net", 0700))
    exit(1);
  unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE;
  if (mount("/syzcgroup/unified", "./syz-tmp/newroot/syzcgroup/unified", NULL,
            bind_mount_flags, NULL)) {
  }
  if (mount("/syzcgroup/cpu", "./syz-tmp/newroot/syzcgroup/cpu", NULL,
            bind_mount_flags, NULL)) {
  }
  if (mount("/syzcgroup/net", "./syz-tmp/newroot/syzcgroup/net", NULL,
            bind_mount_flags, NULL)) {
  }
}

static void setup_gadgetfs();
static void setup_binderfs();
static void setup_fusectl();
static void sandbox_common_mount_tmpfs(void)
{
  write_file("/proc/sys/fs/mount-max", "100000");
  if (mkdir("./syz-tmp", 0777))
    exit(1);
  if (mount("", "./syz-tmp", "tmpfs", 0, NULL))
    exit(1);
  if (mkdir("./syz-tmp/newroot", 0777))
    exit(1);
  if (mkdir("./syz-tmp/newroot/dev", 0700))
    exit(1);
  unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE;
  if (mount("/dev", "./syz-tmp/newroot/dev", NULL, bind_mount_flags, NULL))
    exit(1);
  if (mkdir("./syz-tmp/newroot/proc", 0700))
    exit(1);
  if (mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL))
    exit(1);
  if (mkdir("./syz-tmp/newroot/selinux", 0700))
    exit(1);
  const char* selinux_path = "./syz-tmp/newroot/selinux";
  if (mount("/selinux", selinux_path, NULL, bind_mount_flags, NULL)) {
    if (errno != ENOENT)
      exit(1);
    if (mount("/sys/fs/selinux", selinux_path, NULL, bind_mount_flags, NULL) &&
        errno != ENOENT)
      exit(1);
  }
  if (mkdir("./syz-tmp/newroot/sys", 0700))
    exit(1);
  if (mount("/sys", "./syz-tmp/newroot/sys", 0, bind_mount_flags, NULL))
    exit(1);
  if (mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL,
            bind_mount_flags, NULL) &&
      errno != ENOENT)
    exit(1);
  if (mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL,
            bind_mount_flags, NULL) &&
      errno != ENOENT)
    exit(1);
  if (mount("/proc/sys/fs/binfmt_misc",
            "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, bind_mount_flags,
            NULL) &&
      errno != ENOENT)
    exit(1);
  if (mkdir("./syz-tmp/newroot/syz-inputs", 0700))
    exit(1);
  if (mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL,
            bind_mount_flags | MS_RDONLY, NULL) &&
      errno != ENOENT)
    exit(1);
  initialize_cgroups();
  if (mkdir("./syz-tmp/pivot", 0777))
    exit(1);
  if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) {
    if (chdir("./syz-tmp"))
      exit(1);
  } else {
    if (chdir("/"))
      exit(1);
    if (umount2("./pivot", MNT_DETACH))
      exit(1);
  }
  if (chroot("./newroot"))
    exit(1);
  if (chdir("/"))
    exit(1);
  setup_gadgetfs();
  setup_binderfs();
  setup_fusectl();
}

static void setup_gadgetfs()
{
  if (mkdir("/dev/gadgetfs", 0777)) {
  }
  if (mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL)) {
  }
}

static void setup_fusectl()
{
  if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
  }
}

static void setup_binderfs()
{
  if (mkdir("/dev/binderfs", 0777)) {
  }
  if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) {
  }
}

static void loop();

static void sandbox_common()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  if (getppid() == 1)
    exit(1);
  struct rlimit rlim;
  rlim.rlim_cur = rlim.rlim_max = (200 << 20);
  setrlimit(RLIMIT_AS, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 32 << 20;
  setrlimit(RLIMIT_MEMLOCK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 136 << 20;
  setrlimit(RLIMIT_FSIZE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 1 << 20;
  setrlimit(RLIMIT_STACK, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 128 << 20;
  setrlimit(RLIMIT_CORE, &rlim);
  rlim.rlim_cur = rlim.rlim_max = 256;
  setrlimit(RLIMIT_NOFILE, &rlim);
  if (unshare(CLONE_NEWNS)) {
  }
  if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
  }
  if (unshare(CLONE_NEWIPC)) {
  }
  if (unshare(0x02000000)) {
  }
  if (unshare(CLONE_NEWUTS)) {
  }
  if (unshare(CLONE_SYSVSEM)) {
  }
  typedef struct {
    const char* name;
    const char* value;
  } sysctl_t;
  static const sysctl_t sysctls[] = {
      {"/proc/sys/kernel/shmmax", "16777216"},
      {"/proc/sys/kernel/shmall", "536870912"},
      {"/proc/sys/kernel/shmmni", "1024"},
      {"/proc/sys/kernel/msgmax", "8192"},
      {"/proc/sys/kernel/msgmni", "1024"},
      {"/proc/sys/kernel/msgmnb", "1024"},
      {"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
  };
  unsigned i;
  for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
    write_file(sysctls[i].name, sysctls[i].value);
}

static int wait_for_loop(int pid)
{
  if (pid < 0)
    exit(1);
  int status = 0;
  while (waitpid(-1, &status, __WALL) != pid) {
  }
  return WEXITSTATUS(status);
}

static void drop_caps(void)
{
  struct __user_cap_header_struct cap_hdr = {};
  struct __user_cap_data_struct cap_data[2] = {};
  cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
  cap_hdr.pid = getpid();
  if (syscall(SYS_capget, &cap_hdr, &cap_data))
    exit(1);
  const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
  cap_data[0].effective &= ~drop;
  cap_data[0].permitted &= ~drop;
  cap_data[0].inheritable &= ~drop;
  if (syscall(SYS_capset, &cap_hdr, &cap_data))
    exit(1);
}

static int do_sandbox_none(void)
{
  if (unshare(CLONE_NEWPID)) {
  }
  int pid = fork();
  if (pid != 0)
    return wait_for_loop(pid);
  initialize_vhci();
  sandbox_common();
  drop_caps();
  if (unshare(CLONE_NEWNET)) {
  }
  write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535");
  initialize_wifi_devices();
  sandbox_common_mount_tmpfs();
  loop();
  exit(1);
}

#define FS_IOC_SETFLAGS _IOW('f', 2, long)
static void remove_dir(const char* dir)
{
  int iter = 0;
  DIR* dp = 0;
  const int umount_flags = MNT_FORCE | UMOUNT_NOFOLLOW;

retry:
  while (umount2(dir, umount_flags) == 0) {
  }
  dp = opendir(dir);
  if (dp == NULL) {
    if (errno == EMFILE) {
      exit(1);
    }
    exit(1);
  }
  struct dirent* ep = 0;
  while ((ep = readdir(dp))) {
    if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
      continue;
    char filename[FILENAME_MAX];
    snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
    while (umount2(filename, umount_flags) == 0) {
    }
    struct stat st;
    if (lstat(filename, &st))
      exit(1);
    if (S_ISDIR(st.st_mode)) {
      remove_dir(filename);
      continue;
    }
    int i;
    for (i = 0;; i++) {
      if (unlink(filename) == 0)
        break;
      if (errno == EPERM) {
        int fd = open(filename, O_RDONLY);
        if (fd != -1) {
          long flags = 0;
          if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
          }
          close(fd);
          continue;
        }
      }
      if (errno == EROFS) {
        break;
      }
      if (errno != EBUSY || i > 100)
        exit(1);
      if (umount2(filename, umount_flags))
        exit(1);
    }
  }
  closedir(dp);
  for (int i = 0;; i++) {
    if (rmdir(dir) == 0)
      break;
    if (i < 100) {
      if (errno == EPERM) {
        int fd = open(dir, O_RDONLY);
        if (fd != -1) {
          long flags = 0;
          if (ioctl(fd, FS_IOC_SETFLAGS, &flags) == 0) {
          }
          close(fd);
          continue;
        }
      }
      if (errno == EROFS) {
        break;
      }
      if (errno == EBUSY) {
        if (umount2(dir, umount_flags))
          exit(1);
        continue;
      }
      if (errno == ENOTEMPTY) {
        if (iter < 100) {
          iter++;
          goto retry;
        }
      }
    }
    exit(1);
  }
}

static void kill_and_wait(int pid, int* status)
{
  kill(-pid, SIGKILL);
  kill(pid, SIGKILL);
  for (int i = 0; i < 100; i++) {
    if (waitpid(-1, status, WNOHANG | __WALL) == pid)
      return;
    usleep(1000);
  }
  DIR* dir = opendir("/sys/fs/fuse/connections");
  if (dir) {
    for (;;) {
      struct dirent* ent = readdir(dir);
      if (!ent)
        break;
      if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
        continue;
      char abort[300];
      snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
               ent->d_name);
      int fd = open(abort, O_WRONLY);
      if (fd == -1) {
        continue;
      }
      if (write(fd, abort, 1) < 0) {
      }
      close(fd);
    }
    closedir(dir);
  } else {
  }
  while (waitpid(-1, status, __WALL) != pid) {
  }
}

static void setup_loop()
{
  setup_cgroups_loop();
}

static void setup_test()
{
  prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
  setpgrp();
  setup_cgroups_test();
  write_file("/proc/self/oom_score_adj", "1000");
  if (symlink("/dev/binderfs", "./binderfs")) {
  }
}

static void close_fds()
{
  for (int fd = 3; fd < MAX_FDS; fd++)
    close(fd);
}

static const char* setup_usb()
{
  if (chmod("/dev/raw-gadget", 0666))
    return "failed to chmod /dev/raw-gadget";
  return NULL;
}

#define NL802154_CMD_SET_SHORT_ADDR 11
#define NL802154_ATTR_IFINDEX 3
#define NL802154_ATTR_SHORT_ADDR 10

static const char* setup_802154()
{
  const char* error = NULL;
  int sock_generic = -1;
  int sock_route = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
  if (sock_route == -1) {
    error = "socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) failed";
    goto fail;
  }
  sock_generic = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC);
  if (sock_generic == -1) {
    error = "socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) failed";
    goto fail;
  }
  {
    int nl802154_family_id =
        netlink_query_family_id(&nlmsg, sock_generic, "nl802154", true);
    if (nl802154_family_id < 0) {
      error = "netlink_query_family_id failed";
      goto fail;
    }
    for (int i = 0; i < 2; i++) {
      char devname[] = "wpan0";
      devname[strlen(devname) - 1] += i;
      uint64_t hwaddr = 0xaaaaaaaaaaaa0002 + (i << 8);
      uint16_t shortaddr = 0xaaa0 + i;
      int ifindex = if_nametoindex(devname);
      struct genlmsghdr genlhdr;
      memset(&genlhdr, 0, sizeof(genlhdr));
      genlhdr.cmd = NL802154_CMD_SET_SHORT_ADDR;
      netlink_init(&nlmsg, nl802154_family_id, 0, &genlhdr, sizeof(genlhdr));
      netlink_attr(&nlmsg, NL802154_ATTR_IFINDEX, &ifindex, sizeof(ifindex));
      netlink_attr(&nlmsg, NL802154_ATTR_SHORT_ADDR, &shortaddr,
                   sizeof(shortaddr));
      if (netlink_send(&nlmsg, sock_generic) < 0) {
        error = "NL802154_CMD_SET_SHORT_ADDR failed";
        goto fail;
      }
      netlink_device_change(&nlmsg, sock_route, devname, true, 0, &hwaddr,
                            sizeof(hwaddr), 0);
      if (i == 0) {
        netlink_add_device_impl(&nlmsg, "lowpan", "lowpan0", false);
        netlink_done(&nlmsg);
        netlink_attr(&nlmsg, IFLA_LINK, &ifindex, sizeof(ifindex));
        if (netlink_send(&nlmsg, sock_route) < 0) {
          error = "netlink: adding device lowpan0 type lowpan link wpan0";
          goto fail;
        }
      }
    }
  }
fail:
  close(sock_route);
  close(sock_generic);
  return error;
}

#define SWAP_FILE "./swap-file"
#define SWAP_FILE_SIZE (128 * 1000 * 1000)

static const char* setup_swap()
{
  swapoff(SWAP_FILE);
  unlink(SWAP_FILE);
  int fd = open(SWAP_FILE, O_CREAT | O_WRONLY | O_CLOEXEC, 0600);
  if (fd == -1)
    return "swap file open failed";
  fallocate(fd, FALLOC_FL_ZERO_RANGE, 0, SWAP_FILE_SIZE);
  close(fd);
  char cmdline[64];
  sprintf(cmdline, "mkswap %s", SWAP_FILE);
  if (runcmdline(cmdline))
    return "mkswap failed";
  if (swapon(SWAP_FILE, SWAP_FLAG_PREFER) == 1)
    return "swapon failed";
  return NULL;
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
  setup_loop();
  int iter = 0;
  for (;; iter++) {
    char cwdbuf[32];
    sprintf(cwdbuf, "./%d", iter);
    if (mkdir(cwdbuf, 0777))
      exit(1);
    int pid = fork();
    if (pid < 0)
      exit(1);
    if (pid == 0) {
      if (chdir(cwdbuf))
        exit(1);
      setup_test();
      execute_one();
      close_fds();
      exit(0);
    }
    int status = 0;
    uint64_t start = current_time_ms();
    for (;;) {
      sleep_ms(10);
      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
        break;
      if (current_time_ms() - start < 5000)
        continue;
      kill_and_wait(pid, &status);
      break;
    }
    remove_dir(cwdbuf);
  }
}

void execute_one(void)
{
  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
  }
  //  recvmsg$kcm arguments: [
  //    fd: sock_kcm (resource)
  //    msg: nil
  //    f: recv_flags = 0x0 (8 bytes)
  //  ]
  syscall(__NR_recvmsg, /*fd=*/(intptr_t)-1, /*msg=*/0ul, /*f=*/0ul, 0);
  //  perf_event_open$cgroup arguments: [
  //    attr: ptr[in, perf_event_attr] {
  //      perf_event_attr {
  //        type: perf_event_type = 0x2 (4 bytes)
  //        size: len = 0x80 (4 bytes)
  //        config0: int8 = 0x16 (1 bytes)
  //        config1: int8 = 0x1 (1 bytes)
  //        config2: int8 = 0x0 (1 bytes)
  //        config3: int8 = 0x0 (1 bytes)
  //        config4: const = 0x0 (4 bytes)
  //        sample_freq: int64 = 0x5 (8 bytes)
  //        sample_type: perf_sample_type = 0x0 (8 bytes)
  //        read_format: perf_read_format = 0x0 (8 bytes)
  //        disabled: int64 = 0x0 (0 bytes)
  //        inherit: int64 = 0x0 (0 bytes)
  //        pinned: int64 = 0x0 (0 bytes)
  //        exclusive: int64 = 0x0 (0 bytes)
  //        exclude_user: int64 = 0x0 (0 bytes)
  //        exclude_kernel: int64 = 0x0 (0 bytes)
  //        exclude_hv: int64 = 0x0 (0 bytes)
  //        exclude_idle: int64 = 0x0 (0 bytes)
  //        mmap: int64 = 0x0 (0 bytes)
  //        comm: int64 = 0x0 (0 bytes)
  //        freq: int64 = 0x0 (0 bytes)
  //        inherit_stat: int64 = 0x0 (0 bytes)
  //        enable_on_exec: int64 = 0x0 (0 bytes)
  //        task: int64 = 0x0 (0 bytes)
  //        watermark: int64 = 0x0 (0 bytes)
  //        precise_ip: int64 = 0x0 (0 bytes)
  //        mmap_data: int64 = 0x0 (0 bytes)
  //        sample_id_all: int64 = 0x0 (0 bytes)
  //        exclude_host: int64 = 0x0 (0 bytes)
  //        exclude_guest: int64 = 0x0 (0 bytes)
  //        exclude_callchain_kernel: int64 = 0x0 (0 bytes)
  //        exclude_callchain_user: int64 = 0x0 (0 bytes)
  //        mmap2: int64 = 0x0 (0 bytes)
  //        comm_exec: int64 = 0x0 (0 bytes)
  //        use_clockid: int64 = 0x0 (0 bytes)
  //        context_switch: int64 = 0x0 (0 bytes)
  //        write_backward: int64 = 0x0 (0 bytes)
  //        namespaces: int64 = 0x0 (0 bytes)
  //        ksymbol: int64 = 0x0 (0 bytes)
  //        bpf_event: int64 = 0x0 (0 bytes)
  //        aux_output: int64 = 0x0 (0 bytes)
  //        cgroup: int64 = 0x0 (0 bytes)
  //        text_poke: int64 = 0x0 (0 bytes)
  //        build_id: int64 = 0x0 (0 bytes)
  //        inherit_thread: int64 = 0x0 (0 bytes)
  //        remove_on_exec: int64 = 0x0 (0 bytes)
  //        sigtrap: int64 = 0x0 (0 bytes)
  //        __reserved_1: const = 0x0 (8 bytes)
  //        wakeup_events: int32 = 0x0 (4 bytes)
  //        bp_type: perf_bp_type = 0x4 (4 bytes)
  //        bp_config: union perf_bp_config {
  //          perf_bp: perf_bp {
  //            bp_addr: nil
  //            bp_len: perf_bp_lens = 0x0 (8 bytes)
  //          }
  //        }
  //        branch_sample_type: perf_branch_sample_type = 0x80 (8 bytes)
  //        sample_regs_user: int64 = 0x800 (8 bytes)
  //        sample_stack_user: int32 = 0x0 (4 bytes)
  //        clockid: clock_type = 0x0 (4 bytes)
  //        sample_regs_intr: int64 = 0x0 (8 bytes)
  //        aux_watermark: int32 = 0x7 (4 bytes)
  //        sample_max_stack: int16 = 0xffff (2 bytes)
  //        __reserved_2: const = 0x0 (2 bytes)
  //        aux_sample_size: int32 = 0x0 (4 bytes)
  //        __reserved_3: const = 0x0 (4 bytes)
  //        sig_data: int64 = 0x7 (8 bytes)
  //      }
  //    }
  //    fd: fd_cgroup (resource)
  //    cpu: intptr = 0x0 (8 bytes)
  //    group: fd_perf (resource)
  //    flags: perf_flags_cgroup = 0x0 (8 bytes)
  //  ]
  //  returns fd_perf
  *(uint32_t*)0x2000000003c0 = 2;
  *(uint32_t*)0x2000000003c4 = 0x80;
  *(uint8_t*)0x2000000003c8 = 0x16;
  *(uint8_t*)0x2000000003c9 = 1;
  *(uint8_t*)0x2000000003ca = 0;
  *(uint8_t*)0x2000000003cb = 0;
  *(uint32_t*)0x2000000003cc = 0;
  *(uint64_t*)0x2000000003d0 = 5;
  *(uint64_t*)0x2000000003d8 = 0;
  *(uint64_t*)0x2000000003e0 = 0;
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 0, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 1, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 2, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 3, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 4, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 5, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 6, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 7, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 8, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 9, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 10, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 11, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 12, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 13, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 14, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 15, 2);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 17, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 18, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 19, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 20, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 21, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 22, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 23, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 24, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 25, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 26, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 27, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 28, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 29, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 30, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 31, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 32, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 33, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 34, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 35, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 36, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 37, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 38, 26);
  *(uint32_t*)0x2000000003f0 = 0;
  *(uint32_t*)0x2000000003f4 = 4;
  *(uint64_t*)0x2000000003f8 = 0;
  *(uint64_t*)0x200000000400 = 0;
  *(uint64_t*)0x200000000408 = 0x80;
  *(uint64_t*)0x200000000410 = 0x800;
  *(uint32_t*)0x200000000418 = 0;
  *(uint32_t*)0x20000000041c = 0;
  *(uint64_t*)0x200000000420 = 0;
  *(uint32_t*)0x200000000428 = 7;
  *(uint16_t*)0x20000000042c = -1;
  *(uint16_t*)0x20000000042e = 0;
  *(uint32_t*)0x200000000430 = 0;
  *(uint32_t*)0x200000000434 = 0;
  *(uint64_t*)0x200000000438 = 7;
  syscall(__NR_perf_event_open, /*attr=*/0x2000000003c0ul, /*fd=*/(intptr_t)-1,
          /*cpu=*/0ul, /*group=*/(intptr_t)-1, /*flags=*/0ul);
  //  perf_event_open arguments: [
  //    attr: nil
  //    pid: pid (resource)
  //    cpu: intptr = 0xffffffffffffffff (8 bytes)
  //    group: fd_perf (resource)
  //    flags: perf_flags = 0xa (8 bytes)
  //  ]
  //  returns fd_perf
  syscall(__NR_perf_event_open, /*attr=*/0ul, /*pid=*/0, /*cpu=*/(intptr_t)-1,
          /*group=*/(intptr_t)-1,
          /*flags=PERF_FLAG_FD_CLOEXEC|PERF_FLAG_FD_OUTPUT*/ 0xaul);
  //  perf_event_open arguments: [
  //    attr: ptr[in, perf_event_attr] {
  //      perf_event_attr {
  //        type: perf_event_type = 0x1 (4 bytes)
  //        size: len = 0x80 (4 bytes)
  //        config0: int8 = 0x0 (1 bytes)
  //        config1: int8 = 0x0 (1 bytes)
  //        config2: int8 = 0x0 (1 bytes)
  //        config3: int8 = 0x0 (1 bytes)
  //        config4: const = 0x0 (4 bytes)
  //        sample_freq: int64 = 0x4d31 (8 bytes)
  //        sample_type: perf_sample_type = 0xc (8 bytes)
  //        read_format: perf_read_format = 0x0 (8 bytes)
  //        disabled: int64 = 0x0 (0 bytes)
  //        inherit: int64 = 0x0 (0 bytes)
  //        pinned: int64 = 0x0 (0 bytes)
  //        exclusive: int64 = 0x0 (0 bytes)
  //        exclude_user: int64 = 0x0 (0 bytes)
  //        exclude_kernel: int64 = 0x0 (0 bytes)
  //        exclude_hv: int64 = 0x0 (0 bytes)
  //        exclude_idle: int64 = 0x0 (0 bytes)
  //        mmap: int64 = 0x0 (0 bytes)
  //        comm: int64 = 0x0 (0 bytes)
  //        freq: int64 = 0x0 (0 bytes)
  //        inherit_stat: int64 = 0x0 (0 bytes)
  //        enable_on_exec: int64 = 0x0 (0 bytes)
  //        task: int64 = 0x0 (0 bytes)
  //        watermark: int64 = 0x0 (0 bytes)
  //        precise_ip: int64 = 0x0 (0 bytes)
  //        mmap_data: int64 = 0x0 (0 bytes)
  //        sample_id_all: int64 = 0x0 (0 bytes)
  //        exclude_host: int64 = 0x0 (0 bytes)
  //        exclude_guest: int64 = 0x0 (0 bytes)
  //        exclude_callchain_kernel: int64 = 0x0 (0 bytes)
  //        exclude_callchain_user: int64 = 0x0 (0 bytes)
  //        mmap2: int64 = 0x0 (0 bytes)
  //        comm_exec: int64 = 0x0 (0 bytes)
  //        use_clockid: int64 = 0x0 (0 bytes)
  //        context_switch: int64 = 0x0 (0 bytes)
  //        write_backward: int64 = 0x0 (0 bytes)
  //        namespaces: int64 = 0x0 (0 bytes)
  //        ksymbol: int64 = 0x0 (0 bytes)
  //        bpf_event: int64 = 0x0 (0 bytes)
  //        aux_output: int64 = 0x0 (0 bytes)
  //        cgroup: int64 = 0x0 (0 bytes)
  //        text_poke: int64 = 0x0 (0 bytes)
  //        build_id: int64 = 0x0 (0 bytes)
  //        inherit_thread: int64 = 0x0 (0 bytes)
  //        remove_on_exec: int64 = 0x0 (0 bytes)
  //        sigtrap: int64 = 0x0 (0 bytes)
  //        __reserved_1: const = 0x0 (8 bytes)
  //        wakeup_events: int32 = 0x0 (4 bytes)
  //        bp_type: perf_bp_type = 0x0 (4 bytes)
  //        bp_config: union perf_bp_config {
  //          perf_config_ext: perf_config_ext {
  //            config1: int64 = 0x8 (8 bytes)
  //            config2: int64 = 0x830d (8 bytes)
  //          }
  //        }
  //        branch_sample_type: perf_branch_sample_type = 0x0 (8 bytes)
  //        sample_regs_user: int64 = 0x2 (8 bytes)
  //        sample_stack_user: int32 = 0x9 (4 bytes)
  //        clockid: clock_type = 0x0 (4 bytes)
  //        sample_regs_intr: int64 = 0x0 (8 bytes)
  //        aux_watermark: int32 = 0x0 (4 bytes)
  //        sample_max_stack: int16 = 0x0 (2 bytes)
  //        __reserved_2: const = 0x0 (2 bytes)
  //        aux_sample_size: int32 = 0x0 (4 bytes)
  //        __reserved_3: const = 0x0 (4 bytes)
  //        sig_data: int64 = 0x0 (8 bytes)
  //      }
  //    }
  //    pid: pid (resource)
  //    cpu: intptr = 0xffffffffffffffff (8 bytes)
  //    group: fd_perf (resource)
  //    flags: perf_flags = 0x0 (8 bytes)
  //  ]
  //  returns fd_perf
  *(uint32_t*)0x2000000003c0 = 1;
  *(uint32_t*)0x2000000003c4 = 0x80;
  *(uint8_t*)0x2000000003c8 = 0;
  *(uint8_t*)0x2000000003c9 = 0;
  *(uint8_t*)0x2000000003ca = 0;
  *(uint8_t*)0x2000000003cb = 0;
  *(uint32_t*)0x2000000003cc = 0;
  *(uint64_t*)0x2000000003d0 = 0x4d31;
  *(uint64_t*)0x2000000003d8 = 0xc;
  *(uint64_t*)0x2000000003e0 = 0;
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 0, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 1, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 2, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 3, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 4, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 5, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 6, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 7, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 8, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 9, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 10, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 11, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 12, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 13, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 14, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 15, 2);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 17, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 18, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 19, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 20, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 21, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 22, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 23, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 24, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 25, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 26, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 27, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 28, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 29, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 30, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 31, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 32, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 33, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 34, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 35, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 36, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 37, 1);
  STORE_BY_BITMASK(uint64_t, , 0x2000000003e8, 0, 38, 26);
  *(uint32_t*)0x2000000003f0 = 0;
  *(uint32_t*)0x2000000003f4 = 0;
  *(uint64_t*)0x2000000003f8 = 8;
  *(uint64_t*)0x200000000400 = 0x830d;
  *(uint64_t*)0x200000000408 = 0;
  *(uint64_t*)0x200000000410 = 2;
  *(uint32_t*)0x200000000418 = 9;
  *(uint32_t*)0x20000000041c = 0;
  *(uint64_t*)0x200000000420 = 0;
  *(uint32_t*)0x200000000428 = 0;
  *(uint16_t*)0x20000000042c = 0;
  *(uint16_t*)0x20000000042e = 0;
  *(uint32_t*)0x200000000430 = 0;
  *(uint32_t*)0x200000000434 = 0;
  *(uint64_t*)0x200000000438 = 0;
  syscall(__NR_perf_event_open, /*attr=*/0x2000000003c0ul, /*pid=*/0,
          /*cpu=*/(intptr_t)-1, /*group=*/(intptr_t)-1, /*flags=*/0ul);
  //  bpf$PROG_LOAD arguments: [
  //    cmd: const = 0x5 (8 bytes)
  //    arg: ptr[in, bpf_prog_t[flags[bpf_prog_type, int32],
  //    bpf_prog_attach_types, bpf_btf_id[opt], fd_bpf_prog[opt]]] {
  //      bpf_prog_t[flags[bpf_prog_type, int32], bpf_prog_attach_types,
  //      bpf_btf_id[opt], fd_bpf_prog[opt]] {
  //        type: bpf_prog_type = 0xc (4 bytes)
  //        ninsn: bytesize8 = 0xe (4 bytes)
  //        insns: ptr[inout, array[ANYUNION]] {
  //          array[ANYUNION] {
  //            union ANYUNION {
  //              ANYBLOB: buffer: {b7 02 00 00 1a 00 00 00 bf a3 00 00 00 00 00
  //              00 07 03 00 00 00 fe ff ff 7a 0a f0 ff 01 00 00 00 79 a4 f0 ff
  //              00 00 00 00 b7 06 00 00 7f ff ff ff 2d 64 05 00 00 00 00 00 65
  //              04 04 00 01 00 00 00 04 04 00 00 01 00 7d 60 b7 03 00 00 00 00
  //              00 00 6a 0a 00 fe 00 00 00 00 85 00 00 00 0d 00 00 00 b7 00 00
  //              00 00 00 00 00 95 00 00 00 00 00 00 00 4e ce fa b8 f2 e8 5c 6c
  //              1c a7 11 fc d0 cd fa 14 6e c5 61 75 03 79 58 5e 5a 07 6d 83 92
  //              40 d2 9c 03 40 15 b6 7d af e6 c8 dc 3d 5d 78 c0 7f a1 f7 e6 18
  //              5f ec 0e 07 00 4e 60 c0 8d c8 b8 db f1 1e 6e 94 d7 59 38 32 1a
  //              3a a5 02 cd 24 24 a6 6e 6d 2e f8 31 ab 7e a0 c3 4f 17 e3 94 6e
  //              0e bc 62 20 03 b5 38 df d8 e0 12 e7 95 78 e5 1b c5 f3 1e 31 06
  //              d1 dd d6 15 2f 7c bd b9 cd 38 bd b2 20 9c 67 de ca 8e eb 9c 15
  //              ab 3a 14 81 7a c6 1e 4d d1 11 83 a1 34 77 bf 7e 86 0e 36 70 ef
  //              0e 78 9f 65 f1 32 8d 67 04 90 2c be 7b c0 4b 82 d2 78 9c b1 32
  //              b8 03 00 00 00 66 1d f2 8d 99 61 b6 3e 1a 9c f6 c2 a6 60 a1 fe
  //              3c 18 4b 75 1c 51 16 0f b2 0b 1c 58 1e 7b 14 8b a5 32 e6 ea 09
  //              c3 46 df eb d3 86 08 b3 2a 00 80 00 5d 9a 95 00 00 00 00 00 00
  //              00 33 4d 83 23 9d d2 70 80 85 1d ca c3 c1 22 33 f9 a1 fb 9c 2a
  //              ec 61 ce 63 a3 8d 2f d5 01 17 b8 9a 9a b3 59 b4 ee a0 c6 e9 57
  //              67 d4 2b 4e 14 86 1d 02 27 db fd 2e 6d 7f 71 5a 7f 3d ea dd 71
  //              30 85 6f 75 64 36 30 37 67 d2 e2 4f 29 e5 da d9 79 6e db 69 7a
  //              ee a0 18 2b ab d1 8c ac 1b d4 f4 39 0a f9 a9 ce af d0 00 2c ab
  //              15 4a d0 29 a1 09 00 00 00 27 80 87 00 14 f5 1c 3c 97 5d 5a ec
  //              84 22 2f d3 a0 ec 4b e3 e5 63 11 2f 0b 39 50 1a af e2 34 87 00
  //              72 85 8d c0 6e 7c 33 76 42 d3 e5 a8 15 23 2f 5e 16 b0 89 f3 7b
  //              35 91 a1 5c 0a 9b e6 eb 18 20 84 04 c1 b3 0c 3a 6a 71 bc 85 01
  //              8e 5f f2 c9 10 18 af c9 ff c2 cc 78 8b ee 1b 47 68 3d b0 1a 46
  //              93 98 68 52 11 df bb ae 3e 2e d0 a5 0e 73 13 bf f5 d4 c3 91 dd
  //              ec e0 0f c7 72 dd 6b 4d 4d e2 a4 19 90 f0 5c a3 bd fc 92 c8 8c
  //              5b 74 cd 36 e7 48 7a fa 44 7e 2e df ae 4f 39 0a 83 37 84 1c ef
  //              38 6e 22 cc 22 ee 17 47 6d 73 89 52 22 96 82 e2 4b 92 53 3a c2
  //              a9 f5 a6 99 59 3f 08 44 19 ca e0 b4 53 2b cc 97 d3 ae 48 6a ca
  //              54 18 3f b0 1c 73 f9 79 ca 98 57 39 95 37 f5 dc 2a 2d 0e 00 00
  //              00 00 00 00 05 78 67 3f 8b 6e 74 ce 23 87 7a 6b 24 db 0e 06 73
  //              45 56 09 42 fa 62 9f be f2 46 1c 96 a0 88 a2 2e 8b 15 c3 e2 33
  //              db 7a b2 2e 30 d4 6a 9d 24 d3 7c ef 09 9e ce 72 9a a2 18 f9 f4
  //              4a 32 10 22 3f da e7 ed 04 93 5c 3c 90 d3 ad d8 ee bc 86 19 d7
  //              34 15 cd a2 13 0f 50 71 46 00 fb 62 41 c6 e9 55 03 17 95 b2 c2
  //              f5 64 11 e4 84 55 b5 a8 b9 0d fa e1 58 b9 4f 50 ad ab 98 8d d8
  //              e1 2b af 5c c9 39 8f ff 00 40 4d 5d 99 f8 2e 20 ee 6a 8c 88 e1
  //              8c 29 77 aa b3 7d 9a c4 cf c1 c7 b4 00 00 00 00 00 00 07 ff 57
  //              c3 94 95 c8 26 b9 56 ba 85 9a c8 e3 c1 77 b9 1b d7 d5 e4 1f f8
  //              68 f7 ca e2 cd 0a 27 82 d2 23 0f e4 bf 98 65 de 0d 16 64 fe 2f
  //              3c ed 84 68 91 18 06 04 b6 dd 24 99 d1 6d 7d 91 58 ff ff ff ff
  //              00 00 00 00 ef 06 9d c4 27 49 a8 9f 85 47 97 f2 9d 00 00 00 2d
  //              8c 38 a9 67 c1 bb e0 93 15 c2 98 77 a3 08 bc c8 7d c3 ad db 08
  //              14 1b de e5 d2 78 74 b2 f6 63 dd ee dd 00 5b 3d 96 c7 aa bf 4d
  //              f5 17 d9 0b dc 01 e7 38 35 d5 a3 e1 a9 08 00 c6 6e e2 b1 ad 76
  //              df f9 f9 00 00 71 41 4c 99 d4 89 4e e7 f8 24 9d c1 e3 42 8d 21
  //              29 36 9e e1 b8 5a f6 eb 2e ea 0d 0d f4 14 b3 15 f6 51 c8 41 23
  //              92 19 1f a8 3e e8 30 54 8f 11 e1 03 6a 8d eb d6 4c be 35 94 54
  //              a3 f2 23 9c fe 00 00 00 00 00 00 42 b8 ff 8c 21 ad 70 2c ca ca
  //              d5 b3 9e ef 21 3d 1c a2 96 d2 a2 77 98 c8 ce 2a 30 5c 0c 7d 35
  //              cf 4b 22 54 9a 4b d9 20 52 18 8b d1 f2 85 f6 53 b6 21 49 1d c6
  //              aa ee 02 00 e2 ff 08 64 4f b9 4c 06 00 6e ff 1b e2 f6 33 c1 d9
  //              87 59 1e c3 db 58 a7 bb 30 42 ec 3f 77 1f 7a 13 38 a5 c3 dd 35
  //              e9 26 04 9f e8 6e 09 c5 8e 27 3c d9 05 de b2 8c 13 c1 ed 1c 0d
  //              9c ae 84 6b cb fa 8c ce 7b 89 3e 57 8a f7 dc 7d 5e 87 d4 4f f8
  //              28 de 45 3f 34 c2 b1 86 60 b0 80 ef c7 07 e6 76 e1 fb 4d 58 25
  //              c0 ca 17 7a 4c 7f bb 4e da 05 45 c0 0f 57 6b 2b 5c c7 f8 19 ab
  //              d0 f8 85 cc 48 06 f4 03 00 96 6f cf 1e 54 f5 a2 d3 87 08 29 4c
  //              d6 f4 96 e5 de e7 34 fe 7d a3 77 08 45 cf 44 2d 48 8a fd c0 e1
  //              70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  //              00 00 00 00 00 00 52 05 00 00 00 dc 1c 56 d5 9f 35 f2 67 63 29
  //              52 a9 34 66 ae 59 5c 6a 8c da 69 0d 19 2a 07 08 86 df 42 b2 70
  //              98 77 3b 45 19 8b 4a 34 ac 97 7e bd 44 50 e1 21 d0 13 42 70 3f
  //              5b f0 30 e9 35 87 8a 6d 16 9c 80 aa 42 52 d4 ea 6b 8f 62 16 ff
  //              20 2b 5b 5a 18 2c b5 e8 03 39 f9 95 3c 30 93 c3 69 0d 10 ec b6
  //              5d c5 b4 74 81 ed bf 1f 00 00 00 00 00 00 00 4d 16 d2 9c 28 eb
  //              51 67 e9 93 6e d3 27 fb 23 7a 56 22 4e 49 d9 ea 95 5a 5f 0d ec
  //              1b 3c cd 52 36 46 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  //              00 00 00 00 00 00 00 dd 6f e1 51 8c c7 80 20 43 ec fe 69 f7 43
  //              f1 21 3b f8 17 9e cd 9e 5a 22 5d 67 52 1d c7 28 ea c7 d8 0a 56
  //              56 ac 2c bd e2 1d 3e bf bf 69 ff 86 1f 43 94 83 6d df 12 8d 6d
  //              19 07 9e 64 33 6e 7c 67 65 05 c7 8a d6 75 48 f4 b1 92 be 18 27
  //              fc d9 5c f1 07 75 3c b0 a6 a9 79 d3 db 0c 40 70 81 c6 28 1e 2d
  //              84 29 a8 63 90 3c a7 5f 4c 7d f3 ea 8f c2 01 8d 07 af 14 91 ef
  //              06 0c d4 40 3a 09 9f 32 46 8f 65 bd 06 b4 08 2d 43 e1 21 86 1b
  //              5c c0 3f 1a 15 61 f0 58 9e 0d 12 96 9b c9 82 ff 5d 8e 9b 98 6c
  //              0c 6c 74 7d 9a 1c c5 00 bb 89 2c 3a 16 ff 10 fe ea 20 bd ac 00
  //              00 00 00 00 00 00 00 ca 06 f2 56 c8 02 8e 0f 9b 65 f0 37 b2 1f
  //              32 89 f8 6a 68 26 c6 9f a3 5b a5 cb c3 f2 db 15 16 ff c5 c6 e3
  //              fa 61 8b 24 a6 ce 16 d6 c7 01 0b b3 7b 61 fa 0a 2d 89 74 e6 91
  //              15 d3 33 94 e8 6e 4b 83 82 97 ba 20 f9 69 36 b7 e4 74 6e 92 de
  //              a6 c5 d1 d3 3d 84 d9 6b 50 fb 00 00 00 ae 07 c6 5b 71 08 8d d7
  //              d5 d1 e1 ba b9 00 00 00 00 00 00 00 00 00 00 00 00 a5 ac e2 93
  //              be c8 33 c1 3e 32 29 43 2a d7 1d 64 62 18 b5 22 9d d8 81 37 fc
  //              7c 59 aa 24 2a f3 bb 4e fb 82 05 5a 3b 61 22 7a d4 0f 52 c9 f2
  //              50 05 79 ac a1 10 33 ec 14 bb 9c c1 6b d8 3a 00 84 0e 31 d8 28
  //              ec 78 e1 16 ae 46 c4 89 7e 27 95 b6 ff 92 e9 a1 e2 4b 0b 85 5c
  //              02 f2 b7 ad d5 8f fb 25 f3 39 03 43 c1 2a a5 18 10 13 4d 3d fb
  //              f7 1f 65 16 73 7b e5 5c 06 d9 cd cf b1 e2 bb 10 b5 00 00 eb 4a
  //              cf f9 07 56 db a1 ec f9 f5 8a fd 3c 19 b5 c4 55 8b a9 af 6b 73
  //              33 c8 94 a1 fb 29 ad e9 ad 75 c9 c0 22 e8 d0 3f e2 8b c3 58 68
  //              44 92 aa 77 1d bf e8 07 45 fe 89 ad 34 9f fa ad 76 ff 9d d6 43
  //              79 6c af fd f6 7a f5 dd 47 6c 37 e7 e9 a8 4e 2e 5d a2 69 6e 2a
  //              5a 59 b5 3f 2f b0 e1 6d 82 62 c0 80 c1 59 ce 40 c1 40 89 c8 27
  //              59 10 6f 42 25 82 b4 2e 3e 84 84 ea 5a 6a d9 aa 52 10 6e af e0
  //              e0 ca ea 1a d4 cb 23 f3 c2 b8 a0 f4 55 ba 69 ea 28 4c 26 8d 54
  //              b4 31 58 a8 b1 d1 28 d0 2a f2 63 b3 dc 1c ab 79 4c 9a c5 7a 2a
  //              73 32 f4 d8 76 4c 30 2c cd 5a ac 11 44 82 b6 19 fc a4 d9 7a 0a
  //              e7 5c cf 04 e2 9a 85 43 80 e2 f1 e4 9d b5 a1 51 7e c4 0b b3 fa
  //              44 f9 95 9b ad 67 cc ab a7 64 08 da 35 e9 f1 53 4c 8b d4 8b bd
  //              61 62 7a 2e 0a 74 b5 e6 ae fb 7e ee 40 35 02 73 41 37 ff 17 32
  //              0a dd a5 86 79 47 25 7f 16 43 91 c6 73 b6 07 9e 65 d7 29 5e ed
  //              16 4c a6 3e 4e a2 6d ce 0f b3 ce 0f 65 91 d8 0d fb 8f 38 6b b7
  //              4b 55 89 82 9b 6b 06 79 b5 d6 5a 92 7d e6 f4 c0 9f 4b 74 2e 03
  //              73 81 c8 5d 2e c7 bb 2a 81 52 f0 d6 a9 9a 03 70 e0 cb d6 57 44
  //              eb 2e fd 7b 65 f0 4a a7 e7 25 88 75 7b 96 12 bb 42 53 a6 3b b3
  //              03 c0 c6 8a 07 f1 15 d1 04 f2 00 72 37 a4 f7 71 41 67 41 bf d6
  //              3f df e3 ae 6f 8b ea 75 5d 8b 72 02 c2 bb ae 13 7d c1 c3 cf 40
  //              db 74 a4 c1 c2 19 d8 dd ec 8f 91 da e2 cd ea 13 53 fe 06 28 30
  //              fa 1d 23 32 96 e9 9d 83 17 87 22 57 e1 54 66 54 85 e7 f3 1c db
  //              fb f4 35 51 7f af 93 01 5b 57 41 7d 84 b8 bc 86 62 e0 97 d5 ba
  //              55 d0 2d 48 e1 50 69 5f fa e3 a6 76 55 5b 10 da 11 75 18 65 12
  //              6d 19 33 61 16 a1 e5 8a b7 27 dd a6 b3 43 cc 97 f9 47 91 36 a6
  //              6f 55 2a bf 8f e3 d1 34 f6 d6 9d f1 cf fe 67 40 f9 07 35 f6 6c
  //              a5 4f d8 78 00 b4 bd a4 db 5e 68 aa cc f4 4d 24 e0 9f 8a 76 9e
  //              3a e7 bf 24 66 73 f1 5e 3d 1a da e4 38 4b db 7c d3 0a 33 e3 04
  //              66 b4 21 fe b9 60 06 c8 10 fd 38 30 a1 c7 5a f2 58 07 27 ff c6
  //              04 d2 b0 4f 47 6a cc 21 41 9f ad 9b 1b ae c8 89 74 da 2d b2 9b
  //              80 85 9b de 08 b8 5c 80 86 e4 b7 f1 fd 56 80 42 ad 53 96 d3 17
  //              9c 71 b1 dc 43 29 1e 45 0c e9 b8 d7 d8 0f cb 44 96 6d 7a d4 69
  //              1a 37 87 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  //              00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 83 a5 76 5d 06
  //              da 91 16 5d 24 bc 31 66 07 e2 d6 93 44 aa 1c 07 ff 7c d7 bc 3d
  //              17 f1 22 47 8b 6e 81 07 77 82 b9 c2 98 ed c2 54 60 45 fe ff 90
  //              e7 aa 7d c1 a8 69 fa 55 e9 79 e0 33 37 70 7d f7 5b 93 cf 5b 8d
  //              25 24 27 41 a8 8f 2d 54 a7 10 73 75 b2 59 11 aa 11 ef a3 a4 f8
  //              7f c1 4f 18 0e 35 36 15 b3 cb 9a 5c f5 ea 84 30 14 a2 77 c3 69
  //              4a 5a 83 26 6f 73 ef 03 9d d7 39 18 79 23 71 55 48 d5 8f f4 3b
  //              e9 97 e3 57 e0 cb ed 29 fa ef 19 c0 08 2e 26 fb 86 7b f0 ff 00
  //              00 00 00 00 00 00 00 00 00 00 a0 61 62 52 ab da 11 02 c3 ee e1
  //              3e dd ef 02 75 f2 17 52 ee 47 4e 32 d7 90 ae 1f 3d f7 7e 30 3a
  //              e1 96 8c 2a 44 50 c4 3e 93 b9 7b 2c 31 23 ab 5b 84 73 b8 80 64
  //              4e 6a cf e1 d3 46 d1 52 82 62 c6 e9 1f 38 02 9e c2 4e eb 4f e5
  //              c1 b3 72 6b cf d3 86 ba 15 3f ed 11 69 21 70 e5 a0 94 32 bd 02
  //              fa 9d ba 86 1e ca d4 db f6 1a 93 73 3a 21 ae ff 5f 54 1b 8f 78
  //              bc cb f1 ac} (length 0xb50)
  //            }
  //          }
  //        }
  //        license: ptr[in, buffer] {
  //          buffer: {73 79 7a 6b 61 6c 6c 65 72 00} (length 0xa)
  //        }
  //        loglev: int32 = 0x0 (4 bytes)
  //        logsize: len = 0x0 (4 bytes)
  //        log: nil
  //        kern_version: bpf_kern_version = 0x0 (4 bytes)
  //        flags: bpf_prog_load_flags = 0x0 (4 bytes)
  //        prog_name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00}
  //        (length 0x10) prog_ifindex: ifindex (resource) expected_attach_type:
  //        union bpf_prog_attach_types {
  //          fallback: bpf_attach_types = 0x0 (4 bytes)
  //        }
  //        btf_fd: fd_btf (resource)
  //        func_info_rec_size: const = 0x8 (4 bytes)
  //        func_info: nil
  //        func_info_cnt: len = 0x0 (4 bytes)
  //        line_info_rec_size: const = 0x10 (4 bytes)
  //        line_info: nil
  //        line_info_cnt: len = 0x0 (4 bytes)
  //        attach_btf_id: bpf_btf_id (resource)
  //        attach_prog_fd: fd_bpf_prog (resource)
  //        core_relo_cnt: len = 0x0 (4 bytes)
  //        fd_array: nil
  //        core_relos: nil
  //        core_relo_rec_size: const = 0x10 (4 bytes)
  //        log_true_size: int32 = 0x0 (4 bytes)
  //        prog_token_fd: union _bpf_prog_t[flags[bpf_prog_type, int32],
  //        bpf_prog_attach_types, bpf_btf_id[opt],
  //        fd_bpf_prog[opt]]_prog_token_fd_wrapper {
  //          void: buffer: {} (length 0x0)
  //        }
  //        pad: union _bpf_prog_t[flags[bpf_prog_type, int32],
  //        bpf_prog_attach_types, bpf_btf_id[opt],
  //        fd_bpf_prog[opt]]_pad_wrapper {
  //          value: const = 0x0 (4 bytes)
  //        }
  //      }
  //    }
  //    size: len = 0x48 (8 bytes)
  //  ]
  //  returns fd_bpf_prog
  *(uint32_t*)0x200000000200 = 0xc;
  *(uint32_t*)0x200000000204 = 0xe;
  *(uint64_t*)0x200000000208 = 0x2000000008c0;
  memcpy(
      (void*)0x2000000008c0,
      "\xb7\x02\x00\x00\x1a\x00\x00\x00\xbf\xa3\x00\x00\x00\x00\x00\x00\x07\x03"
      "\x00\x00\x00\xfe\xff\xff\x7a\x0a\xf0\xff\x01\x00\x00\x00\x79\xa4\xf0\xff"
      "\x00\x00\x00\x00\xb7\x06\x00\x00\x7f\xff\xff\xff\x2d\x64\x05\x00\x00\x00"
      "\x00\x00\x65\x04\x04\x00\x01\x00\x00\x00\x04\x04\x00\x00\x01\x00\x7d\x60"
      "\xb7\x03\x00\x00\x00\x00\x00\x00\x6a\x0a\x00\xfe\x00\x00\x00\x00\x85\x00"
      "\x00\x00\x0d\x00\x00\x00\xb7\x00\x00\x00\x00\x00\x00\x00\x95\x00\x00\x00"
      "\x00\x00\x00\x00\x4e\xce\xfa\xb8\xf2\xe8\x5c\x6c\x1c\xa7\x11\xfc\xd0\xcd"
      "\xfa\x14\x6e\xc5\x61\x75\x03\x79\x58\x5e\x5a\x07\x6d\x83\x92\x40\xd2\x9c"
      "\x03\x40\x15\xb6\x7d\xaf\xe6\xc8\xdc\x3d\x5d\x78\xc0\x7f\xa1\xf7\xe6\x18"
      "\x5f\xec\x0e\x07\x00\x4e\x60\xc0\x8d\xc8\xb8\xdb\xf1\x1e\x6e\x94\xd7\x59"
      "\x38\x32\x1a\x3a\xa5\x02\xcd\x24\x24\xa6\x6e\x6d\x2e\xf8\x31\xab\x7e\xa0"
      "\xc3\x4f\x17\xe3\x94\x6e\x0e\xbc\x62\x20\x03\xb5\x38\xdf\xd8\xe0\x12\xe7"
      "\x95\x78\xe5\x1b\xc5\xf3\x1e\x31\x06\xd1\xdd\xd6\x15\x2f\x7c\xbd\xb9\xcd"
      "\x38\xbd\xb2\x20\x9c\x67\xde\xca\x8e\xeb\x9c\x15\xab\x3a\x14\x81\x7a\xc6"
      "\x1e\x4d\xd1\x11\x83\xa1\x34\x77\xbf\x7e\x86\x0e\x36\x70\xef\x0e\x78\x9f"
      "\x65\xf1\x32\x8d\x67\x04\x90\x2c\xbe\x7b\xc0\x4b\x82\xd2\x78\x9c\xb1\x32"
      "\xb8\x03\x00\x00\x00\x66\x1d\xf2\x8d\x99\x61\xb6\x3e\x1a\x9c\xf6\xc2\xa6"
      "\x60\xa1\xfe\x3c\x18\x4b\x75\x1c\x51\x16\x0f\xb2\x0b\x1c\x58\x1e\x7b\x14"
      "\x8b\xa5\x32\xe6\xea\x09\xc3\x46\xdf\xeb\xd3\x86\x08\xb3\x2a\x00\x80\x00"
      "\x5d\x9a\x95\x00\x00\x00\x00\x00\x00\x00\x33\x4d\x83\x23\x9d\xd2\x70\x80"
      "\x85\x1d\xca\xc3\xc1\x22\x33\xf9\xa1\xfb\x9c\x2a\xec\x61\xce\x63\xa3\x8d"
      "\x2f\xd5\x01\x17\xb8\x9a\x9a\xb3\x59\xb4\xee\xa0\xc6\xe9\x57\x67\xd4\x2b"
      "\x4e\x14\x86\x1d\x02\x27\xdb\xfd\x2e\x6d\x7f\x71\x5a\x7f\x3d\xea\xdd\x71"
      "\x30\x85\x6f\x75\x64\x36\x30\x37\x67\xd2\xe2\x4f\x29\xe5\xda\xd9\x79\x6e"
      "\xdb\x69\x7a\xee\xa0\x18\x2b\xab\xd1\x8c\xac\x1b\xd4\xf4\x39\x0a\xf9\xa9"
      "\xce\xaf\xd0\x00\x2c\xab\x15\x4a\xd0\x29\xa1\x09\x00\x00\x00\x27\x80\x87"
      "\x00\x14\xf5\x1c\x3c\x97\x5d\x5a\xec\x84\x22\x2f\xd3\xa0\xec\x4b\xe3\xe5"
      "\x63\x11\x2f\x0b\x39\x50\x1a\xaf\xe2\x34\x87\x00\x72\x85\x8d\xc0\x6e\x7c"
      "\x33\x76\x42\xd3\xe5\xa8\x15\x23\x2f\x5e\x16\xb0\x89\xf3\x7b\x35\x91\xa1"
      "\x5c\x0a\x9b\xe6\xeb\x18\x20\x84\x04\xc1\xb3\x0c\x3a\x6a\x71\xbc\x85\x01"
      "\x8e\x5f\xf2\xc9\x10\x18\xaf\xc9\xff\xc2\xcc\x78\x8b\xee\x1b\x47\x68\x3d"
      "\xb0\x1a\x46\x93\x98\x68\x52\x11\xdf\xbb\xae\x3e\x2e\xd0\xa5\x0e\x73\x13"
      "\xbf\xf5\xd4\xc3\x91\xdd\xec\xe0\x0f\xc7\x72\xdd\x6b\x4d\x4d\xe2\xa4\x19"
      "\x90\xf0\x5c\xa3\xbd\xfc\x92\xc8\x8c\x5b\x74\xcd\x36\xe7\x48\x7a\xfa\x44"
      "\x7e\x2e\xdf\xae\x4f\x39\x0a\x83\x37\x84\x1c\xef\x38\x6e\x22\xcc\x22\xee"
      "\x17\x47\x6d\x73\x89\x52\x22\x96\x82\xe2\x4b\x92\x53\x3a\xc2\xa9\xf5\xa6"
      "\x99\x59\x3f\x08\x44\x19\xca\xe0\xb4\x53\x2b\xcc\x97\xd3\xae\x48\x6a\xca"
      "\x54\x18\x3f\xb0\x1c\x73\xf9\x79\xca\x98\x57\x39\x95\x37\xf5\xdc\x2a\x2d"
      "\x0e\x00\x00\x00\x00\x00\x00\x05\x78\x67\x3f\x8b\x6e\x74\xce\x23\x87\x7a"
      "\x6b\x24\xdb\x0e\x06\x73\x45\x56\x09\x42\xfa\x62\x9f\xbe\xf2\x46\x1c\x96"
      "\xa0\x88\xa2\x2e\x8b\x15\xc3\xe2\x33\xdb\x7a\xb2\x2e\x30\xd4\x6a\x9d\x24"
      "\xd3\x7c\xef\x09\x9e\xce\x72\x9a\xa2\x18\xf9\xf4\x4a\x32\x10\x22\x3f\xda"
      "\xe7\xed\x04\x93\x5c\x3c\x90\xd3\xad\xd8\xee\xbc\x86\x19\xd7\x34\x15\xcd"
      "\xa2\x13\x0f\x50\x71\x46\x00\xfb\x62\x41\xc6\xe9\x55\x03\x17\x95\xb2\xc2"
      "\xf5\x64\x11\xe4\x84\x55\xb5\xa8\xb9\x0d\xfa\xe1\x58\xb9\x4f\x50\xad\xab"
      "\x98\x8d\xd8\xe1\x2b\xaf\x5c\xc9\x39\x8f\xff\x00\x40\x4d\x5d\x99\xf8\x2e"
      "\x20\xee\x6a\x8c\x88\xe1\x8c\x29\x77\xaa\xb3\x7d\x9a\xc4\xcf\xc1\xc7\xb4"
      "\x00\x00\x00\x00\x00\x00\x07\xff\x57\xc3\x94\x95\xc8\x26\xb9\x56\xba\x85"
      "\x9a\xc8\xe3\xc1\x77\xb9\x1b\xd7\xd5\xe4\x1f\xf8\x68\xf7\xca\xe2\xcd\x0a"
      "\x27\x82\xd2\x23\x0f\xe4\xbf\x98\x65\xde\x0d\x16\x64\xfe\x2f\x3c\xed\x84"
      "\x68\x91\x18\x06\x04\xb6\xdd\x24\x99\xd1\x6d\x7d\x91\x58\xff\xff\xff\xff"
      "\x00\x00\x00\x00\xef\x06\x9d\xc4\x27\x49\xa8\x9f\x85\x47\x97\xf2\x9d\x00"
      "\x00\x00\x2d\x8c\x38\xa9\x67\xc1\xbb\xe0\x93\x15\xc2\x98\x77\xa3\x08\xbc"
      "\xc8\x7d\xc3\xad\xdb\x08\x14\x1b\xde\xe5\xd2\x78\x74\xb2\xf6\x63\xdd\xee"
      "\xdd\x00\x5b\x3d\x96\xc7\xaa\xbf\x4d\xf5\x17\xd9\x0b\xdc\x01\xe7\x38\x35"
      "\xd5\xa3\xe1\xa9\x08\x00\xc6\x6e\xe2\xb1\xad\x76\xdf\xf9\xf9\x00\x00\x71"
      "\x41\x4c\x99\xd4\x89\x4e\xe7\xf8\x24\x9d\xc1\xe3\x42\x8d\x21\x29\x36\x9e"
      "\xe1\xb8\x5a\xf6\xeb\x2e\xea\x0d\x0d\xf4\x14\xb3\x15\xf6\x51\xc8\x41\x23"
      "\x92\x19\x1f\xa8\x3e\xe8\x30\x54\x8f\x11\xe1\x03\x6a\x8d\xeb\xd6\x4c\xbe"
      "\x35\x94\x54\xa3\xf2\x23\x9c\xfe\x00\x00\x00\x00\x00\x00\x42\xb8\xff\x8c"
      "\x21\xad\x70\x2c\xca\xca\xd5\xb3\x9e\xef\x21\x3d\x1c\xa2\x96\xd2\xa2\x77"
      "\x98\xc8\xce\x2a\x30\x5c\x0c\x7d\x35\xcf\x4b\x22\x54\x9a\x4b\xd9\x20\x52"
      "\x18\x8b\xd1\xf2\x85\xf6\x53\xb6\x21\x49\x1d\xc6\xaa\xee\x02\x00\xe2\xff"
      "\x08\x64\x4f\xb9\x4c\x06\x00\x6e\xff\x1b\xe2\xf6\x33\xc1\xd9\x87\x59\x1e"
      "\xc3\xdb\x58\xa7\xbb\x30\x42\xec\x3f\x77\x1f\x7a\x13\x38\xa5\xc3\xdd\x35"
      "\xe9\x26\x04\x9f\xe8\x6e\x09\xc5\x8e\x27\x3c\xd9\x05\xde\xb2\x8c\x13\xc1"
      "\xed\x1c\x0d\x9c\xae\x84\x6b\xcb\xfa\x8c\xce\x7b\x89\x3e\x57\x8a\xf7\xdc"
      "\x7d\x5e\x87\xd4\x4f\xf8\x28\xde\x45\x3f\x34\xc2\xb1\x86\x60\xb0\x80\xef"
      "\xc7\x07\xe6\x76\xe1\xfb\x4d\x58\x25\xc0\xca\x17\x7a\x4c\x7f\xbb\x4e\xda"
      "\x05\x45\xc0\x0f\x57\x6b\x2b\x5c\xc7\xf8\x19\xab\xd0\xf8\x85\xcc\x48\x06"
      "\xf4\x03\x00\x96\x6f\xcf\x1e\x54\xf5\xa2\xd3\x87\x08\x29\x4c\xd6\xf4\x96"
      "\xe5\xde\xe7\x34\xfe\x7d\xa3\x77\x08\x45\xcf\x44\x2d\x48\x8a\xfd\xc0\xe1"
      "\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x52\x05\x00\x00\x00\xdc\x1c\x56\xd5"
      "\x9f\x35\xf2\x67\x63\x29\x52\xa9\x34\x66\xae\x59\x5c\x6a\x8c\xda\x69\x0d"
      "\x19\x2a\x07\x08\x86\xdf\x42\xb2\x70\x98\x77\x3b\x45\x19\x8b\x4a\x34\xac"
      "\x97\x7e\xbd\x44\x50\xe1\x21\xd0\x13\x42\x70\x3f\x5b\xf0\x30\xe9\x35\x87"
      "\x8a\x6d\x16\x9c\x80\xaa\x42\x52\xd4\xea\x6b\x8f\x62\x16\xff\x20\x2b\x5b"
      "\x5a\x18\x2c\xb5\xe8\x03\x39\xf9\x95\x3c\x30\x93\xc3\x69\x0d\x10\xec\xb6"
      "\x5d\xc5\xb4\x74\x81\xed\xbf\x1f\x00\x00\x00\x00\x00\x00\x00\x4d\x16\xd2"
      "\x9c\x28\xeb\x51\x67\xe9\x93\x6e\xd3\x27\xfb\x23\x7a\x56\x22\x4e\x49\xd9"
      "\xea\x95\x5a\x5f\x0d\xec\x1b\x3c\xcd\x52\x36\x46\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xdd\x6f"
      "\xe1\x51\x8c\xc7\x80\x20\x43\xec\xfe\x69\xf7\x43\xf1\x21\x3b\xf8\x17\x9e"
      "\xcd\x9e\x5a\x22\x5d\x67\x52\x1d\xc7\x28\xea\xc7\xd8\x0a\x56\x56\xac\x2c"
      "\xbd\xe2\x1d\x3e\xbf\xbf\x69\xff\x86\x1f\x43\x94\x83\x6d\xdf\x12\x8d\x6d"
      "\x19\x07\x9e\x64\x33\x6e\x7c\x67\x65\x05\xc7\x8a\xd6\x75\x48\xf4\xb1\x92"
      "\xbe\x18\x27\xfc\xd9\x5c\xf1\x07\x75\x3c\xb0\xa6\xa9\x79\xd3\xdb\x0c\x40"
      "\x70\x81\xc6\x28\x1e\x2d\x84\x29\xa8\x63\x90\x3c\xa7\x5f\x4c\x7d\xf3\xea"
      "\x8f\xc2\x01\x8d\x07\xaf\x14\x91\xef\x06\x0c\xd4\x40\x3a\x09\x9f\x32\x46"
      "\x8f\x65\xbd\x06\xb4\x08\x2d\x43\xe1\x21\x86\x1b\x5c\xc0\x3f\x1a\x15\x61"
      "\xf0\x58\x9e\x0d\x12\x96\x9b\xc9\x82\xff\x5d\x8e\x9b\x98\x6c\x0c\x6c\x74"
      "\x7d\x9a\x1c\xc5\x00\xbb\x89\x2c\x3a\x16\xff\x10\xfe\xea\x20\xbd\xac\x00"
      "\x00\x00\x00\x00\x00\x00\x00\xca\x06\xf2\x56\xc8\x02\x8e\x0f\x9b\x65\xf0"
      "\x37\xb2\x1f\x32\x89\xf8\x6a\x68\x26\xc6\x9f\xa3\x5b\xa5\xcb\xc3\xf2\xdb"
      "\x15\x16\xff\xc5\xc6\xe3\xfa\x61\x8b\x24\xa6\xce\x16\xd6\xc7\x01\x0b\xb3"
      "\x7b\x61\xfa\x0a\x2d\x89\x74\xe6\x91\x15\xd3\x33\x94\xe8\x6e\x4b\x83\x82"
      "\x97\xba\x20\xf9\x69\x36\xb7\xe4\x74\x6e\x92\xde\xa6\xc5\xd1\xd3\x3d\x84"
      "\xd9\x6b\x50\xfb\x00\x00\x00\xae\x07\xc6\x5b\x71\x08\x8d\xd7\xd5\xd1\xe1"
      "\xba\xb9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa5\xac\xe2\x93"
      "\xbe\xc8\x33\xc1\x3e\x32\x29\x43\x2a\xd7\x1d\x64\x62\x18\xb5\x22\x9d\xd8"
      "\x81\x37\xfc\x7c\x59\xaa\x24\x2a\xf3\xbb\x4e\xfb\x82\x05\x5a\x3b\x61\x22"
      "\x7a\xd4\x0f\x52\xc9\xf2\x50\x05\x79\xac\xa1\x10\x33\xec\x14\xbb\x9c\xc1"
      "\x6b\xd8\x3a\x00\x84\x0e\x31\xd8\x28\xec\x78\xe1\x16\xae\x46\xc4\x89\x7e"
      "\x27\x95\xb6\xff\x92\xe9\xa1\xe2\x4b\x0b\x85\x5c\x02\xf2\xb7\xad\xd5\x8f"
      "\xfb\x25\xf3\x39\x03\x43\xc1\x2a\xa5\x18\x10\x13\x4d\x3d\xfb\xf7\x1f\x65"
      "\x16\x73\x7b\xe5\x5c\x06\xd9\xcd\xcf\xb1\xe2\xbb\x10\xb5\x00\x00\xeb\x4a"
      "\xcf\xf9\x07\x56\xdb\xa1\xec\xf9\xf5\x8a\xfd\x3c\x19\xb5\xc4\x55\x8b\xa9"
      "\xaf\x6b\x73\x33\xc8\x94\xa1\xfb\x29\xad\xe9\xad\x75\xc9\xc0\x22\xe8\xd0"
      "\x3f\xe2\x8b\xc3\x58\x68\x44\x92\xaa\x77\x1d\xbf\xe8\x07\x45\xfe\x89\xad"
      "\x34\x9f\xfa\xad\x76\xff\x9d\xd6\x43\x79\x6c\xaf\xfd\xf6\x7a\xf5\xdd\x47"
      "\x6c\x37\xe7\xe9\xa8\x4e\x2e\x5d\xa2\x69\x6e\x2a\x5a\x59\xb5\x3f\x2f\xb0"
      "\xe1\x6d\x82\x62\xc0\x80\xc1\x59\xce\x40\xc1\x40\x89\xc8\x27\x59\x10\x6f"
      "\x42\x25\x82\xb4\x2e\x3e\x84\x84\xea\x5a\x6a\xd9\xaa\x52\x10\x6e\xaf\xe0"
      "\xe0\xca\xea\x1a\xd4\xcb\x23\xf3\xc2\xb8\xa0\xf4\x55\xba\x69\xea\x28\x4c"
      "\x26\x8d\x54\xb4\x31\x58\xa8\xb1\xd1\x28\xd0\x2a\xf2\x63\xb3\xdc\x1c\xab"
      "\x79\x4c\x9a\xc5\x7a\x2a\x73\x32\xf4\xd8\x76\x4c\x30\x2c\xcd\x5a\xac\x11"
      "\x44\x82\xb6\x19\xfc\xa4\xd9\x7a\x0a\xe7\x5c\xcf\x04\xe2\x9a\x85\x43\x80"
      "\xe2\xf1\xe4\x9d\xb5\xa1\x51\x7e\xc4\x0b\xb3\xfa\x44\xf9\x95\x9b\xad\x67"
      "\xcc\xab\xa7\x64\x08\xda\x35\xe9\xf1\x53\x4c\x8b\xd4\x8b\xbd\x61\x62\x7a"
      "\x2e\x0a\x74\xb5\xe6\xae\xfb\x7e\xee\x40\x35\x02\x73\x41\x37\xff\x17\x32"
      "\x0a\xdd\xa5\x86\x79\x47\x25\x7f\x16\x43\x91\xc6\x73\xb6\x07\x9e\x65\xd7"
      "\x29\x5e\xed\x16\x4c\xa6\x3e\x4e\xa2\x6d\xce\x0f\xb3\xce\x0f\x65\x91\xd8"
      "\x0d\xfb\x8f\x38\x6b\xb7\x4b\x55\x89\x82\x9b\x6b\x06\x79\xb5\xd6\x5a\x92"
      "\x7d\xe6\xf4\xc0\x9f\x4b\x74\x2e\x03\x73\x81\xc8\x5d\x2e\xc7\xbb\x2a\x81"
      "\x52\xf0\xd6\xa9\x9a\x03\x70\xe0\xcb\xd6\x57\x44\xeb\x2e\xfd\x7b\x65\xf0"
      "\x4a\xa7\xe7\x25\x88\x75\x7b\x96\x12\xbb\x42\x53\xa6\x3b\xb3\x03\xc0\xc6"
      "\x8a\x07\xf1\x15\xd1\x04\xf2\x00\x72\x37\xa4\xf7\x71\x41\x67\x41\xbf\xd6"
      "\x3f\xdf\xe3\xae\x6f\x8b\xea\x75\x5d\x8b\x72\x02\xc2\xbb\xae\x13\x7d\xc1"
      "\xc3\xcf\x40\xdb\x74\xa4\xc1\xc2\x19\xd8\xdd\xec\x8f\x91\xda\xe2\xcd\xea"
      "\x13\x53\xfe\x06\x28\x30\xfa\x1d\x23\x32\x96\xe9\x9d\x83\x17\x87\x22\x57"
      "\xe1\x54\x66\x54\x85\xe7\xf3\x1c\xdb\xfb\xf4\x35\x51\x7f\xaf\x93\x01\x5b"
      "\x57\x41\x7d\x84\xb8\xbc\x86\x62\xe0\x97\xd5\xba\x55\xd0\x2d\x48\xe1\x50"
      "\x69\x5f\xfa\xe3\xa6\x76\x55\x5b\x10\xda\x11\x75\x18\x65\x12\x6d\x19\x33"
      "\x61\x16\xa1\xe5\x8a\xb7\x27\xdd\xa6\xb3\x43\xcc\x97\xf9\x47\x91\x36\xa6"
      "\x6f\x55\x2a\xbf\x8f\xe3\xd1\x34\xf6\xd6\x9d\xf1\xcf\xfe\x67\x40\xf9\x07"
      "\x35\xf6\x6c\xa5\x4f\xd8\x78\x00\xb4\xbd\xa4\xdb\x5e\x68\xaa\xcc\xf4\x4d"
      "\x24\xe0\x9f\x8a\x76\x9e\x3a\xe7\xbf\x24\x66\x73\xf1\x5e\x3d\x1a\xda\xe4"
      "\x38\x4b\xdb\x7c\xd3\x0a\x33\xe3\x04\x66\xb4\x21\xfe\xb9\x60\x06\xc8\x10"
      "\xfd\x38\x30\xa1\xc7\x5a\xf2\x58\x07\x27\xff\xc6\x04\xd2\xb0\x4f\x47\x6a"
      "\xcc\x21\x41\x9f\xad\x9b\x1b\xae\xc8\x89\x74\xda\x2d\xb2\x9b\x80\x85\x9b"
      "\xde\x08\xb8\x5c\x80\x86\xe4\xb7\xf1\xfd\x56\x80\x42\xad\x53\x96\xd3\x17"
      "\x9c\x71\xb1\xdc\x43\x29\x1e\x45\x0c\xe9\xb8\xd7\xd8\x0f\xcb\x44\x96\x6d"
      "\x7a\xd4\x69\x1a\x37\x87\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00\x83\xa5\x76\x5d\x06\xda\x91\x16\x5d\x24\xbc\x31\x66\x07"
      "\xe2\xd6\x93\x44\xaa\x1c\x07\xff\x7c\xd7\xbc\x3d\x17\xf1\x22\x47\x8b\x6e"
      "\x81\x07\x77\x82\xb9\xc2\x98\xed\xc2\x54\x60\x45\xfe\xff\x90\xe7\xaa\x7d"
      "\xc1\xa8\x69\xfa\x55\xe9\x79\xe0\x33\x37\x70\x7d\xf7\x5b\x93\xcf\x5b\x8d"
      "\x25\x24\x27\x41\xa8\x8f\x2d\x54\xa7\x10\x73\x75\xb2\x59\x11\xaa\x11\xef"
      "\xa3\xa4\xf8\x7f\xc1\x4f\x18\x0e\x35\x36\x15\xb3\xcb\x9a\x5c\xf5\xea\x84"
      "\x30\x14\xa2\x77\xc3\x69\x4a\x5a\x83\x26\x6f\x73\xef\x03\x9d\xd7\x39\x18"
      "\x79\x23\x71\x55\x48\xd5\x8f\xf4\x3b\xe9\x97\xe3\x57\xe0\xcb\xed\x29\xfa"
      "\xef\x19\xc0\x08\x2e\x26\xfb\x86\x7b\xf0\xff\x00\x00\x00\x00\x00\x00\x00"
      "\x00\x00\x00\x00\xa0\x61\x62\x52\xab\xda\x11\x02\xc3\xee\xe1\x3e\xdd\xef"
      "\x02\x75\xf2\x17\x52\xee\x47\x4e\x32\xd7\x90\xae\x1f\x3d\xf7\x7e\x30\x3a"
      "\xe1\x96\x8c\x2a\x44\x50\xc4\x3e\x93\xb9\x7b\x2c\x31\x23\xab\x5b\x84\x73"
      "\xb8\x80\x64\x4e\x6a\xcf\xe1\xd3\x46\xd1\x52\x82\x62\xc6\xe9\x1f\x38\x02"
      "\x9e\xc2\x4e\xeb\x4f\xe5\xc1\xb3\x72\x6b\xcf\xd3\x86\xba\x15\x3f\xed\x11"
      "\x69\x21\x70\xe5\xa0\x94\x32\xbd\x02\xfa\x9d\xba\x86\x1e\xca\xd4\xdb\xf6"
      "\x1a\x93\x73\x3a\x21\xae\xff\x5f\x54\x1b\x8f\x78\xbc\xcb\xf1\xac",
      2896);
  *(uint64_t*)0x200000000210 = 0x200000000340;
  memcpy((void*)0x200000000340, "syzkaller\000", 10);
  *(uint32_t*)0x200000000218 = 0;
  *(uint32_t*)0x20000000021c = 0;
  *(uint64_t*)0x200000000220 = 0;
  *(uint32_t*)0x200000000228 = 0;
  *(uint32_t*)0x20000000022c = 0;
  memset((void*)0x200000000230, 0, 16);
  *(uint32_t*)0x200000000240 = 0;
  *(uint32_t*)0x200000000244 = 0;
  *(uint32_t*)0x200000000248 = -1;
  *(uint32_t*)0x20000000024c = 8;
  *(uint64_t*)0x200000000250 = 0;
  *(uint32_t*)0x200000000258 = 0;
  *(uint32_t*)0x20000000025c = 0x10;
  *(uint64_t*)0x200000000260 = 0;
  *(uint32_t*)0x200000000268 = 0;
  *(uint32_t*)0x20000000026c = 0;
  *(uint32_t*)0x200000000270 = -1;
  *(uint32_t*)0x200000000274 = 0;
  *(uint64_t*)0x200000000278 = 0;
  *(uint64_t*)0x200000000280 = 0;
  *(uint32_t*)0x200000000288 = 0x10;
  *(uint32_t*)0x20000000028c = 0;
  *(uint32_t*)0x200000000290 = 0;
  syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0x200000000200ul, /*size=*/0x48ul);
  //  bpf$OBJ_GET_MAP arguments: [
  //    cmd: const = 0x7 (8 bytes)
  //    arg: ptr[in, bpf_obj_get] {
  //      union bpf_obj_get {
  //        o_path: bpf_obj_get_o_path {
  //          path: ptr[in, buffer] {
  //            buffer: {2e 2f 63 67 72 6f 75 70 2e 63 70 75 2f 63 70 75 73 65
  //            74 2e 63 70 75 73 00} (length 0x19)
  //          }
  //          fd: const = 0x0 (4 bytes)
  //          file_flags: bpf_obj_get_flags = 0x0 (4 bytes)
  //          path_fd: fd (resource)
  //          pad = 0x0 (4 bytes)
  //        }
  //      }
  //    }
  //    size: len = 0x18 (8 bytes)
  //  ]
  //  returns fd_bpf_map
  *(uint64_t*)0x2000000003c0 = 0x200000000080;
  memcpy((void*)0x200000000080, "./cgroup.cpu/cpuset.cpus\000", 25);
  *(uint32_t*)0x2000000003c8 = 0;
  *(uint32_t*)0x2000000003cc = 0;
  *(uint32_t*)0x2000000003d0 = -1;
  syscall(__NR_bpf, /*cmd=*/7ul, /*arg=*/0x2000000003c0ul, /*size=*/0x18ul);
  //  perf_event_open$cgroup arguments: [
  //    attr: ptr[in, perf_event_attr] {
  //      perf_event_attr {
  //        type: perf_event_type = 0x6 (4 bytes)
  //        size: len = 0x80 (4 bytes)
  //        config0: int8 = 0x0 (1 bytes)
  //        config1: int8 = 0x0 (1 bytes)
  //        config2: int8 = 0x0 (1 bytes)
  //        config3: int8 = 0x0 (1 bytes)
  //        config4: const = 0x0 (4 bytes)
  //        sample_freq: int64 = 0x0 (8 bytes)
  //        sample_type: perf_sample_type = 0x0 (8 bytes)
  //        read_format: perf_read_format = 0x0 (8 bytes)
  //        disabled: int64 = 0x0 (0 bytes)
  //        inherit: int64 = 0x0 (0 bytes)
  //        pinned: int64 = 0x0 (0 bytes)
  //        exclusive: int64 = 0x0 (0 bytes)
  //        exclude_user: int64 = 0x0 (0 bytes)
  //        exclude_kernel: int64 = 0x0 (0 bytes)
  //        exclude_hv: int64 = 0x0 (0 bytes)
  //        exclude_idle: int64 = 0x0 (0 bytes)
  //        mmap: int64 = 0x0 (0 bytes)
  //        comm: int64 = 0x0 (0 bytes)
  //        freq: int64 = 0x0 (0 bytes)
  //        inherit_stat: int64 = 0x0 (0 bytes)
  //        enable_on_exec: int64 = 0x0 (0 bytes)
  //        task: int64 = 0x0 (0 bytes)
  //        watermark: int64 = 0x0 (0 bytes)
  //        precise_ip: int64 = 0x0 (0 bytes)
  //        mmap_data: int64 = 0x0 (0 bytes)
  //        sample_id_all: int64 = 0x0 (0 bytes)
  //        exclude_host: int64 = 0x0 (0 bytes)
  //        exclude_guest: int64 = 0x0 (0 bytes)
  //        exclude_callchain_kernel: int64 = 0x0 (0 bytes)
  //        exclude_callchain_user: int64 = 0x0 (0 bytes)
  //        mmap2: int64 = 0x0 (0 bytes)
  //        comm_exec: int64 = 0x0 (0 bytes)
  //        use_clockid: int64 = 0x0 (0 bytes)
  //        context_switch: int64 = 0x0 (0 bytes)
  //        write_backward: int64 = 0x0 (0 bytes)
  //        namespaces: int64 = 0x0 (0 bytes)
  //        ksymbol: int64 = 0x0 (0 bytes)
  //        bpf_event: int64 = 0x0 (0 bytes)
  //        aux_output: int64 = 0x0 (0 bytes)
  //        cgroup: int64 = 0x0 (0 bytes)
  //        text_poke: int64 = 0x0 (0 bytes)
  //        build_id: int64 = 0x0 (0 bytes)
  //        inherit_thread: int64 = 0x0 (0 bytes)
  //        remove_on_exec: int64 = 0x0 (0 bytes)
  //        sigtrap: int64 = 0x0 (0 bytes)
  //        __reserved_1: const = 0x0 (8 bytes)
  //        wakeup_events: int32 = 0x0 (4 bytes)
  //        bp_type: perf_bp_type = 0x0 (4 bytes)
  //        bp_config: union perf_bp_config {
  //          perf_bp: perf_bp {
  //            bp_addr: ptr[out, int8] {
  //              int8 = 0x0 (1 bytes)
  //            }
  //            bp_len: perf_bp_lens = 0x0 (8 bytes)
  //          }
  //        }
  //        branch_sample_type: perf_branch_sample_type = 0x0 (8 bytes)
  //        sample_regs_user: int64 = 0x0 (8 bytes)
  //        sample_stack_user: int32 = 0x0 (4 bytes)
  //        clockid: clock_type = 0x0 (4 bytes)
  //        sample_regs_intr: int64 = 0x0 (8 bytes)
  //        aux_watermark: int32 = 0x0 (4 bytes)
  //        sample_max_stack: int16 = 0x0 (2 bytes)
  //        __reserved_2: const = 0x0 (2 bytes)
  //        aux_sample_size: int32 = 0x0 (4 bytes)
  //        __reserved_3: const = 0x0 (4 bytes)
  //        sig_data: int64 = 0x0 (8 bytes)
  //      }
  //    }
  //    fd: fd_cgroup (resource)
  //    cpu: intptr = 0x0 (8 bytes)
  //    group: fd_perf (resource)
  //    flags: perf_flags_cgroup = 0x0 (8 bytes)
  //  ]
  //  returns fd_perf
  *(uint32_t*)0x200000000000 = 6;
  *(uint32_t*)0x200000000004 = 0x80;
  *(uint8_t*)0x200000000008 = 0;
  *(uint8_t*)0x200000000009 = 0;
  *(uint8_t*)0x20000000000a = 0;
  *(uint8_t*)0x20000000000b = 0;
  *(uint32_t*)0x20000000000c = 0;
  *(uint64_t*)0x200000000010 = 0;
  *(uint64_t*)0x200000000018 = 0;
  *(uint64_t*)0x200000000020 = 0;
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 0, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 1, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 2, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 3, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 4, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 5, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 6, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 7, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 8, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 9, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 10, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 11, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 12, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 13, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 14, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 15, 2);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 17, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 18, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 19, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 20, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 21, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 22, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 23, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 24, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 25, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 26, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 27, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 28, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 29, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 30, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 31, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 32, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 33, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 34, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 35, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 36, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 37, 1);
  STORE_BY_BITMASK(uint64_t, , 0x200000000028, 0, 38, 26);
  *(uint32_t*)0x200000000030 = 0;
  *(uint32_t*)0x200000000034 = 0;
  *(uint64_t*)0x200000000038 = 0x200000000080;
  *(uint64_t*)0x200000000040 = 0;
  *(uint64_t*)0x200000000048 = 0;
  *(uint64_t*)0x200000000050 = 0;
  *(uint32_t*)0x200000000058 = 0;
  *(uint32_t*)0x20000000005c = 0;
  *(uint64_t*)0x200000000060 = 0;
  *(uint32_t*)0x200000000068 = 0;
  *(uint16_t*)0x20000000006c = 0;
  *(uint16_t*)0x20000000006e = 0;
  *(uint32_t*)0x200000000070 = 0;
  *(uint32_t*)0x200000000074 = 0;
  *(uint64_t*)0x200000000078 = 0;
  syscall(__NR_perf_event_open, /*attr=*/0x200000000000ul, /*fd=*/(intptr_t)-1,
          /*cpu=*/0ul, /*group=*/(intptr_t)-1, /*flags=*/0ul);
  //  bpf$PROG_LOAD arguments: [
  //    cmd: const = 0x5 (8 bytes)
  //    arg: nil
  //    size: len = 0x0 (8 bytes)
  //  ]
  //  returns fd_bpf_prog
  syscall(__NR_bpf, /*cmd=*/5ul, /*arg=*/0ul, /*size=*/0ul);
}
int main(void)
{
  syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul,
          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul,
          /*fd=*/(intptr_t)-1, /*offset=*/0ul);
  setup_cgroups();
  const char* reason;
  (void)reason;
  if ((reason = setup_usb()))
    printf("the reproducer may not work as expected: USB injection setup "
           "failed: %s\n",
           reason);
  if ((reason = setup_802154()))
    printf("the reproducer may not work as expected: 802154 injection setup "
           "failed: %s\n",
           reason);
  if ((reason = setup_swap()))
    printf("the reproducer may not work as expected: swap setup failed: %s\n",
           reason);
  for (procid = 0; procid < 5; procid++) {
    if (fork() == 0) {
      use_temporary_dir();
      do_sandbox_none();
    }
  }
  sleep(1000000);
  return 0;
}