// https://syzkaller.appspot.com/bug?id=96a4feb01cb9f64ffc2bce699556000b8a1d1495 // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } struct nlmsg { char* pos; int nesting; struct nlattr* nested[8]; char buf[4096]; }; static void netlink_init(struct nlmsg* nlmsg, int typ, int flags, const void* data, int size) { memset(nlmsg, 0, sizeof(*nlmsg)); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_type = typ; hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK | flags; memcpy(hdr + 1, data, size); nlmsg->pos = (char*)(hdr + 1) + NLMSG_ALIGN(size); } static void netlink_attr(struct nlmsg* nlmsg, int typ, const void* data, int size) { struct nlattr* attr = (struct nlattr*)nlmsg->pos; attr->nla_len = sizeof(*attr) + size; attr->nla_type = typ; if (size > 0) memcpy(attr + 1, data, size); nlmsg->pos += NLMSG_ALIGN(attr->nla_len); } static int netlink_send_ext(struct nlmsg* nlmsg, int sock, uint16_t reply_type, int* reply_len, bool dofail) { if (nlmsg->pos > nlmsg->buf + sizeof(nlmsg->buf) || nlmsg->nesting) exit(1); struct nlmsghdr* hdr = (struct nlmsghdr*)nlmsg->buf; hdr->nlmsg_len = nlmsg->pos - nlmsg->buf; struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; ssize_t n = sendto(sock, nlmsg->buf, hdr->nlmsg_len, 0, (struct sockaddr*)&addr, sizeof(addr)); if (n != (ssize_t)hdr->nlmsg_len) { if (dofail) exit(1); return -1; } n = recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); if (reply_len) *reply_len = 0; if (n < 0) { if (dofail) exit(1); return -1; } if (n < (ssize_t)sizeof(struct nlmsghdr)) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type == NLMSG_DONE) return 0; if (reply_len && hdr->nlmsg_type == reply_type) { *reply_len = n; return 0; } if (n < (ssize_t)(sizeof(struct nlmsghdr) + sizeof(struct nlmsgerr))) { errno = EINVAL; if (dofail) exit(1); return -1; } if (hdr->nlmsg_type != NLMSG_ERROR) { errno = EINVAL; if (dofail) exit(1); return -1; } errno = -((struct nlmsgerr*)(hdr + 1))->error; return -errno; } static int netlink_send(struct nlmsg* nlmsg, int sock) { return netlink_send_ext(nlmsg, sock, 0, NULL, true); } static int netlink_query_family_id(struct nlmsg* nlmsg, int sock, const char* family_name, bool dofail) { struct genlmsghdr genlhdr; memset(&genlhdr, 0, sizeof(genlhdr)); genlhdr.cmd = CTRL_CMD_GETFAMILY; netlink_init(nlmsg, GENL_ID_CTRL, 0, &genlhdr, sizeof(genlhdr)); netlink_attr(nlmsg, CTRL_ATTR_FAMILY_NAME, family_name, strnlen(family_name, GENL_NAMSIZ - 1) + 1); int n = 0; int err = netlink_send_ext(nlmsg, sock, GENL_ID_CTRL, &n, dofail); if (err < 0) { return -1; } uint16_t id = 0; struct nlattr* attr = (struct nlattr*)(nlmsg->buf + NLMSG_HDRLEN + NLMSG_ALIGN(sizeof(genlhdr))); for (; (char*)attr < nlmsg->buf + n; attr = (struct nlattr*)((char*)attr + NLMSG_ALIGN(attr->nla_len))) { if (attr->nla_type == CTRL_ATTR_FAMILY_ID) { id = *(uint16_t*)(attr + 1); break; } } if (!id) { errno = EINVAL; return -1; } recv(sock, nlmsg->buf, sizeof(nlmsg->buf), 0); return id; } static void netlink_device_change(struct nlmsg* nlmsg, int sock, const char* name, bool up, const char* master, const void* mac, int macsize, const char* new_name) { struct ifinfomsg hdr; memset(&hdr, 0, sizeof(hdr)); if (up) hdr.ifi_flags = hdr.ifi_change = IFF_UP; hdr.ifi_index = if_nametoindex(name); netlink_init(nlmsg, RTM_NEWLINK, 0, &hdr, sizeof(hdr)); if (new_name) netlink_attr(nlmsg, IFLA_IFNAME, new_name, strlen(new_name)); if (master) { int ifindex = if_nametoindex(master); netlink_attr(nlmsg, IFLA_MASTER, &ifindex, sizeof(ifindex)); } if (macsize) netlink_attr(nlmsg, IFLA_ADDRESS, mac, macsize); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static int netlink_add_addr(struct nlmsg* nlmsg, int sock, const char* dev, const void* addr, int addrsize) { struct ifaddrmsg hdr; memset(&hdr, 0, sizeof(hdr)); hdr.ifa_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ifa_prefixlen = addrsize == 4 ? 24 : 120; hdr.ifa_scope = RT_SCOPE_UNIVERSE; hdr.ifa_index = if_nametoindex(dev); netlink_init(nlmsg, RTM_NEWADDR, NLM_F_CREATE | NLM_F_REPLACE, &hdr, sizeof(hdr)); netlink_attr(nlmsg, IFA_LOCAL, addr, addrsize); netlink_attr(nlmsg, IFA_ADDRESS, addr, addrsize); return netlink_send(nlmsg, sock); } static void netlink_add_addr4(struct nlmsg* nlmsg, int sock, const char* dev, const char* addr) { struct in_addr in_addr; inet_pton(AF_INET, addr, &in_addr); int err = netlink_add_addr(nlmsg, sock, dev, &in_addr, sizeof(in_addr)); if (err < 0) { } } static void netlink_add_addr6(struct nlmsg* nlmsg, int sock, const char* dev, const char* addr) { struct in6_addr in6_addr; inet_pton(AF_INET6, addr, &in6_addr); int err = netlink_add_addr(nlmsg, sock, dev, &in6_addr, sizeof(in6_addr)); if (err < 0) { } } static void netlink_add_neigh(struct nlmsg* nlmsg, int sock, const char* name, const void* addr, int addrsize, const void* mac, int macsize) { struct ndmsg hdr; memset(&hdr, 0, sizeof(hdr)); hdr.ndm_family = addrsize == 4 ? AF_INET : AF_INET6; hdr.ndm_ifindex = if_nametoindex(name); hdr.ndm_state = NUD_PERMANENT; netlink_init(nlmsg, RTM_NEWNEIGH, NLM_F_EXCL | NLM_F_CREATE, &hdr, sizeof(hdr)); netlink_attr(nlmsg, NDA_DST, addr, addrsize); netlink_attr(nlmsg, NDA_LLADDR, mac, macsize); int err = netlink_send(nlmsg, sock); if (err < 0) { } } static struct nlmsg nlmsg; static int tunfd = -1; #define TUN_IFACE "syz_tun" #define LOCAL_MAC 0xaaaaaaaaaaaa #define REMOTE_MAC 0xaaaaaaaaaabb #define LOCAL_IPV4 "172.20.20.170" #define REMOTE_IPV4 "172.20.20.187" #define LOCAL_IPV6 "fe80::aa" #define REMOTE_IPV6 "fe80::bb" #define IFF_NAPI 0x0010 static void correct_dev_net_tun(void) { struct stat st; if (stat("/dev/net/tun", &st) == 0) { if (S_ISCHR(st.st_mode) && major(st.st_rdev) == 10 && minor(st.st_rdev) == 200) return; if (unlink("/dev/net/tun")) { } } if (mkdir("/dev/net", 0755) && errno != EEXIST) { } if (mknod("/dev/net/tun", S_IFCHR | 0666, makedev(10, 200))) { } if (chmod("/dev/net/tun", 0666)) { } } static void initialize_tun(void) { correct_dev_net_tun(); tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK); if (tunfd == -1) { printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n"); printf("otherwise fuzzing or reproducing might not work as intended\n"); return; } const int kTunFd = 200; if (dup2(tunfd, kTunFd) < 0) exit(1); close(tunfd); tunfd = kTunFd; struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, TUN_IFACE, IFNAMSIZ); ifr.ifr_flags = IFF_TAP | IFF_NO_PI; if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) { exit(1); } char sysctl[64]; sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/accept_dad", TUN_IFACE); write_file(sysctl, "0"); sprintf(sysctl, "/proc/sys/net/ipv6/conf/%s/router_solicitations", TUN_IFACE); write_file(sysctl, "0"); int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock == -1) exit(1); netlink_add_addr4(&nlmsg, sock, TUN_IFACE, LOCAL_IPV4); netlink_add_addr6(&nlmsg, sock, TUN_IFACE, LOCAL_IPV6); uint64_t macaddr = REMOTE_MAC; struct in_addr in_addr; inet_pton(AF_INET, REMOTE_IPV4, &in_addr); netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in_addr, sizeof(in_addr), &macaddr, ETH_ALEN); struct in6_addr in6_addr; inet_pton(AF_INET6, REMOTE_IPV6, &in6_addr); netlink_add_neigh(&nlmsg, sock, TUN_IFACE, &in6_addr, sizeof(in6_addr), &macaddr, ETH_ALEN); macaddr = LOCAL_MAC; netlink_device_change(&nlmsg, sock, TUN_IFACE, true, 0, &macaddr, ETH_ALEN, NULL); close(sock); } static long syz_emit_ethernet(volatile long a0, volatile long a1, volatile long a2) { if (tunfd < 0) return (uintptr_t)-1; uint32_t length = a0; char* data = (char*)a1; return write(tunfd, data, length); } static long syz_genetlink_get_family_id(volatile long name, volatile long sock_arg) { int fd = sock_arg; if (fd < 0) { fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (fd == -1) { return -1; } } struct nlmsg nlmsg_tmp; int ret = netlink_query_family_id(&nlmsg_tmp, fd, (char*)name, false); if ((int)sock_arg < 0) close(fd); if (ret < 0) { return -1; } return ret; } static void setup_gadgetfs(); static void setup_binderfs(); static void setup_fusectl(); static void sandbox_common_mount_tmpfs(void) { write_file("/proc/sys/fs/mount-max", "100000"); if (mkdir("./syz-tmp", 0777)) exit(1); if (mount("", "./syz-tmp", "tmpfs", 0, NULL)) exit(1); if (mkdir("./syz-tmp/newroot", 0777)) exit(1); if (mkdir("./syz-tmp/newroot/dev", 0700)) exit(1); unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE; if (mount("/dev", "./syz-tmp/newroot/dev", NULL, bind_mount_flags, NULL)) exit(1); if (mkdir("./syz-tmp/newroot/proc", 0700)) exit(1); if (mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL)) exit(1); if (mkdir("./syz-tmp/newroot/selinux", 0700)) exit(1); const char* selinux_path = "./syz-tmp/newroot/selinux"; if (mount("/selinux", selinux_path, NULL, bind_mount_flags, NULL)) { if (errno != ENOENT) exit(1); if (mount("/sys/fs/selinux", selinux_path, NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); } if (mkdir("./syz-tmp/newroot/sys", 0700)) exit(1); if (mount("/sys", "./syz-tmp/newroot/sys", 0, bind_mount_flags, NULL)) exit(1); if (mount("/sys/kernel/debug", "./syz-tmp/newroot/sys/kernel/debug", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mount("/proc/sys/fs/binfmt_misc", "./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, bind_mount_flags, NULL) && errno != ENOENT) exit(1); if (mkdir("./syz-tmp/newroot/syz-inputs", 0700)) exit(1); if (mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL, bind_mount_flags | MS_RDONLY, NULL) && errno != ENOENT) exit(1); if (mkdir("./syz-tmp/pivot", 0777)) exit(1); if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) { if (chdir("./syz-tmp")) exit(1); } else { if (chdir("/")) exit(1); if (umount2("./pivot", MNT_DETACH)) exit(1); } if (chroot("./newroot")) exit(1); if (chdir("/")) exit(1); setup_gadgetfs(); setup_binderfs(); setup_fusectl(); } static void setup_gadgetfs() { if (mkdir("/dev/gadgetfs", 0777)) { } if (mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL)) { } } static void setup_fusectl() { if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) { } } static void setup_binderfs() { if (mkdir("/dev/binderfs", 0777)) { } if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) { } if (symlink("/dev/binderfs", "./binderfs")) { } } static void loop(); static void sandbox_common() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); if (getppid() == 1) exit(1); struct rlimit rlim; rlim.rlim_cur = rlim.rlim_max = (200 << 20); setrlimit(RLIMIT_AS, &rlim); rlim.rlim_cur = rlim.rlim_max = 32 << 20; setrlimit(RLIMIT_MEMLOCK, &rlim); rlim.rlim_cur = rlim.rlim_max = 136 << 20; setrlimit(RLIMIT_FSIZE, &rlim); rlim.rlim_cur = rlim.rlim_max = 1 << 20; setrlimit(RLIMIT_STACK, &rlim); rlim.rlim_cur = rlim.rlim_max = 128 << 20; setrlimit(RLIMIT_CORE, &rlim); rlim.rlim_cur = rlim.rlim_max = 256; setrlimit(RLIMIT_NOFILE, &rlim); if (unshare(CLONE_NEWNS)) { } if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) { } if (unshare(CLONE_NEWIPC)) { } if (unshare(0x02000000)) { } if (unshare(CLONE_NEWUTS)) { } if (unshare(CLONE_SYSVSEM)) { } typedef struct { const char* name; const char* value; } sysctl_t; static const sysctl_t sysctls[] = { {"/proc/sys/kernel/shmmax", "16777216"}, {"/proc/sys/kernel/shmall", "536870912"}, {"/proc/sys/kernel/shmmni", "1024"}, {"/proc/sys/kernel/msgmax", "8192"}, {"/proc/sys/kernel/msgmni", "1024"}, {"/proc/sys/kernel/msgmnb", "1024"}, {"/proc/sys/kernel/sem", "1024 1048576 500 1024"}, }; unsigned i; for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++) write_file(sysctls[i].name, sysctls[i].value); } static int wait_for_loop(int pid) { if (pid < 0) exit(1); int status = 0; while (waitpid(-1, &status, __WALL) != pid) { } return WEXITSTATUS(status); } static void drop_caps(void) { struct __user_cap_header_struct cap_hdr = {}; struct __user_cap_data_struct cap_data[2] = {}; cap_hdr.version = _LINUX_CAPABILITY_VERSION_3; cap_hdr.pid = getpid(); if (syscall(SYS_capget, &cap_hdr, &cap_data)) exit(1); const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE); cap_data[0].effective &= ~drop; cap_data[0].permitted &= ~drop; cap_data[0].inheritable &= ~drop; if (syscall(SYS_capset, &cap_hdr, &cap_data)) exit(1); } static int do_sandbox_none(void) { if (unshare(CLONE_NEWPID)) { } int pid = fork(); if (pid != 0) return wait_for_loop(pid); sandbox_common(); drop_caps(); if (unshare(CLONE_NEWNET)) { } write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535"); initialize_tun(); sandbox_common_mount_tmpfs(); loop(); exit(1); } uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; void loop(void) { intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // socket$inet6 arguments: [ // domain: const = 0xa (8 bytes) // type: socket_type = 0x3 (8 bytes) // proto: int32 = 0xff (4 bytes) // ] // returns sock_in6 res = syscall(__NR_socket, /*domain=*/0xaul, /*type=SOCK_RAW*/ 3ul, /*proto=*/0xff); if (res != -1) r[0] = res; // socket arguments: [ // domain: socket_domain = 0x10 (8 bytes) // type: socket_type = 0x3 (8 bytes) // proto: int32 = 0x0 (4 bytes) // ] // returns sock res = syscall(__NR_socket, /*domain=AF_NETLINK*/ 0x10ul, /*type=SOCK_RAW*/ 3ul, /*proto=*/0); if (res != -1) r[1] = res; // setsockopt$netlink_NETLINK_TX_RING arguments: [ // fd: sock_netlink (resource) // level: const = 0x10e (4 bytes) // opt: const = 0xc (4 bytes) // arg: nil // arglen: len = 0x0 (8 bytes) // ] syscall(__NR_setsockopt, /*fd=*/r[1], /*level=*/0x10e, /*opt=*/0xc, /*arg=*/0ul, /*arglen=*/0ul); // sendmsg$nl_route_sched arguments: [ // fd: sock_nl_route (resource) // msg: ptr[in, msghdr_netlink[netlink_msg_route_sched]] { // msghdr_netlink[netlink_msg_route_sched] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, netlink_msg_route_sched]] { // iovec[in, netlink_msg_route_sched] { // addr: nil // len: len = 0x0 (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x4000 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x200000000080 = 0; *(uint32_t*)0x200000000088 = 0; *(uint64_t*)0x200000000090 = 0x200000000040; *(uint64_t*)0x200000000040 = 0; *(uint64_t*)0x200000000048 = 0; *(uint64_t*)0x200000000098 = 1; *(uint64_t*)0x2000000000a0 = 0; *(uint64_t*)0x2000000000a8 = 0; *(uint32_t*)0x2000000000b0 = 0x4000; syscall(__NR_sendmsg, /*fd=*/r[1], /*msg=*/0x200000000080ul, /*f=*/0ul); // sendmsg$IPCTNL_MSG_EXP_GET arguments: [ // fd: sock_nl_netfilter (resource) // msg: nil // f: send_flags = 0x8000 (8 bytes) // ] syscall(__NR_sendmsg, /*fd=*/(intptr_t)-1, /*msg=*/0ul, /*f=MSG_MORE*/ 0x8000ul); // socket$netlink arguments: [ // domain: const = 0x10 (8 bytes) // type: const = 0x3 (8 bytes) // proto: netlink_proto = 0x5 (4 bytes) // ] // returns sock_netlink res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=NETLINK_NFLOG*/ 5); if (res != -1) r[2] = res; // sendmsg$sock arguments: [ // fd: sock (resource) // msg: ptr[in, msghdr_sock] { // msghdr_sock { // msg_name: ptr[in, sockaddr_storage] { // union sockaddr_storage { // phonet: sockaddr_pn { // spn_family: const = 0x23 (2 bytes) // spn_obj: int8 = 0xf (1 bytes) // spn_dev: int8 = 0x7f (1 bytes) // spn_resource: int8 = 0x8 (1 bytes) // spn_zero: buffer: {00 00 00 00 00 00 00 00 00 00 00} (length // 0xb) // } // } // } // msg_namelen: len = 0x80 (4 bytes) // pad = 0x0 (4 bytes) // msg_iov: ptr[in, array[iovec[in, array[int8]]]] { // array[iovec[in, array[int8]]] { // iovec[in, array[int8]] { // addr: ptr[in, buffer] { // buffer: {07 5c bd bb 13 ae 06 a7 87 a8 c6 2c 22 73 e1 1a 73 // 34 15 5d 52 84 1d 6d 00 7c 6b 3e 9b 85 68 2e 9d e6 96 c5 5a // 9c ba 78 02 f3 33 dd 2f 69 85 21 03 b7 4f 85 02 1f 61 81 16 // b3 97 10 ad e6 0d 85 92 8f 19 7f 2f 6e 8a 41 a1 3a c0 19 d4 // e0 e0 66 b2 1a 05 11 bf f0 b3 67 a1 6e 0b a6 5d 09 3d ba 56 // 92 2f 5e b6 ef 6e 13 bb 4c 75 81 cd 86 d8 5a da f1 13 aa 7b // c3 89 c1 2a f8 22 a6 17 64 4e d7 c1 db 21 22 85 40 76 58 2c // c7 83 1c fe 1a ca 9a c7 63 4d 33 a5 5f d9 a2 d8 5b 4e 25 b9 // cb 26 20 dc e9 ea 4c 25 d5 68 4e 27 08 54 d9 61 25 4e e9 6f // 84 72 1b 23 d7 1a 25 44 92 1a 48 3c 9f 6a d9 63 50 54 00 45 // fb c3 37 9f 14 15 38 94 ac 46 8f 68 b2 09 ee fb c2 10 28 16 // 48 db d7 70 17 63 db ec ed 43 b4 9d ad a4 1b b4 b1 df 13 86 // f2 20 99 ee 15 52 34 ed cc 6c f8 2e 46} (length 0xfa) // } // len: len = 0xfa (8 bytes) // } // iovec[in, array[int8]] { // addr: ptr[in, buffer] { // buffer: {02 f9 eb 61 ed 3c 96 0e 43 c3 c5 81 64 c0 6e d0 8f // 9d 7c 1b b6 be ab 81 a3 a1 1b 41 a7 bb fe f4 10 15 ac dd 11 // 69 56 66 3a 05 e2 8c 02 8f c5 3c 33 3f 75 f7 dc a1 70 bf 08 // d0 8e 95 6b d6 43 a8 87 34 95 42 8c a9 42 70 81 42 1c be 4f // 54 dd 0d b3 a5 6f 3f df 13 e5 43 8b 60 7e e1 09 d6 57 cf 8a // b9 63 c4 be 3a 89 32 ff e4 32 20 bf fa d6 17 d9 c2 e1 35 73 // f1 1a bb 8e 51 7f 1a 2d 83 5f 06 c6 01 16 e1 14 c1 4a 2c 91 // 7e 3c 6c 20 1d 56 be cd 81 9d bd bc 43 7e 9c 4b 30 9d 37 4f // 7f 20 c5 00 12 26 96 e6 4d 0e 02 83 82 47 bd 17 bc 35 a0 2e // 8e 6f a5 a0 0b ed 65 4e fb 67 ed 43 6f a6 f0 9e b3 5e 0b f0 // d0 cf bf 63 32 1b 71 25 5e 2e 9d d6 b4 64 b1 7f ef a4 f9 06 // 7a 26 64 5b ed 1f 59 31 d6 c4 94 c9 e1 38 d4 10 b4 e4 35 03 // 9f 10 09 6e 4a 95 65 69 eb a2 6e 53 92 04 ef f3 aa a6 73 99 // 81 ca 02 dc 86 59 06 98 6e 44 90 4e 44 ae b6 25 1f 8c 2e 8c // 94 43 0a 6a 0e f5 cc 53 6d f6 be e5 03 6b fd 97 ef e2 37 95 // a6 8b 48 85 5d c8 e7 1e fb 42 ce df 16 b6 9d 3e 8f 06 32 8c // 6b c8 05 87 c9 98 5a 95 28 ce a1 4e 15 6f 3c 65 f0 9d a9 46 // f4 23 43 3b 06 af 65 7c 81 66 6e 26 e1 e6 c3 29 ae ac cb fd // 9a 26 94 4a 33 e8 26 a7 36 f8 cb b1 a4 2d 98 da 1b 8c 0e 4f // 6d e4 af 8b fd 95 5c 80 08 5f c8 cb 38 4b b6 76 07 54 72 4d // 0a b3 c8 8b e8 04 ce 30 9a c4 69 8e 12 95 f0 04 30 cb 3d cb // 52 14 2c d7 3b 73 ec 26 8d d2 d8 f7 68 53 00 a6 67 c5 40 9b // f7 0c fe b5 eb 24 b6 c8 be 1a 3e dd e9 e4 01 d5 fe c1 dd d4 // 62 b7 b3 62 c5 3c 2c c9 f9 8d 50 1e 9a 4b 93 48 25 5c 13 94 // cc 76 92 ec ad 75 40 d2 a2 75 e5 70 5e a7 ed e8 78 eb 3a 24 // cb 9d 28 e1 fc 87 98 ad b3 8d 40 83 29 59 dc 2f 8e 26 7f 4f // b6 10 78 d7 a2 b9 0d 44 cd 0c cc c1 82 f0 4e 74 f7 a9 31 20 // bd b3 d7 aa 97 80 4e 21 ff 82 dc 83 8d d9 3f cd a1 ad 09 e2 // 8c 02 a3 05 75 6b 1e 06 85 ea a5 48 be bc d3 24 5d cd df 4b // f9 e8 30 12 93 b4 64 41 5a 43 b8 11 9f f2 ba 26 21 b7 ae ad // c9 16 9a 0d 46 44 b5 85 f1 e7 9f a2 31 56 11 80 d1 15 f2 29 // 41 02 cb 2e 94 b2 75 60 a5 c9 62 8a a8 1b c9 36 65 74 8f e1 // a6 2a 09 e0 5e 82 3e 01 31 81 c6 14 32 f9 e7 3e 51 3a c9 9b // f5 00 3c 69 3c f8 54 87 05 9c bf 48 91 b2 3a fd 21 2a 90 77 // 73 0a 45 ac aa d1 e4 45 e1 3e 7f e2 3a 91 f3 3f bc 7f fe 4d // a4 6e dc af 4f 38 de ba 0a 2c 84 7b 25 29 0c e3 e8 0b e3 b0 // 9f d5 f4 01 bf 1e 58 f2 f0 ba 4f 2f 53 7c e4 37 c1 cc 03 2d // e0 da a2 12 69 c7 dd 11 85 92 7c 31 ea 8a 43 14 89 6a 32 83 // 51 3e c0 16 0e 95 f7 6d 08 3e ec 4c 4b 62 83 75 ef fe 0b 1a // f4 70 a4 fc b9 c9 87 6a 9e 34 c7 8a 3d 1b 5f 73 3e 8f fd 7c // ea be aa 7f 20 8e e1 1f 44 b6 0d 63 3b 2f d9 35 d8 35 56 02 // 85 b0 02 cc 28 86 df ba f3 06 09 f7 02 e6 33 7a ca 09 34 ff // 3e 59 fa 59 2c f3 c0 73 35 66 3b 29 e1 5f 52 1b b4 02 08 f6 // 46 49 37 62 b8 13 8b 3c f1 23 93 34 07 cf ae 09 52 d6 93 f9 // 33 a8 0d be 2f 60 e2 a5 c4 dc 7f 01 1f 0e 55 38 25 52 97 78 // cb a2 60 51 6c e0 b1 70 c1 ae f9 ed a9 8e 49 05 23 2c 61 55 // b8 ce bf 55 1a 64 86 53 07 57 c2 92 34 50 95 64 38 dd 46 6a // f6 42 02 b0 e5 3a f8 2f 20 64 66 97 27 d8 87 c6 12 18 f7 c6 // 2b a5 67 2d 8f 06 8e 8e 66 51 ca 31 35 cb 16 12 a8 1a e9 82 // e7 a3 06 9f 07 33 79 79 c7 97 97 e1 45 fb 56 fd 61 88 ea 90 // 3e a7 30 57 83 c5 c9 ee ea 8a 57 eb 32 ae 0b 3c d6 d2 56 f0 // a6 76 96 ad fd 28 56 95 29 b6 41 6e f7 3e 65 4e e8 e7 8d 60 // c1 09 e5 53 12 8c fe 7b 81 ee b4 f6 3f aa 39 62 17 f8 a7 71 // 4f a0 0a c6 4c 1a ef c2 2a f2 f2 c3 b9 16 87 a3 0d 71 ad 7c // 6b d7 ff 32 bf 4f c4 a6 ac 6b 21 03 78 c6 83 a4 41 0e f6 3d // 62 e1 ee 81 e2 3d 0a ff 17 f2 eb 31 87 d7 07 ad e7 6d 77 e9 // cc 12 96 ca 50 60 af 08 2c 2d d9 aa b0 53 8e 05 6f 84 d4 0e // 2d 40 97 8b de 38 ef 6c bc 2a 81 2a 79 81 c9 0c 41 0c e4 6f // 7f 03 a9 21 ae 29 f1 e2 3a c8 58 0d e4 ea a9 e6 3c 11 28 6f // 2d 94 d3 57 ba 89 d9 42 ed 53 3e f5 09 1c 0f 1a 99 d3 76 25 // 45 c1 7e e3 49 e2 fe 5f 7a d2 eb 8c ae ac c7 f4 97 85 dd 2a // 85 32 e4 38 ac 1a 02 c9 c9 de 46 8b 78 a1 06 0c f7 f1 90 36 // aa 30 87 2f a6 c5 ad bc 3d b1 fa 47 05 26 a4 38 21 ce 47 ac // 73 af d6 e9 1c 0e 97 4b fe 9e f2 27 88 93 2e 36 f3 43 0e 5a // a1 25 87 78 16 c2 26 7e 47 1b 7e 00 c1 8a bc 78 eb 7c 0a 90 // 27 1c f5 fe ed f5 8b 0a bc c5 96 dc 99 9f c3 f0 80 96 07 23 // a5 8d d1 9d 02 23 5b d8 38 0b fa 66 8f a7 93 fa 80 9c 4a 43 // 3e 0f 29 b4 8f bc 44 68 7e af 83 16 44 48 e8 85 c4 3c 80 af // 30 ef 80 ab 6e aa 4a d5 e2 02 24 04 d3 59 4f f7 c0 ce 89 56 // 62 9b 67 da 2f 92 f2 fb 1e 8b 69 31 b2 54 7c 35 ff 17 eb ec // 23 8c a1 18 3a ae d0 78 c3 19 04 f5 9c 0e 5f dc 42 eb 9b 2b // 9c 95 60 5a 5f cf 84 4f bd 43 d8 0c f6 5f bd 9d 27 b7 20 f4 // c8 6e 42 22 16 19 e9 e8 3f 37 6b 55 63 ed 07 08 bd f6 b2 ba // a2 3f 6f f3 f7 12 13 55 64 d1 36 2e 38 d0 fe 6f 06 dd 17 05 // 2f 29 db 3e 62 41 a5 fb 9c a4 43 0c 8b 67 d8 a8 14 2c 1b 21 // d8 1e 16 6b de 10 1a d2 af 57 43 fc 17 5b a1 48 de a0 b2 57 // 4a 86 b6 1e 74 66 7b 5d 06 e1 24 62 10 f9 02 dd 40 de a0 cb // 9c 93 02 2a 05 ce fd 25 78 f5 f3 f3 95 9a 54 a7 dd 7c 59 4d // 57 ce e2 91 18 b8 50 e8 1d 52 a9 99 96 b5 ab 5c 4f b7 27 c1 // d5 d2 d8 3e f6 83 21 ab 93 87 36 0f 57 1f 07 99 35 99 04 a0 // d4 8e 09 5b ee 7a 37 d2 a2 b1 f3 cd 08 08 fd 13 3e e7 a7 77 // 16 89 eb 59 e8 9a 38 8f fb 5b ea 7e d7 87 84 a9 61 af 18 41 // 13 48 50 0d ec 61 ba 10 01 a6 22 9c e3 60 17 e9 c8 e4 89 31 // a6 57 ee 81 29 59 c5 cc d5 09 dd 37 07 13 4e cc 0a 2d 71 89 // 8f 4b bd 12 66 49 8b ca b3 41 1e 5b 7a 60 3b 0c c6 81 d3 fc // 15 40 e7 1a 1a ec 9d 1f 7e 16 39 02 31 d3 6e 5a 14 01 4a 71 // bf 46 e5 52 c2 da d6 d4 1a 53 c1 03 1b 51 47 9b 20 d0 bc c3 // a9 f2 d6 a5 b3 0d de 2b af 9e 68 f5 3d 1e 96 98 68 e4 6b 1f // 7d 66 b0 85 18 6f d7 57 ac bd 4d ca 4a ca 00 51 34 36 1d fe // bc 58 3e 7f 0e 3f ca ce dd b1 f7 6d e0 24 c9 a4 71 b2 5c 85 // 79 16 fb bd 35 86 1f 47 9f be c1 ea ae 9a f3 7d fc f0 5a ab // d2 40 ea 8a 79 72 c4 da da c2 b4 06 68 59 98 ac 6f 5f 43 c9 // 89 23 5f a1 8b 26 ec 55 8c d7 e7 cd 86 83 8f 15 ef f1 cb 26 // d1 37 bf 57 dd 9f cb 7b 48 0b 82 20 af 6c da 07 fa e1 a1 c0 // 65 d0 e7 e6 10 16 63 9e 39 c5 60 be 39 3d 07 33 75 67 9a f9 // 19 b8 d3 d5 fa e1 17 ac c6 57 ae 06 37 9f 52 0d d2 82 3d 53 // af c4 96 a3 32 eb 84 bd 77 99 81 8b 54 02 30 26 8c 23 c0 55 // 73 69 04 5e d3 52 56 8d db 33 e1 01 46 d4 b3 3b c1 e9 5f cf // 12 9c c6 e3 97 fa 0f 6c fb 46 2c 41 a7 60 16 ca 1c 3f f1 70 // 79 cd 0e fa d1 bb 29 d0 f5 7c dc 7a 04 b1 42 03 de 2c 0b 89 // 29 97 89 c0 1b 06 3e 6b 27 c1 e9 f7 71 79 6a 9a be b7 03 7b // 3a 0e 7a aa e1 d9 49 32 2d c9 3e cb ef 01 b5 6d c8 f0 7b cd // b7 69 5b 75 82 6a be c9 c0 76 58 33 17 a6 40 7d b6 79 94 2d // bc e5 ba b4 63 92 df 6c e3 e0 a6 53 97 8d 6c 5f 8f 6b b4 58 // 18 9d 2d c8 c7 c6 9f 22 a7 d8 2f bd ed 77 3b 86 2f bc 7e 50 // 41 b2 6a c9 32 83 7a 70 ca 86 cb 22 d9 a3 f5 0e f8 ce 23 03 // b0 2e 1f c6 6e 39 da d9 9c a6 0f 3f 8d 4d 94 c5 38 01 02 db // 74 4a e8 c3 ff 50 38 76 9b fd 0b a6 8f 63 f6 60 dc 04 0a f8 // 39 8e 6d 3d 3a 93 8b 5e 02 58 f9 b3 b1 6a a0 f1 28 a4 7b ae // 62 72 b3 fd be 5e 60 28 e0 aa c0 34 d7 d0 6f 29 2b 68 fa dc // dc 7f 33 b6 25 59 a2 05 b4 96 7f af cf ab 3b a6 0f c7 1f 5e // 95 d8 47 1f e8 ee 4b ca c5 ad 43 48 69 4a 2b c2 3e 81 79 e6 // f3 80 f0 8d f1 c0 a1 29 13 6c 4c dd d1 34 dd 0f a0 f4 57 0d // 30 0d 66 a5 5f 8d e2 e9 5b cc ad 35 e3 ee 63 5e ca f9 3d 45 // 7e 76 8e f3 24 e3 03 f9 e5 7c c9 69 c4 c5 d8 2e ec ff 34 c4 // 92 69 d5 04 4c c2 fe cb ae b0 0b 96 b9 54 89 d9 8c bb 6d f0 // 9c 2e d1 6d 35 62 17 ff c4 9b cc 57 08 93 b9 d5 08 24 96 fa // bd 2b 7c c6 24 54 50 15 51 66 11 68 65 f6 c9 dd 67 30 bc dd // 40 3e 70 98 a2 59 97 b8 ed e0 42 97 bf 18 09 17 86 80 4e c5 // 3a cb d8 ff 58 f6 a2 b2 66 36 4e 32 43 7b fc fd 78 65 a6 ba // fd 66 4a 81 f2 e9 d3 0e dc 34 bf 38 62 94 92 88 81 c0 3a e6 // 11 8e 7b 08 97 ea 0f c8 a0 c6 8e 83 6b fe 68 47 ff ef 99 f3 // b8 9a 04 69 13 f5 33 2a 14 88 45 07 d5 4f c7 40 d4 a6 2c e7 // ab 6f c0 b0 26 a2 f7 41 61 ea c0 d8 7b a7 fa 7b c2 a8 7a 52 // 71 8f 9d 79 90 71 6c a0 77 f7 ae 30 75 f9 77 80 e4 48 ac 84 // 07 cd e0 b8 b0 03 44 45 7a 12 57 73 c8 0b 2c b7 e4 9f c7 d8 // c9 65 79 1f 60 0f 87 8d d4 36 98 8a f8 b4 ca dd 3f e0 19 37 // eb 8b f2 3a 58 a3 44 d7 c7 ce 57 11 98 d5 03 69 26 05 e4 49 // cd 98 b8 8b 53 24 95 eb ca b3 e2 cb bf a1 d5 d0 4b 78 04 a5 // 2b c4 7b 27 d5 ab c5 03 a7 9a b6 3f ab c6 fe c7 e9 12 dc 1b // b0 07 9f aa 83 13 1c e2 6c 91 e4 b1 00 fb 97 a4 88 0d 4c c2 // 8e bc 00 cf 1f 68 72 04 eb e2 da 9d b6 8a 70 9e 61 e0 24 86 // b9 a3 4d 0a 88 3a e5 c1 81 e1 f5 d0 30 f9 95 98 76 b1 2a b9 // 58 a7 b4 05 ac d8 a8 b9 e2 33 1a 09 4d dc d2 2e 62 98 3d 6a // 9b 48 93 4f a4 17 ec aa 26 af 89 02 ad b1 b0 22 e0 c7 a7 fc // 40 db 4d be 40 ea 4e a9 f9 6a b8 cc 77 33 0b cf f0 de 18 0d // cd 0a 96 3e d5 f8 53 77 6e f4 6d 9a 21 85 48 5c 56 35 e2 85 // 8e f5 b0 f9 da 7e 83 6f c6 ab 6b 79 a3 a9 05 38 76 9b 18 fb // 04 6e 57 8a 34 80 f1 b0 0e 51 85 e7 18 92 2c e3 10 aa b7 f6 // af 1b 03 7f 18 43 b9 8f 29 98 9d 85 37 29 8d 59 c9 21 44 5f // 5d 43 60 c3 f3 f3 90 a6 5d 72 97 3e 90 8e 91 a7 d0 d8 53 14 // 83 03 75 67 d8 b7 34 99 41 6e 24 cd 38 19 62 7d 39 96 6d fe // 35 f5 75 21 4d 38 88 c9 51 3b 06 f5 65 cd ee 8e 94 22 89 97 // 37 85 aa 57 34 03 d3 2f d4 4f b7 3b a9 93 f1 fa 76 30 49 00 // d1 d0 f0 af aa 3e 41 16 1a 16 00 70 a6 92 b6 e6 4c e9 d2 37 // ca c4 10 c7 9d eb 4f 03 07 36 e5 71 48 b7 6e fc bb 93 d1 9f // 15 0a bb 81 8c 9e e9 31 c6 47 1e 60 1b 6f a6 79 a0 78 2f b1 // 4c 9b 08 22 2e e3 d7 8f 5a de 5f 61 bf ec 5d e5 b6 b5 7f 52 // a1 ef 8c f1 32 69 8e f1 60 51 5f 4a 55 d7 93 3b 9e 82 81 0d // c2 03 81 3f 4c c5 f8 46 9b c8 de 70 03 6f bd fd 75 24 2a 96 // f3 6b f1 e5 ff c7 3f 46 c3 a0 b7 d4 6f 61 04 8d 2d 9a b6 e6 // 03 58 33 ed 3a de 90 16 c6 f1 a4 af e5 13 37 f7 51 c3 04 5d // ae 76 98 85 d6 b2 86 e4 7d 15 13 ca ec e3 45 18 08 5e 4a 8e // de f0 d9 72 2c 63 11 38 c9 8a d1 6a 01 55 84 c1 ae b4 cb 0c // 4e 57 ed 59 e7 0a e1 02 36 6d 52 e3 85 ef a4 ed 5e 86 e7 a9 // 92 b9 ee 09 15 e5 9d 6a 4a 1a 4f 1d 02 7a 3a f0 33 a4 ac 50 // d4 7e f2 eb 94 2c a6 b7 f4 0d 41 e9 a6 bf 12 7e 8d cd 8d cb // e3 9f 2d f6 1c c2 ca dd 86 68 6a a2 a3 15 a7 b8 7e 02 50 d9 // eb 1e 7f 27 76 8b db 84 7e 04 75 26 5b 5f af db 7a 80 b7 0e // a4 dd 07 30 e9 4d 5d 9a c1 36 ba a6 4b da 0d 63 1c 42 dd 94 // f7 c5 0f 08 72 f8 8b 57 81 40 22 b3 c5 69 7e 74 b4 13 95 d8 // 8b f1 82 e8 6f 0b af ec a2 b7 85 9f bb 13 f4 78 d3 0d 07 45 // 7c d1 ef c0 2a 7a 5e 4d de ec 8d 09 48 a8 c4 02 21 42 95 28 // 3f 30 60 55 22 2d 29 15 a5 2a 29 d7 6e 9b 24 d4 18 19 d1 8c // 23 95 ce 19 6d ac cc a0 d5 c1 e9 5a fd ef 03 59 9c c3 e0 3d // c7 76 14 85 76 8d 0f 78 d3 9f 81 45 47 fc 20 91 ef 8f 7e fd // 17 89 e4 03 a8 04 f0 13 23 9f 9d 20 86 31 68 48 66 99 fe 32 // be 11 e6 28 9f e4 db 12 b7 5f ad a5 8a d2 c6 b3 04 53 83 84 // ac 3c a6 c9 7f 9d eb a8 5c b6 11 1c 2a 84 6a fd 5b 9b cc b6 // fd 76 fd 60 c8 b9 70 ea 0c 36 24 c4 94 8d 0d 1b 84 32 b2 dd // e1 81 67 0b 0a eb 1e 70 c2 ee 90 81 bf 74 45 8a 68 b3 01 5a // 6c 17 10 3b 7a f7 2a 2b bc f3 69 28 91 1f b7 c1 95 9b 58 14 // 9d e1 81 ae bc c9 5d e5 d0 ef a1 04 46 2d a6 59 6c f0 42 c2 // 68 af c5 4e c9 d4 72 44 e9 c7 99 12 97 cb f4 e3 58 29 34 34 // ea 72 3a 99 e3 0e 69 4f 45 a5 c2 40 16 cd 07 9d fe 70 7b 55 // 7e 58 9d d1 88 8d 4b be 3c e4 d4 a4 30 cb d4 f6 f7 0f eb a7 // 05 4d e8 49 9c 19 47 d9 0d dd c4 21 c6 28 61 27 9d 40 8e 45 // 85 4b a3 ca 4f 9e 4d 70 6f 21 3c 00 70 fa 25 28 f7 cd 0e 8b // 8d 32 a7 a0 0f 7c 41 a4 49 29 b4 13 a7 56 68 75 d6 d6 d7 65 // 50 67 da 20 c8 c8 0a e2 95 71 ce cb c3 0f cf 7f cb 87 74 f4 // 83 e0 9d 12 45 b1 c7 5b b3 58 7f fd fa fd 58 a9 c8 57 b9 4a // 74 bb ec da 40 41 b8 c9 0c 38 40 bd 63 3c 53 6d bb 24 4d d0 // bb 94 ad 63 df 2e e1 19 74 f3 21 a2 68 83 5a 7a 75 db 83 5c // ce 52 4f 2d 23 df 1b eb 0c 5d a4 de 41 f3 ba 30 95 dc 55 20 // c6 46 af 3f 35 8a 81 94 e2 56 0d e8 65 4d 1a 46 a8 cd db af // 1a 60 e1 c8 af 79 c9 49 7b 84 a4 6e f9 3b 4b cc c8 0c e7 60 // 5f 0b e0 d5 a9 f2 7d 7a d7 5e db d7 ef 0e 67 b9 5c 0a be 18 // 03 fc 45 27 df 25 97 d8 82 85 20 50 f7 b5 50 c1 02 4e b0 0d // 65 ec 5e 40 42 66 a7 f3 bb 7e 97 f2 e0 5a dc 1c d5 fe b4 a6 // 1d eb bf 4e 25 e7 d9 79 d3 fe 40 d5 f4 62 e8 a9 7f 57 c0 93 // b4 1b 41 e1 64 a4 bd 59 ec ac 48 00 3e 10 a3 25 0a 72 51 12 // d9 ee 95 f1 13 05 d2 b0 1a 7a b5 7d 96 3c 1e 49 57 94 1c fd // b8 3d a1 87 20 ae 9c e4 47 c5 96 02 df ae b4 b9 0c 55 d1 52 // 8a 59 74 f0 0d 58 38 0e af 2c dc 97 22 ad f5 42 3c 6e 88 36 // f7 d8 2c 98 17 cb 8a 7c 3f 97 70 26 f7 40 5c c1 9c 2a 9b b6 // b9 0f 92 dd 81 43 79 1b e4 d0 a9 c4 5e cb 0c 80 03 61 73 28 // 15 94 85 11 32 e7 81 72 04 59 df 2c 60 bf 65 72 cc c0 ff a2 // 1d 74 a5 0b 78 3f 25 79 42 7c 04 f5 04 a1 59 66 9f e2 30 0c // 67 a8 09 12 3b e8 d2 c6 83 4f 96 5a 4d 05 08 3e 7e c1 95 f3 // cd e5 82 ff 0a c5 f1 48 42 c5 6c af 19 d0 f6 ec 0c ce b7 11 // 08 e5 7a 5f 09 a2 eb 49 3b c4 15 c9 04 22 6d 07 15 70 a7 56 // 4d c8 10 89 04 f8 10 bc d9 12 89 2a 04 90 18 1a 34 ac 8f 38 // 12 72 40 2d 8d 39 6e 79 fd 57 ac 70 70 7b d0 90 3e c7 ec 1f // a6 7a 57 ac c5 37 25 50 59 44 a5 89 68 26 60 2b a8 fd b7 55 // 25 e0 90 a0 2a 72 45 8e 98 45 0c 35 20 42 3e da 97 d5 45} // (length 0x1000) // } // len: len = 0x1000 (8 bytes) // } // iovec[in, array[int8]] { // addr: ptr[in, buffer] { // buffer: {17 b3 ee 12 92 9d a2 f4 66 a5 8b 03 fb dd 6b f5 53 // cd af 1b bc 8d 12 cb 55 ba 06 f5 9e 6e 6c d2 32 81} (length // 0x22) // } // len: len = 0x22 (8 bytes) // } // } // } // msg_iovlen: len = 0x3 (8 bytes) // msg_control: nil // msg_controllen: bytesize = 0x0 (8 bytes) // msg_flags: const = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x200000002d00 = 0x200000000080; *(uint16_t*)0x200000000080 = 0x23; *(uint8_t*)0x200000000082 = 0xf; *(uint8_t*)0x200000000083 = 0x7f; *(uint8_t*)0x200000000084 = 8; memset((void*)0x200000000085, 0, 11); *(uint32_t*)0x200000002d08 = 0x80; *(uint64_t*)0x200000002d10 = 0x200000002cc0; *(uint64_t*)0x200000002cc0 = 0x200000000540; memcpy( (void*)0x200000000540, "\x07\x5c\xbd\xbb\x13\xae\x06\xa7\x87\xa8\xc6\x2c\x22\x73\xe1\x1a\x73\x34" "\x15\x5d\x52\x84\x1d\x6d\x00\x7c\x6b\x3e\x9b\x85\x68\x2e\x9d\xe6\x96\xc5" "\x5a\x9c\xba\x78\x02\xf3\x33\xdd\x2f\x69\x85\x21\x03\xb7\x4f\x85\x02\x1f" "\x61\x81\x16\xb3\x97\x10\xad\xe6\x0d\x85\x92\x8f\x19\x7f\x2f\x6e\x8a\x41" "\xa1\x3a\xc0\x19\xd4\xe0\xe0\x66\xb2\x1a\x05\x11\xbf\xf0\xb3\x67\xa1\x6e" "\x0b\xa6\x5d\x09\x3d\xba\x56\x92\x2f\x5e\xb6\xef\x6e\x13\xbb\x4c\x75\x81" "\xcd\x86\xd8\x5a\xda\xf1\x13\xaa\x7b\xc3\x89\xc1\x2a\xf8\x22\xa6\x17\x64" "\x4e\xd7\xc1\xdb\x21\x22\x85\x40\x76\x58\x2c\xc7\x83\x1c\xfe\x1a\xca\x9a" "\xc7\x63\x4d\x33\xa5\x5f\xd9\xa2\xd8\x5b\x4e\x25\xb9\xcb\x26\x20\xdc\xe9" "\xea\x4c\x25\xd5\x68\x4e\x27\x08\x54\xd9\x61\x25\x4e\xe9\x6f\x84\x72\x1b" "\x23\xd7\x1a\x25\x44\x92\x1a\x48\x3c\x9f\x6a\xd9\x63\x50\x54\x00\x45\xfb" "\xc3\x37\x9f\x14\x15\x38\x94\xac\x46\x8f\x68\xb2\x09\xee\xfb\xc2\x10\x28" "\x16\x48\xdb\xd7\x70\x17\x63\xdb\xec\xed\x43\xb4\x9d\xad\xa4\x1b\xb4\xb1" "\xdf\x13\x86\xf2\x20\x99\xee\x15\x52\x34\xed\xcc\x6c\xf8\x2e\x46", 250); *(uint64_t*)0x200000002cc8 = 0xfa; *(uint64_t*)0x200000002cd0 = 0x200000001c80; memcpy( (void*)0x200000001c80, "\x02\xf9\xeb\x61\xed\x3c\x96\x0e\x43\xc3\xc5\x81\x64\xc0\x6e\xd0\x8f\x9d" "\x7c\x1b\xb6\xbe\xab\x81\xa3\xa1\x1b\x41\xa7\xbb\xfe\xf4\x10\x15\xac\xdd" "\x11\x69\x56\x66\x3a\x05\xe2\x8c\x02\x8f\xc5\x3c\x33\x3f\x75\xf7\xdc\xa1" "\x70\xbf\x08\xd0\x8e\x95\x6b\xd6\x43\xa8\x87\x34\x95\x42\x8c\xa9\x42\x70" "\x81\x42\x1c\xbe\x4f\x54\xdd\x0d\xb3\xa5\x6f\x3f\xdf\x13\xe5\x43\x8b\x60" "\x7e\xe1\x09\xd6\x57\xcf\x8a\xb9\x63\xc4\xbe\x3a\x89\x32\xff\xe4\x32\x20" "\xbf\xfa\xd6\x17\xd9\xc2\xe1\x35\x73\xf1\x1a\xbb\x8e\x51\x7f\x1a\x2d\x83" "\x5f\x06\xc6\x01\x16\xe1\x14\xc1\x4a\x2c\x91\x7e\x3c\x6c\x20\x1d\x56\xbe" "\xcd\x81\x9d\xbd\xbc\x43\x7e\x9c\x4b\x30\x9d\x37\x4f\x7f\x20\xc5\x00\x12" "\x26\x96\xe6\x4d\x0e\x02\x83\x82\x47\xbd\x17\xbc\x35\xa0\x2e\x8e\x6f\xa5" "\xa0\x0b\xed\x65\x4e\xfb\x67\xed\x43\x6f\xa6\xf0\x9e\xb3\x5e\x0b\xf0\xd0" "\xcf\xbf\x63\x32\x1b\x71\x25\x5e\x2e\x9d\xd6\xb4\x64\xb1\x7f\xef\xa4\xf9" "\x06\x7a\x26\x64\x5b\xed\x1f\x59\x31\xd6\xc4\x94\xc9\xe1\x38\xd4\x10\xb4" "\xe4\x35\x03\x9f\x10\x09\x6e\x4a\x95\x65\x69\xeb\xa2\x6e\x53\x92\x04\xef" "\xf3\xaa\xa6\x73\x99\x81\xca\x02\xdc\x86\x59\x06\x98\x6e\x44\x90\x4e\x44" "\xae\xb6\x25\x1f\x8c\x2e\x8c\x94\x43\x0a\x6a\x0e\xf5\xcc\x53\x6d\xf6\xbe" "\xe5\x03\x6b\xfd\x97\xef\xe2\x37\x95\xa6\x8b\x48\x85\x5d\xc8\xe7\x1e\xfb" "\x42\xce\xdf\x16\xb6\x9d\x3e\x8f\x06\x32\x8c\x6b\xc8\x05\x87\xc9\x98\x5a" "\x95\x28\xce\xa1\x4e\x15\x6f\x3c\x65\xf0\x9d\xa9\x46\xf4\x23\x43\x3b\x06" "\xaf\x65\x7c\x81\x66\x6e\x26\xe1\xe6\xc3\x29\xae\xac\xcb\xfd\x9a\x26\x94" "\x4a\x33\xe8\x26\xa7\x36\xf8\xcb\xb1\xa4\x2d\x98\xda\x1b\x8c\x0e\x4f\x6d" "\xe4\xaf\x8b\xfd\x95\x5c\x80\x08\x5f\xc8\xcb\x38\x4b\xb6\x76\x07\x54\x72" "\x4d\x0a\xb3\xc8\x8b\xe8\x04\xce\x30\x9a\xc4\x69\x8e\x12\x95\xf0\x04\x30" "\xcb\x3d\xcb\x52\x14\x2c\xd7\x3b\x73\xec\x26\x8d\xd2\xd8\xf7\x68\x53\x00" "\xa6\x67\xc5\x40\x9b\xf7\x0c\xfe\xb5\xeb\x24\xb6\xc8\xbe\x1a\x3e\xdd\xe9" "\xe4\x01\xd5\xfe\xc1\xdd\xd4\x62\xb7\xb3\x62\xc5\x3c\x2c\xc9\xf9\x8d\x50" "\x1e\x9a\x4b\x93\x48\x25\x5c\x13\x94\xcc\x76\x92\xec\xad\x75\x40\xd2\xa2" "\x75\xe5\x70\x5e\xa7\xed\xe8\x78\xeb\x3a\x24\xcb\x9d\x28\xe1\xfc\x87\x98" "\xad\xb3\x8d\x40\x83\x29\x59\xdc\x2f\x8e\x26\x7f\x4f\xb6\x10\x78\xd7\xa2" "\xb9\x0d\x44\xcd\x0c\xcc\xc1\x82\xf0\x4e\x74\xf7\xa9\x31\x20\xbd\xb3\xd7" "\xaa\x97\x80\x4e\x21\xff\x82\xdc\x83\x8d\xd9\x3f\xcd\xa1\xad\x09\xe2\x8c" "\x02\xa3\x05\x75\x6b\x1e\x06\x85\xea\xa5\x48\xbe\xbc\xd3\x24\x5d\xcd\xdf" "\x4b\xf9\xe8\x30\x12\x93\xb4\x64\x41\x5a\x43\xb8\x11\x9f\xf2\xba\x26\x21" "\xb7\xae\xad\xc9\x16\x9a\x0d\x46\x44\xb5\x85\xf1\xe7\x9f\xa2\x31\x56\x11" "\x80\xd1\x15\xf2\x29\x41\x02\xcb\x2e\x94\xb2\x75\x60\xa5\xc9\x62\x8a\xa8" "\x1b\xc9\x36\x65\x74\x8f\xe1\xa6\x2a\x09\xe0\x5e\x82\x3e\x01\x31\x81\xc6" "\x14\x32\xf9\xe7\x3e\x51\x3a\xc9\x9b\xf5\x00\x3c\x69\x3c\xf8\x54\x87\x05" "\x9c\xbf\x48\x91\xb2\x3a\xfd\x21\x2a\x90\x77\x73\x0a\x45\xac\xaa\xd1\xe4" "\x45\xe1\x3e\x7f\xe2\x3a\x91\xf3\x3f\xbc\x7f\xfe\x4d\xa4\x6e\xdc\xaf\x4f" "\x38\xde\xba\x0a\x2c\x84\x7b\x25\x29\x0c\xe3\xe8\x0b\xe3\xb0\x9f\xd5\xf4" "\x01\xbf\x1e\x58\xf2\xf0\xba\x4f\x2f\x53\x7c\xe4\x37\xc1\xcc\x03\x2d\xe0" "\xda\xa2\x12\x69\xc7\xdd\x11\x85\x92\x7c\x31\xea\x8a\x43\x14\x89\x6a\x32" "\x83\x51\x3e\xc0\x16\x0e\x95\xf7\x6d\x08\x3e\xec\x4c\x4b\x62\x83\x75\xef" "\xfe\x0b\x1a\xf4\x70\xa4\xfc\xb9\xc9\x87\x6a\x9e\x34\xc7\x8a\x3d\x1b\x5f" "\x73\x3e\x8f\xfd\x7c\xea\xbe\xaa\x7f\x20\x8e\xe1\x1f\x44\xb6\x0d\x63\x3b" "\x2f\xd9\x35\xd8\x35\x56\x02\x85\xb0\x02\xcc\x28\x86\xdf\xba\xf3\x06\x09" "\xf7\x02\xe6\x33\x7a\xca\x09\x34\xff\x3e\x59\xfa\x59\x2c\xf3\xc0\x73\x35" "\x66\x3b\x29\xe1\x5f\x52\x1b\xb4\x02\x08\xf6\x46\x49\x37\x62\xb8\x13\x8b" "\x3c\xf1\x23\x93\x34\x07\xcf\xae\x09\x52\xd6\x93\xf9\x33\xa8\x0d\xbe\x2f" "\x60\xe2\xa5\xc4\xdc\x7f\x01\x1f\x0e\x55\x38\x25\x52\x97\x78\xcb\xa2\x60" "\x51\x6c\xe0\xb1\x70\xc1\xae\xf9\xed\xa9\x8e\x49\x05\x23\x2c\x61\x55\xb8" "\xce\xbf\x55\x1a\x64\x86\x53\x07\x57\xc2\x92\x34\x50\x95\x64\x38\xdd\x46" "\x6a\xf6\x42\x02\xb0\xe5\x3a\xf8\x2f\x20\x64\x66\x97\x27\xd8\x87\xc6\x12" "\x18\xf7\xc6\x2b\xa5\x67\x2d\x8f\x06\x8e\x8e\x66\x51\xca\x31\x35\xcb\x16" "\x12\xa8\x1a\xe9\x82\xe7\xa3\x06\x9f\x07\x33\x79\x79\xc7\x97\x97\xe1\x45" "\xfb\x56\xfd\x61\x88\xea\x90\x3e\xa7\x30\x57\x83\xc5\xc9\xee\xea\x8a\x57" "\xeb\x32\xae\x0b\x3c\xd6\xd2\x56\xf0\xa6\x76\x96\xad\xfd\x28\x56\x95\x29" "\xb6\x41\x6e\xf7\x3e\x65\x4e\xe8\xe7\x8d\x60\xc1\x09\xe5\x53\x12\x8c\xfe" "\x7b\x81\xee\xb4\xf6\x3f\xaa\x39\x62\x17\xf8\xa7\x71\x4f\xa0\x0a\xc6\x4c" "\x1a\xef\xc2\x2a\xf2\xf2\xc3\xb9\x16\x87\xa3\x0d\x71\xad\x7c\x6b\xd7\xff" "\x32\xbf\x4f\xc4\xa6\xac\x6b\x21\x03\x78\xc6\x83\xa4\x41\x0e\xf6\x3d\x62" "\xe1\xee\x81\xe2\x3d\x0a\xff\x17\xf2\xeb\x31\x87\xd7\x07\xad\xe7\x6d\x77" "\xe9\xcc\x12\x96\xca\x50\x60\xaf\x08\x2c\x2d\xd9\xaa\xb0\x53\x8e\x05\x6f" "\x84\xd4\x0e\x2d\x40\x97\x8b\xde\x38\xef\x6c\xbc\x2a\x81\x2a\x79\x81\xc9" "\x0c\x41\x0c\xe4\x6f\x7f\x03\xa9\x21\xae\x29\xf1\xe2\x3a\xc8\x58\x0d\xe4" "\xea\xa9\xe6\x3c\x11\x28\x6f\x2d\x94\xd3\x57\xba\x89\xd9\x42\xed\x53\x3e" "\xf5\x09\x1c\x0f\x1a\x99\xd3\x76\x25\x45\xc1\x7e\xe3\x49\xe2\xfe\x5f\x7a" "\xd2\xeb\x8c\xae\xac\xc7\xf4\x97\x85\xdd\x2a\x85\x32\xe4\x38\xac\x1a\x02" "\xc9\xc9\xde\x46\x8b\x78\xa1\x06\x0c\xf7\xf1\x90\x36\xaa\x30\x87\x2f\xa6" "\xc5\xad\xbc\x3d\xb1\xfa\x47\x05\x26\xa4\x38\x21\xce\x47\xac\x73\xaf\xd6" "\xe9\x1c\x0e\x97\x4b\xfe\x9e\xf2\x27\x88\x93\x2e\x36\xf3\x43\x0e\x5a\xa1" "\x25\x87\x78\x16\xc2\x26\x7e\x47\x1b\x7e\x00\xc1\x8a\xbc\x78\xeb\x7c\x0a" "\x90\x27\x1c\xf5\xfe\xed\xf5\x8b\x0a\xbc\xc5\x96\xdc\x99\x9f\xc3\xf0\x80" "\x96\x07\x23\xa5\x8d\xd1\x9d\x02\x23\x5b\xd8\x38\x0b\xfa\x66\x8f\xa7\x93" "\xfa\x80\x9c\x4a\x43\x3e\x0f\x29\xb4\x8f\xbc\x44\x68\x7e\xaf\x83\x16\x44" "\x48\xe8\x85\xc4\x3c\x80\xaf\x30\xef\x80\xab\x6e\xaa\x4a\xd5\xe2\x02\x24" "\x04\xd3\x59\x4f\xf7\xc0\xce\x89\x56\x62\x9b\x67\xda\x2f\x92\xf2\xfb\x1e" "\x8b\x69\x31\xb2\x54\x7c\x35\xff\x17\xeb\xec\x23\x8c\xa1\x18\x3a\xae\xd0" "\x78\xc3\x19\x04\xf5\x9c\x0e\x5f\xdc\x42\xeb\x9b\x2b\x9c\x95\x60\x5a\x5f" "\xcf\x84\x4f\xbd\x43\xd8\x0c\xf6\x5f\xbd\x9d\x27\xb7\x20\xf4\xc8\x6e\x42" "\x22\x16\x19\xe9\xe8\x3f\x37\x6b\x55\x63\xed\x07\x08\xbd\xf6\xb2\xba\xa2" "\x3f\x6f\xf3\xf7\x12\x13\x55\x64\xd1\x36\x2e\x38\xd0\xfe\x6f\x06\xdd\x17" "\x05\x2f\x29\xdb\x3e\x62\x41\xa5\xfb\x9c\xa4\x43\x0c\x8b\x67\xd8\xa8\x14" "\x2c\x1b\x21\xd8\x1e\x16\x6b\xde\x10\x1a\xd2\xaf\x57\x43\xfc\x17\x5b\xa1" "\x48\xde\xa0\xb2\x57\x4a\x86\xb6\x1e\x74\x66\x7b\x5d\x06\xe1\x24\x62\x10" "\xf9\x02\xdd\x40\xde\xa0\xcb\x9c\x93\x02\x2a\x05\xce\xfd\x25\x78\xf5\xf3" "\xf3\x95\x9a\x54\xa7\xdd\x7c\x59\x4d\x57\xce\xe2\x91\x18\xb8\x50\xe8\x1d" "\x52\xa9\x99\x96\xb5\xab\x5c\x4f\xb7\x27\xc1\xd5\xd2\xd8\x3e\xf6\x83\x21" "\xab\x93\x87\x36\x0f\x57\x1f\x07\x99\x35\x99\x04\xa0\xd4\x8e\x09\x5b\xee" "\x7a\x37\xd2\xa2\xb1\xf3\xcd\x08\x08\xfd\x13\x3e\xe7\xa7\x77\x16\x89\xeb" "\x59\xe8\x9a\x38\x8f\xfb\x5b\xea\x7e\xd7\x87\x84\xa9\x61\xaf\x18\x41\x13" "\x48\x50\x0d\xec\x61\xba\x10\x01\xa6\x22\x9c\xe3\x60\x17\xe9\xc8\xe4\x89" "\x31\xa6\x57\xee\x81\x29\x59\xc5\xcc\xd5\x09\xdd\x37\x07\x13\x4e\xcc\x0a" "\x2d\x71\x89\x8f\x4b\xbd\x12\x66\x49\x8b\xca\xb3\x41\x1e\x5b\x7a\x60\x3b" "\x0c\xc6\x81\xd3\xfc\x15\x40\xe7\x1a\x1a\xec\x9d\x1f\x7e\x16\x39\x02\x31" "\xd3\x6e\x5a\x14\x01\x4a\x71\xbf\x46\xe5\x52\xc2\xda\xd6\xd4\x1a\x53\xc1" "\x03\x1b\x51\x47\x9b\x20\xd0\xbc\xc3\xa9\xf2\xd6\xa5\xb3\x0d\xde\x2b\xaf" "\x9e\x68\xf5\x3d\x1e\x96\x98\x68\xe4\x6b\x1f\x7d\x66\xb0\x85\x18\x6f\xd7" "\x57\xac\xbd\x4d\xca\x4a\xca\x00\x51\x34\x36\x1d\xfe\xbc\x58\x3e\x7f\x0e" "\x3f\xca\xce\xdd\xb1\xf7\x6d\xe0\x24\xc9\xa4\x71\xb2\x5c\x85\x79\x16\xfb" "\xbd\x35\x86\x1f\x47\x9f\xbe\xc1\xea\xae\x9a\xf3\x7d\xfc\xf0\x5a\xab\xd2" "\x40\xea\x8a\x79\x72\xc4\xda\xda\xc2\xb4\x06\x68\x59\x98\xac\x6f\x5f\x43" "\xc9\x89\x23\x5f\xa1\x8b\x26\xec\x55\x8c\xd7\xe7\xcd\x86\x83\x8f\x15\xef" "\xf1\xcb\x26\xd1\x37\xbf\x57\xdd\x9f\xcb\x7b\x48\x0b\x82\x20\xaf\x6c\xda" "\x07\xfa\xe1\xa1\xc0\x65\xd0\xe7\xe6\x10\x16\x63\x9e\x39\xc5\x60\xbe\x39" "\x3d\x07\x33\x75\x67\x9a\xf9\x19\xb8\xd3\xd5\xfa\xe1\x17\xac\xc6\x57\xae" "\x06\x37\x9f\x52\x0d\xd2\x82\x3d\x53\xaf\xc4\x96\xa3\x32\xeb\x84\xbd\x77" "\x99\x81\x8b\x54\x02\x30\x26\x8c\x23\xc0\x55\x73\x69\x04\x5e\xd3\x52\x56" "\x8d\xdb\x33\xe1\x01\x46\xd4\xb3\x3b\xc1\xe9\x5f\xcf\x12\x9c\xc6\xe3\x97" "\xfa\x0f\x6c\xfb\x46\x2c\x41\xa7\x60\x16\xca\x1c\x3f\xf1\x70\x79\xcd\x0e" "\xfa\xd1\xbb\x29\xd0\xf5\x7c\xdc\x7a\x04\xb1\x42\x03\xde\x2c\x0b\x89\x29" "\x97\x89\xc0\x1b\x06\x3e\x6b\x27\xc1\xe9\xf7\x71\x79\x6a\x9a\xbe\xb7\x03" "\x7b\x3a\x0e\x7a\xaa\xe1\xd9\x49\x32\x2d\xc9\x3e\xcb\xef\x01\xb5\x6d\xc8" "\xf0\x7b\xcd\xb7\x69\x5b\x75\x82\x6a\xbe\xc9\xc0\x76\x58\x33\x17\xa6\x40" "\x7d\xb6\x79\x94\x2d\xbc\xe5\xba\xb4\x63\x92\xdf\x6c\xe3\xe0\xa6\x53\x97" "\x8d\x6c\x5f\x8f\x6b\xb4\x58\x18\x9d\x2d\xc8\xc7\xc6\x9f\x22\xa7\xd8\x2f" "\xbd\xed\x77\x3b\x86\x2f\xbc\x7e\x50\x41\xb2\x6a\xc9\x32\x83\x7a\x70\xca" "\x86\xcb\x22\xd9\xa3\xf5\x0e\xf8\xce\x23\x03\xb0\x2e\x1f\xc6\x6e\x39\xda" "\xd9\x9c\xa6\x0f\x3f\x8d\x4d\x94\xc5\x38\x01\x02\xdb\x74\x4a\xe8\xc3\xff" "\x50\x38\x76\x9b\xfd\x0b\xa6\x8f\x63\xf6\x60\xdc\x04\x0a\xf8\x39\x8e\x6d" "\x3d\x3a\x93\x8b\x5e\x02\x58\xf9\xb3\xb1\x6a\xa0\xf1\x28\xa4\x7b\xae\x62" "\x72\xb3\xfd\xbe\x5e\x60\x28\xe0\xaa\xc0\x34\xd7\xd0\x6f\x29\x2b\x68\xfa" "\xdc\xdc\x7f\x33\xb6\x25\x59\xa2\x05\xb4\x96\x7f\xaf\xcf\xab\x3b\xa6\x0f" "\xc7\x1f\x5e\x95\xd8\x47\x1f\xe8\xee\x4b\xca\xc5\xad\x43\x48\x69\x4a\x2b" "\xc2\x3e\x81\x79\xe6\xf3\x80\xf0\x8d\xf1\xc0\xa1\x29\x13\x6c\x4c\xdd\xd1" "\x34\xdd\x0f\xa0\xf4\x57\x0d\x30\x0d\x66\xa5\x5f\x8d\xe2\xe9\x5b\xcc\xad" "\x35\xe3\xee\x63\x5e\xca\xf9\x3d\x45\x7e\x76\x8e\xf3\x24\xe3\x03\xf9\xe5" "\x7c\xc9\x69\xc4\xc5\xd8\x2e\xec\xff\x34\xc4\x92\x69\xd5\x04\x4c\xc2\xfe" "\xcb\xae\xb0\x0b\x96\xb9\x54\x89\xd9\x8c\xbb\x6d\xf0\x9c\x2e\xd1\x6d\x35" "\x62\x17\xff\xc4\x9b\xcc\x57\x08\x93\xb9\xd5\x08\x24\x96\xfa\xbd\x2b\x7c" "\xc6\x24\x54\x50\x15\x51\x66\x11\x68\x65\xf6\xc9\xdd\x67\x30\xbc\xdd\x40" "\x3e\x70\x98\xa2\x59\x97\xb8\xed\xe0\x42\x97\xbf\x18\x09\x17\x86\x80\x4e" "\xc5\x3a\xcb\xd8\xff\x58\xf6\xa2\xb2\x66\x36\x4e\x32\x43\x7b\xfc\xfd\x78" "\x65\xa6\xba\xfd\x66\x4a\x81\xf2\xe9\xd3\x0e\xdc\x34\xbf\x38\x62\x94\x92" "\x88\x81\xc0\x3a\xe6\x11\x8e\x7b\x08\x97\xea\x0f\xc8\xa0\xc6\x8e\x83\x6b" "\xfe\x68\x47\xff\xef\x99\xf3\xb8\x9a\x04\x69\x13\xf5\x33\x2a\x14\x88\x45" "\x07\xd5\x4f\xc7\x40\xd4\xa6\x2c\xe7\xab\x6f\xc0\xb0\x26\xa2\xf7\x41\x61" "\xea\xc0\xd8\x7b\xa7\xfa\x7b\xc2\xa8\x7a\x52\x71\x8f\x9d\x79\x90\x71\x6c" "\xa0\x77\xf7\xae\x30\x75\xf9\x77\x80\xe4\x48\xac\x84\x07\xcd\xe0\xb8\xb0" "\x03\x44\x45\x7a\x12\x57\x73\xc8\x0b\x2c\xb7\xe4\x9f\xc7\xd8\xc9\x65\x79" "\x1f\x60\x0f\x87\x8d\xd4\x36\x98\x8a\xf8\xb4\xca\xdd\x3f\xe0\x19\x37\xeb" "\x8b\xf2\x3a\x58\xa3\x44\xd7\xc7\xce\x57\x11\x98\xd5\x03\x69\x26\x05\xe4" "\x49\xcd\x98\xb8\x8b\x53\x24\x95\xeb\xca\xb3\xe2\xcb\xbf\xa1\xd5\xd0\x4b" "\x78\x04\xa5\x2b\xc4\x7b\x27\xd5\xab\xc5\x03\xa7\x9a\xb6\x3f\xab\xc6\xfe" "\xc7\xe9\x12\xdc\x1b\xb0\x07\x9f\xaa\x83\x13\x1c\xe2\x6c\x91\xe4\xb1\x00" "\xfb\x97\xa4\x88\x0d\x4c\xc2\x8e\xbc\x00\xcf\x1f\x68\x72\x04\xeb\xe2\xda" "\x9d\xb6\x8a\x70\x9e\x61\xe0\x24\x86\xb9\xa3\x4d\x0a\x88\x3a\xe5\xc1\x81" "\xe1\xf5\xd0\x30\xf9\x95\x98\x76\xb1\x2a\xb9\x58\xa7\xb4\x05\xac\xd8\xa8" "\xb9\xe2\x33\x1a\x09\x4d\xdc\xd2\x2e\x62\x98\x3d\x6a\x9b\x48\x93\x4f\xa4" "\x17\xec\xaa\x26\xaf\x89\x02\xad\xb1\xb0\x22\xe0\xc7\xa7\xfc\x40\xdb\x4d" "\xbe\x40\xea\x4e\xa9\xf9\x6a\xb8\xcc\x77\x33\x0b\xcf\xf0\xde\x18\x0d\xcd" "\x0a\x96\x3e\xd5\xf8\x53\x77\x6e\xf4\x6d\x9a\x21\x85\x48\x5c\x56\x35\xe2" "\x85\x8e\xf5\xb0\xf9\xda\x7e\x83\x6f\xc6\xab\x6b\x79\xa3\xa9\x05\x38\x76" "\x9b\x18\xfb\x04\x6e\x57\x8a\x34\x80\xf1\xb0\x0e\x51\x85\xe7\x18\x92\x2c" "\xe3\x10\xaa\xb7\xf6\xaf\x1b\x03\x7f\x18\x43\xb9\x8f\x29\x98\x9d\x85\x37" "\x29\x8d\x59\xc9\x21\x44\x5f\x5d\x43\x60\xc3\xf3\xf3\x90\xa6\x5d\x72\x97" "\x3e\x90\x8e\x91\xa7\xd0\xd8\x53\x14\x83\x03\x75\x67\xd8\xb7\x34\x99\x41" "\x6e\x24\xcd\x38\x19\x62\x7d\x39\x96\x6d\xfe\x35\xf5\x75\x21\x4d\x38\x88" "\xc9\x51\x3b\x06\xf5\x65\xcd\xee\x8e\x94\x22\x89\x97\x37\x85\xaa\x57\x34" "\x03\xd3\x2f\xd4\x4f\xb7\x3b\xa9\x93\xf1\xfa\x76\x30\x49\x00\xd1\xd0\xf0" "\xaf\xaa\x3e\x41\x16\x1a\x16\x00\x70\xa6\x92\xb6\xe6\x4c\xe9\xd2\x37\xca" "\xc4\x10\xc7\x9d\xeb\x4f\x03\x07\x36\xe5\x71\x48\xb7\x6e\xfc\xbb\x93\xd1" "\x9f\x15\x0a\xbb\x81\x8c\x9e\xe9\x31\xc6\x47\x1e\x60\x1b\x6f\xa6\x79\xa0" "\x78\x2f\xb1\x4c\x9b\x08\x22\x2e\xe3\xd7\x8f\x5a\xde\x5f\x61\xbf\xec\x5d" "\xe5\xb6\xb5\x7f\x52\xa1\xef\x8c\xf1\x32\x69\x8e\xf1\x60\x51\x5f\x4a\x55" "\xd7\x93\x3b\x9e\x82\x81\x0d\xc2\x03\x81\x3f\x4c\xc5\xf8\x46\x9b\xc8\xde" "\x70\x03\x6f\xbd\xfd\x75\x24\x2a\x96\xf3\x6b\xf1\xe5\xff\xc7\x3f\x46\xc3" "\xa0\xb7\xd4\x6f\x61\x04\x8d\x2d\x9a\xb6\xe6\x03\x58\x33\xed\x3a\xde\x90" "\x16\xc6\xf1\xa4\xaf\xe5\x13\x37\xf7\x51\xc3\x04\x5d\xae\x76\x98\x85\xd6" "\xb2\x86\xe4\x7d\x15\x13\xca\xec\xe3\x45\x18\x08\x5e\x4a\x8e\xde\xf0\xd9" "\x72\x2c\x63\x11\x38\xc9\x8a\xd1\x6a\x01\x55\x84\xc1\xae\xb4\xcb\x0c\x4e" "\x57\xed\x59\xe7\x0a\xe1\x02\x36\x6d\x52\xe3\x85\xef\xa4\xed\x5e\x86\xe7" "\xa9\x92\xb9\xee\x09\x15\xe5\x9d\x6a\x4a\x1a\x4f\x1d\x02\x7a\x3a\xf0\x33" "\xa4\xac\x50\xd4\x7e\xf2\xeb\x94\x2c\xa6\xb7\xf4\x0d\x41\xe9\xa6\xbf\x12" "\x7e\x8d\xcd\x8d\xcb\xe3\x9f\x2d\xf6\x1c\xc2\xca\xdd\x86\x68\x6a\xa2\xa3" "\x15\xa7\xb8\x7e\x02\x50\xd9\xeb\x1e\x7f\x27\x76\x8b\xdb\x84\x7e\x04\x75" "\x26\x5b\x5f\xaf\xdb\x7a\x80\xb7\x0e\xa4\xdd\x07\x30\xe9\x4d\x5d\x9a\xc1" "\x36\xba\xa6\x4b\xda\x0d\x63\x1c\x42\xdd\x94\xf7\xc5\x0f\x08\x72\xf8\x8b" "\x57\x81\x40\x22\xb3\xc5\x69\x7e\x74\xb4\x13\x95\xd8\x8b\xf1\x82\xe8\x6f" "\x0b\xaf\xec\xa2\xb7\x85\x9f\xbb\x13\xf4\x78\xd3\x0d\x07\x45\x7c\xd1\xef" "\xc0\x2a\x7a\x5e\x4d\xde\xec\x8d\x09\x48\xa8\xc4\x02\x21\x42\x95\x28\x3f" "\x30\x60\x55\x22\x2d\x29\x15\xa5\x2a\x29\xd7\x6e\x9b\x24\xd4\x18\x19\xd1" "\x8c\x23\x95\xce\x19\x6d\xac\xcc\xa0\xd5\xc1\xe9\x5a\xfd\xef\x03\x59\x9c" "\xc3\xe0\x3d\xc7\x76\x14\x85\x76\x8d\x0f\x78\xd3\x9f\x81\x45\x47\xfc\x20" "\x91\xef\x8f\x7e\xfd\x17\x89\xe4\x03\xa8\x04\xf0\x13\x23\x9f\x9d\x20\x86" "\x31\x68\x48\x66\x99\xfe\x32\xbe\x11\xe6\x28\x9f\xe4\xdb\x12\xb7\x5f\xad" "\xa5\x8a\xd2\xc6\xb3\x04\x53\x83\x84\xac\x3c\xa6\xc9\x7f\x9d\xeb\xa8\x5c" "\xb6\x11\x1c\x2a\x84\x6a\xfd\x5b\x9b\xcc\xb6\xfd\x76\xfd\x60\xc8\xb9\x70" "\xea\x0c\x36\x24\xc4\x94\x8d\x0d\x1b\x84\x32\xb2\xdd\xe1\x81\x67\x0b\x0a" "\xeb\x1e\x70\xc2\xee\x90\x81\xbf\x74\x45\x8a\x68\xb3\x01\x5a\x6c\x17\x10" "\x3b\x7a\xf7\x2a\x2b\xbc\xf3\x69\x28\x91\x1f\xb7\xc1\x95\x9b\x58\x14\x9d" "\xe1\x81\xae\xbc\xc9\x5d\xe5\xd0\xef\xa1\x04\x46\x2d\xa6\x59\x6c\xf0\x42" "\xc2\x68\xaf\xc5\x4e\xc9\xd4\x72\x44\xe9\xc7\x99\x12\x97\xcb\xf4\xe3\x58" "\x29\x34\x34\xea\x72\x3a\x99\xe3\x0e\x69\x4f\x45\xa5\xc2\x40\x16\xcd\x07" "\x9d\xfe\x70\x7b\x55\x7e\x58\x9d\xd1\x88\x8d\x4b\xbe\x3c\xe4\xd4\xa4\x30" "\xcb\xd4\xf6\xf7\x0f\xeb\xa7\x05\x4d\xe8\x49\x9c\x19\x47\xd9\x0d\xdd\xc4" "\x21\xc6\x28\x61\x27\x9d\x40\x8e\x45\x85\x4b\xa3\xca\x4f\x9e\x4d\x70\x6f" "\x21\x3c\x00\x70\xfa\x25\x28\xf7\xcd\x0e\x8b\x8d\x32\xa7\xa0\x0f\x7c\x41" "\xa4\x49\x29\xb4\x13\xa7\x56\x68\x75\xd6\xd6\xd7\x65\x50\x67\xda\x20\xc8" "\xc8\x0a\xe2\x95\x71\xce\xcb\xc3\x0f\xcf\x7f\xcb\x87\x74\xf4\x83\xe0\x9d" "\x12\x45\xb1\xc7\x5b\xb3\x58\x7f\xfd\xfa\xfd\x58\xa9\xc8\x57\xb9\x4a\x74" "\xbb\xec\xda\x40\x41\xb8\xc9\x0c\x38\x40\xbd\x63\x3c\x53\x6d\xbb\x24\x4d" "\xd0\xbb\x94\xad\x63\xdf\x2e\xe1\x19\x74\xf3\x21\xa2\x68\x83\x5a\x7a\x75" "\xdb\x83\x5c\xce\x52\x4f\x2d\x23\xdf\x1b\xeb\x0c\x5d\xa4\xde\x41\xf3\xba" "\x30\x95\xdc\x55\x20\xc6\x46\xaf\x3f\x35\x8a\x81\x94\xe2\x56\x0d\xe8\x65" "\x4d\x1a\x46\xa8\xcd\xdb\xaf\x1a\x60\xe1\xc8\xaf\x79\xc9\x49\x7b\x84\xa4" "\x6e\xf9\x3b\x4b\xcc\xc8\x0c\xe7\x60\x5f\x0b\xe0\xd5\xa9\xf2\x7d\x7a\xd7" "\x5e\xdb\xd7\xef\x0e\x67\xb9\x5c\x0a\xbe\x18\x03\xfc\x45\x27\xdf\x25\x97" "\xd8\x82\x85\x20\x50\xf7\xb5\x50\xc1\x02\x4e\xb0\x0d\x65\xec\x5e\x40\x42" "\x66\xa7\xf3\xbb\x7e\x97\xf2\xe0\x5a\xdc\x1c\xd5\xfe\xb4\xa6\x1d\xeb\xbf" "\x4e\x25\xe7\xd9\x79\xd3\xfe\x40\xd5\xf4\x62\xe8\xa9\x7f\x57\xc0\x93\xb4" "\x1b\x41\xe1\x64\xa4\xbd\x59\xec\xac\x48\x00\x3e\x10\xa3\x25\x0a\x72\x51" "\x12\xd9\xee\x95\xf1\x13\x05\xd2\xb0\x1a\x7a\xb5\x7d\x96\x3c\x1e\x49\x57" "\x94\x1c\xfd\xb8\x3d\xa1\x87\x20\xae\x9c\xe4\x47\xc5\x96\x02\xdf\xae\xb4" "\xb9\x0c\x55\xd1\x52\x8a\x59\x74\xf0\x0d\x58\x38\x0e\xaf\x2c\xdc\x97\x22" "\xad\xf5\x42\x3c\x6e\x88\x36\xf7\xd8\x2c\x98\x17\xcb\x8a\x7c\x3f\x97\x70" "\x26\xf7\x40\x5c\xc1\x9c\x2a\x9b\xb6\xb9\x0f\x92\xdd\x81\x43\x79\x1b\xe4" "\xd0\xa9\xc4\x5e\xcb\x0c\x80\x03\x61\x73\x28\x15\x94\x85\x11\x32\xe7\x81" "\x72\x04\x59\xdf\x2c\x60\xbf\x65\x72\xcc\xc0\xff\xa2\x1d\x74\xa5\x0b\x78" "\x3f\x25\x79\x42\x7c\x04\xf5\x04\xa1\x59\x66\x9f\xe2\x30\x0c\x67\xa8\x09" "\x12\x3b\xe8\xd2\xc6\x83\x4f\x96\x5a\x4d\x05\x08\x3e\x7e\xc1\x95\xf3\xcd" "\xe5\x82\xff\x0a\xc5\xf1\x48\x42\xc5\x6c\xaf\x19\xd0\xf6\xec\x0c\xce\xb7" "\x11\x08\xe5\x7a\x5f\x09\xa2\xeb\x49\x3b\xc4\x15\xc9\x04\x22\x6d\x07\x15" "\x70\xa7\x56\x4d\xc8\x10\x89\x04\xf8\x10\xbc\xd9\x12\x89\x2a\x04\x90\x18" "\x1a\x34\xac\x8f\x38\x12\x72\x40\x2d\x8d\x39\x6e\x79\xfd\x57\xac\x70\x70" "\x7b\xd0\x90\x3e\xc7\xec\x1f\xa6\x7a\x57\xac\xc5\x37\x25\x50\x59\x44\xa5" "\x89\x68\x26\x60\x2b\xa8\xfd\xb7\x55\x25\xe0\x90\xa0\x2a\x72\x45\x8e\x98" "\x45\x0c\x35\x20\x42\x3e\xda\x97\xd5\x45", 4096); *(uint64_t*)0x200000002cd8 = 0x1000; *(uint64_t*)0x200000002ce0 = 0x200000002c80; memcpy((void*)0x200000002c80, "\x17\xb3\xee\x12\x92\x9d\xa2\xf4\x66\xa5\x8b\x03\xfb\xdd\x6b\xf5\x53" "\xcd\xaf\x1b\xbc\x8d\x12\xcb\x55\xba\x06\xf5\x9e\x6e\x6c\xd2\x32\x81", 34); *(uint64_t*)0x200000002ce8 = 0x22; *(uint64_t*)0x200000002d18 = 3; *(uint64_t*)0x200000002d20 = 0; *(uint64_t*)0x200000002d28 = 0; *(uint32_t*)0x200000002d30 = 0; syscall(__NR_sendmsg, /*fd=*/(intptr_t)-1, /*msg=*/0x200000002d00ul, /*f=*/0ul); // syz_genetlink_get_family_id$ethtool arguments: [ // name: ptr[in, buffer] { // buffer: {65 74 68 74 6f 6f 6c 00} (length 0x8) // } // fd: sock_nl_generic (resource) // ] // returns genl_ethtool_family_id memcpy((void*)0x200000000040, "ethtool\000", 8); syz_genetlink_get_family_id(/*name=*/0x200000000040, /*fd=*/-1); // sendmsg$ETHTOOL_MSG_DEBUG_SET arguments: [ // fd: sock_nl_generic (resource) // msg: ptr[in, msghdr_netlink[netlink_msg_t[genl_ethtool_family_id, // genlmsghdr_t[ETHTOOL_MSG_DEBUG_SET], ethnl_debug_set_policy]]] { // msghdr_netlink[netlink_msg_t[genl_ethtool_family_id, // genlmsghdr_t[ETHTOOL_MSG_DEBUG_SET], ethnl_debug_set_policy]] { // addr: ptr[in, sockaddr_nl_t[AF_NETLINK, const[0, int32], // flags[netlink_group_bitmap, int32]]] { // sockaddr_nl_t[AF_NETLINK, const[0, int32], // flags[netlink_group_bitmap, int32]] { // nl_family: const = 0x10 (2 bytes) // nl_pad: const = 0x0 (2 bytes) // nl_pid: const = 0x0 (4 bytes) // nl_groups: netlink_group_bitmap = 0x80 (4 bytes) // } // } // addrlen: len = 0xc (4 bytes) // pad = 0x0 (4 bytes) // vec: nil // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x20000040 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x200000001c40 = 0x200000000000; *(uint16_t*)0x200000000000 = 0x10; *(uint16_t*)0x200000000002 = 0; *(uint32_t*)0x200000000004 = 0; *(uint32_t*)0x200000000008 = 0x80; *(uint32_t*)0x200000001c48 = 0xc; *(uint64_t*)0x200000001c50 = 0; *(uint64_t*)0x200000001c58 = 1; *(uint64_t*)0x200000001c60 = 0; *(uint64_t*)0x200000001c68 = 0; *(uint32_t*)0x200000001c70 = 0x20000040; syscall(__NR_sendmsg, /*fd=*/r[2], /*msg=*/0x200000001c40ul, /*f=*/0ul); // setsockopt$IP6T_SO_SET_REPLACE arguments: [ // fd: sock_in6 (resource) // level: const = 0x29 (4 bytes) // opt: const = 0x40 (4 bytes) // val: ptr[in, ip6t_replace] { // union ip6t_replace { // filter: ip6t_replace_t["filter", 3, 4, IPT_FILTER_VALID_HOOKS, // ip6t_filter_matches, ip6t_filter_targets, ipt_unused, ipt_hook, // ipt_hook, ipt_hook, ipt_unused, ipt_unused, ipt_hook, ipt_hook, // ipt_hook, ipt_unused] { // name: buffer: {66 69 6c 74 65 72 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x20) // valid_hooks: const = 0xe (4 bytes) // num_entries: const = 0x4 (4 bytes) // size: bytesize = 0x340 (4 bytes) // hook_pre_routing: const = 0xffffffff (4 bytes) // hook_local_in: const = 0x0 (4 bytes) // hook_forward: const = 0x1a0 (4 bytes) // hook_local_out: const = 0x270 (4 bytes) // hook_post_routing: const = 0xffffffff (4 bytes) // underflow_pre_routing: const = 0xffffffff (4 bytes) // underflow_local_in: const = 0xd0 (4 bytes) // underflow_forward: const = 0x1a0 (4 bytes) // underflow_local_out: const = 0x270 (4 bytes) // underflow_post_routing: const = 0xffffffff (4 bytes) // num_counters: const = 0x4 (4 bytes) // counters: nil // entries: ip6t_replace_entries[3, ip6t_filter_matches, // ip6t_filter_targets] { // entries: array[ip6t_entry[ip6t_filter_matches, // ip6t_filter_targets]] { // ip6t_entry[ip6t_filter_matches, ip6t_filter_targets] { // matches: ip6t_entry_matches[ip6t_filter_matches] { // ipv6: union ip6t_ip6_or_uncond { // ipv6: ip6t_ip6 { // src: union ipv6_addr { // empty: ipv6_addr_empty { // a0: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00} (length 0x10) // } // } // dst: union ipv6_addr { // empty: ipv6_addr_empty { // a0: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00} (length 0x10) // } // } // smsk: array[ipv4_addr_mask_vals] { // ipv4_addr_mask_vals = 0x0 (4 bytes) // ipv4_addr_mask_vals = 0x0 (4 bytes) // ipv4_addr_mask_vals = 0x0 (4 bytes) // ipv4_addr_mask_vals = 0x0 (4 bytes) // } // dmsk: array[ipv4_addr_mask_vals] { // ipv4_addr_mask_vals = 0x0 (4 bytes) // ipv4_addr_mask_vals = 0x0 (4 bytes) // ipv4_addr_mask_vals = 0x0 (4 bytes) // ipv4_addr_mask_vals = 0x0 (4 bytes) // } // iniface: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00} (length 0x10) outiface: buffer: {00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10) // iniface_mask: devname_mask { // lo: devname_mask_values = 0x0 (1 bytes) // pad = 0x0 (15 bytes) // } // outiface_mask: devname_mask { // lo: devname_mask_values = 0x0 (1 bytes) // pad = 0x0 (15 bytes) // } // proto: ipv6_types = 0x6 (2 bytes) // tos: int8 = 0x0 (1 bytes) // flags: ip6t_ip6_flags = 0x1 (1 bytes) // invflags: ip6t_ip6_invflags = 0x0 (1 bytes) // pad = 0x0 (3 bytes) // } // } // nfcache: const = 0x0 (4 bytes) // target_offset: len = 0xa8 (2 bytes) // next_offset: len = 0xd0 (2 bytes) // comefrom: const = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // counters: xt_counters { // pcnt: const = 0x0 (8 bytes) // bcnt: const = 0x0 (8 bytes) // } // matches: array[ip6t_filter_matches] { // } // } // target: union ip6t_filter_targets { // common: union ip6t_targets { // inet: union xt_inet_targets { // SYNPROXY: xt_target_t["SYNPROXY", xt_synproxy_info, 0] // { // target_size: len = 0x28 (2 bytes) // name: buffer: {53 59 4e 50 52 4f 58 59 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x1d) revision: const = 0x0 (1 bytes) data: // xt_synproxy_info { // options: xt_synproxy_options = 0x1 (1 bytes) // wscale: int8 = 0x7 (1 bytes) // mss: int16 = 0x5a0 (2 bytes) // } // pad = 0x0 (4 bytes) // } // } // } // } // } // ip6t_entry[ip6t_filter_matches, ip6t_filter_targets] { // matches: ip6t_entry_matches[ip6t_filter_matches] { // ipv6: union ip6t_ip6_or_uncond { // uncond: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00} (length 0x88) // } // nfcache: const = 0x0 (4 bytes) // target_offset: len = 0xa8 (2 bytes) // next_offset: len = 0xd0 (2 bytes) // comefrom: const = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // counters: xt_counters { // pcnt: const = 0x0 (8 bytes) // bcnt: const = 0x0 (8 bytes) // } // matches: array[ip6t_filter_matches] { // } // } // target: union ip6t_filter_targets { // common: union ip6t_targets { // unspec: union xt_unspec_targets { // STANDARD: xt_target_t["", flags[nf_verdicts, int32], // 0] { // target_size: len = 0x28 (2 bytes) // name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x1d) revision: const = 0x0 (1 bytes) data: // nf_verdicts = 0xfffffffe (4 bytes) pad = 0x0 (4 // bytes) // } // } // } // } // } // ip6t_entry[ip6t_filter_matches, ip6t_filter_targets] { // matches: ip6t_entry_matches[ip6t_filter_matches] { // ipv6: union ip6t_ip6_or_uncond { // uncond: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00} (length 0x88) // } // nfcache: const = 0x0 (4 bytes) // target_offset: len = 0xa8 (2 bytes) // next_offset: len = 0xd0 (2 bytes) // comefrom: const = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // counters: xt_counters { // pcnt: const = 0x0 (8 bytes) // bcnt: const = 0x0 (8 bytes) // } // matches: array[ip6t_filter_matches] { // } // } // target: union ip6t_filter_targets { // common: union ip6t_targets { // unspec: union xt_unspec_targets { // STANDARD: xt_target_t["", flags[nf_verdicts, int32], // 0] { // target_size: len = 0x28 (2 bytes) // name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} // (length 0x1d) revision: const = 0x0 (1 bytes) data: // nf_verdicts = 0xfffffffe (4 bytes) pad = 0x0 (4 // bytes) // } // } // } // } // } // } // underflow: ip6t_entry_underflow { // matches: ip6t_entry_underflow_matches { // ipv6: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00} (length 0x88) nfcache: const = 0x0 (4 bytes) // target_offset: len = 0xa8 (2 bytes) // next_offset: len = 0xd0 (2 bytes) // comefrom: const = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // counters: xt_counters { // pcnt: const = 0x0 (8 bytes) // bcnt: const = 0x0 (8 bytes) // } // } // target: xt_target_t["", const[NF_ACCEPT_VERDICT, int32], 0] { // target_size: len = 0x28 (2 bytes) // name: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 // 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x1d) // revision: const = 0x0 (1 bytes) // data: const = 0xfffffffe (4 bytes) // pad = 0x0 (4 bytes) // } // } // } // } // } // } // len: len = 0x3a0 (8 bytes) // ] memcpy((void*)0x200000000100, "filter\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000\000\000\000\000\000", 32); *(uint32_t*)0x200000000120 = 0xe; *(uint32_t*)0x200000000124 = 4; *(uint32_t*)0x200000000128 = 0x340; *(uint32_t*)0x20000000012c = -1; *(uint32_t*)0x200000000130 = 0; *(uint32_t*)0x200000000134 = 0x1a0; *(uint32_t*)0x200000000138 = 0x270; *(uint32_t*)0x20000000013c = -1; *(uint32_t*)0x200000000140 = -1; *(uint32_t*)0x200000000144 = 0xd0; *(uint32_t*)0x200000000148 = 0x1a0; *(uint32_t*)0x20000000014c = 0x270; *(uint32_t*)0x200000000150 = -1; *(uint32_t*)0x200000000154 = 4; *(uint64_t*)0x200000000158 = 0; memset((void*)0x200000000160, 0, 16); memset((void*)0x200000000170, 0, 16); *(uint32_t*)0x200000000180 = htobe32(0); *(uint32_t*)0x200000000184 = htobe32(0); *(uint32_t*)0x200000000188 = htobe32(0); *(uint32_t*)0x20000000018c = htobe32(0); *(uint32_t*)0x200000000190 = htobe32(0); *(uint32_t*)0x200000000194 = htobe32(0); *(uint32_t*)0x200000000198 = htobe32(0); *(uint32_t*)0x20000000019c = htobe32(0); memset((void*)0x2000000001a0, 0, 16); memset((void*)0x2000000001b0, 0, 16); *(uint8_t*)0x2000000001c0 = 0; *(uint8_t*)0x2000000001d0 = 0; *(uint16_t*)0x2000000001e0 = 6; *(uint8_t*)0x2000000001e2 = 0; *(uint8_t*)0x2000000001e3 = 1; *(uint8_t*)0x2000000001e4 = 0; *(uint32_t*)0x2000000001e8 = 0; *(uint16_t*)0x2000000001ec = 0xa8; *(uint16_t*)0x2000000001ee = 0xd0; *(uint32_t*)0x2000000001f0 = 0; *(uint64_t*)0x2000000001f8 = 0; *(uint64_t*)0x200000000200 = 0; *(uint16_t*)0x200000000208 = 0x28; memcpy((void*)0x20000000020a, "SYNPROXY\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" "\000\000\000\000\000\000", 29); *(uint8_t*)0x200000000227 = 0; *(uint8_t*)0x200000000228 = 1; *(uint8_t*)0x200000000229 = 7; *(uint16_t*)0x20000000022a = 0x5a0; memset((void*)0x200000000230, 0, 136); *(uint32_t*)0x2000000002b8 = 0; *(uint16_t*)0x2000000002bc = 0xa8; *(uint16_t*)0x2000000002be = 0xd0; *(uint32_t*)0x2000000002c0 = 0; *(uint64_t*)0x2000000002c8 = 0; *(uint64_t*)0x2000000002d0 = 0; *(uint16_t*)0x2000000002d8 = 0x28; memset((void*)0x2000000002da, 0, 29); *(uint8_t*)0x2000000002f7 = 0; *(uint32_t*)0x2000000002f8 = 0xfffffffe; memset((void*)0x200000000300, 0, 136); *(uint32_t*)0x200000000388 = 0; *(uint16_t*)0x20000000038c = 0xa8; *(uint16_t*)0x20000000038e = 0xd0; *(uint32_t*)0x200000000390 = 0; *(uint64_t*)0x200000000398 = 0; *(uint64_t*)0x2000000003a0 = 0; *(uint16_t*)0x2000000003a8 = 0x28; memset((void*)0x2000000003aa, 0, 29); *(uint8_t*)0x2000000003c7 = 0; *(uint32_t*)0x2000000003c8 = 0xfffffffe; memset((void*)0x2000000003d0, 0, 136); *(uint32_t*)0x200000000458 = 0; *(uint16_t*)0x20000000045c = 0xa8; *(uint16_t*)0x20000000045e = 0xd0; *(uint32_t*)0x200000000460 = 0; *(uint64_t*)0x200000000468 = 0; *(uint64_t*)0x200000000470 = 0; *(uint16_t*)0x200000000478 = 0x28; memset((void*)0x20000000047a, 0, 29); *(uint8_t*)0x200000000497 = 0; *(uint32_t*)0x200000000498 = 0xfffffffe; syscall(__NR_setsockopt, /*fd=*/r[0], /*level=*/0x29, /*opt=*/0x40, /*val=*/0x200000000100ul, /*len=*/0x3a0ul); // syz_emit_ethernet arguments: [ // len: len = 0x4a (8 bytes) // packet: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {aa aa aa aa aa aa aa aa aa aa aa bb 86 dd 60 00 // 00 20 00 14 33 40 fe 80 00 00 00 00 00 00 00 00 00 00 00 00 00 bb // fe 80 00 00 00 00 00 00 00 00 00 00 00 00 00 aa} (length 0x36) // } // } // } // frags: nil // ] memcpy((void*)0x200000000500, "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xbb\x86\xdd\x60\x00\x00" "\x20\x00\x14\x33\x40\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\xbb\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\xaa", 54); syz_emit_ethernet(/*len=*/0x4a, /*packet=*/0x200000000500, /*frags=*/0); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; do_sandbox_none(); return 0; }