syzbot

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision	Error
57e7d91c-dd09-44ba-9bd8-f414457d7638	repro		❓	KASAN: null-ptr-deref Read in drop_buffers (5)	2026/03/07 05:28	2026/03/07 05:28	2026/03/07 05:40	31e9c887f7dc24e04b3ca70d0d54fc34141844b0

repro

❓

KASAN: null-ptr-deref Read in drop_buffers (5)

2026/03/07 05:28

2026/03/07 05:40

31e9c887f7dc24e04b3ca70d0d54fc34141844b0

r0 = syz_mount_image$ntfs(&(0x7f0000000100)='ntfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "eb52904e5446532020202020000208000000000000f800003f00ff00000000008000800000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r1 = syz_mount_image$hfsplus(&(0x7f0000000100)='hfsplus\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "482b0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r2 = syz_mount_image$reiserfs(&(0x7f0000000100)='reiserfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000003452654973457246730000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r3 = syz_mount_image$jfs(&(0x7f0000000100)='jfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "4a465331000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r4 = syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "01161970000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r5 = syz_mount_image$nilfs2(&(0x7f0000000100)='nilfs2\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000003434180000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r6 = syz_mount_image$udf(&(0x7f0000000100)='udf\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r7 = syz_mount_image$iso9660(&(0x7f0000000100)='iso9660\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "01434430303101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00')

================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline] BUG: KASAN: null-ptr-deref in buffer_busy fs/buffer.c:2886 [inline] BUG: KASAN: null-ptr-deref in drop_buffers.constprop.0+0x89/0x340 fs/buffer.c:2898 Read of size 4 at addr 0000000000000060 by task kswapd0/85 CPU: 1 UID: 0 PID: 85 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 kasan_report+0xe0/0x110 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:194 [inline] kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:200 instrument_atomic_read include/linux/instrumented.h:68 [inline] atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline] buffer_busy fs/buffer.c:2886 [inline] drop_buffers.constprop.0+0x89/0x340 fs/buffer.c:2898 try_to_free_buffers+0x21c/0x2d0 fs/buffer.c:2952 filemap_release_folio+0x219/0x280 mm/filemap.c:4423 shrink_folio_list+0x28a5/0x4800 mm/vmscan.c:1519 evict_folios+0x79c/0x1b30 mm/vmscan.c:4745 try_to_shrink_lruvec+0x585/0x9b0 mm/vmscan.c:4908 shrink_one+0x3e3/0x7a0 mm/vmscan.c:4953 shrink_many mm/vmscan.c:5016 [inline] lru_gen_shrink_node mm/vmscan.c:5094 [inline] shrink_node+0x26cb/0x3d80 mm/vmscan.c:6081 kswapd_shrink_node mm/vmscan.c:6941 [inline] balance_pgdat+0xbb8/0x1a50 mm/vmscan.c:7124 kswapd+0x590/0xb90 mm/vmscan.c:7389 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> ==================================================================

Trajectory:
Seq	Timestamp	Type	Name	Duration
0/0	2026/03/07 05:28	flow	repro	12m Results: map[ReproOpts: ReproSyz:r0 = syz_mount_image$ntfs(&(0x7f0000000100)='ntfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "eb52904e5446532020202020000208000000000000f800003f00ff00000000008000800000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r1 = syz_mount_image$hfsplus(&(0x7f0000000100)='hfsplus\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "482b0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r2 = syz_mount_image$reiserfs(&(0x7f0000000100)='reiserfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000003452654973457246730000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r3 = syz_mount_image$jfs(&(0x7f0000000100)='jfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "4a465331000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r4 = syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "01161970000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r5 = syz_mount_image$nilfs2(&(0x7f0000000100)='nilfs2\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000003434180000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r6 = syz_mount_image$udf(&(0x7f0000000100)='udf\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r7 = syz_mount_image$iso9660(&(0x7f0000000100)='iso9660\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "01434430303101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]
1/1	2026/03/07 05:28	action	provide-var	0m Results: map[DescriptionFiles:[acpi_thermal_rel.txt aio.txt auto.txt binfmt.txt bpf.txt bpf_prog.txt bpf_trace.txt cgroup.txt damon.txt dev_ashmem.txt dev_bifrost.txt dev_binder.txt dev_binderfs.txt dev_block.txt dev_bsg.txt dev_bus_usb.txt dev_camx.txt dev_cdrom.txt dev_cec.txt dev_char_usb.txt dev_comedi.txt dev_dma_heap.txt dev_dri.txt dev_dsp.txt dev_dvb_demux.txt dev_dvb_dvr.txt dev_dvb_frontend.txt dev_fb.txt dev_floppy.txt dev_hidraw.txt dev_i2c.txt dev_i915.txt dev_img_rogue.txt dev_infiniband_rdma.txt dev_infiniband_rdma_cm.txt dev_input.txt dev_iommu.txt dev_kvm.txt dev_kvm_amd64.txt dev_kvm_arm64.txt dev_kvm_extra.txt dev_kvm_riscv64.txt dev_loop.txt dev_mali.txt dev_media.txt dev_msm.txt dev_msr.txt dev_nbd.txt dev_net_tun.txt dev_panthor.txt dev_ppp.txt dev_ptmx.txt dev_ptp.txt dev_qat_adf_ctl.txt dev_qrtr_tun.txt dev_random.txt dev_rfkill.txt dev_rtc.txt dev_sequencer.txt dev_sg.txt dev_snapshot.txt dev_snd_control.txt dev_snd_hw.txt dev_snd_midi.txt dev_snd_pcm.txt dev_snd_seq.txt dev_snd_timer.txt dev_sr.txt dev_sw_sync.txt dev_tlk_device.txt dev_trusty.txt dev_udmabuf.txt dev_uhid.txt dev_uinput.txt dev_usb_hiddev.txt dev_usbmon.txt dev_userio.txt dev_vfio.txt dev_vga_arbiter.txt dev_vhci.txt dev_video4linux.txt dev_video4linux_vim2m.txt dev_virtual_nci.txt dev_vtpm.txt fanotify.txt filesystem.txt fs_9p.txt fs_fuse.txt fs_incfs.txt fs_ioctl.txt fs_ioctl_autofs.txt fs_ioctl_btrfs.txt fs_ioctl_ext4.txt fs_ioctl_f2fs.txt fs_ioctl_fat.txt fs_ioctl_fscrypt.txt fs_ioctl_fsverity.txt fs_ioctl_xfs.txt futex.txt hafnium.txt inotify.txt io_uring.txt ipc.txt key.txt kfuzztest.txt l2cap.txt landlock.txt lsm.txt namespaces.txt net_80211.txt netfilter.txt netfilter_arp.txt netfilter_bridge.txt netfilter_ipv4.txt netfilter_ipv6.txt netfilter_ipvs.txt netfilter_targets.txt pagemap_ioctl.txt perf.txt prctl.txt quotactl.txt seccomp.txt security_apparmor.txt security_selinux.txt security_smack.txt socket.txt socket_alg.txt socket_ax25.txt socket_bluetooth.txt socket_caif.txt socket_can.txt socket_ieee802154.txt socket_inet.txt socket_inet6.txt socket_inet_dccp.txt socket_inet_icmp.txt socket_inet_igmp.txt socket_inet_l2tp.txt socket_inet_sctp.txt socket_inet_tcp.txt socket_inet_udp.txt socket_ip_tunnel.txt socket_isdn.txt socket_kcm.txt socket_key.txt socket_llc.txt socket_netlink.txt socket_netlink_audit.txt socket_netlink_crypto.txt socket_netlink_generic.txt socket_netlink_generic_80211.txt socket_netlink_generic_batadv.txt socket_netlink_generic_devlink.txt socket_netlink_generic_ethtool.txt socket_netlink_generic_fou.txt socket_netlink_generic_gtp.txt socket_netlink_generic_mptcp.txt socket_netlink_generic_net_dm.txt socket_netlink_generic_netlabel.txt socket_netlink_generic_nfc.txt socket_netlink_generic_seg6.txt socket_netlink_generic_smc.txt socket_netlink_generic_team.txt socket_netlink_generic_wireguard.txt socket_netlink_netfilter.txt socket_netlink_netfilter_acct.txt socket_netlink_netfilter_conntrack.txt socket_netlink_netfilter_conntrack_exp.txt socket_netlink_netfilter_conntrack_helper.txt socket_netlink_netfilter_ipset.txt socket_netlink_netfilter_log.txt socket_netlink_netfilter_nft_compat.txt socket_netlink_netfilter_nftables.txt socket_netlink_netfilter_osf.txt socket_netlink_netfilter_queue.txt socket_netlink_netfilter_timeout.txt socket_netlink_rdma.txt socket_netlink_route.txt socket_netlink_route_sched.txt socket_netlink_route_sched_retired.txt socket_netlink_sock_diag.txt socket_netlink_xfrm.txt socket_netrom.txt socket_nfc.txt socket_nvme_of_tcp.txt socket_packet.txt socket_phonet.txt socket_pppox.txt socket_qipcrtr.txt socket_rds.txt socket_rose.txt socket_rxrpc.txt socket_tipc.txt socket_tipc_netlink.txt socket_unix.txt socket_vnet.txt socket_x25.txt socket_xdp.txt sys.txt uffd.txt usbip.txt vmw_vmci.txt vnet.txt vnet_mptcp.txt vusb.txt watch_queue.txt xattr.txt] SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]
2/1	2026/03/07 05:28	action	kernel-checkouter	0m Results: map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/9e0ba73ced41300be62f05c3f33945086933cf79]
3/1	2026/03/07 05:29	action	kernel-builder	6m Results: map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/c41c72a11afa6b467c8b8e92565171b658accdaf]
4/1	2026/03/07 05:35	agent	crash-repro-finder	5m Model: gemini-3-pro-preview Results: map[ReproOpts:] Instruction: You are an expert in linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug. Print only the syz program that could be executed directly, without backticks. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Bug Title: KASAN: null-ptr-deref Read in drop_buffers Original Crash Report: ================================================================== BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline] BUG: KASAN: null-ptr-deref in buffer_busy fs/buffer.c:2886 [inline] BUG: KASAN: null-ptr-deref in drop_buffers.constprop.0+0x89/0x340 fs/buffer.c:2898 Read of size 4 at addr 0000000000000060 by task kswapd0/85 CPU: 1 UID: 0 PID: 85 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 kasan_report+0xe0/0x110 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:194 [inline] kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:200 instrument_atomic_read include/linux/instrumented.h:68 [inline] atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline] buffer_busy fs/buffer.c:2886 [inline] drop_buffers.constprop.0+0x89/0x340 fs/buffer.c:2898 try_to_free_buffers+0x21c/0x2d0 fs/buffer.c:2952 filemap_release_folio+0x219/0x280 mm/filemap.c:4423 shrink_folio_list+0x28a5/0x4800 mm/vmscan.c:1519 evict_folios+0x79c/0x1b30 mm/vmscan.c:4745 try_to_shrink_lruvec+0x585/0x9b0 mm/vmscan.c:4908 shrink_one+0x3e3/0x7a0 mm/vmscan.c:4953 shrink_many mm/vmscan.c:5016 [inline] lru_gen_shrink_node mm/vmscan.c:5094 [inline] shrink_node+0x26cb/0x3d80 mm/vmscan.c:6081 kswapd_shrink_node mm/vmscan.c:6941 [inline] balance_pgdat+0xbb8/0x1a50 mm/vmscan.c:7124 kswapd+0x590/0xb90 mm/vmscan.c:7389 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> ================================================================== The list of existing description files: acpi_thermal_rel.txt aio.txt auto.txt binfmt.txt bpf.txt bpf_prog.txt bpf_trace.txt cgroup.txt damon.txt dev_ashmem.txt dev_bifrost.txt dev_binder.txt dev_binderfs.txt dev_block.txt dev_bsg.txt dev_bus_usb.txt dev_camx.txt dev_cdrom.txt dev_cec.txt dev_char_usb.txt dev_comedi.txt dev_dma_heap.txt dev_dri.txt dev_dsp.txt dev_dvb_demux.txt dev_dvb_dvr.txt dev_dvb_frontend.txt dev_fb.txt dev_floppy.txt dev_hidraw.txt dev_i2c.txt dev_i915.txt dev_img_rogue.txt dev_infiniband_rdma.txt dev_infiniband_rdma_cm.txt dev_input.txt dev_iommu.txt dev_kvm.txt dev_kvm_amd64.txt dev_kvm_arm64.txt dev_kvm_extra.txt dev_kvm_riscv64.txt dev_loop.txt dev_mali.txt dev_media.txt dev_msm.txt dev_msr.txt dev_nbd.txt dev_net_tun.txt dev_panthor.txt dev_ppp.txt dev_ptmx.txt dev_ptp.txt dev_qat_adf_ctl.txt dev_qrtr_tun.txt dev_random.txt dev_rfkill.txt dev_rtc.txt dev_sequencer.txt dev_sg.txt dev_snapshot.txt dev_snd_control.txt dev_snd_hw.txt dev_snd_midi.txt dev_snd_pcm.txt dev_snd_seq.txt dev_snd_timer.txt dev_sr.txt dev_sw_sync.txt dev_tlk_device.txt dev_trusty.txt dev_udmabuf.txt dev_uhid.txt dev_uinput.txt dev_usb_hiddev.txt dev_usbmon.txt dev_userio.txt dev_vfio.txt dev_vga_arbiter.txt dev_vhci.txt dev_video4linux.txt dev_video4linux_vim2m.txt dev_virtual_nci.txt dev_vtpm.txt fanotify.txt filesystem.txt fs_9p.txt fs_fuse.txt fs_incfs.txt fs_ioctl.txt fs_ioctl_autofs.txt fs_ioctl_btrfs.txt fs_ioctl_ext4.txt fs_ioctl_f2fs.txt fs_ioctl_fat.txt fs_ioctl_fscrypt.txt fs_ioctl_fsverity.txt fs_ioctl_xfs.txt futex.txt hafnium.txt inotify.txt io_uring.txt ipc.txt key.txt kfuzztest.txt l2cap.txt landlock.txt lsm.txt namespaces.txt net_80211.txt netfilter.txt netfilter_arp.txt netfilter_bridge.txt netfilter_ipv4.txt netfilter_ipv6.txt netfilter_ipvs.txt netfilter_targets.txt pagemap_ioctl.txt perf.txt prctl.txt quotactl.txt seccomp.txt security_apparmor.txt security_selinux.txt security_smack.txt socket.txt socket_alg.txt socket_ax25.txt socket_bluetooth.txt socket_caif.txt socket_can.txt socket_ieee802154.txt socket_inet.txt socket_inet6.txt socket_inet_dccp.txt socket_inet_icmp.txt socket_inet_igmp.txt socket_inet_l2tp.txt socket_inet_sctp.txt socket_inet_tcp.txt socket_inet_udp.txt socket_ip_tunnel.txt socket_isdn.txt socket_kcm.txt socket_key.txt socket_llc.txt socket_netlink.txt socket_netlink_audit.txt socket_netlink_crypto.txt socket_netlink_generic.txt socket_netlink_generic_80211.txt socket_netlink_generic_batadv.txt socket_netlink_generic_devlink.txt socket_netlink_generic_ethtool.txt socket_netlink_generic_fou.txt socket_netlink_generic_gtp.txt socket_netlink_generic_mptcp.txt socket_netlink_generic_net_dm.txt socket_netlink_generic_netlabel.txt socket_netlink_generic_nfc.txt socket_netlink_generic_seg6.txt socket_netlink_generic_smc.txt socket_netlink_generic_team.txt socket_netlink_generic_wireguard.txt socket_netlink_netfilter.txt socket_netlink_netfilter_acct.txt socket_netlink_netfilter_conntrack.txt socket_netlink_netfilter_conntrack_exp.txt socket_netlink_netfilter_conntrack_helper.txt socket_netlink_netfilter_ipset.txt socket_netlink_netfilter_log.txt socket_netlink_netfilter_nft_compat.txt socket_netlink_netfilter_nftables.txt socket_netlink_netfilter_osf.txt socket_netlink_netfilter_queue.txt socket_netlink_netfilter_timeout.txt socket_netlink_rdma.txt socket_netlink_route.txt socket_netlink_route_sched.txt socket_netlink_route_sched_retired.txt socket_netlink_sock_diag.txt socket_netlink_xfrm.txt socket_netrom.txt socket_nfc.txt socket_nvme_of_tcp.txt socket_packet.txt socket_phonet.txt socket_pppox.txt socket_qipcrtr.txt socket_rds.txt socket_rose.txt socket_rxrpc.txt socket_tipc.txt socket_tipc_netlink.txt socket_unix.txt socket_vnet.txt socket_x25.txt socket_xdp.txt sys.txt uffd.txt usbip.txt vmw_vmci.txt vnet.txt vnet_mptcp.txt vusb.txt watch_queue.txt xattr.txt Reply: r0 = syz_mount_image$ntfs(&(0x7f0000000100)='ntfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "eb52904e5446532020202020000208000000000000f800003f00ff00000000008000800000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r1 = syz_mount_image$hfsplus(&(0x7f0000000100)='hfsplus\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "482b0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r2 = syz_mount_image$reiserfs(&(0x7f0000000100)='reiserfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000003452654973457246730000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r3 = syz_mount_image$jfs(&(0x7f0000000100)='jfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "4a465331000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r4 = syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "01161970000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r5 = syz_mount_image$nilfs2(&(0x7f0000000100)='nilfs2\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000003434180000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r6 = syz_mount_image$udf(&(0x7f0000000100)='udf\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00') r7 = syz_mount_image$iso9660(&(0x7f0000000100)='iso9660\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "01434430303101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}]) umount(&(0x7f0000000200)='./mnt\x00')
5/2	2026/03/07 05:35	llm	crash-repro-finder	5m Model: gemini-3-pro-preview Tokens: input: 2776 output: 17 thoughts: 35747
6/2	2026/03/07 05:40	tool	set-results	0m Args: map[ReproOpts:] Results: map[ReproOpts:]
7/2	2026/03/07 05:40	llm	crash-repro-finder	0m Model: gemini-3-pro-preview Tokens: input: 38555 output: 2164 thoughts: 0

Trajectory:

Seq

Timestamp

Type

Name

Duration

0/0

2026/03/07 05:28

flow

repro

12m

Results:

map[ReproOpts: ReproSyz:r0 = syz_mount_image$ntfs(&(0x7f0000000100)='ntfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "eb52904e5446532020202020000208000000000000f800003f00ff00000000008000800000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r1 = syz_mount_image$hfsplus(&(0x7f0000000100)='hfsplus\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "482b0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r2 = syz_mount_image$reiserfs(&(0x7f0000000100)='reiserfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000003452654973457246730000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r3 = syz_mount_image$jfs(&(0x7f0000000100)='jfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "4a465331000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r4 = syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "01161970000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r5 = syz_mount_image$nilfs2(&(0x7f0000000100)='nilfs2\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000003434180000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r6 = syz_mount_image$udf(&(0x7f0000000100)='udf\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r7 = syz_mount_image$iso9660(&(0x7f0000000100)='iso9660\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "01434430303101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
 SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]

1/1

2026/03/07 05:28

action

provide-var

Results:

map[DescriptionFiles:[acpi_thermal_rel.txt aio.txt auto.txt binfmt.txt bpf.txt bpf_prog.txt bpf_trace.txt cgroup.txt damon.txt dev_ashmem.txt dev_bifrost.txt dev_binder.txt dev_binderfs.txt dev_block.txt dev_bsg.txt dev_bus_usb.txt dev_camx.txt dev_cdrom.txt dev_cec.txt dev_char_usb.txt dev_comedi.txt dev_dma_heap.txt dev_dri.txt dev_dsp.txt dev_dvb_demux.txt dev_dvb_dvr.txt dev_dvb_frontend.txt dev_fb.txt dev_floppy.txt dev_hidraw.txt dev_i2c.txt dev_i915.txt dev_img_rogue.txt dev_infiniband_rdma.txt dev_infiniband_rdma_cm.txt dev_input.txt dev_iommu.txt dev_kvm.txt dev_kvm_amd64.txt dev_kvm_arm64.txt dev_kvm_extra.txt dev_kvm_riscv64.txt dev_loop.txt dev_mali.txt dev_media.txt dev_msm.txt dev_msr.txt dev_nbd.txt dev_net_tun.txt dev_panthor.txt dev_ppp.txt dev_ptmx.txt dev_ptp.txt dev_qat_adf_ctl.txt dev_qrtr_tun.txt dev_random.txt dev_rfkill.txt dev_rtc.txt dev_sequencer.txt dev_sg.txt dev_snapshot.txt dev_snd_control.txt dev_snd_hw.txt dev_snd_midi.txt dev_snd_pcm.txt dev_snd_seq.txt dev_snd_timer.txt dev_sr.txt dev_sw_sync.txt dev_tlk_device.txt dev_trusty.txt dev_udmabuf.txt dev_uhid.txt dev_uinput.txt dev_usb_hiddev.txt dev_usbmon.txt dev_userio.txt dev_vfio.txt dev_vga_arbiter.txt dev_vhci.txt dev_video4linux.txt dev_video4linux_vim2m.txt dev_virtual_nci.txt dev_vtpm.txt fanotify.txt filesystem.txt fs_9p.txt fs_fuse.txt fs_incfs.txt fs_ioctl.txt fs_ioctl_autofs.txt fs_ioctl_btrfs.txt fs_ioctl_ext4.txt fs_ioctl_f2fs.txt fs_ioctl_fat.txt fs_ioctl_fscrypt.txt fs_ioctl_fsverity.txt fs_ioctl_xfs.txt futex.txt hafnium.txt inotify.txt io_uring.txt ipc.txt key.txt kfuzztest.txt l2cap.txt landlock.txt lsm.txt namespaces.txt net_80211.txt netfilter.txt netfilter_arp.txt netfilter_bridge.txt netfilter_ipv4.txt netfilter_ipv6.txt netfilter_ipvs.txt netfilter_targets.txt pagemap_ioctl.txt perf.txt prctl.txt quotactl.txt seccomp.txt security_apparmor.txt security_selinux.txt security_smack.txt socket.txt socket_alg.txt socket_ax25.txt socket_bluetooth.txt socket_caif.txt socket_can.txt socket_ieee802154.txt socket_inet.txt socket_inet6.txt socket_inet_dccp.txt socket_inet_icmp.txt socket_inet_igmp.txt socket_inet_l2tp.txt socket_inet_sctp.txt socket_inet_tcp.txt socket_inet_udp.txt socket_ip_tunnel.txt socket_isdn.txt socket_kcm.txt socket_key.txt socket_llc.txt socket_netlink.txt socket_netlink_audit.txt socket_netlink_crypto.txt socket_netlink_generic.txt socket_netlink_generic_80211.txt socket_netlink_generic_batadv.txt socket_netlink_generic_devlink.txt socket_netlink_generic_ethtool.txt socket_netlink_generic_fou.txt socket_netlink_generic_gtp.txt socket_netlink_generic_mptcp.txt socket_netlink_generic_net_dm.txt socket_netlink_generic_netlabel.txt socket_netlink_generic_nfc.txt socket_netlink_generic_seg6.txt socket_netlink_generic_smc.txt socket_netlink_generic_team.txt socket_netlink_generic_wireguard.txt socket_netlink_netfilter.txt socket_netlink_netfilter_acct.txt socket_netlink_netfilter_conntrack.txt socket_netlink_netfilter_conntrack_exp.txt socket_netlink_netfilter_conntrack_helper.txt socket_netlink_netfilter_ipset.txt socket_netlink_netfilter_log.txt socket_netlink_netfilter_nft_compat.txt socket_netlink_netfilter_nftables.txt socket_netlink_netfilter_osf.txt socket_netlink_netfilter_queue.txt socket_netlink_netfilter_timeout.txt socket_netlink_rdma.txt socket_netlink_route.txt socket_netlink_route_sched.txt socket_netlink_route_sched_retired.txt socket_netlink_sock_diag.txt socket_netlink_xfrm.txt socket_netrom.txt socket_nfc.txt socket_nvme_of_tcp.txt socket_packet.txt socket_phonet.txt socket_pppox.txt socket_qipcrtr.txt socket_rds.txt socket_rose.txt socket_rxrpc.txt socket_tipc.txt socket_tipc_netlink.txt socket_unix.txt socket_vnet.txt socket_x25.txt socket_xdp.txt sys.txt uffd.txt usbip.txt vmw_vmci.txt vnet.txt vnet_mptcp.txt vusb.txt watch_queue.txt xattr.txt] SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]

2/1

2026/03/07 05:28

action

kernel-checkouter

Results:

map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/9e0ba73ced41300be62f05c3f33945086933cf79]

3/1

2026/03/07 05:29

action

kernel-builder

Results:

map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/c41c72a11afa6b467c8b8e92565171b658accdaf]

4/1

2026/03/07 05:35

agent

crash-repro-finder

Model:

gemini-3-pro-preview

Results:

map[ReproOpts:]

Instruction:

You are an expert in linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug.
Print only the syz program that could be executed directly, without backticks.




Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt:

Bug Title: KASAN: null-ptr-deref Read in drop_buffers

Original Crash Report:
==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: null-ptr-deref in buffer_busy fs/buffer.c:2886 [inline]
BUG: KASAN: null-ptr-deref in drop_buffers.constprop.0+0x89/0x340 fs/buffer.c:2898
Read of size 4 at addr 0000000000000060 by task kswapd0/85

CPU: 1 UID: 0 PID: 85 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 kasan_report+0xe0/0x110 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:194 [inline]
 kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:200
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
 buffer_busy fs/buffer.c:2886 [inline]
 drop_buffers.constprop.0+0x89/0x340 fs/buffer.c:2898
 try_to_free_buffers+0x21c/0x2d0 fs/buffer.c:2952
 filemap_release_folio+0x219/0x280 mm/filemap.c:4423
 shrink_folio_list+0x28a5/0x4800 mm/vmscan.c:1519
 evict_folios+0x79c/0x1b30 mm/vmscan.c:4745
 try_to_shrink_lruvec+0x585/0x9b0 mm/vmscan.c:4908
 shrink_one+0x3e3/0x7a0 mm/vmscan.c:4953
 shrink_many mm/vmscan.c:5016 [inline]
 lru_gen_shrink_node mm/vmscan.c:5094 [inline]
 shrink_node+0x26cb/0x3d80 mm/vmscan.c:6081
 kswapd_shrink_node mm/vmscan.c:6941 [inline]
 balance_pgdat+0xbb8/0x1a50 mm/vmscan.c:7124
 kswapd+0x590/0xb90 mm/vmscan.c:7389
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
==================================================================


The list of existing description files:
acpi_thermal_rel.txt
aio.txt
auto.txt
binfmt.txt
bpf.txt
bpf_prog.txt
bpf_trace.txt
cgroup.txt
damon.txt
dev_ashmem.txt
dev_bifrost.txt
dev_binder.txt
dev_binderfs.txt
dev_block.txt
dev_bsg.txt
dev_bus_usb.txt
dev_camx.txt
dev_cdrom.txt
dev_cec.txt
dev_char_usb.txt
dev_comedi.txt
dev_dma_heap.txt
dev_dri.txt
dev_dsp.txt
dev_dvb_demux.txt
dev_dvb_dvr.txt
dev_dvb_frontend.txt
dev_fb.txt
dev_floppy.txt
dev_hidraw.txt
dev_i2c.txt
dev_i915.txt
dev_img_rogue.txt
dev_infiniband_rdma.txt
dev_infiniband_rdma_cm.txt
dev_input.txt
dev_iommu.txt
dev_kvm.txt
dev_kvm_amd64.txt
dev_kvm_arm64.txt
dev_kvm_extra.txt
dev_kvm_riscv64.txt
dev_loop.txt
dev_mali.txt
dev_media.txt
dev_msm.txt
dev_msr.txt
dev_nbd.txt
dev_net_tun.txt
dev_panthor.txt
dev_ppp.txt
dev_ptmx.txt
dev_ptp.txt
dev_qat_adf_ctl.txt
dev_qrtr_tun.txt
dev_random.txt
dev_rfkill.txt
dev_rtc.txt
dev_sequencer.txt
dev_sg.txt
dev_snapshot.txt
dev_snd_control.txt
dev_snd_hw.txt
dev_snd_midi.txt
dev_snd_pcm.txt
dev_snd_seq.txt
dev_snd_timer.txt
dev_sr.txt
dev_sw_sync.txt
dev_tlk_device.txt
dev_trusty.txt
dev_udmabuf.txt
dev_uhid.txt
dev_uinput.txt
dev_usb_hiddev.txt
dev_usbmon.txt
dev_userio.txt
dev_vfio.txt
dev_vga_arbiter.txt
dev_vhci.txt
dev_video4linux.txt
dev_video4linux_vim2m.txt
dev_virtual_nci.txt
dev_vtpm.txt
fanotify.txt
filesystem.txt
fs_9p.txt
fs_fuse.txt
fs_incfs.txt
fs_ioctl.txt
fs_ioctl_autofs.txt
fs_ioctl_btrfs.txt
fs_ioctl_ext4.txt
fs_ioctl_f2fs.txt
fs_ioctl_fat.txt
fs_ioctl_fscrypt.txt
fs_ioctl_fsverity.txt
fs_ioctl_xfs.txt
futex.txt
hafnium.txt
inotify.txt
io_uring.txt
ipc.txt
key.txt
kfuzztest.txt
l2cap.txt
landlock.txt
lsm.txt
namespaces.txt
net_80211.txt
netfilter.txt
netfilter_arp.txt
netfilter_bridge.txt
netfilter_ipv4.txt
netfilter_ipv6.txt
netfilter_ipvs.txt
netfilter_targets.txt
pagemap_ioctl.txt
perf.txt
prctl.txt
quotactl.txt
seccomp.txt
security_apparmor.txt
security_selinux.txt
security_smack.txt
socket.txt
socket_alg.txt
socket_ax25.txt
socket_bluetooth.txt
socket_caif.txt
socket_can.txt
socket_ieee802154.txt
socket_inet.txt
socket_inet6.txt
socket_inet_dccp.txt
socket_inet_icmp.txt
socket_inet_igmp.txt
socket_inet_l2tp.txt
socket_inet_sctp.txt
socket_inet_tcp.txt
socket_inet_udp.txt
socket_ip_tunnel.txt
socket_isdn.txt
socket_kcm.txt
socket_key.txt
socket_llc.txt
socket_netlink.txt
socket_netlink_audit.txt
socket_netlink_crypto.txt
socket_netlink_generic.txt
socket_netlink_generic_80211.txt
socket_netlink_generic_batadv.txt
socket_netlink_generic_devlink.txt
socket_netlink_generic_ethtool.txt
socket_netlink_generic_fou.txt
socket_netlink_generic_gtp.txt
socket_netlink_generic_mptcp.txt
socket_netlink_generic_net_dm.txt
socket_netlink_generic_netlabel.txt
socket_netlink_generic_nfc.txt
socket_netlink_generic_seg6.txt
socket_netlink_generic_smc.txt
socket_netlink_generic_team.txt
socket_netlink_generic_wireguard.txt
socket_netlink_netfilter.txt
socket_netlink_netfilter_acct.txt
socket_netlink_netfilter_conntrack.txt
socket_netlink_netfilter_conntrack_exp.txt
socket_netlink_netfilter_conntrack_helper.txt
socket_netlink_netfilter_ipset.txt
socket_netlink_netfilter_log.txt
socket_netlink_netfilter_nft_compat.txt
socket_netlink_netfilter_nftables.txt
socket_netlink_netfilter_osf.txt
socket_netlink_netfilter_queue.txt
socket_netlink_netfilter_timeout.txt
socket_netlink_rdma.txt
socket_netlink_route.txt
socket_netlink_route_sched.txt
socket_netlink_route_sched_retired.txt
socket_netlink_sock_diag.txt
socket_netlink_xfrm.txt
socket_netrom.txt
socket_nfc.txt
socket_nvme_of_tcp.txt
socket_packet.txt
socket_phonet.txt
socket_pppox.txt
socket_qipcrtr.txt
socket_rds.txt
socket_rose.txt
socket_rxrpc.txt
socket_tipc.txt
socket_tipc_netlink.txt
socket_unix.txt
socket_vnet.txt
socket_x25.txt
socket_xdp.txt
sys.txt
uffd.txt
usbip.txt
vmw_vmci.txt
vnet.txt
vnet_mptcp.txt
vusb.txt
watch_queue.txt
xattr.txt

Reply:

r0 = syz_mount_image$ntfs(&(0x7f0000000100)='ntfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "eb52904e5446532020202020000208000000000000f800003f00ff00000000008000800000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r1 = syz_mount_image$hfsplus(&(0x7f0000000100)='hfsplus\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "482b0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r2 = syz_mount_image$reiserfs(&(0x7f0000000100)='reiserfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000003452654973457246730000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r3 = syz_mount_image$jfs(&(0x7f0000000100)='jfs\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "4a465331000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r4 = syz_mount_image$gfs2(&(0x7f0000000100)='gfs2\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "01161970000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r5 = syz_mount_image$nilfs2(&(0x7f0000000100)='nilfs2\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000003434180000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r6 = syz_mount_image$udf(&(0x7f0000000100)='udf\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')
r7 = syz_mount_image$iso9660(&(0x7f0000000100)='iso9660\x00', &(0x7f0000000200)='./mnt\x00', 0x0, 0x0, 0x0, 0x100000, &(0x7f0000000300)=[{0x0, 0x40, "01434430303101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"}])
umount(&(0x7f0000000200)='./mnt\x00')

5/2

2026/03/07 05:35

llm

crash-repro-finder

Model:

gemini-3-pro-preview

Tokens:

							input: 2776
							output: 17
							thoughts: 35747

6/2

2026/03/07 05:40

tool

set-results

Args:

map[ReproOpts:]

Results:

map[ReproOpts:]

7/2

2026/03/07 05:40

llm

crash-repro-finder

Model:

gemini-3-pro-preview

Tokens:

							input: 38555
							output: 2164
							thoughts: 0