map[SimplifiedCRepro:// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <endian.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <unistd.h>
#ifndef __NR_connect
#define __NR_connect 203
#endif
#ifndef __NR_getsockname
#define __NR_getsockname 204
#endif
#ifndef __NR_mmap
#define __NR_mmap 222
#endif
#ifndef __NR_sendmsg
#define __NR_sendmsg 211
#endif
#ifndef __NR_socket
#define __NR_socket 198
#endif
#define BITMASK(bf_off,bf_len) (((1ull << (bf_len)) - 1) << (bf_off))
#define STORE_BY_BITMASK(type,htobe,addr,val,bf_off,bf_len) *(type*)(addr) = htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len))))
uint64_t r[9] = {0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0};
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
const char* reason;
(void)reason;
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
// socket$nl_route arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: const = 0x0 (4 bytes)
// ]
// returns sock_nl_route
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
if (res != -1)
r[0] = res;
// socket arguments: [
// domain: socket_domain = 0x10 (8 bytes)
// type: socket_type = 0x803 (8 bytes)
// proto: int32 = 0x0 (4 bytes)
// ]
// returns sock
res = syscall(__NR_socket, /*domain=AF_NETLINK*/0x10ul, /*type=SOCK_NONBLOCK|SOCK_RAW*/0x803ul, /*proto=*/0);
if (res != -1)
r[1] = res;
// connect$netlink arguments: [
// fd: sock_netlink (resource)
// addr: ptr[in, sockaddr_nl] {
// union sockaddr_nl {
// kern: sockaddr_nl_t[AF_NETLINK, const[0, int32], flags[netlink_group_bitmap, int32]] {
// nl_family: const = 0x10 (2 bytes)
// nl_pad: const = 0x0 (2 bytes)
// nl_pid: const = 0x0 (4 bytes)
// nl_groups: netlink_group_bitmap = 0x0 (4 bytes)
// }
// }
// }
// addrlen: len = 0xc (8 bytes)
// ]
*(uint16_t*)0x20000080 = 0x10;
*(uint16_t*)0x20000082 = 0;
*(uint32_t*)0x20000084 = 0;
*(uint32_t*)0x20000088 = 0;
syscall(__NR_connect, /*fd=*/r[1], /*addr=*/0x20000080ul, /*addrlen=*/0xcul);
// getsockname$packet arguments: [
// fd: sock_packet (resource)
// addr: ptr[out, sockaddr_ll] {
// sockaddr_ll {
// sll_family: const = 0x11 (2 bytes)
// sll_protocol: packet_protocols = 0x0 (2 bytes)
// sll_ifindex: ifindex (resource)
// sll_hatype: const = 0x1 (2 bytes)
// sll_pkttype: int8 = 0x0 (1 bytes)
// sll_halen: const = 0x6 (1 bytes)
// sll_addr: union mac_addr {
// broadcast: buffer: (DirOut)
// }
// pad: buffer: (DirOut)
// }
// }
// addrlen: ptr[inout, len] {
// len = 0x14 (4 bytes)
// }
// ]
*(uint32_t*)0x20000200 = 0x14;
res = syscall(__NR_getsockname, /*fd=*/r[1], /*addr=*/0x20000100ul, /*addrlen=*/0x20000200ul);
if (res != -1)
r[2] = *(uint32_t*)0x20000104;
// sendmsg$nl_route arguments: [
// fd: sock_nl_route (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_route]] {
// msghdr_netlink[netlink_msg_route] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_route]] {
// iovec[in, netlink_msg_route] {
// addr: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {44 00 00 00 10 00 01 04 00 10 00 00 00 00 00 c1 00 00 00 00} (length 0x14)
// }
// union ANYUNION {
// ANYRES32: ANYRES32 (resource)
// }
// union ANYUNION {
// ANYBLOB: buffer: {01 00 00 00 00 00 00 00 24 00 12 00 0c 00 01 00 62 72 69 64 67 65} (length 0x16)
// }
// }
// }
// len: len = 0x44 (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x20000180 = 0;
*(uint32_t*)0x20000188 = 0;
*(uint64_t*)0x20000190 = 0x200000c0;
*(uint64_t*)0x200000c0 = 0x200001c0;
memcpy((void*)0x200001c0, "\x44\x00\x00\x00\x10\x00\x01\x04\x00\x10\x00\x00\x00\x00\x00\xc1\x00\x00\x00\x00", 20);
*(uint32_t*)0x200001d4 = r[2];
memcpy((void*)0x200001d8, "\x01\x00\x00\x00\x00\x00\x00\x00\x24\x00\x12\x00\x0c\x00\x01\x00\x62\x72\x69\x64\x67\x65", 22);
*(uint64_t*)0x200000c8 = 0x44;
*(uint64_t*)0x20000198 = 1;
*(uint64_t*)0x200001a0 = 0;
*(uint64_t*)0x200001a8 = 0;
*(uint32_t*)0x200001b0 = 0;
syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x20000180ul, /*f=*/0ul);
// socket$nl_route arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: const = 0x0 (4 bytes)
// ]
// returns sock_nl_route
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
if (res != -1)
r[3] = res;
// socket arguments: [
// domain: socket_domain = 0x1 (8 bytes)
// type: socket_type = 0x803 (8 bytes)
// proto: int32 = 0x0 (4 bytes)
// ]
// returns sock
res = syscall(__NR_socket, /*domain=AF_UNIX*/1ul, /*type=SOCK_NONBLOCK|SOCK_RAW*/0x803ul, /*proto=*/0);
if (res != -1)
r[4] = res;
// getsockname$packet arguments: [
// fd: sock_packet (resource)
// addr: ptr[out, sockaddr_ll] {
// sockaddr_ll {
// sll_family: const = 0x11 (2 bytes)
// sll_protocol: packet_protocols = 0x0 (2 bytes)
// sll_ifindex: ifindex (resource)
// sll_hatype: const = 0x1 (2 bytes)
// sll_pkttype: int8 = 0x0 (1 bytes)
// sll_halen: const = 0x6 (1 bytes)
// sll_addr: union mac_addr {
// broadcast: buffer: (DirOut)
// }
// pad: buffer: (DirOut)
// }
// }
// addrlen: ptr[inout, len] {
// len = 0x6 (4 bytes)
// }
// ]
*(uint32_t*)0x200002c0 = 6;
res = syscall(__NR_getsockname, /*fd=*/r[4], /*addr=*/0x20000100ul, /*addrlen=*/0x200002c0ul);
if (res != -1)
r[5] = *(uint32_t*)0x20000104;
// socket$nl_route arguments: [
// domain: const = 0x10 (8 bytes)
// type: const = 0x3 (8 bytes)
// proto: const = 0x0 (4 bytes)
// ]
// returns sock_nl_route
res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0);
if (res != -1)
r[6] = res;
// socket arguments: [
// domain: socket_domain = 0x10 (8 bytes)
// type: socket_type = 0x803 (8 bytes)
// proto: int32 = 0x0 (4 bytes)
// ]
// returns sock
res = syscall(__NR_socket, /*domain=AF_NETLINK*/0x10ul, /*type=SOCK_NONBLOCK|SOCK_RAW*/0x803ul, /*proto=*/0);
if (res != -1)
r[7] = res;
// sendmsg$ETHTOOL_MSG_STRSET_GET arguments: [
// fd: sock_nl_generic (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_t[genl_ethtool_family_id, genlmsghdr_t[ETHTOOL_MSG_STRSET_GET], ethnl_strset_get_policy]]] {
// msghdr_netlink[netlink_msg_t[genl_ethtool_family_id, genlmsghdr_t[ETHTOOL_MSG_STRSET_GET], ethnl_strset_get_policy]] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_t[genl_ethtool_family_id, genlmsghdr_t[ETHTOOL_MSG_STRSET_GET], ethnl_strset_get_policy]]] {
// iovec[in, netlink_msg_t[genl_ethtool_family_id, genlmsghdr_t[ETHTOOL_MSG_STRSET_GET], ethnl_strset_get_policy]] {
// addr: nil
// len: len = 0x14 (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x20000440 = 0;
*(uint32_t*)0x20000448 = 0;
*(uint64_t*)0x20000450 = 0x20000400;
*(uint64_t*)0x20000400 = 0;
*(uint64_t*)0x20000408 = 0x14;
*(uint64_t*)0x20000458 = 1;
*(uint64_t*)0x20000460 = 0;
*(uint64_t*)0x20000468 = 0;
*(uint32_t*)0x20000470 = 0;
syscall(__NR_sendmsg, /*fd=*/r[7], /*msg=*/0x20000440ul, /*f=*/0ul);
// getsockname$packet arguments: [
// fd: sock_packet (resource)
// addr: ptr[out, sockaddr_ll] {
// sockaddr_ll {
// sll_family: const = 0x11 (2 bytes)
// sll_protocol: packet_protocols = 0x0 (2 bytes)
// sll_ifindex: ifindex (resource)
// sll_hatype: const = 0x1 (2 bytes)
// sll_pkttype: int8 = 0x0 (1 bytes)
// sll_halen: const = 0x6 (1 bytes)
// sll_addr: union mac_addr {
// broadcast: buffer: (DirOut)
// }
// pad: buffer: (DirOut)
// }
// }
// addrlen: ptr[inout, len] {
// len = 0x14 (4 bytes)
// }
// ]
*(uint32_t*)0x20000380 = 0x14;
res = syscall(__NR_getsockname, /*fd=*/r[7], /*addr=*/0x20000100ul, /*addrlen=*/0x20000380ul);
if (res != -1)
r[8] = *(uint32_t*)0x20000104;
// sendmsg$nl_route arguments: [
// fd: sock_nl_route (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_route]] {
// msghdr_netlink[netlink_msg_route] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_route]] {
// iovec[in, netlink_msg_route] {
// addr: ptr[inout, array[ANYUNION]] {
// array[ANYUNION] {
// union ANYUNION {
// ANYBLOB: buffer: {3c 00 00 00 10 00 01 04 00 47 55 ff ff ff ff ff bf 00 00 00} (length 0x14)
// }
// union ANYUNION {
// ANYRES32: ANYRES32 (resource)
// }
// union ANYUNION {
// ANYBLOB: buffer: {01 00 00 00 01 00 00 00 1c 00 12 00 0c 00 01 00 62 72 69 64 67 65} (length 0x16)
// }
// }
// }
// len: len = 0x3c (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x20000000 = 0;
*(uint32_t*)0x20000008 = 0;
*(uint64_t*)0x20000010 = 0x20000140;
*(uint64_t*)0x20000140 = 0x20000040;
memcpy((void*)0x20000040, "\x3c\x00\x00\x00\x10\x00\x01\x04\x00\x47\x55\xff\xff\xff\xff\xff\xbf\x00\x00\x00", 20);
*(uint32_t*)0x20000054 = r[8];
memcpy((void*)0x20000058, "\x01\x00\x00\x00\x01\x00\x00\x00\x1c\x00\x12\x00\x0c\x00\x01\x00\x62\x72\x69\x64\x67\x65", 22);
*(uint64_t*)0x20000148 = 0x3c;
*(uint64_t*)0x20000018 = 1;
*(uint64_t*)0x20000020 = 0;
*(uint64_t*)0x20000028 = 0;
*(uint32_t*)0x20000030 = 0;
syscall(__NR_sendmsg, /*fd=*/r[6], /*msg=*/0x20000000ul, /*f=*/0ul);
// sendmsg$nl_route arguments: [
// fd: sock_nl_route (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_route]] {
// msghdr_netlink[netlink_msg_route] {
// addr: nil
// addrlen: len = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_route]] {
// iovec[in, netlink_msg_route] {
// addr: ptr[in, netlink_msg_route] {
// union netlink_msg_route {
// newlink: netlink_msg_t[const[RTM_NEWLINK, int16], ifinfomsg[AF_UNSPEC], ifla_policy] {
// len: len = 0x4c (4 bytes)
// type: const = 0x10 (2 bytes)
// flags: netlink_msg_flags = 0x401 (2 bytes)
// seq: int32 = 0x0 (4 bytes)
// pid: int32 = 0x0 (4 bytes)
// payload: ifinfomsg[AF_UNSPEC] {
// ifi_family: const = 0x0 (1 bytes)
// __ifi_pad: const = 0x0 (1 bytes)
// ifi_type: const = 0x7a (2 bytes)
// ifi_index: ifindex (resource)
// ifi_flags: net_device_flags = 0x0 (4 bytes)
// ifi_change: net_device_flags = 0x0 (4 bytes)
// }
// attrs: array[ifla_policy] {
// union ifla_policy {
// IFLA_LINKINFO: nlattr_tt[const[IFLA_LINKINFO, int16:14], 0, 1, ifla_info_policy] {
// nla_len: offsetof = 0x1c (2 bytes)
// nla_type: const = 0x12 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: union ifla_info_policy {
// vlan: ifla_info_policy$t["vlan", IFLA_INFO_DATA, array[vlan_policy]] {
// IFLA_INFO_KIND: nlattr_t[const[IFLA_INFO_KIND, int16], string["vlan"]] {
// nla_len: offsetof = 0x9 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {76 6c 61 6e 00} (length 0x5)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// IFLA_INFO_DATA: nlattr_tt[const[IFLA_INFO_DATA, int16:14], 0, 1, array[vlan_policy]] {
// nla_len: offsetof = 0xc (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[vlan_policy] {
// union vlan_policy {
// IFLA_VLAN_ID: nlattr_t[const[IFLA_VLAN_ID, int16], int16[0:4]] {
// nla_len: offsetof = 0x6 (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: int16 = 0x0 (2 bytes)
// size: buffer: {} (length 0x0)
// pad = 0x0 (2 bytes)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// union ifla_policy {
// IFLA_LINK: nlattr_t[const[IFLA_LINK, int16], ifindex] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0x5 (2 bytes)
// payload: ifindex (resource)
// size: buffer: {} (length 0x0)
// }
// }
// union ifla_policy {
// IFLA_MASTER: nlattr_t[const[IFLA_MASTER, int16], ifindex] {
// nla_len: offsetof = 0x8 (2 bytes)
// nla_type: const = 0xa (2 bytes)
// payload: ifindex (resource)
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// }
// len: len = 0x4c (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x20000080 = 0;
*(uint32_t*)0x20000088 = 0;
*(uint64_t*)0x20000090 = 0x20000140;
*(uint64_t*)0x20000140 = 0x20000300;
*(uint32_t*)0x20000300 = 0x4c;
*(uint16_t*)0x20000304 = 0x10;
*(uint16_t*)0x20000306 = 0x401;
*(uint32_t*)0x20000308 = 0;
*(uint32_t*)0x2000030c = 0;
*(uint8_t*)0x20000310 = 0;
*(uint8_t*)0x20000311 = 0;
*(uint16_t*)0x20000312 = 0x7a;
*(uint32_t*)0x20000314 = 0;
*(uint32_t*)0x20000318 = 0;
*(uint32_t*)0x2000031c = 0;
*(uint16_t*)0x20000320 = 0x1c;
STORE_BY_BITMASK(uint16_t, , 0x20000322, 0x12, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000323, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000323, 1, 7, 1);
*(uint16_t*)0x20000324 = 9;
*(uint16_t*)0x20000326 = 1;
memcpy((void*)0x20000328, "vlan\000", 5);
*(uint16_t*)0x20000330 = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x20000332, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000333, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000333, 1, 7, 1);
*(uint16_t*)0x20000334 = 6;
*(uint16_t*)0x20000336 = 1;
*(uint16_t*)0x20000338 = 0;
*(uint16_t*)0x2000033c = 8;
*(uint16_t*)0x2000033e = 5;
*(uint32_t*)0x20000340 = r[8];
*(uint16_t*)0x20000344 = 8;
*(uint16_t*)0x20000346 = 0xa;
*(uint32_t*)0x20000348 = r[5];
*(uint64_t*)0x20000148 = 0x4c;
*(uint64_t*)0x20000098 = 1;
*(uint64_t*)0x200000a0 = 0;
*(uint64_t*)0x200000a8 = 0;
*(uint32_t*)0x200000b0 = 0;
syscall(__NR_sendmsg, /*fd=*/r[3], /*msg=*/0x20000080ul, /*f=*/0ul);
// sendmsg$nl_route arguments: [
// fd: sock_nl_route (resource)
// msg: ptr[in, msghdr_netlink[netlink_msg_route]] {
// msghdr_netlink[netlink_msg_route] {
// addr: nil
// addrlen: len = 0xfeffffff (4 bytes)
// pad = 0x0 (4 bytes)
// vec: ptr[in, iovec[in, netlink_msg_route]] {
// iovec[in, netlink_msg_route] {
// addr: ptr[in, netlink_msg_route] {
// union netlink_msg_route {
// newlink: netlink_msg_t[const[RTM_NEWLINK, int16], ifinfomsg[AF_UNSPEC], ifla_policy] {
// len: len = 0x3c (4 bytes)
// type: const = 0x10 (2 bytes)
// flags: netlink_msg_flags = 0x439 (2 bytes)
// seq: int32 = 0x0 (4 bytes)
// pid: int32 = 0x0 (4 bytes)
// payload: ifinfomsg[AF_UNSPEC] {
// ifi_family: const = 0x0 (1 bytes)
// __ifi_pad: const = 0x0 (1 bytes)
// ifi_type: const = 0x0 (2 bytes)
// ifi_index: ifindex (resource)
// ifi_flags: net_device_flags = 0x0 (4 bytes)
// ifi_change: net_device_flags = 0x0 (4 bytes)
// }
// attrs: array[ifla_policy] {
// union ifla_policy {
// IFLA_LINKINFO: nlattr_tt[const[IFLA_LINKINFO, int16:14], 0, 1, ifla_info_policy] {
// nla_len: offsetof = 0x1c (2 bytes)
// nla_type: const = 0x12 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: union ifla_info_policy {
// bridge: ifla_info_policy$t["bridge", IFLA_INFO_DATA, array[br_policy]] {
// IFLA_INFO_KIND: nlattr_t[const[IFLA_INFO_KIND, int16], string["bridge"]] {
// nla_len: offsetof = 0xb (2 bytes)
// nla_type: const = 0x1 (2 bytes)
// payload: buffer: {62 72 69 64 67 65 00} (length 0x7)
// size: buffer: {} (length 0x0)
// pad = 0x0 (1 bytes)
// }
// IFLA_INFO_DATA: nlattr_tt[const[IFLA_INFO_DATA, int16:14], 0, 1, array[br_policy]] {
// nla_len: offsetof = 0xc (2 bytes)
// nla_type: const = 0x2 (1 bytes)
// NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes)
// NLA_F_NESTED: const = 0x1 (1 bytes)
// payload: array[br_policy] {
// union br_policy {
// IFLA_BR_MCAST_QUERIER: nlattr_t[const[IFLA_BR_MCAST_QUERIER, int16], int8] {
// nla_len: offsetof = 0x5 (2 bytes)
// nla_type: const = 0x19 (2 bytes)
// payload: int8 = 0x7 (1 bytes)
// size: buffer: {} (length 0x0)
// pad = 0x0 (3 bytes)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// size: buffer: {} (length 0x0)
// }
// }
// }
// }
// }
// }
// len: len = 0x3c (8 bytes)
// }
// }
// vlen: const = 0x1 (8 bytes)
// ctrl: const = 0x0 (8 bytes)
// ctrllen: const = 0x0 (8 bytes)
// f: send_flags = 0x0 (4 bytes)
// pad = 0x0 (4 bytes)
// }
// }
// f: send_flags = 0x0 (8 bytes)
// ]
*(uint64_t*)0x20000000 = 0;
*(uint32_t*)0x20000008 = 0xfeffffff;
*(uint64_t*)0x20000010 = 0x20000500;
*(uint64_t*)0x20000500 = 0x20000240;
*(uint32_t*)0x20000240 = 0x3c;
*(uint16_t*)0x20000244 = 0x10;
*(uint16_t*)0x20000246 = 0x439;
*(uint32_t*)0x20000248 = 0;
*(uint32_t*)0x2000024c = 0;
*(uint8_t*)0x20000250 = 0;
*(uint8_t*)0x20000251 = 0;
*(uint16_t*)0x20000252 = 0;
*(uint32_t*)0x20000254 = r[2];
*(uint32_t*)0x20000258 = 0;
*(uint32_t*)0x2000025c = 0;
*(uint16_t*)0x20000260 = 0x1c;
STORE_BY_BITMASK(uint16_t, , 0x20000262, 0x12, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000263, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000263, 1, 7, 1);
*(uint16_t*)0x20000264 = 0xb;
*(uint16_t*)0x20000266 = 1;
memcpy((void*)0x20000268, "bridge\000", 7);
*(uint16_t*)0x20000270 = 0xc;
STORE_BY_BITMASK(uint16_t, , 0x20000272, 2, 0, 14);
STORE_BY_BITMASK(uint16_t, , 0x20000273, 0, 6, 1);
STORE_BY_BITMASK(uint16_t, , 0x20000273, 1, 7, 1);
*(uint16_t*)0x20000274 = 5;
*(uint16_t*)0x20000276 = 0x19;
*(uint8_t*)0x20000278 = 7;
*(uint64_t*)0x20000508 = 0x3c;
*(uint64_t*)0x20000018 = 1;
*(uint64_t*)0x20000020 = 0;
*(uint64_t*)0x20000028 = 0;
*(uint32_t*)0x20000030 = 0;
syscall(__NR_sendmsg, /*fd=*/r[3], /*msg=*/0x20000000ul, /*f=*/0ul);
return 0;
}
]