==================================================================
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3526 [inline]
BUG: KASAN: double-free or invalid-free in kfree+0xc4/0x270 mm/slub.c:4588

CPU: 0 PID: 20 Comm: kworker/0:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: kcryptd_io/253:0 kcryptd_io_read_work
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 kasan_report_invalid_free+0x58/0x90 mm/kasan/report.c:370
 ____kasan_slab_free+0x13d/0x160 mm/kasan/common.c:-1
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
 kasan_slab_free include/linux/kasan.h:193 [inline]
 slab_free_hook mm/slub.c:1728 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754
 slab_free mm/slub.c:3526 [inline]
 kfree+0xc4/0x270 mm/slub.c:4588
 crypt_dec_pending+0x1dd/0x2a0 drivers/md/dm-crypt.c:1755
 kcryptd_io_read_work+0x84/0xa0 drivers/md/dm-crypt.c:1853
 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
 kthread+0x3f5/0x4f0 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Allocated by task 303:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:433 [inline]
 ____kasan_kmalloc mm/kasan/common.c:512 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:521
 kasan_kmalloc include/linux/kasan.h:227 [inline]
 __kmalloc+0x13d/0x2c0 mm/slub.c:4436
 kmalloc include/linux/slab.h:624 [inline]
 crypt_map+0x3d1/0xb90 drivers/md/dm-crypt.c:3386
 __map_bio+0x139/0x780 drivers/md/dm.c:1244
 __clone_and_map_data_bio drivers/md/dm.c:1431 [inline]
 __split_and_process_non_flush+0x715/0xa90 drivers/md/dm.c:1522
 __split_and_process_bio drivers/md/dm.c:1562 [inline]
 dm_submit_bio+0x76a/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Freed by task 303:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
 kasan_slab_free include/linux/kasan.h:193 [inline]
 slab_free_hook mm/slub.c:1728 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754
 slab_free mm/slub.c:3526 [inline]
 kfree+0xc4/0x270 mm/slub.c:4588
 crypt_dec_pending+0x1dd/0x2a0 drivers/md/dm-crypt.c:1755
 kcryptd_io_read+0x371/0x480 drivers/md/dm-crypt.c:1837
 crypt_map+0x4c5/0xb90 drivers/md/dm-crypt.c:3401
 __map_bio+0x139/0x780 drivers/md/dm.c:1244
 __clone_and_map_data_bio drivers/md/dm.c:1431 [inline]
 __split_and_process_non_flush+0x715/0xa90 drivers/md/dm.c:1522
 __split_and_process_bio drivers/md/dm.c:1562 [inline]
 dm_submit_bio+0x76a/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

The buggy address belongs to the object at ffff8881045e8300
 which belongs to the cache kmalloc-64 of size 64
The buggy address is located 0 bytes inside of
 64-byte region [ffff8881045e8300, ffff8881045e8340)
The buggy address belongs to the page:
page:ffffea0004117a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1045e8
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 ffffea0004177cc0 0000000400000004 ffff888100042780
raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 2226458882, free_ts 0
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1937 [inline]
 new_slab+0xa0/0x4d0 mm/slub.c:2000
 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033
 __slab_alloc+0x49/0x90 mm/slub.c:3120
 slab_alloc_node mm/slub.c:3211 [inline]
 slab_alloc mm/slub.c:3255 [inline]
 __kmalloc+0x16a/0x2c0 mm/slub.c:4432
 kmalloc include/linux/slab.h:624 [inline]
 kzalloc include/linux/slab.h:750 [inline]
 kobject_get_path+0xbf/0x1f0 lib/kobject.c:184
 kobject_uevent_env+0x28a/0x700 lib/kobject_uevent.c:544
 kobject_uevent+0x1d/0x30 lib/kobject_uevent.c:657
 driver_bound+0x4b4/0x500 drivers/base/dd.c:400
 really_probe+0x77f/0x970 drivers/base/dd.c:649
 __driver_probe_device+0x193/0x270 drivers/base/dd.c:755
 driver_probe_device+0x54/0x3e0 drivers/base/dd.c:785
 __driver_attach+0x40e/0x550 drivers/base/dd.c:1164
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8881045e8200: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff8881045e8280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff8881045e8300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
                   ^
 ffff8881045e8380: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc
 ffff8881045e8400: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
==================================================================
==================================================================
BUG: KASAN: use-after-free in crypt_dec_pending+0x275/0x2a0 drivers/md/dm-crypt.c:1757
Write of size 1 at addr ffff8881220d0872 by task kworker/0:1/20

CPU: 0 PID: 20 Comm: kworker/0:1 Tainted: G    B             syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: kcryptd_io/253:0 kcryptd_io_read_work
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0x10f/0x150 mm/kasan/report.c:444
 __asan_report_store1_noabort+0x17/0x20 mm/kasan/report_generic.c:311
 crypt_dec_pending+0x275/0x2a0 drivers/md/dm-crypt.c:1757
 kcryptd_io_read_work+0x84/0xa0 drivers/md/dm-crypt.c:1853
 process_one_work+0x6c8/0xbb0 kernel/workqueue.c:2328
 worker_thread+0xaa0/0x1250 kernel/workqueue.c:2475
 kthread+0x3f5/0x4f0 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Allocated by task 303:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:433 [inline]
 __kasan_slab_alloc+0xb7/0xe0 mm/kasan/common.c:466
 kasan_slab_alloc include/linux/kasan.h:217 [inline]
 slab_post_alloc_hook+0x4f/0x2b0 mm/slab.h:550
 slab_alloc_node mm/slub.c:3245 [inline]
 slab_alloc mm/slub.c:3255 [inline]
 kmem_cache_alloc+0xf7/0x260 mm/slub.c:3260
 mempool_alloc_slab+0x1d/0x30 mm/mempool.c:513
 mempool_alloc+0x167/0x4c0 mm/mempool.c:393
 bio_alloc_bioset+0x124/0x910 block/bio.c:469
 alloc_io drivers/md/dm.c:536 [inline]
 init_clone_info drivers/md/dm.c:1536 [inline]
 __split_and_process_bio drivers/md/dm.c:1550 [inline]
 dm_submit_bio+0x211/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Freed by task 303:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
 kasan_slab_free include/linux/kasan.h:193 [inline]
 slab_free_hook mm/slub.c:1728 [inline]
 slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754
 slab_free mm/slub.c:3526 [inline]
 kmem_cache_free+0x100/0x320 mm/slub.c:3544
 mempool_free_slab+0x1d/0x30 mm/mempool.c:520
 mempool_free+0xd5/0x330 mm/mempool.c:502
 bio_free+0x255/0x360 block/bio.c:239
 bio_put+0x91/0x610 block/bio.c:700
 free_io drivers/md/dm.c:562 [inline]
 dm_io_dec_pending+0x314/0xa50 drivers/md/dm.c:844
 __split_and_process_bio drivers/md/dm.c:1584 [inline]
 dm_submit_bio+0xc1b/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Last potentially related work creation:
 kasan_save_stack+0x3a/0x60 mm/kasan/common.c:38
 __kasan_record_aux_stack+0xd2/0x100 mm/kasan/generic.c:348
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
 insert_work+0x51/0x310 kernel/workqueue.c:1373
 __queue_work+0x8e1/0xc60 kernel/workqueue.c:1539
 queue_work_on+0xde/0x150 kernel/workqueue.c:1566
 queue_work include/linux/workqueue.h:510 [inline]
 kcryptd_queue_read drivers/md/dm-crypt.c:1861 [inline]
 crypt_map+0x5bf/0xb90 drivers/md/dm-crypt.c:3402
 __map_bio+0x139/0x780 drivers/md/dm.c:1244
 __clone_and_map_data_bio drivers/md/dm.c:1431 [inline]
 __split_and_process_non_flush+0x715/0xa90 drivers/md/dm.c:1522
 __split_and_process_bio drivers/md/dm.c:1562 [inline]
 dm_submit_bio+0x76a/0x10f0 drivers/md/dm.c:1621
 __submit_bio+0x732/0x900 block/blk-core.c:925
 __submit_bio_noacct block/blk-core.c:974 [inline]
 submit_bio_noacct+0x32a/0x800 block/blk-core.c:1039
 submit_bio+0x367/0x620 block/blk-core.c:1110
 submit_bh_wbc+0x5b4/0x680 fs/buffer.c:3056
 submit_bh fs/buffer.c:3062 [inline]
 ll_rw_block+0x1ed/0x250 fs/buffer.c:-1
 __block_write_begin_int+0x6b6/0x14d0 fs/buffer.c:2042
 __block_write_begin fs/buffer.c:2062 [inline]
 block_write_begin+0x54/0xd0 fs/buffer.c:2122
 blkdev_write_begin+0x3c/0x50 block/fops.c:372
 generic_perform_write+0x2b7/0x690 mm/filemap.c:3887
 __generic_file_write_iter+0x268/0x490 mm/filemap.c:4015
 blkdev_write_iter+0x351/0x550 block/fops.c:537
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_pwrite64 fs/read_write.c:701 [inline]
 __do_sys_pwrite64 fs/read_write.c:711 [inline]
 __se_sys_pwrite64 fs/read_write.c:708 [inline]
 __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:708
 x64_sys_call+0xa6/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

The buggy address belongs to the object at ffff8881220d04c0
 which belongs to the cache bio-1080 of size 1080
The buggy address is located 946 bytes inside of
 1080-byte region [ffff8881220d04c0, ffff8881220d08f8)
The buggy address belongs to the page:
page:ffffea0004883400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1220d0
head:ffffea0004883400 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head|zone=1)
raw: 4000000000010200 0000000000000000 dead000000000122 ffff88810bc17980
raw: 0000000000000000 00000000800d000d 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 303, ts 21388405946, free_ts 0
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613
 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487
 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1937 [inline]
 new_slab+0xa0/0x4d0 mm/slub.c:2000
 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033
 __slab_alloc+0x49/0x90 mm/slub.c:3120
 slab_alloc_node mm/slub.c:3211 [inline]
 slab_alloc mm/slub.c:3255 [inline]
 kmem_cache_alloc+0x138/0x260 mm/slub.c:3260
 mempool_alloc_slab+0x1d/0x30 mm/mempool.c:513
 mempool_init_node+0x1e3/0x4a0 mm/mempool.c:202
 mempool_init+0x3c/0x50 mm/mempool.c:231
 mempool_init_slab_pool include/linux/mempool.h:62 [inline]
 bioset_init+0x205/0x5f0 block/bio.c:1627
 bioset_init_from_src+0xb3/0x120 block/bio.c:1668
 __bind_mempools drivers/md/dm.c:1901 [inline]
 __bind drivers/md/dm.c:1974 [inline]
 dm_swap_table+0x442/0x610 drivers/md/dm.c:2362
 do_resume drivers/md/dm-ioctl.c:1176 [inline]
 dev_suspend+0x1e0/0x740 drivers/md/dm-ioctl.c:1226
 ctl_ioctl drivers/md/dm-ioctl.c:2024 [inline]
 dm_ctl_ioctl+0x8ee/0xca0 drivers/md/dm-ioctl.c:2046
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8881220d0700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881220d0780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881220d0800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                             ^
 ffff8881220d0880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
 ffff8881220d0900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================