syzkaller login: [ 258.217104][ T1860] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 266.966668][ T1860] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 267.035397][ T1860] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 267.099656][ T1860] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. Warning: Permanently added '[localhost]:36444' (ECDSA) to the list of known hosts. 1970/01/01 00:05:27 fuzzer started 1970/01/01 00:05:42 dialing manager at localhost:40479 [ 348.795950][ T2027] cgroup: Unknown subsys name 'net' [ 349.998164][ T2027] cgroup: Unknown subsys name 'rlimit' 1970/01/01 00:05:49 syscalls: 2918 1970/01/01 00:05:49 code coverage: enabled 1970/01/01 00:05:49 comparison tracing: enabled 1970/01/01 00:05:49 extra coverage: enabled 1970/01/01 00:05:49 delay kcov mmap: mmap returned an invalid pointer 1970/01/01 00:05:49 setuid sandbox: enabled 1970/01/01 00:05:49 namespace sandbox: enabled 1970/01/01 00:05:49 Android sandbox: /sys/fs/selinux/policy does not exist 1970/01/01 00:05:49 fault injection: enabled 1970/01/01 00:05:49 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 1970/01/01 00:05:49 net packet injection: enabled 1970/01/01 00:05:49 net device setup: enabled 1970/01/01 00:05:49 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 1970/01/01 00:05:49 devlink PCI setup: PCI device 0000:00:10.0 is not available 1970/01/01 00:05:49 NIC VF setup: PCI device 0000:00:11.0 is not available 1970/01/01 00:05:49 USB emulation: enabled 1970/01/01 00:05:49 hci packet injection: /dev/vhci does not exist 1970/01/01 00:05:49 wifi device emulation: /sys/class/mac80211_hwsim/ does not exist 1970/01/01 00:05:49 802.15.4 emulation: /sys/bus/platform/devices/mac802154_hwsim does not exist 1970/01/01 00:05:50 fetching corpus: 0, signal 0/2000 (executing program) 1970/01/01 00:05:55 fetching corpus: 50, signal 31315/34200 (executing program) 1970/01/01 00:05:59 fetching corpus: 100, signal 45730/49242 (executing program) 1970/01/01 00:06:07 fetching corpus: 150, signal 59812/63514 (executing program) 1970/01/01 00:06:09 fetching corpus: 199, signal 65943/69981 (executing program) 1970/01/01 00:06:12 fetching corpus: 249, signal 73503/77609 (executing program) 1970/01/01 00:06:16 fetching corpus: 299, signal 78718/82867 (executing program) 1970/01/01 00:06:19 fetching corpus: 349, signal 83141/87266 (executing program) 1970/01/01 00:06:22 fetching corpus: 399, signal 86363/90492 (executing program) 1970/01/01 00:06:25 fetching corpus: 448, signal 89891/93886 (executing program) 1970/01/01 00:06:28 fetching corpus: 498, signal 93425/97091 (executing program) 1970/01/01 00:06:31 fetching corpus: 548, signal 95703/99190 (executing program) 1970/01/01 00:06:34 fetching corpus: 597, signal 98924/101997 (executing program) 1970/01/01 00:06:36 fetching corpus: 645, signal 102307/104802 (executing program) 1970/01/01 00:06:39 fetching corpus: 693, signal 103898/106150 (executing program) 1970/01/01 00:06:45 fetching corpus: 743, signal 106550/108131 (executing program) 1970/01/01 00:06:49 fetching corpus: 793, signal 108959/109922 (executing program) 1970/01/01 00:06:52 fetching corpus: 833, signal 110348/110903 (executing program) 1970/01/01 00:06:52 fetching corpus: 833, signal 110348/110933 (executing program) 1970/01/01 00:06:52 fetching corpus: 833, signal 110360/110976 (executing program) 1970/01/01 00:06:52 fetching corpus: 833, signal 110360/111004 (executing program) 1970/01/01 00:06:52 fetching corpus: 833, signal 110360/111040 (executing program) 1970/01/01 00:06:53 fetching corpus: 833, signal 110360/111081 (executing program) 1970/01/01 00:06:53 fetching corpus: 833, signal 110360/111118 (executing program) 1970/01/01 00:06:53 fetching corpus: 833, signal 110360/111149 (executing program) 1970/01/01 00:06:53 fetching corpus: 833, signal 110360/111184 (executing program) 1970/01/01 00:06:53 fetching corpus: 833, signal 110360/111212 (executing program) 1970/01/01 00:06:54 fetching corpus: 833, signal 110360/111243 (executing program) 1970/01/01 00:06:54 fetching corpus: 833, signal 110360/111273 (executing program) 1970/01/01 00:06:54 fetching corpus: 833, signal 110360/111314 (executing program) 1970/01/01 00:06:54 fetching corpus: 833, signal 110360/111339 (executing program) 1970/01/01 00:06:54 fetching corpus: 833, signal 110360/111369 (executing program) 1970/01/01 00:06:54 fetching corpus: 833, signal 110360/111398 (executing program) 1970/01/01 00:06:54 fetching corpus: 833, signal 110360/111432 (executing program) 1970/01/01 00:06:54 fetching corpus: 833, signal 110360/111466 (executing program) 1970/01/01 00:06:55 fetching corpus: 833, signal 110360/111500 (executing program) 1970/01/01 00:06:55 fetching corpus: 833, signal 110360/111527 (executing program) 1970/01/01 00:06:55 fetching corpus: 833, signal 110360/111560 (executing program) 1970/01/01 00:06:55 fetching corpus: 833, signal 110360/111595 (executing program) 1970/01/01 00:06:55 fetching corpus: 833, signal 110360/111629 (executing program) 1970/01/01 00:06:55 fetching corpus: 833, signal 110360/111661 (executing program) 1970/01/01 00:06:55 fetching corpus: 833, signal 110360/111691 (executing program) 1970/01/01 00:06:56 fetching corpus: 833, signal 110360/111719 (executing program) 1970/01/01 00:06:56 fetching corpus: 833, signal 110360/111759 (executing program) 1970/01/01 00:06:56 fetching corpus: 833, signal 110360/111795 (executing program) 1970/01/01 00:06:56 fetching corpus: 833, signal 110360/111827 (executing program) 1970/01/01 00:06:56 fetching corpus: 833, signal 110390/111869 (executing program) 1970/01/01 00:06:56 fetching corpus: 833, signal 110390/111895 (executing program) 1970/01/01 00:06:56 fetching corpus: 833, signal 110390/111936 (executing program) 1970/01/01 00:06:57 fetching corpus: 833, signal 110390/111970 (executing program) 1970/01/01 00:06:57 fetching corpus: 833, signal 110390/111990 (executing program) 1970/01/01 00:06:57 fetching corpus: 833, signal 110390/112033 (executing program) 1970/01/01 00:06:57 fetching corpus: 833, signal 110390/112070 (executing program) 1970/01/01 00:06:57 fetching corpus: 833, signal 110390/112097 (executing program) 1970/01/01 00:06:57 fetching corpus: 833, signal 110390/112135 (executing program) 1970/01/01 00:06:58 fetching corpus: 833, signal 110436/112167 (executing program) 1970/01/01 00:06:58 fetching corpus: 833, signal 110436/112169 (executing program) 1970/01/01 00:06:58 fetching corpus: 833, signal 110436/112169 (executing program) 1970/01/01 00:08:49 starting 2 fuzzer processes 00:08:49 executing program 0: r0 = syz_io_uring_setup(0x884, &(0x7f0000000180), &(0x7f0000400000/0xc00000)=nil, &(0x7f0000990000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000480)=@IORING_OP_STATX={0x15, 0x4, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x1ff) syz_io_uring_submit(r1, r2, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r3, 0x0, 0x0}, 0x0) io_uring_enter(r0, 0x547c, 0x0, 0x0, 0x0, 0x0) 00:08:50 executing program 1: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$mixer_OSS_GETVERSION(0xffffffffffffffff, 0x80044dfd, 0x0) ioctl$mixer_OSS_GETVERSION(r0, 0x80044d76, &(0x7f0000000040)) [ 560.545447][ T2039] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 561.019173][ T2039] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 562.219310][ T2038] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 562.888424][ T2038] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 573.286054][ T2039] device hsr_slave_0 entered promiscuous mode [ 573.359692][ T2039] device hsr_slave_1 entered promiscuous mode [ 574.997043][ T2038] device hsr_slave_0 entered promiscuous mode [ 575.338207][ T2038] device hsr_slave_1 entered promiscuous mode [ 575.359752][ T2038] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 575.366593][ T2038] Cannot create hsr debugfs directory [ 582.530211][ T2039] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 582.769564][ T2039] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 583.064564][ T2039] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 583.543549][ T2039] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 584.449121][ T2038] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 584.982293][ T2038] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 585.127471][ C0] ================================================================== [ 585.130366][ C0] BUG: KASAN: use-after-free in walk_stackframe+0x11c/0x260 [ 585.132375][ C0] Read of size 8 at addr ffffaf8020e4fe70 by task syz-executor.1/2038 [ 585.135852][ C0] [ 585.137056][ C0] CPU: 0 PID: 2038 Comm: syz-executor.1 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 585.138640][ C0] Hardware name: riscv-virtio,qemu (DT) [ 585.139741][ C0] Call Trace: [ 585.140732][ C0] [] dump_backtrace+0x2e/0x3c [ 585.142469][ C0] [] show_stack+0x34/0x40 [ 585.143727][ C0] [] dump_stack_lvl+0xe4/0x150 [ 585.144957][ C0] [] print_address_description.constprop.0+0x2a/0x330 [ 585.146363][ C0] [] kasan_report+0x184/0x1e0 [ 585.147631][ C0] [] __asan_load8+0x6e/0x96 [ 585.148890][ C0] [] walk_stackframe+0x11c/0x260 [ 585.150126][ C0] [] arch_stack_walk+0x2c/0x3c [ 585.151680][ C0] [] stack_trace_save+0xa6/0xd8 [ 585.152967][ C0] [] kasan_save_stack+0x2c/0x58 [ 585.154106][ C0] [ 585.154703][ C0] The buggy address belongs to the page: [ 585.155793][ C0] page:ffffaf807af89638 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xa104f [ 585.157076][ C0] flags: 0xa000000000(section=20|node=0|zone=0) [ 585.158982][ C0] raw: 000000a000000000 ffffaf807af89448 ffffaf807af89298 0000000000000000 [ 585.159929][ C0] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 585.160779][ C0] raw: 00000000000007ff [ 585.161561][ C0] page dumped because: kasan: bad access detected [ 585.162698][ C0] page_owner tracks the page as freed [ 585.163439][ C0] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), pid 2653, ts 584273844600, free_ts 584284221900 [ 585.164931][ C0] __set_page_owner+0x48/0x136 [ 585.165831][ C0] post_alloc_hook+0xd0/0x10a [ 585.166617][ C0] get_page_from_freelist+0x8da/0x12d8 [ 585.167448][ C0] __alloc_pages+0x150/0x3b6 [ 585.168237][ C0] alloc_pages+0x132/0x2a6 [ 585.169038][ C0] __get_free_pages+0x14/0xb2 [ 585.169784][ C0] get_zeroed_page+0x12/0x1a [ 585.170658][ C0] __pud_alloc+0x68/0x1ca [ 585.171588][ C0] __handle_mm_fault+0x864/0x23a4 [ 585.172614][ C0] handle_mm_fault+0x296/0x674 [ 585.173377][ C0] __get_user_pages+0x444/0x7b4 [ 585.174180][ C0] __get_user_pages_remote+0x156/0x63a [ 585.175058][ C0] get_user_pages_remote+0x5e/0x86 [ 585.175921][ C0] get_arg_page+0xf4/0x282 [ 585.176663][ C0] copy_string_kernel+0x13c/0x3ea [ 585.177604][ C0] kernel_execve+0x16c/0x288 [ 585.178730][ C0] page last free stack trace: [ 585.179375][ C0] __reset_page_owner+0x4a/0xea [ 585.180208][ C0] free_pcp_prepare+0x29c/0x45e [ 585.181329][ C0] free_unref_page+0x6a/0x31e [ 585.182279][ C0] __free_pages+0xe2/0x112 [ 585.183135][ C0] free_pages.part.0+0xe0/0xf6 [ 585.183935][ C0] free_pages+0xe/0x18 [ 585.184656][ C0] free_pgd_range+0xb56/0xc54 [ 585.185402][ C0] free_pgtables+0xf2/0x1c8 [ 585.186169][ C0] exit_mmap+0x168/0x412 [ 585.186964][ C0] mmput+0xee/0x2c2 [ 585.187742][ C0] free_bprm+0xbc/0x1de [ 585.188532][ C0] kernel_execve+0x214/0x288 [ 585.189304][ C0] call_usermodehelper_exec_async+0x1c0/0x2dc [ 585.190219][ C0] ret_from_exception+0x0/0x10 [ 585.191421][ C0] [ 585.192126][ C0] Memory state around the buggy address: [ 585.193198][ C0] ffffaf8020e4fd00: ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 [ 585.194161][ C0] ffffaf8020e4fd80: ff ff ff ff 00 00 00 00 00 00 00 00 ff ff ff ff [ 585.195471][ C0] >ffffaf8020e4fe00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 585.196678][ C0] ^ [ 585.197904][ C0] ffffaf8020e4fe80: ff ff ff ff ff ff ff ff f1 f1 f1 f1 00 00 00 f3 [ 585.198900][ C0] ffffaf8020e4ff00: f3 f3 f3 f3 00 00 00 00 ff ff ff ff 00 00 00 00 [ 585.200122][ C0] ================================================================== [ 585.202008][ C0] Disabling lock debugging due to kernel taint [ 585.207197][ T2038] Kernel panic - not syncing: corrupted stack end detected inside scheduler [ 585.209316][ T2038] CPU: 0 PID: 2038 Comm: syz-executor.1 Tainted: G B 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 585.210936][ T2038] Hardware name: riscv-virtio,qemu (DT) [ 585.212139][ T2038] Call Trace: [ 585.212802][ T2038] [] dump_backtrace+0x2e/0x3c [ 585.213934][ T2038] [] show_stack+0x34/0x40 [ 585.214958][ T2038] [] dump_stack_lvl+0xe4/0x150 [ 585.216052][ T2038] [] dump_stack+0x1c/0x24 [ 585.217114][ T2038] [] panic+0x24a/0x634 [ 585.218040][ T2038] [] schedule+0x0/0x14c [ 585.219065][ T2038] [] preempt_schedule_common+0x4e/0xde [ 585.220224][ T2038] [] preempt_schedule+0x34/0x36 [ 585.221651][ T2038] [] _raw_spin_unlock_irqrestore+0x8c/0x98 [ 585.223040][ T2038] [] pcpu_alloc+0x7ca/0x1278 [ 585.224187][ T2038] [] __alloc_percpu_gfp+0x28/0x36 [ 585.225486][ T2038] [] fib6_nh_init+0x37a/0x10c0 [ 585.226412][ T2038] [] ip6_route_info_create+0xb70/0xf78 [ 585.228120][ T2038] [] addrconf_f6i_alloc+0x242/0x3d8 [ 585.230084][ T2038] [] ipv6_add_addr+0x28e/0x12f2 [ 585.231867][ T2038] [] addrconf_add_linklocal+0x152/0x312 [ 585.233067][ T2038] [] addrconf_addr_gen+0x2c8/0x2d2 [ 585.234149][ T2038] [] addrconf_dev_config+0x208/0x3a0 [ 585.235256][ T2038] [] addrconf_notify+0xaa4/0x1360 [ 585.236493][ T2038] [] notifier_call_chain+0xb8/0x188 [ 585.237857][ T2038] [] raw_notifier_call_chain+0x2a/0x38 [ 585.239279][ T2038] [] call_netdevice_notifiers_info+0x9e/0x10c [ 585.240106][ T2038] [] __dev_notify_flags+0x108/0x1fa [ 585.241289][ T2038] [] dev_change_flags+0x9c/0xba [ 585.242391][ T2038] [] do_setlink+0x5d6/0x21c4 [ 585.244123][ T2038] [] __rtnl_newlink+0x99e/0xfa0 [ 585.245560][ T2038] [] rtnl_newlink+0x60/0x8c [ 585.246919][ T2038] [] rtnetlink_rcv_msg+0x338/0x9a0 [ 585.248555][ T2038] [] netlink_rcv_skb+0xf8/0x2be [ 585.249453][ T2038] [] rtnetlink_rcv+0x26/0x30 [ 585.250215][ T2038] [] netlink_unicast+0x40e/0x5fe [ 585.251624][ T2038] [] netlink_sendmsg+0x4e0/0x994 [ 585.252624][ T2038] [] sock_sendmsg+0xa0/0xc4 [ 585.254055][ T2038] [] __sys_sendto+0x1f2/0x2e0 [ 585.255234][ T2038] [] sys_sendto+0x3e/0x52 [ 585.256240][ T2038] [] ret_from_syscall+0x0/0x2 [ 585.257805][ T2038] SMP: stopping secondary CPUs [ 585.260082][ T2038] Rebooting in 86400 seconds.. VM DIAGNOSIS: 04:00:46 Registers: info registers vcpu 0 pc ffffffff80475986 mhartid 0000000000000000 mstatus 00000000000000a0 mip 00000000000000a0 mie 000000000000022a mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffff800055d4 mepc ffffffff80475786 sepc ffffffff80be7ae8 mcause 8000000000000007 scause 8000000000000005 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffff80dc3394 x2/sp ffffaf8020e4f840 x3/gp ffffffff85863ac0 x4/tp ffffaf8007460000 x5/t0 ffffffff86bcb657 x6/t1 9687866e00f81900 x7/t2 0000000000000000 x8/s0 ffffaf8020e4f870 x9/s1 ffffffff86e58900 x10/a0 ffffaf8007460020 x11/a1 ffff8f800066c000 x12/a2 1ffffffff0dcb129 x13/a3 ffffffff80dc337e x14/a4 0000000000000000 x15/a5 ffffffff86e58948 x16/a6 ffffffff86e589f1 x17/a7 ffffffff80dcc9fe x18/s2 ffffaf8007460000 x19/s3 0000000000000061 x20/s4 ffffffff86e58900 x21/s5 ffffffff80dc333e x22/s6 0000000000000000 x23/s7 ffffffff86bcb69b x24/s8 0000000000000010 x25/s9 ffffffff86e58958 x26/s10 0000000000000010 x27/s11 0000000000000000 x28/t3 fffffffff3f3f300 x29/t4 ffffffff80112282 x30/t5 1ffff5f0041c9eb8 x31/t6 ffffffff86bcb657 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000 info registers vcpu 1 pc ffffffff80112488 mhartid 0000000000000001 mstatus 00000000000000a0 mip 0000000000000000 mie 00000000000002aa mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffff800055d4 mepc ffffffff8000f97e sepc 00007fffa884429c mcause 0000000000000009 scause 0000000000000008 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffff80115922 x2/sp ffffaf801087bba0 x3/gp ffffffff85863ac0 x4/tp ffffaf800ce76100 x5/t0 0000000000000388 x6/t1 9687866e00f81900 x7/t2 ffffffffffffffff x8/s0 ffffaf801087bb40 x9/s1 0000000000000001 x10/a0 ffffaf800ce76108 x11/a1 0000000000000003 x12/a2 1ffff5f0019ced63 x13/a3 ffffffff831a24dc x14/a4 ffffaf800ce77100 x15/a5 ffffffff8586fd20 x16/a6 0000000000f00000 x17/a7 ffffffff803ccf2c x18/s2 0000000000000000 x19/s3 ffffaf800ce76100 x20/s4 ffffaf800ce76b18 x21/s5 00007fffedafa450 x22/s6 1ffff5f00210f7c8 x23/s7 00007fffa8bdec48 x24/s8 ffffffffffffffff x25/s9 0000000000000000 x26/s10 0000000000000001 x27/s11 0000000000000001 x28/t3 fffffffff3f3f300 x29/t4 ffffffff80112282 x30/t5 1ffff5f00210f750 x31/t6 0000000000f4a2c0 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000