last executing test programs: 1.366644411s ago: executing program 4 (id=5): sendmsg$unix(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="89000000ffff000001"], 0x9}, 0x0) sysctl$net_inet_ip(&(0x7f0000000040)={0x4, 0x11}, 0x4, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000340)={0x0, 0xfffffffffffffda6, 0x0, 0x0, &(0x7f00000003c0)=""/240, 0xf0}, 0x0) sendmsg(r0, &(0x7f0000000380)={0x0, 0x32c, 0x0, 0x0, &(0x7f0000000000), 0x90}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) setrlimit(0x8, &(0x7f0000000580)={0xa, 0x56}) openat$bpf(0xffffffffffffff9c, 0x0, 0x400, 0x0) 1.341792883s ago: executing program 7 (id=8): r0 = socket(0x18, 0x2, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaa2aaaa00000000000086dd60a0b04400081600fe0000020000ff80d144004a950b3f26cdb30500000000000000000000cdc3c8062952c730200008907800"]) (async) ioctl$FIONREAD(r0, 0x8020697a, &(0x7f0000000000)) 1.332775419s ago: executing program 0 (id=1): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) syz_emit_ethernet(0x1000e, &(0x7f00000015c0)=ANY=[]) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000), 0x20, 0x0) r1 = openat$wskbd(0xffffffffffffff9c, &(0x7f0000000600), 0x80, 0x0) r2 = getppid() fcntl$setown(r1, 0x6, r2) fcntl$setown(r1, 0x6, r2) r3 = socket(0x2, 0x1, 0x0) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) ioctl$FIONREAD(r3, 0x8040691a, &(0x7f00000001c0)) dup3(r0, r1, 0x0) mlock(&(0x7f00002d0000/0x3000)=nil, 0x3000) r4 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x80, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x10, 0x0) r5 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) fcntl$lock(r5, 0x9, &(0x7f00000000c0)={0x0, 0x0, 0x4000, 0x300000023}) closefrom(r4) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) 1.331481209s ago: executing program 1 (id=2): setrlimit(0x8, &(0x7f0000000980)={0xb, 0x53}) r0 = syz_open_pts() select(0x40, &(0x7f0000000000)={0x3, 0x1, 0xc, 0x0, 0x6, 0xedea, 0x10000, 0x9}, 0x0, &(0x7f00000000c0)={0xfd6, 0x8001, 0x1, 0x7fffffff, 0x2, 0x4, 0xffffffffd7ca143a, 0x7}, 0x0) ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000040)={0x1100f66c, 0xfffffffd, 0x2000009, 0x5fffff7f, "9cdcb99375947dacb0253c0000002f9e68de3204", 0x2003, 0xd}) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x9be, 0x1080, 0x3, 0xcd, 0x4, 0x5, 0x45, 0x10, [{0x3, 0x2, 0x8a, 0x71800}, {0x3, 0xb7fe, 0x800003, 0xffff}, {0x100006, 0x401, 0x420a, 0x10000000}, {0xffffffff, 0x8, 0x200, 0xffff}, {0x10000, 0x177e, 0x80000101, 0x7}, {0x2, 0x7f, 0x14000003, 0xf}, {0x5, 0xbffffff9, 0x2000001, 0x6d}, {0x4, 0xffffffff, 0x2, 0x4}, {0x6, 0xfffffff8, 0x9, 0x9}, {0x401, 0x2, 0x8001, 0x4}, {0x800a44f, 0xfff9, 0x166, 0xf}, {0x1, 0x80000001, 0x109, 0x3}, {0x2000de, 0x29, 0x5, 0x3ff}, {0x8, 0xfffffffc, 0x100, 0xffffffb9}, {0xc, 0x3, 0xffffffff, 0x1000003}, {0x6, 0x80000000, 0x3, 0x7}]}) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r1 = socket(0x11, 0x3, 0x0) sendto$unix(r1, &(0x7f0000000300)="b1000503000004000000080007000000331c13fe4ea10500fef96ec0c72fd3357ae30200004e3039d2d236acf20b7804be38164991f7c8cf5f882b297be1aa0500000051e2f0ad09000000000000009b672f4d335c223e7d0c032bfa896443842102000000720fd18bfbb670ea6e2ec5890400000000008000361b1257aea84600002002fbfe0c230000a37f50b6090004f834000000000000000000000000000000f70000000000007500000000000000", 0xb1, 0x400, 0x0, 0x0) r2 = socket(0x18, 0x3, 0x0) r3 = semget$private(0x0, 0x1, 0x4a8) semop(r3, &(0x7f0000000000)=[{0x4, 0x2}], 0x1) r4 = socket(0x18, 0x3, 0x0) ioctl$FIONREAD(r4, 0xc0106924, &(0x7f00000001c0)) r5 = socket$inet6(0x18, 0x2, 0x0) setsockopt$sock_int(r5, 0xffff, 0x1000, &(0x7f0000000140)=0x5, 0x4) bind$inet6(r5, &(0x7f0000000040)={0x1c, 0x18, 0x0, 0x3, "00000000010000000600", 0xc}, 0x1c) connect$inet6(r5, &(0x7f0000000180)={0x1c, 0x18, 0x2, 0x5, "0000fe1b00000100bb000000ffffffff", 0xd5}, 0x1c) sendmsg(r5, &(0x7f0000000000)={&(0x7f0000000600)=@in6={0x1c, 0x18, 0x0, 0xff, "00000000000600000016880000002601", 0x101}, 0x1c, 0x0, 0x0, 0x0}, 0x406) r6 = openat$speaker(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) write(r6, &(0x7f0000000180)='ol', 0x2) ioctl$FIONREAD(r2, 0x8080691a, &(0x7f0000000100)) unveil(&(0x7f0000000000)='./bus\x00', &(0x7f00000000c0)='w\x00') 1.27442974s ago: executing program 1 (id=9): sysctl$vm(&(0x7f0000000040)={0x2, 0x1}, 0x2, 0x0, 0x0, 0x0, 0xffffffffffffff85) (async) setitimer(0x2, &(0x7f0000000080)={{0xff, 0x800000000000004}, {0x0, 0x6}}, 0x0) sysctl$kern(&(0x7f0000000080)={0x1, 0x44}, 0x4000000000000004, 0x0, 0x0, 0x0, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) setsockopt(r0, 0x800, 0x2, &(0x7f0000000100)="b7d60123583742308e8d45c5815d5118e91c7835ff26d28181e6dd42d365b842fec3d921dca7e36d05f6b8633480660675b89614b8130a2130f479525c38d9b59cb9fe8d514bcf6a67ba0aa35031ebf1ee43d49c2b9942e990d72fd31d864052438d3650a6cb395186789c8f47d4ee6536e1012e55510be8121ba13fbab951b9a9521e8a0f52284039740d72ccc5725f7b4e8d8985efed887e8957f4a9e05d2b297eddc085e14b2df683dc6c6b8348812e1685d8b0e4207ad6947a9b37e44368083fe4938417a167409be0f32c3b190f1e8a86fa5b6eb6ca", 0xd8) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) (async) sysctl$ddb(&(0x7f0000000000)={0x9, 0x5}, 0x2, 0x0, 0x0, &(0x7f0000001080), 0x4) 1.273913311s ago: executing program 7 (id=10): pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) readv(r0, &(0x7f00000029c0)=[{&(0x7f00000018c0)=""/237, 0xed}], 0x1) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0x80000000, 0xffff63de, 0x5, 0x2, 0x8, 0x3, 0x44, 0x10, [{0x5, 0x3, 0xfffff115, 0x8}, {0x3, 0xffffffff, 0x6, 0xfff}, {0x1, 0x4baa, 0x3, 0x9}, {0x4, 0xe2, 0x0, 0x100}, {0x3, 0x2000007, 0x5, 0x84}, {0x7890, 0xffff, 0x8, 0x2}, {0x4, 0x800, 0x3, 0xfffffffa}, {0x207, 0xffffffff, 0x28000, 0xffffe2e9}, {0x9, 0x1000, 0x6, 0x7fff}, {0x5, 0x1, 0x6, 0x8bfd}, {0x800, 0x0, 0x8, 0x6}, {0x10000, 0x0, 0x800000, 0xa6a}, {0x401, 0x4, 0x400009, 0xa1}, {0x3, 0x6e2, 0x2, 0x6f5fc48f}, {0x3, 0x101, 0x3, 0xc}, {0x9be2, 0x1, 0x2, 0x400}]}) ftruncate(r0, 0x7241ff58) poll(&(0x7f0000000000), 0x35, 0x0) close(0x3) syz_emit_ethernet(0x6e, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd609907a600382c03cb697a653e336f000000500000000000ff0200000000000000000e00000000013c000006000000000200907800000003690000000006160800000000000000000000000000000000fe8000000000000000000000000000bb"]) 171.249116ms ago: executing program 3 (id=4): recvmsg(0xffffffffffffffff, 0x0, 0x0) r0 = geteuid() r1 = semget(0x0, 0x1, 0x281) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x2, 0x0, 0x0, 0x8000003}, {0x0, 0x0, 0x40}, {0x46, 0x0, 0x0, 0x37f}]}) ioctl$WSMOUSEIO_SETPARAMS(0xffffffffffffffff, 0x80105727, &(0x7f00000000c0)={&(0x7f0000000040)=[{0x82, 0x7ff}, {0x26, 0x8807}, {0x45, 0x8}, {0x100, 0x200}, {0x24, 0x5}, {0x22, 0x6}], 0x6}) sysctl$kern(&(0x7f00000000c0)={0x1, 0x42}, 0x6, &(0x7f0000000100)="71f91e3471ac0058bc5a91501d94a34b8e5f84cf71b59c7afec37082", &(0x7f0000000080)=0x1918, 0x0, 0xffac) getsockopt$sock_cred(r2, 0xffff, 0x1022, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000000140)=0xc) setresgid(0x0, r4, 0x0) semctl$IPC_SET(r1, 0x0, 0x1, &(0x7f0000000780)={{0x0, r4, r3, r4, 0x8f, 0x9, 0x0, 0x0, 0x62}, 0x0, 0x6, 0x0, 0x0, 0x1, 0x0, 0x200000000005}) chown(&(0x7f0000000000)='./file0\x00', r0, r4) 58.971582ms ago: executing program 1 (id=11): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000001200), 0x10000, 0x0) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$DIOCRSETTFLAGS(r1, 0xc450444a, &(0x7f0000000280)={{'./file0\x00', './file0\x00', 0x1, 0xfb}, 0x0, 0x428, 0xa30c333, 0x0, 0x1, 0xf2e, 0x400, 0x2, 0x1020003}) (async) ioctl$BIOCSETWF(r0, 0x80104277, &(0x7f0000001280)={0x2, &(0x7f0000001240)=[{0x0, 0x4, 0x5, 0x86d}, {0x9c, 0xb, 0xfe, 0x10001}]}) 58.447715ms ago: executing program 1 (id=12): ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc2585601, &(0x7f00000000c0)={0x10, 0xfffffffffffffffd, [{&(0x7f00000c7000/0x3000)=nil, &(0x7f0000ff6000/0x6000)=nil, 0x1}, {&(0x7f00004d7000/0x2000)=nil, &(0x7f0000698000/0x1000)=nil, 0x3}, {&(0x7f00005fd000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x1}, {&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff7000/0x3000)=nil, 0x80}, {&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff1000/0x1000)=nil, 0xc}, {&(0x7f00004f8000/0x2000)=nil, &(0x7f000068e000/0x12000)=nil, 0x2000000000000000}, {&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ff2000/0x2000)=nil, 0x7}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000696000/0x2000)=nil, 0xffffffffffffffff}, {&(0x7f000013f000/0x2000)=nil, &(0x7f0000445000/0x3000)=nil, 0xfffffffffffffffd}, {&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000445000/0x4000)=nil, 0x8}, {&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000695000/0x1000)=nil, 0xffffffff}, {&(0x7f00007f8000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x43}, {&(0x7f00000c6000/0x2000)=nil, &(0x7f0000668000/0x4000)=nil}, {&(0x7f000051f000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, 0x4}, {&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ffa000/0x6000)=nil}, {&(0x7f0000ff1000/0x1000)=nil, &(0x7f0000010000/0x3000)=nil, 0x1}], './file0\x00', 0x0, 0x0, 0x0, 0xfffffffe, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}) r0 = socket$inet(0x2, 0x8003, 0x0) setsockopt(r0, 0x0, 0x22, 0x0, 0x0) (async) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000, 0x0) (async) r1 = open(&(0x7f0000000100)='./file0\x00', 0x70e, 0x0) ioctl$FIONREAD(r1, 0x80206910, &(0x7f00000001c0)) (async) syz_emit_ethernet(0x32, &(0x7f0000000040)={@local, @random="00000c000001", [], {@arp={0x806, @generic={0x1, 0x805d, 0x6, 0x0, 0x1, @broadcast, "", @random="508e55a27239", "20ff0100"}}}}) 57.974524ms ago: executing program 6 (id=7): mknod(&(0x7f0000000040)='./file0\x00', 0x40, 0x0) (async, rerun: 64) select(0x0, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64) mknod(&(0x7f0000000100)='./bus\x00', 0x2062, 0xd02) r0 = openat$wsmouse(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) ioctl$WSMOUSEIO_SETPARAMS(r0, 0x80105728, &(0x7f0000000300)={&(0x7f0000000440)}) munmap(&(0x7f0000001000/0x2000)=nil, 0x2000) socket(0x18, 0x1, 0x6) (async, rerun: 32) r1 = shmget$private(0x0, 0x2000, 0x3b4, &(0x7f0000001000/0x2000)=nil) (rerun: 32) r2 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$BIOCLOCK(r2, 0x20004276) ioctl$BIOCIMMEDIATE(r2, 0x8010427e, &(0x7f0000000040)=0x8) (async) ioctl$BIOCSRTIMEOUT(r2, 0x8010426d, &(0x7f0000000080)={0x5, 0x1}) (async) shmat(r1, &(0x7f0000001000/0x3000)=nil, 0x0) (async) r3 = open(&(0x7f0000000040)='./bus\x00', 0x8, 0xf8) preadv(r3, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/92}, {&(0x7f0000000140)=""/192, 0x100000}, {&(0x7f0000000340)=""/175}, {&(0x7f0000000000)=""/18, 0x9}], 0x10000000000002b8, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) 50.895978ms ago: executing program 5 (id=6): munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0xa, 0x3, 0x1, 0x8}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x2, 0x0, 0xac1400ff}, 0x10) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) r0 = socket(0x2, 0x3, 0x1) connect$unix(r0, &(0x7f0000000000), 0x10) sendto(r0, 0x0, 0x0, 0xc, &(0x7f0000000240)=@un=@abs={0x9, 0x1, 0x0, 0x0}, 0x8) mknod(&(0x7f0000000040)='./bus\x00', 0x2000, 0xd02) openat$bpf(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = open(&(0x7f0000000040)='./file1\x00', 0x18289, 0x1a0) write(r1, &(0x7f00000004c0)="b96abcf5ac7cffa09ea845315c0d853a14", 0xffffff1c) mquery(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x400) sysctl$kern(&(0x7f0000005f00)={0x1, 0x58}, 0x2, &(0x7f0000005f40), 0x0, 0x0, 0x0) 20.295521ms ago: executing program 0 (id=13): ftruncate(0xffffffffffffffff, 0x0) setrlimit(0x8, &(0x7f0000000740)={0xb, 0x53}) r0 = syz_open_pts() close(r0) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x285b9c) select(0x40, &(0x7f0000000180)={0xfffffffffffffff9, 0x40, 0x16cf8ee, 0xfffffffffffffffd, 0x7, 0x181c, 0x8, 0x2000000000000084}, 0x0, 0x0, 0x0) r1 = kqueue() kevent(r1, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) r2 = open(&(0x7f0000000080)='./file0\x00', 0x10, 0xe0) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x2) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) mknod(&(0x7f0000000000)='./file1\x00', 0x2000, 0x285b9a) r3 = open(&(0x7f0000000080)='./file1\x00', 0x40, 0x132) ioctl$FIONBIO(r3, 0xc0307004, &(0x7f0000000140)=0x1) syz_open_pts() ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000180)={0x9210, 0x9, 0xffffdf82, 0xffffffd4, "08955c1cfac164eb0a07fa23b8aa291cfcf20800", 0x4000000, 0x2}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) mknod(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x40000802) r4 = open(&(0x7f0000000100)='./file0\x00', 0x80, 0x8) mknod(&(0x7f0000000000)='./bus\x00', 0x3a0914c44f7b202d, 0x504) r5 = open(&(0x7f0000000040)='./bus\x00', 0x1, 0x11c) ioctl$TIOCSETD(r5, 0x8004741b, &(0x7f0000000080)=0x7) ioctl$TIOCSETD(r4, 0x8004741b, &(0x7f0000000080)=0x7) r6 = socket(0x2, 0x8002, 0x0) r7 = fcntl$dupfd(r6, 0x2, 0xffffffffffffffff) closefrom(r7) unveil(0x0, &(0x7f0000000040)='c\x00') socket(0x2, 0x8002, 0x0) r8 = fcntl$dupfd(r1, 0xc, r5) closefrom(r8) 13.465748ms ago: executing program 1 (id=14): sysctl$vfs_nfs(&(0x7f0000000080)={0xa, 0x2, 0x1}, 0x3, 0x0, 0x0, 0x0, 0x3) (async) r0 = socket(0x11, 0x3, 0x0) sendto$unix(r0, &(0x7f0000000180)="b1000503000004000000000205000000dc8518e9cea10500fef96ec0300100007ae30200004e3039d2d236acf20b7810be38164991f7c8cf5f882b29ffffff7f000000510100ad090000006c0000009b672f4d335c223e7d0c032bfa896443a4210200040000000000000070c1f5a872c881ea6e2ec5890400000000008000361b1257aea8063076000000000000000004bfba353e4b24b23b7d8dc80ff4f707e37183f834371205d1a7f1c057aa1a3300644759906057d517fe0b82da70b6d01810ecd5779c9bc3815110b805dcb54444bb7ccd5834e3b6e88beb1b0a2212ff777419db2c835ea2bacf354c53e7153263e33c4164efb6b4ae89fb2b5d889107fd63aecdb9488c9289d604bbc6243c77cbcf71ec0f20ff7e38ca5c10d512a232c2fc417b3ea90c4c5c36776a8bd652ff1cb26743d976c24baf8e2ef6b3fe592ee2d09048badbc412452d57121a8f9183129d02625525dbb0d8d2db4e9bcec812cc698e1cce9a7fc1127fc36517085577642dcec99d2950f02e84237f", 0xb1, 0x80e, 0x0, 0x5a) (async) sysctl$vm_swapencrypt(&(0x7f00000000c0), 0x3, 0x0, 0x0, 0x0, 0x0) (async) ftruncate(0xffffffffffffffff, 0xffffffffffffffff) (async) sysctl$vm(&(0x7f0000000000)={0x2, 0x8}, 0x400000ea, 0x0, 0x0, 0x0, 0x54) (async) pwritev(0xffffffffffffffff, &(0x7f0000001440)=[{&(0x7f0000000440)="ae593731695d3f65beffbd50f12998b0026887ad08f572dc1f18c8880cb549ee431c2ae1771b4c305ffbce08cfc5ad738294d003e49cc1f01ea4d99eb541af8de9703be2f0781b6713d91d5c41053767eafacdcc0ad218d2e5128a85c8331975da378bbc7e7e3e772024437e14e1a86ab8f6493a69b6079e236e5f53dd785b22a6211205644a6f33144ad695e7dbc7ef1ec70009785ea9d39d800124660f1c119b8b6f4f25bdb917267b023d9ebc570956ec3ca636313c12e0ab2a477ed74e885dbdaf84efd544091b0bdb5ea82824e956020a5b322f07cd92f5184177a24ed52448c35718fb8b53780683899537c460857b289695daddae3b043f4942ad9363cbe71887df2c9f21eca2287209fba69db8240952a243b1b082580ed5c278ad40528a91251483753748ce699915d8ebacfd4e105c44b839632536d3bacf8c7438baa3a8747d1d79d8d18d683892f03de4d5052e479f91c58a74b9e503dd1edfb6ea51d9244ce0aa7782619d453e09d8a78c8850751fdc9ae21c9ee72f0dea3c07260806631cab028f7c00e4f45835a03b3d502f4d9036005ff7b81a0c8f25d0f846c4352be29846acb9665264d39433ac9c99fdc3a2babd09ba2f00e043761dcb0020789858fb232a22b7a09cceac467f796c9f64dd370d61496c8df3a5e1820d44c4f5230bda32801093b2481644a36cf32bf9e8a1cc639006d07562593c09e86d3dc01552fca4af4e4edb6e92922eb15f294db6e02a72277c73d5bd1aa1196edc5df32fc505204d39e42557e64c5c1352512d6f888785656cf765fd230657b466fdbb0aa152767623e8fac6256424f49d98d53491c266f743773a0c565572eb3e0d3798a5dff6848a3109d62c75cfe11f72fee21abfbcca8f4be9a9fa87f81cc3b66ac8916b0dfaddeba7b6f4bb5ebf9bf60ceb00dd9c2134569e9a3607c28aac783220c6ac9d143814155c11c68dbaf314913ffefa6a2cbf43ec1b98ed0a0de428567b42e031dd2efdae14c1ece0d6c14a5ae24f60994799820b7e142acfeca18c7103af4c6b21ac1f0174cf6dd0a1d445ce6d82b4add00111b7185833563ff7627a1ea65ae48a0b090e141eb04660d5a9e3f7478e0e855a78955a46e11b8c6f0eae3d8b25348d3358d27ee53f8a7070e7b9255fccd3b34251259cf93522815c15a9466b14dbfe6bf080fa34e866dc2f8e9350e57e00b17b62323d74b9c7f0dbb520b56031e452996be94407fcf22a104760dadc568f79dd9907cb4fdab6216cb19713658ff60599f8e4fe82e633f66ad413ae80cacf3230b0a5764269f41862436a890879b56eaf9c8e318a74ec988fdbc0d2b18c3612cd1e18f37bf17d770ccd38dd20a971ed8d5c882a2470949696359e7558ddc34d7c152dbbfffef306dec7ad778e52ef16487e7764b3b5650c3dd0da013ab0ab63dac72b9199a06617650a70b006c861663653768bad8cdff3d8f5261dd863649eba0ce9528a3c7c47814e423bf26bb9313dfb1563068c6095f80e738b7599867df9c04c775f684ccf34660bc4ff914de446f59a3be19da115ac56fd4a13cea4e1cfe152d9373ed1d419f0a4e64c892e4f0056d0c4cfa26b2619296c00e0d25961c66f2904e5206bcf88037725dffda3c85e02f0ed18acee087399211f9bebf463fcfef50805d99b99f325dfb500f740f21b2a77cbda665d91b13878fc4c6f71f9e5e9a9e486fc5f2aa6c67365b2a810c144d7f545684ad39ce90baf539ddc730138760683b11c8c584c00fd30e065d7a03924cc21765dbd8ffdebb2ae542b73236ce718ad6c7640118470f1a1add7c5e478f0233d57275a5a2bf64a6eaa71f421aa226f0e78b79ac41b2e7169fe0a41939c6820ab3f6b123d91dc30919b8cb352b348792a8dd67901226a1223d8e0bb339dfb351ce52f09211403d38d79ad614ef6fe0df36e38dc99782774a3a5f759b0eadef5718a7e9fa67efde7ec745b0f88c895b016a5eb2fda35c766f72514608cb998ed0e437091dbb64128d6f2b3b0e61a839fea233b2d4a1e1ce08c3476e960547df92af16cb6ca288776c43301a8bb544d68eb85a2573947d1edd82d30c20b65cf2db0e179276f7106a050bb4121ed5a4ba345201f6c3f4e811e14e293e20cf91d75886ae513f62c5faf7dfab0980851df9a0e8b6a761fd36874bb280a9922c0fb18a222580ecfec4442a32de4ea920290e39e2ed49e662764d46a171c5e817d334d937e0d4d30f9baa3c946c158bda8c9231fa93371f1053f53bfe38ba2fbd12bac2cdff3e2b6d2fd6c4cd4834496fac88ccebc4c476f2c85b3da55da1398a26c8aba7f4e2bb48e9e454d070a9613bcd43180ad06c620f4c138da572e8c4c83ddf9b7a3058127e8a953db91ac915a4c06104d769040c542c10628673f97f7dbb5bf8188c450daa01c67f35bd858b841a6563169c241d0bbcc6dc34e6250a9122511388ef0c97062b3d2cdaa8691887a8ed312d14c48b073e92c804d5f0a7ff04b39bbf10e28dfd96fa1b9ffd7f7df0bef257b61057f061c0b15b0743ba2b333c9ab7575e8fc27574b64c12b99047f0c69e09e9f8282b59660aaf44b3da52e69f7d54ce802718871d7b772478b1d96f883b6ffb00a659a31f6ea842f1e6291e174eb9a7c67c26fdcb8eda8ea57af0fe2ead918a31f056626c39e19239968bc861d06e4f617a6726676f45e4b49fbbdbb117a0371191347e300074457489d327bdd7f70ebbf4458fd2553d4660a804094fc07878d1c07a391facc2bbc4cdf2f568123f57d80b255c8154e7fd5c98d8df5e9a82eba645dc90215bf0cebb48843963717e1b00869bfcda3b8e21e5dea183ec23cb723bdcafe38c9abf7e10b124b21689c17836228fff29cbf1e34fd46250390365cf71f5946fcb9fcd530e9374b5c051a17e818d0a88d92d048b11df7f7019bb43017cc2243f9452392f1eda4694f391ac218c7f2f4bb37b065366d2a007a0c3df56b5441bf0990eb9a062a9817b46e0b20e5c40192fae074e534c726b4717c837605f28796d8517315b3847a6f0bfb8dfb71b1eff2ab6866cbfe0e2b6a4d69bb35b8957eced73be10c7ba9cb79f008a5f810bf4a0d0186c94e05af0646fb9ffc29a35db1499750e436600906526b4129e77a6fd2d9a0fd46a1af00e2d9f7e350df41c4efdeda7cefa35ae96130f980a4277de519ec674763c71681c84517c8b8c5e876295d80067d1010aba96ef63879dfbda4e4b2a78ca43ca373655f5231b513a7c3286ac0f8c4275eccf422dac311be2047fafa6263ad57ad88a179f2b33783d929e88b74fb561eab02c6091d12d34320e13d85f7cb12ce1883751ff7224ceb0f607765dde8b8fdc540ed1a4cb3c82e0493341b2fab4aeb71fd09a407d9ea6d2564ca1d9e0f90e921d77b597d1cf2f95f011adfe13d129eafb70486d9eb9a2c7df4668552555db209a43c956222b5a4372a1ef0a58fad28989940c4fda708560375597c03eb0bf86c6841e8bbe63a799066cd8d0185f9cf8e0f19e83c445acc0680d5f89d3e176a3a17bd69f7fec747f7e8375555cfdb3bed56a71c4174831541902dfcec6f8bbb10b4b343229738a3842cce2683d3dbe41b91ec3e6afebf06fcc44876ac74b7608982a2bce1752632935a18f1800f779af0ec5aea0b83f1cb227e10fc102270980c36cb38b10a95e78b42e9b52f2ddd747b951b05cc59caf700eadf764ea2c3f4d92bcf9688943ad04e376069019d07ecfb0b66f1aa820fbf4d5dd931d52b807ad4a84966a921f0d286f60c58b06e58420718cf7cf4324c0ac68145142405cf048c542053c0f3adb2f36fe822bd03bb931f33a5b6a29f1820f979ea27819129b35330b0f43309c8ed1a0408535d78d040bf921cb2653e5d3f6c18fda5df759bac53097f24e4c940cc7ef6728161040a167866820ad2b33380dc76b60e9136db56e4b9cf9824e66c93d58c9d2e83b6bd916b17faaee31fc0dc0135766677670a3bee21e3588094e53a75ce9de873f31567616c5c9a9f325568f78338f36e70b3d184511c536aafab6eb13c6b784473e98719d47be30069cf7d5eb5a069bcac3eee202503113d4539879be59d8702f2df66683f8a21c83da7e29377a22162c6c565b8f02d40b4bc40300748583c9583832e0376223c1ae0a4cafc6e818154068c0344ce22ec8fc7756ceb03063ce036d3e787027317750ddfbc136bd5c60b750180d40d4ef16a6bce1cb42e9519d3cb7c9ab15cd4b8ce1d77ee52e422a663ed61f1173beb9ace5738bc4187f7dee2f1144a63578f580f7ef6bdc0e57cc4d6bfb613bab5fce52c87576baafa665c9d3e5f73ef257ecc3f2c3c6f092e08a11a8eae29faacffb5951d995143cec378eb7137994b070a209dda61ecba4bc73a278b5d507f1ed5539966794c502ed98ec249aba1272b6e5dc8edc5ecfedf3858e7", 0xc41}], 0x1, 0x3) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) (async) sysctl$ddb(&(0x7f0000000000)={0x9, 0x5}, 0x2, 0x0, 0x0, &(0x7f0000001080), 0x4) (async, rerun: 64) syz_emit_ethernet(0x2e, &(0x7f0000000000)={@local, @broadcast, [], {@ipv4={0x800, {{0x6, 0x4, 0x0, 0x0, 0x20, 0xfffe, 0x0, 0x0, 0x1, 0x0, @multicast2, @empty, {[@lsrr={0x83, 0x3, 0x80}]}}, @icmp=@info_request={0xf, 0x0, 0x0, 0x7, 0xa}}}}}) (async, rerun: 64) kqueue1(0x10004) 4.790997ms ago: executing program 3 (id=15): r0 = openat$pf(0xffffffffffffff9c, &(0x7f00000000c0), 0x80, 0x0) ioctl$DIOCSETTIMEOUT(r0, 0xc008441d, &(0x7f0000000100)={0x0, 0x5}) (async, rerun: 32) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x2000, 0x801) (async, rerun: 32) ioctl$DIOCXROLLBACK(r0, 0xc0104453, &(0x7f00000016c0)={0x5, 0x5, &(0x7f0000000280)=[{0x1, './file0\x00', 0xf26}, {0x0, './file0\x00', 0x6}, {0x0, './file0\x00', 0x4}, {0x1, './file0\x00', 0x7}, {0x0, './file0\x00', 0xfffffff8}]}) (async) r1 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0xc7) setrlimit(0x8, &(0x7f0000000400)={0x42, 0x800000003fb}) r2 = syz_open_pts() close(r2) (async, rerun: 64) r3 = syz_open_pts() (rerun: 64) close(r3) (async) writev(r2, &(0x7f0000000740)=[{0x0}], 0x1) (async) r4 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000080), 0x20, 0x0) ioctl$BIOCSETIF(r4, 0x8020426c, &(0x7f0000000240)={'tap', 0x0}) (async) ioctl$BIOCSBLEN(r4, 0xc0044266, &(0x7f0000000140)=0x10000) (async, rerun: 64) pread(r1, 0x0, 0x0, 0x5) (rerun: 64) 3.31843ms ago: executing program 5 (id=16): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x200000000000c, &(0x7f0000000240)="ea00070100000000", 0xc) setsockopt$inet_opts(r0, 0x0, 0x200000000000c, &(0x7f0000000240)="ea00000100000000", 0x8) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x5900) r1 = openat$vmm(0xffffffffffffff9c, &(0x7f0000000000), 0x8, 0x0) ioctl$WSMUXIO_LIST_DEVICES(0xffffffffffffffff, 0xc1045763, &(0x7f0000000040)={0x0, [{}, {0x1}, {0x0, 0x300}, {0x2, 0x4}, {0x0, 0x4000}, {0x2, 0xe}, {}, {0x3, 0x1}, {}, {0x4}, {}, {0x1}, {0x3, 0x6}, {0x2}, {0x3}, {0x1}, {0x2}, {0x1}, {0x1}, {0x0, 0x100}, {0x3}, {0x0, 0x4}, {0x2}, {0x2}, {0x3}, {0x0, 0x5}, {0x2, 0x1}, {0x0, 0x10000}, {0x1, 0x80000000}, {0x1, 0x6}, {0x0, 0x2}]}) ioctl$TIOCSETD(0xffffffffffffffff, 0x8004741b, &(0x7f0000000080)=0x7) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$VMM_IOC_CREATE(r1, 0xca605601, &(0x7f0000000080)={0x10, 0x9, [{&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x9}, {&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, 0xffffffffffff822d}, {&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x73}, {&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0xb}, {&(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x800000}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0xffffffffffffff89}, {&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x7}, {&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x6}, {&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, 0x6}, {&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x762c}, {&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x6}, {&(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x4}, {&(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x2}, {&(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x7fffffff}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x8001}, {&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0xffffffff}], './file0\x00', 0x5, 0x9, 0x0, 0x8, [0x9, 0x7, 0x6, 0x4, 0x0, 0x3ff, 0x2, 0x8, 0xfff, 0x3, 0x7, 0x401, 0x1, 0x9, 0x4, 0x8, 0x298, 0x5, 0x100, 0x5, 0x8, 0x7, 0x5, 0xffff, 0x1, 0x8, 0x7, 0xd, 0x5e5, 0x6, 0x0, 0xb677, 0x7f, 0x8, 0xa094, 0x2, 0x100, 0x2, 0x1, 0x4, 0x1, 0x9248, 0x100, 0xb, 0x10000, 0x51, 0xfffffffe, 0x81, 0xa, 0x6, 0xd19d, 0xf, 0x24, 0xabf4, 0x6, 0x3, 0x100, 0x4, 0x2, 0x2, 0xd1, 0xb, 0x4, 0xfffffffe, 0x5, 0x6, 0xe, 0x2, 0x7, 0x6, 0x7, 0xfffffff4, 0x4, 0xb370, 0x2, 0x0, 0x2, 0x3ff, 0xfba, 0x7, 0x0, 0x5, 0x7, 0x51, 0xfff, 0xb9, 0x7, 0x5, 0xf, 0x0, 0x1, 0xbe000000, 0x2, 0x1, 0x8, 0xfffffffb, 0x6, 0x7063, 0xa, 0x6, 0x7, 0xa23d, 0x80000001, 0x8, 0x8, 0x9, 0x2, 0x1, 0x6, 0xbc6, 0x5, 0x6, 0x2, 0x2, 0xfff, 0x2, 0x7fffffff, 0x4, 0xffff, 0x5, 0xfffffffc, 0xa000, 0x9, 0x3, 0x3ff, 0x1, 0xd7d9, 0x100, 0xb, 0x1, 0x9, 0x79, 0x2, 0x5, 0xa, 0xb, 0x2, 0x2, 0x5, 0x5, 0xd, 0x9, 0x8001, 0x80000000, 0x52f, 0x5, 0x2, 0x6, 0x5, 0x7a9f, 0xcf, 0x0, 0xea3c, 0x5, 0x8, 0x4, 0x0, 0x3, 0xffffffff, 0x2, 0x9, 0x4, 0x80, 0xf5a, 0x200, 0xfffffc8f, 0x2, 0x5, 0x5, 0x101, 0x0, 0xaf, 0x8, 0x4, 0x5, 0x2, 0x2, 0x6, 0x7fd, 0x7, 0x6, 0x7fff, 0x6, 0x800, 0x21, 0x9, 0x5, 0x8, 0x8, 0x64a, 0x5, 0x7c, 0x2204fbed, 0x0, 0x8, 0x1, 0x10001, 0x800, 0x9, 0x75a1, 0x0, 0x0, 0x32, 0xe04d, 0x4, 0x2, 0x8, 0x100, 0x2, 0x8, 0x9, 0x9229, 0x0, 0xb0, 0xc, 0xe11, 0x891a74b, 0xd39, 0x2, 0x9, 0xe73, 0x6, 0x7, 0x9, 0x7fffffff, 0x5, 0x0, 0x1, 0xfffffff7, 0xc74c, 0xff, 0x8, 0x6, 0x4, 0x8a, 0x8, 0x2, 0x4774, 0x7, 0x3, 0x7, 0x81, 0x3, 0x8, 0x1, 0x2, 0xb, 0x8e6, 0x5, 0x6, 0x80, 0x2, 0x7f, 0xe, 0x80000000, 0x4, 0x4, 0x9, 0x1, 0x1, 0x9, 0x180, 0x401, 0x7, 0x8, 0x81, 0x4c1, 0x0, 0x6, 0x4, 0xf7ffffff, 0x12000, 0x10001, 0x99, 0xba8, 0x1, 0xfffffffb, 0xa, 0x1, 0x200, 0x6b73, 0x0, 0x80, 0x8, 0xef2f, 0x9, 0x0, 0x0, 0xffffffd6, 0x80, 0x1b, 0xe2, 0x0, 0x0, 0x1, 0x1, 0x7, 0xffff, 0x99, 0x8, 0x8, 0xe, 0xfff, 0x3, 0x8, 0x3, 0x8, 0xfffffe00, 0x8000, 0x8, 0xd, 0x1, 0x6, 0x5, 0x0, 0x2, 0x401, 0xbf73, 0x3, 0x7ff, 0x0, 0x5, 0xf, 0x0, 0x4, 0xfffffffc, 0x5, 0xa, 0x6, 0x2, 0x800, 0x2, 0x6, 0x80000000, 0xed, 0x2, 0x7, 0x8, 0x0, 0x6, 0xfffffff9, 0x7, 0x9, 0xffffffff, 0x0, 0x9, 0x1fd, 0xfa7, 0x6, 0x5, 0x9, 0x2c, 0x2, 0xffffffff, 0x7, 0x8, 0x80000000, 0x4ef69553, 0xf, 0xe80, 0x7fffffff, 0x5, 0x1, 0x1, 0x2, 0x61, 0xc, 0x9, 0x800, 0x2, 0x100, 0xfffffffa, 0x2, 0x1, 0x10000, 0x3, 0x51, 0x8, 0x0, 0x1, 0x5ed, 0x2, 0x9, 0x22, 0x2, 0x8001, 0xdf, 0x5, 0x6, 0x5, 0x4d7e, 0x5, 0x6, 0x62e4, 0x9, 0x7ff, 0x101, 0x5c, 0x93, 0x6, 0xe, 0xe14, 0x6, 0x8, 0x3, 0x101, 0x5, 0x8001, 0x81, 0x0, 0x1, 0x4, 0x1, 0x9, 0xfffffffa, 0x1000, 0xfff, 0x7fff, 0x75da, 0x2, 0x1, 0xb1a, 0x827, 0x8, 0x81, 0x80000000, 0x9, 0x0, 0x4, 0xd, 0x7, 0xfffffffa, 0x1, 0x1, 0x3, 0x2, 0x50b, 0x10000, 0x5, 0x80e, 0x4, 0xd92, 0x4, 0x40, 0x3, 0xd59, 0x2, 0x4, 0xa53d, 0x8, 0x7, 0xb63, 0xd, 0x4, 0x2, 0x1, 0x5, 0x10, 0x8001, 0x0, 0x8, 0x4, 0x2, 0x9, 0x8001, 0x7fffffff, 0x9, 0x4, 0x8, 0x4, 0x8, 0xffffffff, 0x7f, 0x7fffffff, 0x4, 0x3, 0x7, 0x7, 0x8, 0x10000, 0xb, 0xbb5c, 0x3, 0xa, 0x80000001, 0x7, 0x132, 0x80000001, 0x5, 0xa, 0x2, 0x0, 0x80000000, 0x200, 0xa, 0xa0d, 0xff, 0x4, 0xcf71, 0x1e46c000, 0x9, 0xe, 0xb, 0xfffffffd, 0xf2, 0x7, 0x1000, 0x9, 0x9, 0x1000, 0x5, 0x80000001]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r2 = socket(0x18, 0x3, 0x0) setsockopt(r2, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000000)="8d6bb855", 0x4}], 0x1) msgrcv(0x0, &(0x7f0000000040)={0x0, ""/4096}, 0x1008, 0x1, 0x1000) msgctl$IPC_SET(0x0, 0x1, &(0x7f00000018c0)={{0x0, 0x0, 0x0, 0x0, 0x10a, 0x2, 0x0, 0x0, 0x18}, 0x0, 0x0, 0x1, 0x7fffffffffffffff, 0x2, 0x0, 0x0, 0x3, 0x0, 0x3, 0x0, 0xfffffffffffffff2}) msgsnd(0x0, &(0x7f0000001a80)={0x3, "a1e1ccf045a66b806fa9760aaddea37f743ed5d4eb7eafef07575cdd488f64c0694a85a02d944bb7a205fe4b74db5e84ca34840bcbb843101f876b8bb20fc25ca35bc047ee6c24f481568d718b51330243ac3383107b43c014c55da61da50e"}, 0x67, 0x800) r3 = socket$inet(0x2, 0x8003, 0xfc) ioctl$FIONREAD(r3, 0x80206979, &(0x7f0000000000)) connect$inet6(r2, &(0x7f0000000080)={0x1c, 0x18, 0x1, 0x1ff, "e9762081a9638dec9d7bf50d9832f56e", 0xb}, 0x1c) r4 = socket(0x2, 0x8002, 0x0) r5 = fcntl$dupfd(r4, 0x2, r4) closefrom(r5) mkdir(&(0x7f0000000080)='.\x00', 0x0) 2.060602ms ago: executing program 7 (id=17): r0 = openat$vmm(0xffffffffffffff9c, &(0x7f0000000000), 0x8, 0x0) ioctl$WSMUXIO_LIST_DEVICES(0xffffffffffffffff, 0xc1045763, &(0x7f0000000040)={0x0, [{}, {0x1}, {0x0, 0x300}, {0x2, 0x4}, {0x0, 0x4000}, {0x2, 0xe}, {}, {0x3, 0x1}, {}, {0x4}, {}, {0x1}, {0x3, 0x6}, {0x2}, {0x3}, {0x1}, {0x2}, {0x1}, {0x1}, {0x0, 0x100}, {0x3}, {0x0, 0x4}, {0x2}, {0x2}, {0x3}, {0x0, 0x5}, {0x2, 0x1}, {0x0, 0x10000}, {0x1, 0x80000000}, {0x1, 0x6}, {0x0, 0x2}]}) ioctl$TIOCSETD(0xffffffffffffffff, 0x8004741b, &(0x7f0000000080)=0x7) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$VMM_IOC_CREATE(r0, 0xca605601, &(0x7f0000000080)={0x10, 0x9, [{&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x9}, {&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, 0xffffffffffff822d}, {&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x73}, {&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0xb}, {&(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, 0x800000}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0xffffffffffffff89}, {&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x7}, {&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x6}, {&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, 0x6}, {&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x762c}, {&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x6}, {&(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x4}, {&(0x7f0000ff9000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x2}, {&(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x7fffffff}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x8001}, {&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff9000/0x2000)=nil, 0xffffffff}], './file0\x00', 0x5, 0x9, 0x0, 0x8, [0x9, 0x7, 0x6, 0x4, 0x0, 0x3ff, 0x2, 0x8, 0xfff, 0x3, 0x7, 0x401, 0x1, 0x9, 0x4, 0x8, 0x298, 0x5, 0x100, 0x5, 0x8, 0x7, 0x5, 0xffff, 0x1, 0x8, 0x7, 0xd, 0x5e5, 0x6, 0x0, 0xb677, 0x7f, 0x8, 0xa094, 0x2, 0x100, 0x2, 0x1, 0x4, 0x1, 0x9248, 0x100, 0xb, 0x10000, 0x51, 0xfffffffe, 0x81, 0xa, 0x6, 0xd19d, 0xf, 0x24, 0xabf4, 0x6, 0x3, 0x100, 0x4, 0x2, 0x2, 0xd1, 0xb, 0x4, 0xfffffffe, 0x5, 0x6, 0x7, 0x2, 0x7, 0x6, 0x7, 0xfffffff4, 0x4, 0xb370, 0x2, 0x0, 0x2, 0x3ff, 0xfba, 0x7, 0x0, 0x5, 0x7, 0x51, 0xfff, 0xb9, 0x7, 0x5, 0xf, 0x0, 0x1, 0xbe000000, 0x2, 0x1, 0x8, 0xfffffffb, 0x6, 0x7063, 0xa, 0x6, 0x7, 0xa23d, 0x80000001, 0x8, 0x8, 0x9, 0x2, 0x1, 0x6, 0xbc6, 0x5, 0x6, 0x2, 0x2, 0xfff, 0x2, 0x7fffffff, 0x4, 0xffff, 0x5, 0xfffffffc, 0xa000, 0x9, 0x3, 0x3ff, 0x1, 0xd7d9, 0x100, 0xb, 0x1, 0x9, 0x79, 0x2, 0x5, 0xa, 0xb, 0x2, 0x2, 0x5, 0x5, 0xd, 0x9, 0x8001, 0x80000000, 0x52f, 0x5, 0x2, 0x6, 0x5, 0x7a9f, 0xcf, 0x0, 0xea3c, 0x5, 0x8, 0x4, 0x0, 0x3, 0xffffffff, 0x2, 0x9, 0x4, 0x80, 0xf5a, 0x200, 0xfffffc8f, 0x2, 0x5, 0x5, 0x101, 0x0, 0xaf, 0x8, 0x4, 0x5, 0x2, 0x2, 0x6, 0x7fd, 0x7, 0x6, 0x7fff, 0x6, 0x800, 0x21, 0x9, 0x5, 0x8, 0x8, 0x64a, 0x5, 0x7c, 0x2204fbed, 0x0, 0x8, 0x1, 0x1, 0x800, 0x9, 0x75a1, 0x0, 0x0, 0x32, 0xe04d, 0x4, 0x2, 0x8, 0x100, 0x2, 0x8, 0x9, 0x9229, 0x0, 0xb0, 0xc, 0xe11, 0x891a74b, 0xd39, 0x2, 0x9, 0xe73, 0x6, 0x7, 0x9, 0x7fffffff, 0x5, 0x0, 0x1, 0xfffffff7, 0xc74c, 0xff, 0x8, 0x6, 0x4, 0x8a, 0x8, 0x2, 0x4774, 0x7, 0x3, 0x7, 0x81, 0x3, 0x8, 0x1, 0x2, 0xb, 0x8e6, 0x5, 0x6, 0x80, 0x2, 0x7f, 0xe, 0x80000000, 0x4, 0x4, 0x9, 0x1, 0x1, 0x9, 0x180, 0x401, 0x7, 0x8, 0x81, 0x4c1, 0x0, 0x6, 0x4, 0xf7ffffff, 0x12000, 0x10001, 0x99, 0xba8, 0x1, 0xfffffffb, 0xa, 0x1, 0x200, 0x6b73, 0x0, 0x80, 0x8, 0xef2f, 0x9, 0x0, 0x0, 0xffffffd6, 0x80, 0x1b, 0xe2, 0x0, 0x0, 0x1, 0x1, 0x7, 0xffff, 0x99, 0x8, 0x8, 0xe, 0xfff, 0x3, 0x8, 0x3, 0x8, 0xfffffe00, 0x8000, 0x8, 0xd, 0x1, 0x6, 0x5, 0x0, 0x2, 0x401, 0xbf73, 0x3, 0x7ff, 0x0, 0x5, 0xf, 0x0, 0x4, 0xfffffffc, 0x5, 0xa, 0x6, 0x2, 0x800, 0x2, 0x6, 0x80000000, 0xed, 0x2, 0x7, 0x8, 0x0, 0x6, 0xfffffff9, 0x7, 0x9, 0xffffffff, 0x0, 0x9, 0x1ff, 0xfa7, 0x6, 0x5, 0x9, 0x2c, 0x2, 0xffffffff, 0x7, 0x8, 0x80000000, 0x4ef69553, 0xf, 0xe80, 0x7fffffff, 0x5, 0x1, 0x1, 0x2, 0x61, 0xc, 0x9, 0x800, 0x2, 0x100, 0xfffffffa, 0x2, 0x1, 0x10000, 0x3, 0x51, 0x8, 0x0, 0x1, 0x5ed, 0x2, 0x9, 0x22, 0x2, 0x8001, 0xdf, 0x5, 0x6, 0x5, 0x4d7e, 0x5, 0x6, 0x62e4, 0x9, 0x7ff, 0x101, 0x5c, 0x93, 0x6, 0xe, 0xe14, 0x6, 0x8, 0x3, 0x101, 0x5, 0x8001, 0x81, 0x0, 0x1, 0x4, 0x1, 0x9, 0xfffffffa, 0x1000, 0xfff, 0x7fff, 0x75da, 0x2, 0x1, 0xb1a, 0x827, 0x8, 0x81, 0x80000000, 0x9, 0x0, 0x4, 0xd, 0x7, 0xfffffffa, 0x1, 0x1, 0x3, 0x2, 0x50b, 0x10000, 0x5, 0x80e, 0x4, 0xd92, 0x4, 0x40, 0x3, 0xd59, 0x2, 0x4, 0xa53d, 0x8, 0x7, 0xb63, 0xd, 0x4, 0x2, 0x1, 0x5, 0x10, 0x8001, 0x0, 0x8, 0x4, 0x2, 0x9, 0x8001, 0x7fffffff, 0x9, 0x4, 0x8, 0x4, 0x8, 0xffffffff, 0x7f, 0x7fffffff, 0x4, 0x3, 0x7, 0x7, 0x8, 0x10000, 0xb, 0xbb5c, 0x3, 0xa, 0x80000001, 0x7, 0x132, 0x80000001, 0x5, 0xa, 0x2, 0x0, 0x80000000, 0x200, 0xa, 0xa0d, 0xff, 0x4, 0xcf71, 0x1e46c000, 0x9, 0xe, 0xb, 0xfffffffd, 0xf2, 0x7, 0x1000, 0x9, 0x9, 0x1000, 0x5, 0x80000001]}) mknod(&(0x7f0000000080)='./bus\x00', 0x2000, 0x205b1a) r1 = open(&(0x7f0000000080)='./bus\x00', 0x2, 0x0) setsockopt$inet_opts(r1, 0x0, 0x1, &(0x7f00000000c0)="28210e8babb6d0d1877742184d4114e82f199f0da88b8da8e3c36456cba4b1d84f3b3a306577dc5dc3e80293be62ba0b7b7253d6e2718701f8fe0ca6112aeb492ca4ca65b591c564f5545c89afd1a306a098c73973047b81a7483893a6129703d1f320cc8b72560b20886460bcf478700eb29d85830f2626b4a6081a3ce28f01f9fc3f61d4d887772f7022874404dde9f22914854e345e958db9930b1cd922968e1a4a7146e7e1114c86ed585b411127b5c4ccfc0bc2391ae233e302cfe464e42293a546b73e05d69eeb4259c8df0d009bd288ee1df72ca6224d8d5da1", 0xdd) pwritev(r1, &(0x7f0000001840)=[{0x0, 0x5b}, {0x0}, {0x0}, {0x0}, {0x0, 0x4e}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0xfffffffffffffffd) 0s ago: executing program 4 (id=18): ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x0, {0x0, 0x10000100000002}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) socket$inet(0x2, 0x1, 0x0) r0 = socket$inet6(0x18, 0x2, 0x0) setsockopt(r0, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9f93fcaaa4ea3654e789931", 0x11) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f0000000240)={&(0x7f0000000b80)=@in6={0x1c, 0x18, 0x2, 0x7f, "00007001000000000070000000000001", 0x100}, 0x1c, 0x0, 0x0, 0x0}, 0x2) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.252' (ED25519) to the list of known hosts. pppx: unable to set addresses for pppx1, error=17 panic: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 959 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 313401 44932 0 0 0 0 syz-executor * 2506 44932 0 0 0x4000000 1K syz-executor db_enter() at db_enter+0x25 panic(ffffffff834c6c06) at panic+0x1e5 __assert(ffffffff83502443,ffffffff8350f892,3bf,ffffffff8353820e) at __assert+0x29 refcnt_finalize(ffff800030f92b20,ffffffff834b9a59) at refcnt_finalize+0x1e7 pppx_if_destroy(ffff80002ab83000,ffff800030f92b18) at pppx_if_destroy+0x3d pppxclose(285b9c,1,2000,ffff80002a22aa78) at pppxclose+0xa0 spec_close(ffff80003c3ef8f0) at spec_close+0x417 VOP_CLOSE(fffffd806c52e0e0,1,fffffd80097fd548,ffff80002a22aa78) at VOP_CLOSE+0x132 vn_closefile(fffffd80669a04b0,ffff80002a22aa78) at vn_closefile+0x12b fdrop(fffffd80669a04b0,ffff80002a22aa78) at fdrop+0x121 closef(fffffd80669a04b0,ffff80002a22aa78) at closef+0x192 sys_closefrom(ffff80002a22aa78,ffff80003c3efbc0,ffff80003c3efb10) at sys_closefrom+0x13c syscall(ffff80003c3efbc0) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xd67f4ed2c00, count: 1 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 959 ddb{1}> show kasan No such command ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff834c6c06) at panic+0x1e5 __assert(ffffffff83502443,ffffffff8350f892,3bf,ffffffff8353820e) at __assert+0x29 refcnt_finalize(ffff800030f92b20,ffffffff834b9a59) at refcnt_finalize+0x1e7 pppx_if_destroy(ffff80002ab83000,ffff800030f92b18) at pppx_if_destroy+0x3d pppxclose(285b9c,1,2000,ffff80002a22aa78) at pppxclose+0xa0 spec_close(ffff80003c3ef8f0) at spec_close+0x417 VOP_CLOSE(fffffd806c52e0e0,1,fffffd80097fd548,ffff80002a22aa78) at VOP_CLOSE+0x132 vn_closefile(fffffd80669a04b0,ffff80002a22aa78) at vn_closefile+0x12b fdrop(fffffd80669a04b0,ffff80002a22aa78) at fdrop+0x121 closef(fffffd80669a04b0,ffff80002a22aa78) at closef+0x192 sys_closefrom(ffff80002a22aa78,ffff80003c3efbc0,ffff80003c3efb10) at sys_closefrom+0x13c syscall(ffff80003c3efbc0) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xd67f4ed2c00, count: -14 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff80003c3ef6b0 rbx 0xffff80002999ee0f rdx 0xffff8000015d6a80 rcx 0xffff80002a22aa78 rax 0xffff80002999dff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x8aa275cce9b6948 r11 0x7ed748585973c56a r12 0xffff80002999ec10 r13 0 r14 0 r15 0x1 rip 0xffffffff82cc24f5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80003c3ef6a0 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor) tid=2506 pid=44932 tcnt=3 stat=onproc flags process=0 proc=4000000 runpri=32, usrpri=54, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a22ba08,0xffffffff83b0d768 process=0xffff800045fec018 user=0xffff80003c3ea000, vmspace=0xfffffd806ceabb88 estcpu=4, cpticks=1, pctcpu=0.0, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S PRLAGS PFLAGS WAIT COMMAND 25533 69722 20907 0 2 0 0 syz-executor 25533 349122 20907 0 3 0 0x4000080 fsleep syz-executor 33629 468372 46491 0 3 0 0x80 nanoslp syz-executor 33629 147704 46491 0 2 0 0x4000000 syz-executor 33629 505026 46491 0 3 0 0x4000080 fsleep syz-executor 33629 12673 46491 0 3 0 0x4000080 fsleep syz-executor 44932 313401 82766 0 7 0 0 syz-executor 44932 519317 82766 0 3 0 0x4000000 smrbar syz-executor *44932 2506 82766 0 7 0 0x4000000 syz-executor 31182 443024 38926 0 2 0 0 syz-executor 31182 190794 38926 0 3 0 0x4000080 fsleep syz-executor 31182 29812 38926 0 3 0 0x4000080 kqsel syz-executor 31182 358918 38926 0 3 0 0x4000080 fsleep syz-executor 9500 412578 69580 0 2 0x2 0 sh 18745 373601 20561 0 3 0x2 0x80 piperd syz-executor 38926 429037 20561 0 3 0x2 0x80 nanoslp syz-executor 20907 126483 20561 0 3 0x2 0x80 nanoslp syz-executor 90264 231391 20561 0 3 0x2 0x80 piperd syz-executor 46491 221071 20561 0 3 0x2 0x80 nanoslp syz-executor 69580 211253 20561 0 3 0x2 0x80 wait syz-executor 82766 415710 20561 0 3 0x2 0x80 nanoslp syz-executor 20561 394641 51067 0 3 0x2 0x80 wait syz-executor 51067 291709 87412 0 3 0x100002 0x88 sigsusp ksh 87412 286264 31 0 3 0x10 0x88 kqread sshd-session 31 286272 11032 0 3 0x12 0x80 kqread sshd-session 51391 337637 1 0 3 0x100003 0x80 ttyin getty 11032 97327 1 0 3 0 0x88 kqread sshd 36061 396637 46947 74 3 0x1100012 0x80 bpf pflogd 46947 161214 1 0 3 0 0x80 sbwait pflogd 40587 71144 7338 73 3 0x1100010 0x80 kqread syslogd 7338 104407 1 0 3 0x100002 0x80 sbwait syslogd 22988 297789 1 0 3 0x100000 0x80 kqread resolvd 90116 411288 39490 77 3 0x100012 0x80 kqread dhcpleased 66676 499926 39490 77 3 0x100012 0x80 kqread dhcpleased 39490 510929 1 0 3 0 0x80 kqread dhcpleased 81973 218388 0 0 3 0x14000 0x200 bored smr 67999 434974 0 0 2 0x14000 0x200 zerothread 86434 422899 0 0 3 0x14000 0x200 aiodoned aiodoned 11920 295668 0 0 3 0x14000 0x200 syncer update 97286 115953 0 0 3 0x14000 0x200 cleaner cleaner 74805 64864 0 0 3 0x14000 0x200 reaper reaper 20371 148685 0 0 3 0x14000 0x200 pgdaemon pagedaemon 81861 185762 0 0 3 0x14000 0x200 bored viomb 77709 280974 0 0 3 0x14000 0x40000200 acpi0 acpi0 65553 289534 0 0 3 0x14000 0x40000200 idle1 4147 38050 0 0 3 0x14000 0x200 bored softnet1 69891 496351 0 0 3 0x14000 0x200 bored softnet0 93445 454424 0 0 3 0x14000 0x200 smrbar systqmp 71478 412597 0 0 3 0x14000 0x200 bored systq 32055 100501 0 0 3 0x14000 0x200 tmoslp softclockmp 67785 149293 0 0 3 0x14000 0x40000200 tmoslp softclock 27770 352631 0 0 3 0x14000 0x40000200 idle0 1 157058 0 0 3 0x2 0x80 wait init 0 0 -1 0 3 0x10000 0x200 scheduler swapper ddb{1}> show all locks Process 44932 (syz-executor) thread 0xffff80002a22aa78 (2506) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83b14140) #0 witness_lock+0x5f1 #1 vn_closefile+0x41 #2 fdrop+0x121 #3 closef+0x192 #4 sys_closefrom+0x13c #5 syscall+0xbd4 #6 Xsyscall+0x128 Process 93445 (systqmp) thread 0xffff800045ffe000 (454424) shared rwlock systqmp r = 0 (0xffffffff8397c358) #0 witness_lock+0x5f1 #1 taskq_thread+0x12a #2 proc_trampoline+0x10 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11093 12155K 12155K 166960K 12193 0 pcb 18 12K 12K 166960K 24 0 rtable 239 7K 7K 166960K 359 0 pf 39 18K 18K 166960K 50 0 ifaddr 46 7K 8K 166960K 49 0 ifgroup 64 2K 2K 166960K 64 0 sysctl 1 1K 9K 166960K 5 0 counters 78 37K 37K 166960K 78 0 ioctlops 0 0K 4K 166960K 1488 0 iov 0 0K 12K 166960K 2 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1294 81K 81K 166960K 1371 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 3 5K 5K 166960K 3 0 VM map 2 1K 1K 166960K 2 0 sem 4 0K 0K 166960K 4 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1734 201K 291K 166960K 11964 0 file desc 15 53K 93K 166960K 146 0 proc 69 115K 180K 166960K 554 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 2 0K 0K 166960K 2 0 in_multi 102 6K 6K 166960K 103 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 3 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 217 970K 970K 166960K 217 0 exec 0 0K 1K 166960K 390 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 218 159K 169K 166960K 3226 0 UVM aobj 36 2K 2K 166960K 36 0 pinsyscall 40 80K 104K 166960K 1329 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 2 0K 0K 166960K 3 0 NDP 20 0K 1K 166960K 30 0 temp 33 9114K 9120K 166960K 3585 0 kqueue 14 22K 22K 166960K 28 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 28 0 0 1 0 1 1 0 8 0 rtpcb 120 37 0 34 1 0 1 1 0 8 0 rtentry 176 112 0 2 6 0 6 6 0 8 1 unpcb 144 47 0 30 1 0 1 1 0 8 0 syncache 336 4 0 4 1 0 1 1 0 8 1 tcpcb 736 43 0 6 4 0 4 4 0 8 0 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 111 0 67 4 0 4 4 0 8 0 nd6 152 23 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1192 2 0 0 1 0 1 1 0 8 0 pppxif 1576 2 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 27 0 0 1 0 1 1 0 8 0 pfstkey 128 27 0 0 1 0 1 1 0 8 0 pfstate 448 27 0 0 3 0 3 3 0 8 0 pfrule 1360 21 0 16 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 457 0 0 29 0 29 29 0 8 0 art_table 40 458 0 0 5 0 5 5 0 8 0 art_node 32 112 0 11 1 0 1 1 0 8 0 semapl 72 2 0 0 1 0 1 1 0 8 0 shmpl 120 33 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1590 0 119 92 0 92 92 0 8 0 ffsino 296 1590 0 119 114 0 114 114 0 8 0 nchpl 144 1794 0 89 64 0 64 64 0 8 0 vnodes 216 1682 0 0 94 0 94 94 0 8 0 namei 1024 6514 0 6514 4 1 3 3 0 8 3 percpumem 16 55 0 0 1 0 1 1 0 8 0 kstatmem 264 31 0 0 3 0 3 3 0 8 0 scxspl 216 6254 0 6254 4 3 1 3 1 8 1 plimitpl 152 33 0 14 1 0 1 1 0 8 0 sigapl 424 472 0 427 7 0 7 7 0 8 1 knotepl 120 86 0 0 3 0 3 3 0 8 0 kqueuepl 224 27 0 16 1 0 1 1 0 8 0 pipepl 344 130 0 103 3 0 3 3 0 8 0 fdescpl 528 456 0 427 3 0 3 3 0 8 0 filepl 160 1826 0 1511 14 0 14 14 0 8 0 lockfpl 104 15 0 12 1 0 1 1 0 8 0 lockfspl 48 7 0 4 1 0 1 1 0 8 0 sessionpl 144 24 0 15 1 0 1 1 0 8 0 pgrppl 48 32 0 15 1 0 1 1 0 8 0 ucredpl 104 182 0 169 1 0 1 1 0 8 0 zombiepl 144 428 0 427 1 0 1 1 0 8 0 processpl 1232 472 0 427 5 0 5 5 0 8 1 procpl 664 504 0 450 6 0 6 6 0 8 1 sockpl 752 195 0 131 7 0 7 7 0 8 0 mcl64k 65536 4 0 0 1 0 1 1 0 8 0 mcl16k 16384 4 0 0 1 0 1 1 0 8 0 mcl8k 8192 3 0 0 1 0 1 1 0 8 0 mcl4k 4096 127 0 0 16 0 16 16 0 8 0 mcl2k 2048 13 0 0 2 0 2 2 0 8 0 mextrefs 64 13 0 0 1 0 1 1 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 167 0 0 11 0 11 11 0 8 0 bufpl 272 2308 0 107 147 0 147 147 0 8 0 anonpl 32 3656 0 0 30 0 30 30 0 247 0 amapchunkpl 152 8582 0 8155 20 0 20 20 0 158 2 amappl16 200 1433 0 1402 5 1 4 5 0 8 2 amappl15 192 6 0 6 1 1 0 1 0 8 0 amappl14 184 440 0 439 1 0 1 1 0 8 0 amappl13 176 126 0 114 1 0 1 1 0 8 0 amappl12 168 711 0 684 2 0 2 2 0 8 0 amappl11 160 43 0 42 1 0 1 1 0 8 0 amappl10 152 63 0 49 1 0 1 1 0 8 0 amappl9 144 274 0 274 1 1 0 1 0 8 0 amappl8 136 98 0 97 1 0 1 1 0 8 0 amappl7 128 148 0 135 1 0 1 1 0 8 0 amappl6 120 153 0 151 1 0 1 1 0 8 0 amappl5 112 100 0 89 1 0 1 1 0 8 0 amappl4 104 298 0 277 1 0 1 1 0 8 0 amappl3 96 1547 0 1465 4 1 3 3 0 8 0 amappl2 88 585 0 511 2 0 2 2 0 8 0 amappl1 80 10611 0 10016 15 0 15 15 0 8 1 amappl 88 2483 0 2337 5 1 4 4 0 92 0 uvmvnodes 80 98 0 0 2 0 2 2 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 35 0 0 1 0 1 1 0 8 0 uaddrrnd 24 456 0 427 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 456 0 427 1 0 1 1 0 8 0 vmmpekpl 168 5885 0 5847 2 0 2 2 0 8 0 vmmpepl 168 38699 0 36919 85 0 85 85 0 357 2 vmsppl 488 455 0 427 5 0 5 5 0 8 0 rwobjpl 80 14516 0 13469 25 1 24 24 0 8 1 pdppl 4096 919 0 854 101 24 77 85 0 8 12 pvpl 32 9374 0 0 76 0 76 76 0 265 0 pmappl 256 455 0 427 3 0 3 3 0 8 0 extentpl 40 46 0 28 1 0 1 1 0 8 0 phpool 112 425 0 28 12 0 12 12 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff838eeff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83b13940) at __mp_lock+0x192 softintr_dispatch(0) at softintr_dispatch+0x125 dosoftint(0) at dosoftint+0x54 Xsoftclock() at Xsoftclock+0x27 end of kernel end trace frame: 0x7319a132c190, count: 8 ddb{0}> trace x86_ipi_db(ffffffff838eeff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83b13940) at __mp_lock+0x192 softintr_dispatch(0) at softintr_dispatch+0x125 dosoftint(0) at dosoftint+0x54 Xsoftclock() at Xsoftclock+0x27 end of kernel end trace frame: 0x7319a132c190, count: -7 ddb{0}> machine ddbcpu 1 Stopped at db_enter+0x25: addq $0x8,%rsp db_enter() at db_enter+0x25 panic(ffffffff834c6c06) at panic+0x1e5 __assert(ffffffff83502443,ffffffff8350f892,3bf,ffffffff8353820e) at __assert+0x29 refcnt_finalize(ffff800030f92b20,ffffffff834b9a59) at refcnt_finalize+0x1e7 pppx_if_destroy(ffff80002ab83000,ffff800030f92b18) at pppx_if_destroy+0x3d pppxclose(285b9c,1,2000,ffff80002a22aa78) at pppxclose+0xa0 spec_close(ffff80003c3ef8f0) at spec_close+0x417 VOP_CLOSE(fffffd806c52e0e0,1,fffffd80097fd548,ffff80002a22aa78) at VOP_CLOSE+0x132 vn_closefile(fffffd80669a04b0,ffff80002a22aa78) at vn_closefile+0x12b fdrop(fffffd80669a04b0,ffff80002a22aa78) at fdrop+0x121 closef(fffffd80669a04b0,ffff80002a22aa78) at closef+0x192 sys_closefrom(ffff80002a22aa78,ffff80003c3efbc0,ffff80003c3efb10) at sys_closefrom+0x13c syscall(ffff80003c3efbc0) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xd67f4ed2c00, count: 1 ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff834c6c06) at panic+0x1e5 __assert(ffffffff83502443,ffffffff8350f892,3bf,ffffffff8353820e) at __assert+0x29 refcnt_finalize(ffff800030f92b20,ffffffff834b9a59) at refcnt_finalize+0x1e7 pppx_if_destroy(ffff80002ab83000,ffff800030f92b18) at pppx_if_destroy+0x3d pppxclose(285b9c,1,2000,ffff80002a22aa78) at pppxclose+0xa0 spec_close(ffff80003c3ef8f0) at spec_close+0x417 VOP_CLOSE(fffffd806c52e0e0,1,fffffd80097fd548,ffff80002a22aa78) at VOP_CLOSE+0x132 vn_closefile(fffffd80669a04b0,ffff80002a22aa78) at vn_closefile+0x12b fdrop(fffffd80669a04b0,ffff80002a22aa78) at fdrop+0x121 closef(fffffd80669a04b0,ffff80002a22aa78) at closef+0x192 sys_closefrom(ffff80002a22aa78,ffff80003c3efbc0,ffff80003c3efb10) at sys_closefrom+0x13c syscall(ffff80003c3efbc0) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0xd67f4ed2c00, count: -14