00ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
inotify_init1(0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:17:54 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:54 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
inotify_init1(0x0)

23:17:54 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:54 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:54 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:54 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:54 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
recvfrom$l2tp(0xffffffffffffffff, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:17:54 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:17:54 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:54 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:54 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:55 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:55 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:55 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:17:55 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:17:55 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:55 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:55 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:55 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:55 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:55 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:55 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:55 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:55 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:55 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:55 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
inotify_init1(0x0)

23:17:55 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:17:55 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:17:55 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
recvfrom$l2tp(0xffffffffffffffff, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:17:55 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
r3 = inotify_init1(0x0)
inotify_add_watch(r3, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:55 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
inotify_init1(0x0)

23:17:56 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:56 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:17:56 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:17:56 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
inotify_init1(0x0)

23:17:56 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:56 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:56 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:17:56 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:56 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:56 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
inotify_init1(0x0)

23:17:56 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:56 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
inotify_init1(0x0)

23:17:56 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
recvfrom$l2tp(0xffffffffffffffff, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:17:56 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:56 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:56 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
inotify_init1(0x0)

23:17:56 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:56 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:56 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
recvfrom$l2tp(0xffffffffffffffff, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:17:57 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:57 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:57 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:57 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
recvfrom$l2tp(0xffffffffffffffff, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:17:57 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:57 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
inotify_init1(0x0)

23:17:57 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
recvfrom$l2tp(0xffffffffffffffff, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:17:57 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:57 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:17:57 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:57 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:17:57 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:17:57 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:57 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)

23:17:57 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:17:57 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:57 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:57 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:57 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:57 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:57 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:57 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)

23:17:57 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:58 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:58 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:58 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:17:58 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:17:58 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:58 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)

23:17:58 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:58 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:58 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:17:58 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:58 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
inotify_init1(0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:17:58 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
inotify_init1(0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:17:58 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:58 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:17:58 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:58 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})

23:17:58 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:58 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})

23:17:58 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:58 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:17:58 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:58 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:58 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:59 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
inotify_init1(0x0)
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:17:59 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:59 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:59 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:17:59 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:59 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})

23:17:59 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:59 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:59 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:59 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:59 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:17:59 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:59 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:59 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})

23:17:59 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:17:59 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:59 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:59 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:59 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:17:59 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:59 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:17:59 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:17:59 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:17:59 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:59 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:17:59 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:59 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:59 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:17:59 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:17:59 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:18:00 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:18:00 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:18:00 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:00 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:18:00 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:00 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:00 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:18:00 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:18:00 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:00 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:18:00 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:00 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:00 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:18:00 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:00 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:00 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:18:00 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:00 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:18:00 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:00 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:18:00 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:18:00 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:18:00 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:00 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)

23:18:00 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:18:01 executing program 2:
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:18:01 executing program 2:
inotify_add_watch(0xffffffffffffffff, 0x0, 0xc1000500)

23:18:01 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:01 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:01 executing program 2:
inotify_add_watch(0xffffffffffffffff, 0x0, 0x0)

23:18:01 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:01 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:01 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:01 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:01 executing program 2:
inotify_add_watch(0xffffffffffffffff, 0x0, 0x0)

23:18:01 executing program 3:
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:01 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:01 executing program 2:
inotify_add_watch(0xffffffffffffffff, 0x0, 0x0)

23:18:01 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:01 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:18:01 executing program 3:
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:01 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})

23:18:01 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:01 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)

23:18:01 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:18:01 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)

23:18:01 executing program 3:
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:01 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)

23:18:01 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:02 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:02 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)

23:18:02 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})

23:18:02 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)

23:18:02 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:02 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)

23:18:02 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4000010, r0, 0x80000001)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:02 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)

23:18:02 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:02 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x80000001)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:02 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:02 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:02 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})

23:18:02 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:02 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:02 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, r0, 0x80000001)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r2 = inotify_init1(0x0)
inotify_add_watch(r2, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:02 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:02 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:02 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:02 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})

23:18:02 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})

23:18:02 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:02 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)

23:18:02 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:03 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})

23:18:03 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:03 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:03 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:03 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:03 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:03 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:03 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:03 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})

23:18:03 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})

23:18:03 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:03 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:03 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})

23:18:03 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:03 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:03 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:03 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:03 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:03 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:03 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:03 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:03 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:03 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:03 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:04 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:04 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:04 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:04 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:04 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:04 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:04 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:04 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:04 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:04 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:04 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:04 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:04 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:04 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:04 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:04 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:04 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:04 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:04 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:04 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:04 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:04 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r0 = inotify_init1(0x0)
inotify_add_watch(r0, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:05 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r0 = inotify_init1(0x0)
inotify_add_watch(r0, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))
sendmsg$BATADV_CMD_GET_ORIGINATORS(r10, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f0000000fc0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000e00)=""/237, 0xed, 0x0, &(0x7f0000000f00)=""/150, 0x96}, &(0x7f0000001000)=0x40)

23:18:05 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r0 = inotify_init1(0x0)
inotify_add_watch(r0, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))
sendmsg$BATADV_CMD_GET_ORIGINATORS(r10, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f0000000fc0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000e00)=""/237, 0xed, 0x0, &(0x7f0000000f00)=""/150, 0x96}, &(0x7f0000001000)=0x40)

23:18:05 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:05 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))
sendmsg$BATADV_CMD_GET_ORIGINATORS(r10, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f0000000fc0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000e00)=""/237, 0xed, 0x0, &(0x7f0000000f00)=""/150, 0x96}, &(0x7f0000001000)=0x40)

23:18:05 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))
sendmsg$BATADV_CMD_GET_ORIGINATORS(r10, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f0000000fc0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000e00)=""/237, 0xed, 0x0, &(0x7f0000000f00)=""/150, 0x96}, &(0x7f0000001000)=0x40)

23:18:05 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))
sendmsg$BATADV_CMD_GET_ORIGINATORS(r10, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f0000000fc0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000e00)=""/237, 0xed, 0x0, &(0x7f0000000f00)=""/150, 0x96}, &(0x7f0000001000)=0x40)

23:18:05 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:05 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))
sendmsg$BATADV_CMD_GET_ORIGINATORS(r10, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f0000000fc0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000e00)=""/237, 0xed, 0x0, &(0x7f0000000f00)=""/150, 0x96}, &(0x7f0000001000)=0x40)

23:18:05 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))
sendmsg$BATADV_CMD_GET_ORIGINATORS(r10, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800)

23:18:05 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))

23:18:05 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))
sendmsg$BATADV_CMD_GET_ORIGINATORS(r10, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f0000000fc0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000e00)=""/237, 0xed, 0x0, &(0x7f0000000f00)=""/150, 0x96}, &(0x7f0000001000)=0x40)

23:18:05 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))
sendmsg$BATADV_CMD_GET_ORIGINATORS(r10, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f0000000fc0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000e00)=""/237, 0xed, 0x0, &(0x7f0000000f00)=""/150, 0x96}, &(0x7f0000001000)=0x40)

23:18:05 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:05 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:06 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))
sendmsg$BATADV_CMD_GET_ORIGINATORS(r10, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800)

23:18:06 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)

23:18:06 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:06 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))
sendmsg$BATADV_CMD_GET_ORIGINATORS(r10, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r7, 0x6, 0x23, &(0x7f0000000fc0)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000e00)=""/237, 0xed, 0x0, &(0x7f0000000f00)=""/150, 0x96}, &(0x7f0000001000)=0x40)

23:18:06 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:06 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))

23:18:06 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})

23:18:06 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))
sendmsg$BATADV_CMD_GET_ORIGINATORS(r10, &(0x7f0000000dc0)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d40)={0x2c, 0x0, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x4}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x20000800)

23:18:06 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:06 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000e40), 0x2, 0x0)

23:18:06 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)

23:18:06 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r9 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r9, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r10, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:06 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:06 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r9 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r9, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:06 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
r5 = syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000e00)={&(0x7f0000ffb000/0x1000)=nil, 0x1000})

23:18:06 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
r1 = inotify_init1(0x0)
inotify_add_watch(r1, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:06 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})

23:18:06 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000cc0))

23:18:06 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r9 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r9, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:06 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:06 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:06 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_open_dev$vcsn(&(0x7f0000000dc0), 0x401, 0x40000)

23:18:06 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r9 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r9, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r10, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:06 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
socket(0x18, 0xa, 0x312)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:06 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})
sendmsg$L2TP_CMD_TUNNEL_GET(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000bc0), 0xc, &(0x7f0000000c40)={&(0x7f0000000c00)={0x1c, r5, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_CONN_ID={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040000}, 0x200040c4)

23:18:06 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, 0xffffffffffffffff, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:06 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:06 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:06 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, <r8=>0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r9 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r9, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r10 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r10, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r11 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r11, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
r12 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)
ioctl$IOMMU_TEST_OP_DESTROY_ACCESS_PAGES(r12, 0x3ba0, &(0x7f0000000b80)={0x38, 0x6, 0x0, 0x0, r8})

23:18:06 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r9 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r9, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r10, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)

23:18:06 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)

23:18:06 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, 0x0, 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:06 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r9 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r9, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r10, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:07 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, 0xffffffffffffffff, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:07 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r9 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r9, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)

23:18:07 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:07 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, 0x0, 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:07 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, 0x0, 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:07 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)
recvfrom$l2tp(r3, &(0x7f0000000d40)=""/61, 0x3d, 0x40012021, &(0x7f0000000d80)={0x2, 0x0, @initdev}, 0x10)

23:18:07 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r9 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r9, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)

23:18:07 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
socket(0x18, 0xa, 0x312)

23:18:07 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r9 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r9, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
r10 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r10, &(0x7f0000000b00)={&(0x7f0000000a00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x5c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xffffffff}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x1000}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xfffffff8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_BONDING_ENABLED={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x24004880)

23:18:07 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, 0xffffffffffffffff, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:07 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:07 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
shmat(0xffffffffffffffff, &(0x7f0000ffd000/0x2000)=nil, 0x0)

23:18:07 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r6, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r6, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:07 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
socket(0x18, 0xa, 0x312)

23:18:07 executing program 4:
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:07 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:07 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r9 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r9, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)

23:18:07 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r6, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:07 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r6, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r6, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
socket(0x18, 0xa, 0x312)

23:18:07 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r6, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
socket(0x18, 0xa, 0x312)

23:18:07 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r2, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})

23:18:07 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, &(0x7f0000000c00)={{0x7, 0x4, 0x9, 0xc51, 'syz0\x00', 0x2}, 0x3, 0x3, 0x5, 0x0, 0x2, 0x7, 'syz0\x00', &(0x7f0000000bc0)=['/dev/virtual_nci\x00', '*]#)&}-\xd7{:\"\x00'], 0x1d})
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:07 executing program 4:
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:07 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
r9 = socket(0x18, 0xa, 0x312)
sendto$l2tp(r9, &(0x7f0000000900)="c34e1fc46d7d469436e0baa5d6165c1bf61717e034e1555663e38ad580bdadba313bebea2d458688b0bad85adde4c7a4e33a31bfebabc5d11dc730e3b95fed4f01ea2b53f713de7614bb82d497ef8a6cb538c51d5c8f5ae928784e9817d8a5262140e4c152d8aac28e79042410588d266c36e4d3b462e723d06d5545ff306fd64281fad9ea262d4381dbaa5a9c6481ebeec5c7d8bc449dad543c07ede55a7c6602839b32799b3b", 0xa7, 0x0, &(0x7f00000009c0)={0x2, 0x0, @empty, 0x1}, 0x10)

23:18:07 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:07 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
socket(0x18, 0xa, 0x312)

23:18:07 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:07 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)
socket(0x18, 0xa, 0x312)

23:18:07 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:07 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:07 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$UFFDIO_COPY(r1, 0xc028aa03, &(0x7f0000000b80)={&(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})

23:18:07 executing program 4:
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:08 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
r3 = accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r5, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r5, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r6 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r6, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r7 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r7, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r7, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
r8 = accept4$llc(r3, &(0x7f0000000800)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000840)=0x10, 0x800)
getsockname$llc(r8, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:08 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
socket(0x18, 0xa, 0x312)

23:18:08 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:08 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:08 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
socket(0x18, 0xa, 0x312)

23:18:08 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r6, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
bind$llc(r6, &(0x7f00000007c0)={0x1a, 0x204, 0x3, 0x3, 0x0, 0x2, @broadcast}, 0x10)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:08 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:08 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:08 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:08 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

23:18:08 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r6, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:08 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
socket(0x18, 0xa, 0x312)

23:18:08 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x10, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:08 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:08 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
inotify_init1(0x0)

23:18:08 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:08 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x10, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:08 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:08 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
socket(0x18, 0xa, 0x312)

23:18:08 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:08 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:08 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)

23:18:08 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
socket(0x18, 0xa, 0x312)

23:18:08 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:08 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x10, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:08 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:08 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
socket$nl_generic(0x10, 0x3, 0x10)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:08 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:08 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0x18, 0xa, 0x312)

23:18:08 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:08 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:08 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)

23:18:09 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:09 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:09 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
socket(0x18, 0xa, 0x312)

23:18:09 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:09 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x0)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:09 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:09 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:09 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)

23:18:09 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
socket(0x18, 0xa, 0x312)

23:18:09 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
socket$nl_generic(0x10, 0x3, 0x10)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:09 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:09 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x0, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:09 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:09 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
socket(0x18, 0xa, 0x312)

23:18:09 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:09 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:09 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:09 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x0, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:09 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:09 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
socket(0x18, 0xa, 0x312)

23:18:09 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:09 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
socket(0x18, 0xa, 0x312)

23:18:09 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket(0x18, 0xa, 0x312)

23:18:09 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:09 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:09 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r0, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:09 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:09 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x0, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:09 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)

23:18:09 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
socket(0x1e, 0x5, 0xfffffffd)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:09 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:09 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:09 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
socket(0x1e, 0x5, 0xfffffffd)
socket(0x18, 0xa, 0x312)

23:18:09 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x10, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:10 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:10 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)

23:18:10 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x10, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:10 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:10 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:10 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
socket(0x18, 0xa, 0x312)

23:18:10 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:10 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})

23:18:10 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, 0x0, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:10 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x10, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:10 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)

23:18:10 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
socket(0x1e, 0x5, 0xfffffffd)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:10 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
socket(0x18, 0xa, 0x312)

23:18:10 executing program 1:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:10 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x0, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:10 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:10 executing program 1:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x4040, 0x0)

23:18:10 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)

23:18:10 executing program 0:
socket(0x18, 0xa, 0x312)

23:18:10 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x0, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:10 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, 0xffffffffffffffff, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:10 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:10 executing program 0:
socket(0x0, 0xa, 0x312)

23:18:10 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)

23:18:10 executing program 1:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x4040, 0x0)

23:18:10 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x0, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:10 executing program 2:
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:10 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x0, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:10 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})

23:18:10 executing program 1:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x4040, 0x0)

23:18:10 executing program 2:
getsockname$llc(0xffffffffffffffff, 0x0, &(0x7f00000008c0))

23:18:10 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, 0xffffffffffffffff, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:10 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x0, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:10 executing program 1:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x0, 0x0)

23:18:10 executing program 0:
socket(0x0, 0xa, 0x312)

23:18:10 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)

23:18:10 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, 0xffffffffffffffff, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:10 executing program 2:
getsockname$llc(0xffffffffffffffff, 0x0, 0x0)

23:18:11 executing program 1:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x0, 0x0)

23:18:11 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x0, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:11 executing program 2:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x0, 0x0)

23:18:11 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)

23:18:11 executing program 1:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x0, 0x0)

23:18:11 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x0)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:11 executing program 2:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x0, 0x0)

23:18:11 executing program 0:
socket(0x0, 0xa, 0x312)

23:18:11 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)

23:18:11 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:11 executing program 1:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x0, 0x0)

23:18:11 executing program 2:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x0, 0x0)

23:18:11 executing program 1:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x0, 0x0)

23:18:11 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x0)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:11 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:11 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)

23:18:11 executing program 0:
socket(0x18, 0x0, 0x312)

23:18:11 executing program 1:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x0, 0x0)

23:18:11 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x0)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:11 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:11 executing program 0:
socket(0x18, 0x0, 0x0)

23:18:11 executing program 2:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)

23:18:11 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)

23:18:11 executing program 1:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)

23:18:11 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)

23:18:11 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:11 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x0, &(0x7f0000000f80))

23:18:11 executing program 1:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)

23:18:11 executing program 2:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)

23:18:11 executing program 0:
socket(0x18, 0x0, 0x0)

23:18:11 executing program 2:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)

23:18:11 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)

23:18:11 executing program 1:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)

23:18:11 executing program 0:
socket(0x18, 0x0, 0x0)

23:18:11 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x0, &(0x7f0000000f80))

23:18:11 executing program 1:
socket(0x18, 0x0, 0x0)

23:18:11 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:11 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:11 executing program 1:
socket(0x18, 0x0, 0x0)

23:18:12 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)

23:18:12 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, 0x0, &(0x7f0000000f80))

23:18:12 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, 0xffffffffffffffff, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:12 executing program 2:
socket(0x0, 0xa, 0x312)

23:18:12 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:12 executing program 1:
socket(0x18, 0x0, 0x0)

23:18:12 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:12 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), 0x0)

23:18:12 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x10, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:12 executing program 1:
socket(0x0, 0x0, 0x0)

23:18:12 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, 0x0, 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:12 executing program 5:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:12 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), 0x0)

23:18:12 executing program 2:
socket(0x0, 0xa, 0x312)

23:18:12 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:12 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x30, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), 0x0)

23:18:12 executing program 5:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:12 executing program 1:
socket(0x0, 0x0, 0x0)

23:18:12 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, 0x0, 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:12 executing program 3:
socket(0x0, 0x0, 0x0)

23:18:12 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:12 executing program 5:
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:12 executing program 2:
socket(0x0, 0xa, 0x312)

23:18:12 executing program 5:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x4040, 0x0)

23:18:12 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, 0x0, 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:12 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:13 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)

23:18:13 executing program 1:
socket(0x0, 0x0, 0x0)

23:18:13 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:13 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
socket(0x1e, 0x5, 0xfffffffd)
socket$igmp6(0xa, 0x3, 0x2)

23:18:13 executing program 5:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)

23:18:13 executing program 3:
socket(0x0, 0x0, 0x0)

23:18:13 executing program 2:
socket(0x0, 0x0, 0x312)

23:18:13 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
socket$igmp6(0xa, 0x3, 0x2)

23:18:13 executing program 0:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
socket$igmp6(0xa, 0x3, 0x2)

23:18:13 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:13 executing program 5:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)

23:18:13 executing program 0:
socket$igmp6(0xa, 0x3, 0x2)

23:18:13 executing program 3:
socket(0x0, 0x0, 0x0)

23:18:13 executing program 5:
openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0)

23:18:13 executing program 2:
socket(0x0, 0x0, 0x0)

23:18:13 executing program 1:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, 0x0, 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:13 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:13 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x10, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:13 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:13 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:13 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x10, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:13 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:13 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)

23:18:13 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)

23:18:13 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:13 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x10, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:13 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:14 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000b40), 0x4040, 0x0)

23:18:14 executing program 0:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

23:18:14 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
socket$igmp6(0xa, 0x3, 0x2)

23:18:14 executing program 5:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
openat$qrtrtun(0xffffffffffffff9c, 0x0, 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x80000001)
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x3ab)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
inotify_init1(0x0)
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000b40)='./file0\x00', 0xc1000500)
ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(0xffffffffffffffff, 0xc1105511, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1000007, 0x10, 0xffffffffffffffff, 0x536ef000)
syz_io_uring_setup(0x4, &(0x7f0000000ec0)={0x0, 0x453e, 0x40, 0x0, 0x262}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000000f40), &(0x7f0000000f80))

23:18:14 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

23:18:14 executing program 3:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
inotify_init1(0x0)

23:18:14 executing program 4:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x10, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(0xffffffffffffffff, 0x706, 0x3ab)
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)

[  290.601796][T26616] ==================================================================
[  290.609902][T26616] BUG: KASAN: slab-use-after-free in __list_add_valid+0xf0/0x100
[  290.617754][T26616] Read of size 8 at addr ffff88807b32a008 by task syz-executor.0/26616
[  290.626010][T26616] 
[  290.628339][T26616] CPU: 1 PID: 26616 Comm: syz-executor.0 Not tainted 6.4.0-rc7-next-20230626-syzkaller #0
[  290.638245][T26616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[  290.648319][T26616] Call Trace:
23:18:14 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r0 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r0, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)

[  290.651613][T26616]  <TASK>
[  290.654552][T26616]  dump_stack_lvl+0xd9/0x150
[  290.659223][T26616]  print_address_description.constprop.0+0x2c/0x3c0
[  290.665883][T26616]  kasan_report+0x11d/0x130
[  290.670423][T26616]  ? __list_add_valid+0xf0/0x100
[  290.675492][T26616]  __list_add_valid+0xf0/0x100
[  290.680284][T26616]  nfc_llcp_register_device+0x7a8/0x9e0
[  290.685928][T26616]  nfc_register_device+0x70/0x3c0
[  290.690981][T26616]  nci_register_device+0x7cb/0xb50
[  290.696170][T26616]  ? nci_init_complete_req+0x3f0/0x3f0
23:18:14 executing program 2:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
r1 = socket(0x1e, 0x5, 0xfffffffd)
getpeername$llc(r1, &(0x7f00000000c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x10)
r2 = socket$igmp6(0xa, 0x3, 0x2)
accept4$llc(r1, &(0x7f0000000140)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000180)=0x10, 0x100800)
sendto$llc(r0, &(0x7f00000001c0)="d6553d7474b52db45c84933ee5c4bf026001df44c3e9c7c507099db84367b8731edfe07cb065beed4f3b74ecb2cb4f91d12b6408359f6fd3bc415545055afcc1cd6963f417e0619cbc1526936b26ae3c8a5258280f34d69d35794d74c3629ac926353f60d08a7eb41c26c36ae7d049d6ac44cf621b6ade45502829b71202a8189dff00c9a0e740", 0x87, 0xc080, &(0x7f0000000280)={0x1a, 0x5, 0x6, 0x6, 0x9, 0x8a}, 0x10)
accept4$llc(0xffffffffffffffff, &(0x7f00000002c0)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, &(0x7f0000000300)=0x10, 0x80000)
sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x2c, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x880)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000480), r1)
sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r4, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x2}]}, 0x24}}, 0xe84417acbcddb544)
sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r4, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x11}, 0x80)
r5 = accept4$llc(r0, &(0x7f0000000680)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f00000006c0)=0x10, 0x80000)
bind$llc(r5, &(0x7f0000000700)={0x1a, 0x13, 0x5, 0xa3, 0x1, 0x7}, 0x10)
r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000740), 0x408240, 0x0)
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000780)={0x38, 0x7, r6, 0x0, 0x10000, 0x0, 0x3, 0x3e5bc7, 0xe295})
getsockname$llc(0xffffffffffffffff, &(0x7f0000000880)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f00000008c0)=0x10)

[  290.701666][T26616]  ? lockdep_init_map_type+0x21e/0x810
[  290.707183][T26616]  ? lockdep_init_map_type+0x21e/0x810
[  290.712684][T26616]  ? virtual_ncidev_read+0x4b0/0x4b0
[  290.718037][T26616]  virtual_ncidev_open+0x14f/0x230
[  290.723194][T26616]  misc_open+0x383/0x4a0
[  290.727495][T26616]  ? misc_devnode+0x120/0x120
[  290.732201][T26616]  chrdev_open+0x273/0x780
[  290.736664][T26616]  ? __unregister_chrdev+0x110/0x110
[  290.741978][T26616]  ? fsnotify_perm.part.0+0x248/0x680
[  290.747420][T26616]  do_dentry_open+0x6ce/0x17b0
23:18:14 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)
socket(0x1e, 0x5, 0xfffffffd)

[  290.752222][T26616]  ? __unregister_chrdev+0x110/0x110
[  290.757544][T26616]  ? may_open+0x1f6/0x420
[  290.761894][T26616]  path_openat+0x1b65/0x2710
[  290.766522][T26616]  ? path_lookupat+0x840/0x840
[  290.771317][T26616]  do_filp_open+0x1ba/0x410
[  290.775855][T26616]  ? may_open_dev+0xf0/0xf0
[  290.780389][T26616]  ? find_held_lock+0x2d/0x110
[  290.785188][T26616]  ? do_raw_spin_lock+0x124/0x2b0
[  290.790245][T26616]  ? spin_bug+0x1c0/0x1c0
[  290.794614][T26616]  ? _raw_spin_unlock+0x28/0x40
23:18:14 executing program 2:
map_shadow_stack(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0)
r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000000), 0x0)
mmap$qrtrtun(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x200000e, 0x4000010, r0, 0x80000001)
map_shadow_stack(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1)
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
mmap$usbmon(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x3000000, 0x810, 0xffffffffffffffff, 0xa776)
ioctl$NBD_SET_SIZE_BLOCKS(0xffffffffffffffff, 0xab07, 0x7)
r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x480, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000840)={0xf8, 0x0, &(0x7f0000000700)=[@increfs_done, @reply={0x40406301, {0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000280)={@ptr={0x70742a85, 0x1, &(0x7f00000000c0)=""/203, 0xcb, 0x2, 0xe}, @ptr={0x70742a85, 0x1, &(0x7f00000001c0)=""/143, 0x8f, 0x0, 0x14}, @flat=@handle}, &(0x7f0000000300)={0x0, 0x28, 0x50}}}, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000400)={@flat=@weak_binder={0x77622a85, 0x110b, 0x1}, @ptr={0x70742a85, 0x1, &(0x7f0000000340)=""/163, 0xa3, 0x4a17, 0x1e}, @flat=@weak_handle={0x77682a85, 0x102}}, &(0x7f0000000480)={0x0, 0x18, 0x40}}}, @free_buffer, @acquire={0x40046305, 0x3}, @exit_looper, @transaction={0x40406300, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000640)={@ptr={0x70742a85, 0x0, &(0x7f00000004c0)=""/241, 0xf1, 0x2, 0x5}, @ptr={0x70742a85, 0x0, &(0x7f00000005c0)=""/116, 0x74, 0x0, 0x1c}, @flat=@weak_binder={0x77622a85, 0x110b}}, &(0x7f00000006c0)={0x0, 0x28, 0x50}}}], 0x21, 0x0, &(0x7f0000000800)="513abbe2256a86716543aa93f7739b2e8dc3f682193152d0d7c132fb7d24c45b82"})
openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write$6lowpan_control(0xffffffffffffffff, &(0x7f00000008c0)='connect aa:aa:aa:aa:aa:10 0', 0x1b)
ioctl$I2C_SLAVE_FORCE(r1, 0x706, 0x3ab)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000a40)={0x4, 0x0, &(0x7f0000000900)=[@enter_looper], 0xdb, 0x0, &(0x7f0000000940)="81c8c7e22c95f958ad49b8e84a6d24e6f4ebeb288b1be3141b9382bae642b72e855f318d617b77c2a73ee9ca067b1630a2679a61761938e3f28b550b4be1e53bda21e771b6c8c19d9315d6c7924a52d8ba2755c7991e5406c34b5da3db7db1ed38fbcc585e1d6ef74dc38b77b1f759c402048f1b29618de7e4e84561cbc7586eb8196f5faed071009550274c8af591827654b3fde892081d92e4d817f0267d95a9b68d79c426c4dc90a14ea642a22f7d6b0cb51e6b065a0447dcf33cd5497ccc41535acb43dc9e6bbb38df5836699dd18c2aee481b59598f79144f"})
openat$nci(0xffffffffffffff9c, &(0x7f0000000a80), 0x2, 0x0)
mlock2(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x0)
r2 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000ac0), 0x500, 0x0)
ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000b00), 0x400, 0x0)
mmap$binder(&(0x7f0000ff9000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x7)
r4 = inotify_init1(0x0)
inotify_add_watch(r4, &(0x7f0000000b40)='./file0\x00', 0xc1000500)

[  290.799593][T26616]  ? alloc_fd+0x2e4/0x750
[  290.803957][T26616]  do_sys_openat2+0x160/0x1c0
[  290.808668][T26616]  ? build_open_flags+0x720/0x720
[  290.813723][T26616]  ? xfd_validate_state+0x5d/0x180
[  290.818929][T26616]  __x64_sys_openat+0x143/0x1f0
[  290.823813][T26616]  ? __ia32_sys_open+0x1c0/0x1c0
[  290.828781][T26616]  ? syscall_enter_from_user_mode+0x26/0x80
[  290.834765][T26616]  do_syscall_64+0x39/0xb0
[  290.839207][T26616]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  290.845186][T26616] RIP: 0033:0x7ff13b28c389
23:18:14 executing program 1:
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_TEE={0x21, 0x1, 0x0, @fd, 0x0, 0x0, 0x4, 0xe, 0x1}, 0x1)
accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x10, 0x80800)

[  290.849624][T26616] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[  290.869253][T26616] RSP: 002b:00007ff13c086168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[  290.877685][T26616] RAX: ffffffffffffffda RBX: 00007ff13b3abf80 RCX: 00007ff13b28c389
[  290.885676][T26616] RDX: 0000000000000002 RSI: 0000000020000a80 RDI: ffffffffffffff9c
[  290.893663][T26616] RBP: 00007ff13b2d7493 R08: 0000000000000000 R09: 0000000000000000
[  290.901647][T26616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  290.909725][T26616] R13: 00007ffd96e55f5f R14: 00007ff13c086300 R15: 0000000000022000
[  290.917721][T26616]  </TASK>
[  290.920748][T26616] 
[  290.923083][T26616] Allocated by task 26593:
[  290.927506][T26616]  kasan_save_stack+0x22/0x40
[  290.932211][T26616]  kasan_set_track+0x25/0x30
[  290.936828][T26616]  __kasan_kmalloc+0xa2/0xb0
[  290.941430][T26616]  nfc_llcp_register_device+0x49/0x9e0
[  290.946903][T26616]  nfc_register_device+0x70/0x3c0
[  290.951927][T26616]  nci_register_device+0x7cb/0xb50
[  290.957046][T26616]  virtual_ncidev_open+0x14f/0x230
[  290.962170][T26616]  misc_open+0x383/0x4a0
[  290.966420][T26616]  chrdev_open+0x273/0x780
[  290.970841][T26616]  do_dentry_open+0x6ce/0x17b0
[  290.975611][T26616]  path_openat+0x1b65/0x2710
[  290.980202][T26616]  do_filp_open+0x1ba/0x410
[  290.984707][T26616]  do_sys_openat2+0x160/0x1c0
[  290.989388][T26616]  __x64_sys_openat+0x143/0x1f0
[  290.994245][T26616]  do_syscall_64+0x39/0xb0
[  290.998659][T26616]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  291.004552][T26616] 
[  291.006864][T26616] Freed by task 26589:
[  291.010918][T26616]  kasan_save_stack+0x22/0x40
[  291.015602][T26616]  kasan_set_track+0x25/0x30
[  291.020196][T26616]  kasan_save_free_info+0x2b/0x40
[  291.025230][T26616]  ____kasan_slab_free+0x160/0x1c0
[  291.030345][T26616]  slab_free_freelist_hook+0x8b/0x1c0
[  291.035717][T26616]  __kmem_cache_free+0xb8/0x2d0
[  291.040573][T26616]  nfc_llcp_unregister_device+0x1ba/0x260
[  291.046296][T26616]  nfc_unregister_device+0x196/0x330
[  291.051576][T26616]  virtual_ncidev_close+0x52/0xb0
[  291.056624][T26616]  __fput+0x40c/0xad0
[  291.060611][T26616]  task_work_run+0x16f/0x270
[  291.065239][T26616]  exit_to_user_mode_prepare+0x210/0x240
[  291.070885][T26616]  syscall_exit_to_user_mode+0x1d/0x50
[  291.076366][T26616]  do_syscall_64+0x46/0xb0
[  291.080788][T26616]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  291.086682][T26616] 
[  291.089025][T26616] Last potentially related work creation:
[  291.094733][T26616]  kasan_save_stack+0x22/0x40
[  291.099423][T26616]  __kasan_record_aux_stack+0xb9/0xd0
[  291.104815][T26616]  insert_work+0x48/0x360
[  291.109154][T26616]  __queue_work+0x625/0x1120
[  291.113744][T26616]  queue_work_on+0xf2/0x110
[  291.118248][T26616]  rfkill_register+0x67c/0xb00
[  291.123097][T26616]  nfc_register_device+0x124/0x3c0
[  291.128213][T26616]  nci_register_device+0x7cb/0xb50
[  291.133335][T26616]  virtual_ncidev_open+0x14f/0x230
[  291.138460][T26616]  misc_open+0x383/0x4a0
[  291.142713][T26616]  chrdev_open+0x273/0x780
[  291.147135][T26616]  do_dentry_open+0x6ce/0x17b0
[  291.151912][T26616]  path_openat+0x1b65/0x2710
[  291.156516][T26616]  do_filp_open+0x1ba/0x410
[  291.161021][T26616]  do_sys_openat2+0x160/0x1c0
[  291.165706][T26616]  __x64_sys_openat+0x143/0x1f0
[  291.170575][T26616]  do_syscall_64+0x39/0xb0
[  291.175001][T26616]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  291.180897][T26616] 
[  291.183215][T26616] Second to last potentially related work creation:
[  291.189800][T26616]  kasan_save_stack+0x22/0x40
[  291.194495][T26616]  __kasan_record_aux_stack+0xb9/0xd0
[  291.199883][T26616]  insert_work+0x48/0x360
[  291.204217][T26616]  __queue_work+0x625/0x1120
[  291.208812][T26616]  queue_work_on+0xf2/0x110
[  291.213317][T26616]  rfkill_register+0x67c/0xb00
[  291.218084][T26616]  nfc_register_device+0x124/0x3c0
[  291.223195][T26616]  nci_register_device+0x7cb/0xb50
[  291.228318][T26616]  virtual_ncidev_open+0x14f/0x230
[  291.233442][T26616]  misc_open+0x383/0x4a0
[  291.237697][T26616]  chrdev_open+0x273/0x780
[  291.242121][T26616]  do_dentry_open+0x6ce/0x17b0
[  291.246892][T26616]  path_openat+0x1b65/0x2710
[  291.251485][T26616]  do_filp_open+0x1ba/0x410
[  291.255992][T26616]  do_sys_openat2+0x160/0x1c0
[  291.260677][T26616]  __x64_sys_openat+0x143/0x1f0
[  291.265537][T26616]  do_syscall_64+0x39/0xb0
[  291.269952][T26616]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  291.275849][T26616] 
[  291.278168][T26616] The buggy address belongs to the object at ffff88807b32a000
[  291.278168][T26616]  which belongs to the cache kmalloc-2k of size 2048
[  291.292213][T26616] The buggy address is located 8 bytes inside of
[  291.292213][T26616]  freed 2048-byte region [ffff88807b32a000, ffff88807b32a800)
[  291.305913][T26616] 
[  291.308225][T26616] The buggy address belongs to the physical page:
[  291.314632][T26616] page:ffffea0001ecca00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7b328
[  291.324785][T26616] head:ffffea0001ecca00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  291.333717][T26616] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[  291.341704][T26616] page_type: 0xffffffff()
[  291.346033][T26616] raw: 00fff00000010200 ffff888012842000 ffffea0001e98c00 dead000000000002
[  291.354615][T26616] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
[  291.363184][T26616] page dumped because: kasan: bad access detected
[  291.369583][T26616] page_owner tracks the page as allocated
[  291.375287][T26616] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5037, tgid 5037 (syz-executor.1), ts 62212982094, free_ts 62187922206
[  291.397775][T26616]  post_alloc_hook+0x2db/0x350
[  291.402548][T26616]  get_page_from_freelist+0xfd9/0x2c40
[  291.408013][T26616]  __alloc_pages+0x1cb/0x4a0
[  291.412609][T26616]  alloc_pages+0x1aa/0x270
[  291.417029][T26616]  allocate_slab+0x25f/0x390
[  291.421623][T26616]  ___slab_alloc+0xbc3/0x15d0
[  291.426305][T26616]  __slab_alloc.constprop.0+0x56/0xa0
[  291.431688][T26616]  __kmem_cache_alloc_node+0x143/0x350
[  291.437157][T26616]  __kmalloc_node_track_caller+0x4f/0x1a0
[  291.442897][T26616]  kmalloc_reserve+0xf0/0x270
[  291.447669][T26616]  pskb_expand_head+0x22e/0x1170
[  291.452607][T26616]  netlink_trim+0x1ea/0x240
[  291.457132][T26616]  netlink_broadcast+0x63/0xd90
[  291.461985][T26616]  nlmsg_notify+0x93/0x280
[  291.466401][T26616]  rtnetlink_event+0x178/0x1f0
[  291.471186][T26616]  notifier_call_chain+0xb6/0x3c0
[  291.476224][T26616] page last free stack trace:
[  291.480896][T26616]  free_unref_page_prepare+0x62e/0xcb0
[  291.486370][T26616]  free_unref_page+0x33/0x370
[  291.491057][T26616]  __unfreeze_partials+0x1fe/0x220
[  291.496170][T26616]  qlist_free_all+0x6a/0x170
[  291.500757][T26616]  kasan_quarantine_reduce+0x195/0x220
[  291.506215][T26616]  __kasan_slab_alloc+0x63/0x90
[  291.511072][T26616]  kmem_cache_alloc+0x16c/0x380
[  291.515930][T26616]  getname_flags.part.0+0x50/0x4f0
[  291.521044][T26616]  getname+0x92/0xd0
[  291.524940][T26616]  do_sys_openat2+0xe8/0x1c0
[  291.529540][T26616]  __x64_sys_openat+0x143/0x1f0
[  291.534399][T26616]  do_syscall_64+0x39/0xb0
[  291.538817][T26616]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  291.544718][T26616] 
[  291.547034][T26616] Memory state around the buggy address:
[  291.552657][T26616]  ffff88807b329f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  291.560712][T26616]  ffff88807b329f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[  291.568780][T26616] >ffff88807b32a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  291.576848][T26616]                       ^
[  291.581171][T26616]  ffff88807b32a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  291.589225][T26616]  ffff88807b32a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  291.597275][T26616] ==================================================================
[  291.612169][T26616] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  291.619391][T26616] CPU: 0 PID: 26616 Comm: syz-executor.0 Not tainted 6.4.0-rc7-next-20230626-syzkaller #0
[  291.629296][T26616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
[  291.639366][T26616] Call Trace:
[  291.642648][T26616]  <TASK>
[  291.645589][T26616]  dump_stack_lvl+0xd9/0x150
[  291.650198][T26616]  panic+0x686/0x730
[  291.654112][T26616]  ? panic_smp_self_stop+0xa0/0xa0
[  291.659237][T26616]  ? preempt_schedule_thunk+0x1a/0x30
[  291.664648][T26616]  ? preempt_schedule_common+0x45/0xb0
[  291.670117][T26616]  check_panic_on_warn+0xb1/0xc0
[  291.675064][T26616]  end_report+0x108/0x150
[  291.679407][T26616]  kasan_report+0xfa/0x130
[  291.683837][T26616]  ? __list_add_valid+0xf0/0x100
[  291.688787][T26616]  __list_add_valid+0xf0/0x100
[  291.693557][T26616]  nfc_llcp_register_device+0x7a8/0x9e0
[  291.699112][T26616]  nfc_register_device+0x70/0x3c0
[  291.704138][T26616]  nci_register_device+0x7cb/0xb50
[  291.709259][T26616]  ? nci_init_complete_req+0x3f0/0x3f0
[  291.714726][T26616]  ? lockdep_init_map_type+0x21e/0x810
[  291.720193][T26616]  ? lockdep_init_map_type+0x21e/0x810
[  291.725666][T26616]  ? virtual_ncidev_read+0x4b0/0x4b0
[  291.730967][T26616]  virtual_ncidev_open+0x14f/0x230
[  291.736092][T26616]  misc_open+0x383/0x4a0
[  291.740351][T26616]  ? misc_devnode+0x120/0x120
[  291.745031][T26616]  chrdev_open+0x273/0x780
[  291.749454][T26616]  ? __unregister_chrdev+0x110/0x110
[  291.754741][T26616]  ? fsnotify_perm.part.0+0x248/0x680
[  291.760125][T26616]  do_dentry_open+0x6ce/0x17b0
[  291.764893][T26616]  ? __unregister_chrdev+0x110/0x110
[  291.770182][T26616]  ? may_open+0x1f6/0x420
[  291.774512][T26616]  path_openat+0x1b65/0x2710
[  291.779108][T26616]  ? path_lookupat+0x840/0x840
[  291.783880][T26616]  do_filp_open+0x1ba/0x410
[  291.788386][T26616]  ? may_open_dev+0xf0/0xf0
[  291.792892][T26616]  ? find_held_lock+0x2d/0x110
[  291.797665][T26616]  ? do_raw_spin_lock+0x124/0x2b0
[  291.802703][T26616]  ? spin_bug+0x1c0/0x1c0
[  291.807042][T26616]  ? _raw_spin_unlock+0x28/0x40
[  291.811907][T26616]  ? alloc_fd+0x2e4/0x750
[  291.816250][T26616]  do_sys_openat2+0x160/0x1c0
[  291.820934][T26616]  ? build_open_flags+0x720/0x720
[  291.825968][T26616]  ? xfd_validate_state+0x5d/0x180
[  291.831093][T26616]  __x64_sys_openat+0x143/0x1f0
[  291.835951][T26616]  ? __ia32_sys_open+0x1c0/0x1c0
[  291.840897][T26616]  ? syscall_enter_from_user_mode+0x26/0x80
[  291.846801][T26616]  do_syscall_64+0x39/0xb0
[  291.851217][T26616]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
[  291.857108][T26616] RIP: 0033:0x7ff13b28c389
[  291.861518][T26616] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[  291.881125][T26616] RSP: 002b:00007ff13c086168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[  291.889537][T26616] RAX: ffffffffffffffda RBX: 00007ff13b3abf80 RCX: 00007ff13b28c389
[  291.897506][T26616] RDX: 0000000000000002 RSI: 0000000020000a80 RDI: ffffffffffffff9c
[  291.905472][T26616] RBP: 00007ff13b2d7493 R08: 0000000000000000 R09: 0000000000000000
[  291.913439][T26616] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  291.921403][T26616] R13: 00007ffd96e55f5f R14: 00007ff13c086300 R15: 0000000000022000
[  291.929386][T26616]  </TASK>
[  291.932492][T26616] Kernel Offset: disabled
[  291.936801][T26616] Rebooting in 86400 seconds..