&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:00 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:00 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2160.917905] binder: 3156:3158 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2160.917914] binder: 3156:3158 got reply transaction with no transaction stack
14:33:00 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:00 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:00 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:00 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 1 printk messages dropped ** [ 2160.922609] binder: undelivered TRANSACTION_ERROR: 29201
[ 2161.024649] binder: 3174:3177 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:00 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:00 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:00 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:00 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:00 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2161.031786] binder: undelivered TRANSACTION_ERROR: 29201
14:33:00 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:00 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:00 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:00 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 5 printk messages dropped ** [ 2161.141777] binder: undelivered TRANSACTION_ERROR: 29201
14:33:00 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:00 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:00 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2161.269873] binder: 3206:3210 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2161.270022] binder: 3206:3210 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
** 3 printk messages dropped ** [ 2161.270249] binder: undelivered TRANSACTION_ERROR: 29201
[ 2161.369658] binder: 3223:3225 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2161.370871] binder: 3223:3225 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2161.370897] binder: 3223:3225 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2161.370905] binder: 3223:3225 got reply transaction with no transaction stack
[ 2161.370915] binder: 3223:3225 transaction failed 29201/-71, size 0-0 line 2922
[ 2161.371092] binder: undelivered TRANSACTION_ERROR: 29201
[ 2161.463423] binder: 3239:3241 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2161.471275] binder: 3239:3241 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2161.471302] binder: 3239:3241 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2161.471311] binder: 3239:3241 got reply transaction with no transaction stack
[ 2161.471322] binder: 3239:3241 transaction failed 29201/-71, size 0-0 line 2922
[ 2161.471523] binder: undelivered TRANSACTION_ERROR: 29201
[ 2161.595622] binder: 3255:3259 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2161.595743] binder: 3255:3259 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:01 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:01 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:01 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:01 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2161.595768] binder: 3255:3259 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2161.595776] binder: 3255:3259 got reply transaction with no transaction stack
[ 2161.595786] binder: 3255:3259 transaction failed 29201/-71, size 0-0 line 2922
[ 2161.595982] binder: undelivered TRANSACTION_ERROR: 29201
[ 2161.730074] binder: 3266:3274 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2161.730235] binder: 3266:3274 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2161.730260] binder: 3266:3274 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2161.730269] binder: 3266:3274 got reply transaction with no transaction stack
14:33:01 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2161.730280] binder: 3266:3274 transaction failed 29201/-71, size 0-0 line 2922
[ 2161.733823] binder: undelivered TRANSACTION_ERROR: 29201
[ 2161.861387] binder: 3289:3293 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2161.861512] binder: 3289:3293 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2161.861537] binder: 3289:3293 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2161.861544] binder: 3289:3293 got reply transaction with no transaction stack
[ 2161.861554] binder: 3289:3293 transaction failed 29201/-71, size 0-0 line 2922
14:33:01 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:01 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:01 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2161.865037] binder: undelivered TRANSACTION_ERROR: 29201
[ 2162.022088] binder: 3309:3315 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:01 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:01 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:01 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:01 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:01 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2162.022209] binder: 3309:3315 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:01 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:01 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:01 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:01 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:01 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:01 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2162.022234] binder: 3309:3315 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:01 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:01 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2162.022242] binder: 3309:3315 got reply transaction with no transaction stack
[ 2162.022252] binder: 3309:3315 transaction failed 29201/-71, size 0-0 line 2922
14:33:01 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:01 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:01 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2162.022432] binder: undelivered TRANSACTION_ERROR: 29201
14:33:01 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:01 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:01 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:01 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2162.147903] binder: 3326:3327 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:01 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:01 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:01 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:01 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:01 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:01 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2162.148011] binder: 3326:3327 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2162.148035] binder: 3326:3327 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:01 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:01 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:02 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:02 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2162.148042] binder: 3326:3327 got reply transaction with no transaction stack
[ 2162.148051] binder: 3326:3327 transaction failed 29201/-71, size 0-0 line 2922
14:33:02 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:02 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:02 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:02 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2162.148216] binder: undelivered TRANSACTION_ERROR: 29201
14:33:02 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:02 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2162.251481] binder: 3338:3342 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2162.252608] binder: 3338:3342 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:02 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:02 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:02 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:02 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2162.252632] binder: 3338:3342 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:02 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:02 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:02 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2162.252640] binder: 3338:3342 got reply transaction with no transaction stack
14:33:02 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:02 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:02 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:02 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:02 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:02 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:02 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 1 printk messages dropped ** [ 2162.252829] binder: undelivered TRANSACTION_ERROR: 29201
14:33:02 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:02 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:02 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:02 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:02 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:02 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:02 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 5 printk messages dropped ** [ 2162.397717] binder: undelivered TRANSACTION_ERROR: 29201
[ 2162.490325] binder: 3373:3376 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:02 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:02 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:02 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:02 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:02 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 4 printk messages dropped ** [ 2162.491174] binder: undelivered TRANSACTION_ERROR: 29201
14:33:02 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:02 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:02 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:02 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 5 printk messages dropped ** [ 2162.622829] binder: undelivered TRANSACTION_ERROR: 29201
[ 2162.770182] binder: 3410:3414 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:02 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:02 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:02 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2162.773119] binder: 3410:3414 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2162.773143] binder: 3410:3414 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:02 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:02 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:02 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 2 printk messages dropped ** [ 2162.780400] binder: undelivered TRANSACTION_ERROR: 29201
[ 2162.851584] binder: 3426:3428 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:02 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:02 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:02 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2162.852663] binder: 3426:3428 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2162.852689] binder: 3426:3428 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:02 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:03 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 2 printk messages dropped ** [ 2162.852899] binder: undelivered TRANSACTION_ERROR: 29201
14:33:03 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:03 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:03 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:03 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:03 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:03 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:03 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:03 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:03 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 5 printk messages dropped ** [ 2162.984435] binder: undelivered TRANSACTION_ERROR: 29201
14:33:03 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:03 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:03 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:03 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2163.137170] binder: 3463:3466 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:03 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:03 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2163.140064] binder: undelivered TRANSACTION_ERROR: 29201
[ 2163.233000] binder: 3477:3482 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2163.233107] binder: 3477:3482 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:03 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:03 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:03 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:03 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:03 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2163.233132] binder: 3477:3482 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:03 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:03 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 2 printk messages dropped ** [ 2163.237525] binder: undelivered TRANSACTION_ERROR: 29201
14:33:03 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:03 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:03 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:03 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:03 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:03 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 11 printk messages dropped ** [ 2163.450147] binder: undelivered TRANSACTION_ERROR: 29201
14:33:03 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:03 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:03 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:03 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:03 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:03 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:03 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2163.572781] binder: 3523:3527 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:03 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:03 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:03 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 4 printk messages dropped ** [ 2163.573117] binder: undelivered TRANSACTION_ERROR: 29201
14:33:03 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:03 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:03 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2163.655815] binder: 3537:3542 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:03 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:03 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:03 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:03 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2163.657021] binder: undelivered TRANSACTION_ERROR: 29201
14:33:03 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:03 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:03 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:03 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:03 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2163.817077] binder: 3558:3559 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:03 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:03 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2163.817433] binder: undelivered TRANSACTION_ERROR: 29201
[ 2163.930843] binder: 3576:3584 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:04 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:04 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:04 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:04 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2163.931123] binder: 3576:3584 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
** 3 printk messages dropped ** [ 2163.931331] binder: undelivered TRANSACTION_ERROR: 29201
14:33:04 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:04 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:04 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2164.038148] binder: 3592:3593 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:04 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:04 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:04 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:04 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2164.038598] binder: undelivered TRANSACTION_ERROR: 29201
14:33:04 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:04 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:04 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2164.150610] binder: 3610:3613 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:04 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:04 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:04 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2164.150940] binder: undelivered TRANSACTION_ERROR: 29201
[ 2164.279308] binder: 3630:3631 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:04 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:04 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:04 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:04 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:04 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2164.279428] binder: 3630:3631 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2164.279453] binder: 3630:3631 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:04 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:04 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 2 printk messages dropped ** [ 2164.279648] binder: undelivered TRANSACTION_ERROR: 29201
[ 2164.398369] binder: 3646:3655 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:04 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:04 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:04 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:04 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:04 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2164.398715] binder: undelivered TRANSACTION_ERROR: 29201
14:33:04 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:04 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:04 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:04 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2164.514993] binder: 3664:3671 IncRefs 0 refcount change on invalid ref 0 ret -22
** 4 printk messages dropped ** [ 2164.515428] binder: undelivered TRANSACTION_ERROR: 29201
[ 2164.627000] binder: 3682:3684 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:04 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2164.627124] binder: 3682:3684 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:04 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:04 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2164.627149] binder: 3682:3684 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:04 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:04 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:04 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2164.627157] binder: 3682:3684 got reply transaction with no transaction stack
14:33:04 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:04 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:04 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 1 printk messages dropped ** [ 2164.627352] binder: undelivered TRANSACTION_ERROR: 29201
14:33:04 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:04 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:04 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2164.771736] binder: undelivered TRANSACTION_ERROR: 29201
14:33:04 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:04 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:04 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:04 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:04 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2164.865902] binder: 3715:3718 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:04 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:04 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2164.866251] binder: undelivered TRANSACTION_ERROR: 29201
[ 2164.973109] binder: 3727:3734 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:05 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:05 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:05 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:05 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2164.973229] binder: 3727:3734 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2164.973252] binder: 3727:3734 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2164.973260] binder: 3727:3734 got reply transaction with no transaction stack
14:33:05 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:05 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 1 printk messages dropped ** [ 2164.973453] binder: undelivered TRANSACTION_ERROR: 29201
[ 2165.062309] binder: 3743:3745 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:05 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:05 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:05 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2165.062443] binder: 3743:3745 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:05 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:05 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:05 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:05 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:05 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2165.062468] binder: 3743:3745 DecRefs 0 refcount change on invalid ref 0 ret -22
** 2 printk messages dropped ** [ 2165.063659] binder: undelivered TRANSACTION_ERROR: 29201
14:33:05 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:05 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:05 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:05 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:05 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2165.251004] binder: 3763:3770 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2165.251144] binder: 3763:3770 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2165.251170] binder: 3763:3770 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:05 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:05 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 2 printk messages dropped ** [ 2165.251423] binder: undelivered TRANSACTION_ERROR: 29201
[ 2165.737674] binder: 3779:3781 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:05 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:05 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2165.737925] binder: 3779:3781 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:05 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:05 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:05 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:05 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:05 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 3 printk messages dropped ** [ 2165.738126] binder: undelivered TRANSACTION_ERROR: 29201
[ 2165.868364] binder: 3800:3803 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:05 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:05 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:05 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2165.868485] binder: 3800:3803 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:05 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:05 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 3 printk messages dropped ** [ 2165.868732] binder: undelivered TRANSACTION_ERROR: 29201
14:33:05 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:05 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:05 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 5 printk messages dropped ** [ 2166.034070] binder: undelivered TRANSACTION_ERROR: 29201
14:33:05 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:05 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:05 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2166.179794] binder: 3843:3847 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2166.179914] binder: 3843:3847 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:05 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:05 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:05 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2166.179940] binder: 3843:3847 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:05 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:05 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:05 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 2 printk messages dropped ** [ 2166.180250] binder: undelivered TRANSACTION_ERROR: 29201
14:33:05 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:05 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:05 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2166.301769] binder: 3862:3867 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:05 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:05 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2166.302122] binder: undelivered TRANSACTION_ERROR: 29201
14:33:05 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:06 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:06 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 5 printk messages dropped ** [ 2166.451728] binder: undelivered TRANSACTION_ERROR: 29201
14:33:06 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:06 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:06 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:06 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:06 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2166.579278] binder: 3901:3909 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:06 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2166.581038] binder: undelivered TRANSACTION_ERROR: 29201
14:33:06 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:06 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:06 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:06 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2166.715640] binder: 3922:3926 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2166.716029] binder: 3922:3926 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2166.716061] binder: 3922:3926 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:06 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 2 printk messages dropped ** [ 2166.716276] binder: undelivered TRANSACTION_ERROR: 29201
[ 2166.861768] binder: 3938:3945 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2166.861895] binder: 3938:3945 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2166.861921] binder: 3938:3945 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2166.861929] binder: 3938:3945 got reply transaction with no transaction stack
[ 2166.861938] binder: 3938:3945 transaction failed 29201/-71, size 0-0 line 2922
[ 2166.862120] binder: undelivered TRANSACTION_ERROR: 29201
[ 2166.950722] binder: 3956:3959 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2166.951489] binder: 3956:3959 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2166.951513] binder: 3956:3959 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:06 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2166.951520] binder: 3956:3959 got reply transaction with no transaction stack
[ 2166.951529] binder: 3956:3959 transaction failed 29201/-71, size 0-0 line 2922
[ 2166.951694] binder: undelivered TRANSACTION_ERROR: 29201
[ 2167.109947] binder: 3976:3983 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2167.110073] binder: 3976:3983 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2167.110098] binder: 3976:3983 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:06 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2167.110106] binder: 3976:3983 got reply transaction with no transaction stack
[ 2167.110116] binder: 3976:3983 transaction failed 29201/-71, size 0-0 line 2922
[ 2167.110279] binder: undelivered TRANSACTION_ERROR: 29201
[ 2167.267344] binder: 4005:4007 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2167.267466] binder: 4005:4007 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2167.267488] binder: 4005:4007 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2167.267496] binder: 4005:4007 got reply transaction with no transaction stack
14:33:06 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:06 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:06 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:06 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:06 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2167.267505] binder: 4005:4007 transaction failed 29201/-71, size 0-0 line 2922
[ 2167.293885] binder: undelivered TRANSACTION_ERROR: 29201
14:33:06 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:06 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:06 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:06 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2167.381235] binder: 4021:4027 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2167.381341] binder: 4021:4027 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:06 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:06 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:06 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:06 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2167.381377] binder: 4021:4027 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:06 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:06 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2167.381385] binder: 4021:4027 got reply transaction with no transaction stack
[ 2167.381394] binder: 4021:4027 transaction failed 29201/-71, size 0-0 line 2922
14:33:06 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:06 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:06 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:07 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2167.384847] binder: undelivered TRANSACTION_ERROR: 29201
14:33:07 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:07 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:07 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:07 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2167.492685] binder: 4042:4045 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2167.492801] binder: 4042:4045 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:07 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:07 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:07 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2167.492826] binder: 4042:4045 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2167.492833] binder: 4042:4045 got reply transaction with no transaction stack
14:33:07 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:07 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:07 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:07 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:07 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2167.492842] binder: 4042:4045 transaction failed 29201/-71, size 0-0 line 2922
14:33:07 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:07 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2167.493038] binder: undelivered TRANSACTION_ERROR: 29201
14:33:07 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:07 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:07 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2167.618949] binder: 4059:4062 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:07 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2167.619058] binder: 4059:4062 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2167.619084] binder: 4059:4062 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:07 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:07 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:07 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:07 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2167.619092] binder: 4059:4062 got reply transaction with no transaction stack
** 1 printk messages dropped ** [ 2167.619280] binder: undelivered TRANSACTION_ERROR: 29201
14:33:07 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2167.759871] binder: 4076:4079 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:07 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:07 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:07 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:07 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2167.759996] binder: 4076:4079 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:07 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:07 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:07 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 3 printk messages dropped ** [ 2167.760223] binder: undelivered TRANSACTION_ERROR: 29201
[ 2167.887833] binder: 4091:4095 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:07 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:07 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:07 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2167.887967] binder: 4091:4095 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:07 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:07 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:07 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:07 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2167.888196] binder: undelivered TRANSACTION_ERROR: 29201
14:33:07 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:07 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:07 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:07 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2167.983130] binder: 4105:4109 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2167.985387] binder: 4105:4109 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
** 3 printk messages dropped ** [ 2167.989678] binder: undelivered TRANSACTION_ERROR: 29201
14:33:07 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:07 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:07 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2168.103226] binder: 4127:4129 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:07 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:07 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:07 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2168.103625] binder: 4127:4129 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:07 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:07 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:07 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 3 printk messages dropped ** [ 2168.103957] binder: undelivered TRANSACTION_ERROR: 29201
14:33:07 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:08 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:08 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:08 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2168.199772] binder: 4141:4145 IncRefs 0 refcount change on invalid ref 0 ret -22
** 4 printk messages dropped ** [ 2168.201061] binder: undelivered TRANSACTION_ERROR: 29201
14:33:08 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:08 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:08 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:08 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:08 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2168.303962] binder: undelivered TRANSACTION_ERROR: 29201
14:33:08 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:08 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2168.406417] binder: 4167:4174 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:08 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:08 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:08 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:08 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:08 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2168.406534] binder: 4167:4174 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
** 3 printk messages dropped ** [ 2168.406748] binder: undelivered TRANSACTION_ERROR: 29201
14:33:08 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2168.553726] binder: 4188:4192 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:08 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:08 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:08 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2168.553846] binder: 4188:4192 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:08 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:08 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:08 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 3 printk messages dropped ** [ 2168.554084] binder: undelivered TRANSACTION_ERROR: 29201
14:33:08 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:08 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2168.685641] binder: 4207:4211 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:08 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:08 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2168.685749] binder: 4207:4211 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:08 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:08 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 3 printk messages dropped ** [ 2168.689722] binder: undelivered TRANSACTION_ERROR: 29201
14:33:08 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:08 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:08 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:08 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:08 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2168.797922] binder: 4225:4227 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:08 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:08 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:08 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2168.798269] binder: undelivered TRANSACTION_ERROR: 29201
14:33:08 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:08 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:08 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:08 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:08 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2168.951167] binder: undelivered TRANSACTION_ERROR: 29201
[ 2169.075805] binder: 4262:4263 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:08 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:08 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:08 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2169.075944] binder: 4262:4263 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:08 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:08 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:08 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:08 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 3 printk messages dropped ** [ 2169.076167] binder: undelivered TRANSACTION_ERROR: 29201
14:33:08 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:08 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:09 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:09 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2169.210507] binder: undelivered TRANSACTION_ERROR: 29201
14:33:09 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:09 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:09 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:09 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:09 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2169.331055] binder: 4293:4296 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:09 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:09 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:09 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:09 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 4 printk messages dropped ** [ 2169.331375] binder: undelivered TRANSACTION_ERROR: 29201
14:33:09 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:09 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:09 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:09 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2169.438414] binder: undelivered TRANSACTION_ERROR: 29201
14:33:09 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:09 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:09 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:09 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:09 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:09 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:09 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 5 printk messages dropped ** [ 2169.577372] binder: undelivered TRANSACTION_ERROR: 29201
14:33:09 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:09 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:09 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:09 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:09 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 5 printk messages dropped ** [ 2169.690183] binder: undelivered TRANSACTION_ERROR: 29201
14:33:09 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:09 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:09 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2169.834457] binder: 4366:4370 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:09 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:09 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:09 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:09 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:09 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:09 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 4 printk messages dropped ** [ 2169.836165] binder: undelivered TRANSACTION_ERROR: 29201
[ 2169.965490] binder: 4385:4386 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:09 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:09 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:09 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2169.966015] binder: undelivered TRANSACTION_ERROR: 29201
14:33:09 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:09 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:09 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 5 printk messages dropped ** [ 2170.062096] binder: undelivered TRANSACTION_ERROR: 29201
14:33:09 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:09 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:09 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2170.207383] binder: 4416:4420 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:09 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:09 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:09 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:09 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:09 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 4 printk messages dropped ** [ 2170.210189] binder: undelivered TRANSACTION_ERROR: 29201
[ 2170.330655] binder: 4436:4437 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2170.331856] binder: 4436:4437 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:10 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:10 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:10 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:10 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 3 printk messages dropped ** [ 2170.332083] binder: undelivered TRANSACTION_ERROR: 29201
[ 2170.426886] binder: 4452:4455 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:10 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:10 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2170.427007] binder: 4452:4455 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:10 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2170.427030] binder: 4452:4455 DecRefs 0 refcount change on invalid ref 0 ret -22
** 2 printk messages dropped ** [ 2170.427228] binder: undelivered TRANSACTION_ERROR: 29201
14:33:10 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:10 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:10 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:10 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:10 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2170.546083] binder: 4468:4472 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2170.546199] binder: 4468:4472 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:10 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:10 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:10 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:10 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2170.546224] binder: 4468:4472 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:10 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:10 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:10 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:10 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 2 printk messages dropped ** [ 2170.556496] binder: undelivered TRANSACTION_ERROR: 29201
14:33:10 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:10 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:10 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2170.921463] binder: undelivered TRANSACTION_ERROR: 29201
14:33:10 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:10 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2171.054353] binder: 4497:4498 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:10 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:10 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:10 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:10 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2171.054687] binder: undelivered TRANSACTION_ERROR: 29201
14:33:10 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:10 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2171.214086] binder: 4512:4516 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:10 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:10 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:10 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 4 printk messages dropped ** [ 2171.225035] binder: undelivered TRANSACTION_ERROR: 29201
14:33:10 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:10 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:10 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2171.337210] binder: 4528:4530 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:10 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:10 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:10 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2171.340667] binder: 4528:4530 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:10 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:10 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:10 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:10 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:10 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:10 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:10 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 3 printk messages dropped ** [ 2171.340917] binder: undelivered TRANSACTION_ERROR: 29201
14:33:10 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:10 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 5 printk messages dropped ** [ 2171.472313] binder: undelivered TRANSACTION_ERROR: 29201
[ 2171.604786] binder: 4565:4568 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:11 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:11 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:11 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:11 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2171.604913] binder: 4565:4568 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:11 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:11 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:11 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:11 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:11 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 3 printk messages dropped ** [ 2171.605137] binder: undelivered TRANSACTION_ERROR: 29201
14:33:11 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:11 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2171.667881] binder: undelivered TRANSACTION_ERROR: 29201
[ 2171.782868] binder: 4592:4593 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:11 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:11 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:11 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:11 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2171.782992] binder: 4592:4593 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:11 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:11 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:11 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:11 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2171.783223] binder: undelivered TRANSACTION_ERROR: 29201
14:33:11 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:11 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:11 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 5 printk messages dropped ** [ 2171.908770] binder: undelivered TRANSACTION_ERROR: 29201
14:33:11 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2172.017119] binder: 4624:4627 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2172.017238] binder: 4624:4627 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2172.017261] binder: 4624:4627 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2172.017268] binder: 4624:4627 got reply transaction with no transaction stack
[ 2172.017277] binder: 4624:4627 transaction failed 29201/-71, size 0-0 line 2922
[ 2172.017460] binder: undelivered TRANSACTION_ERROR: 29201
[ 2172.144030] binder: 4640:4643 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:11 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:11 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:11 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2172.144145] binder: 4640:4643 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2172.144169] binder: 4640:4643 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:11 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2172.144176] binder: 4640:4643 got reply transaction with no transaction stack
[ 2172.144186] binder: 4640:4643 transaction failed 29201/-71, size 0-0 line 2922
[ 2172.144368] binder: undelivered TRANSACTION_ERROR: 29201
[ 2172.238937] binder: 4652:4656 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2172.239044] binder: 4652:4656 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2172.239069] binder: 4652:4656 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2172.239076] binder: 4652:4656 got reply transaction with no transaction stack
[ 2172.239085] binder: 4652:4656 transaction failed 29201/-71, size 0-0 line 2922
[ 2172.239259] binder: undelivered TRANSACTION_ERROR: 29201
[ 2172.344246] binder: 4669:4671 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2172.344349] binder: 4669:4671 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2172.344383] binder: 4669:4671 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2172.344391] binder: 4669:4671 got reply transaction with no transaction stack
[ 2172.344401] binder: 4669:4671 transaction failed 29201/-71, size 0-0 line 2922
[ 2172.344577] binder: undelivered TRANSACTION_ERROR: 29201
[ 2172.479796] binder: 4685:4691 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:11 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:11 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:11 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:11 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:11 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2172.479979] binder: 4685:4691 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2172.480005] binder: 4685:4691 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2172.480013] binder: 4685:4691 got reply transaction with no transaction stack
[ 2172.480022] binder: 4685:4691 transaction failed 29201/-71, size 0-0 line 2922
14:33:12 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:12 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2172.480393] binder: undelivered TRANSACTION_ERROR: 29201
[ 2172.588786] binder: 4705:4707 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:12 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:12 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:12 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:12 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:12 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2172.588900] binder: 4705:4707 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2172.588924] binder: 4705:4707 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:12 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2172.588932] binder: 4705:4707 got reply transaction with no transaction stack
14:33:12 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:12 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:12 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:12 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:12 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2172.588942] binder: 4705:4707 transaction failed 29201/-71, size 0-0 line 2922
[ 2172.589115] binder: undelivered TRANSACTION_ERROR: 29201
14:33:12 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:12 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2172.674469] binder: 4719:4720 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:12 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:12 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:12 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:12 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:12 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2172.674576] binder: 4719:4720 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:12 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:12 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2172.674601] binder: 4719:4720 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2172.674609] binder: 4719:4720 got reply transaction with no transaction stack
[ 2172.674618] binder: 4719:4720 transaction failed 29201/-71, size 0-0 line 2922
14:33:12 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:12 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2172.674780] binder: undelivered TRANSACTION_ERROR: 29201
[ 2172.789813] binder: 4734:4736 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:12 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:12 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2172.789937] binder: 4734:4736 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:12 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:12 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:12 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:12 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:12 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:12 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2172.789961] binder: 4734:4736 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2172.789969] binder: 4734:4736 got reply transaction with no transaction stack
14:33:12 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:12 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:12 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2172.789978] binder: 4734:4736 transaction failed 29201/-71, size 0-0 line 2922
14:33:12 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:12 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:12 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:12 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:12 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:12 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2172.790140] binder: undelivered TRANSACTION_ERROR: 29201
[ 2172.907483] binder: 4750:4752 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:12 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:12 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:12 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:12 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:12 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2172.907648] binder: 4750:4752 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2172.907674] binder: 4750:4752 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:12 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:12 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2172.907682] binder: 4750:4752 got reply transaction with no transaction stack
14:33:13 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:13 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:13 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:13 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2172.907691] binder: 4750:4752 transaction failed 29201/-71, size 0-0 line 2922
14:33:13 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:13 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2172.907874] binder: undelivered TRANSACTION_ERROR: 29201
[ 2173.020795] binder: 4764:4769 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:13 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:13 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:13 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:13 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:13 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:13 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 4 printk messages dropped ** [ 2173.021131] binder: undelivered TRANSACTION_ERROR: 29201
14:33:13 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:13 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:13 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:13 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2173.128101] binder: undelivered TRANSACTION_ERROR: 29201
14:33:13 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:13 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:13 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2173.316763] binder: 4803:4810 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2173.316887] binder: 4803:4810 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:13 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:13 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:13 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:13 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:13 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2173.317109] binder: undelivered TRANSACTION_ERROR: 29201
14:33:13 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:13 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:13 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:13 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:13 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2173.454414] binder: undelivered TRANSACTION_ERROR: 29201
14:33:13 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:13 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2173.566951] binder: 4846:4848 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:13 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:13 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:13 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2173.570457] binder: undelivered TRANSACTION_ERROR: 29201
14:33:13 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:13 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:13 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:13 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:13 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:13 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2173.662946] binder: undelivered TRANSACTION_ERROR: 29201
[ 2173.773199] binder: 4875:4878 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:13 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:13 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2173.773309] binder: 4875:4878 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2173.773334] binder: 4875:4878 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2173.773342] binder: 4875:4878 got reply transaction with no transaction stack
14:33:13 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:13 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:13 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:13 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2173.773352] binder: 4875:4878 transaction failed 29201/-71, size 0-0 line 2922
[ 2173.773685] binder: undelivered TRANSACTION_ERROR: 29201
14:33:13 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:13 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:13 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2173.892800] binder: 4893:4896 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:13 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:13 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2173.892923] binder: 4893:4896 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:14 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:14 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:14 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:14 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 3 printk messages dropped ** [ 2173.893142] binder: undelivered TRANSACTION_ERROR: 29201
14:33:14 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:14 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:14 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:14 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:14 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 1 printk messages dropped ** [ 2174.026710] binder: 4909:4913 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
** 3 printk messages dropped ** [ 2174.026941] binder: undelivered TRANSACTION_ERROR: 29201
14:33:14 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:14 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:14 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:14 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2174.143620] binder: 4924:4929 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2174.143732] binder: 4924:4929 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:14 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:14 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:14 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:14 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 3 printk messages dropped ** [ 2174.145534] binder: undelivered TRANSACTION_ERROR: 29201
[ 2174.216583] binder: 4939:4941 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:14 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:14 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:14 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:14 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2174.217410] binder: 4939:4941 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:14 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:14 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 3 printk messages dropped ** [ 2174.217614] binder: undelivered TRANSACTION_ERROR: 29201
14:33:14 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:14 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2174.362860] binder: 4952:4959 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2174.362992] binder: 4952:4959 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:14 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:14 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:14 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2174.363016] binder: 4952:4959 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2174.363025] binder: 4952:4959 got reply transaction with no transaction stack
[ 2174.363034] binder: 4952:4959 transaction failed 29201/-71, size 0-0 line 2922
14:33:14 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:14 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:14 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:14 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:14 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:14 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:14 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2174.363202] binder: undelivered TRANSACTION_ERROR: 29201
[ 2174.460926] binder: 4971:4976 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:14 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:14 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:14 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:14 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2174.463234] binder: undelivered TRANSACTION_ERROR: 29201
14:33:14 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:14 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:14 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:14 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2174.544113] binder: 4985:4986 IncRefs 0 refcount change on invalid ref 0 ret -22
** 4 printk messages dropped ** [ 2174.546571] binder: undelivered TRANSACTION_ERROR: 29201
14:33:14 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:14 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:14 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2174.712329] binder: 5002:5008 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:14 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:14 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [ 2174.712695] binder: undelivered TRANSACTION_ERROR: 29201
14:33:14 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:15 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:15 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:15 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2174.798594] binder: 5021:5024 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:15 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:15 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:15 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2174.798951] binder: undelivered TRANSACTION_ERROR: 29201
14:33:15 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:15 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:15 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2174.912507] binder: 5038:5041 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:15 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:15 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:15 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [ 2174.915070] binder: undelivered TRANSACTION_ERROR: 29201
14:33:15 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:15 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:15 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:15 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:15 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2175.083458] binder: 5058:5062 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:15 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:15 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:15 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 4 printk messages dropped ** [ 2175.083985] binder: undelivered TRANSACTION_ERROR: 29201
[ 2175.200981] binder: 5077:5078 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:15 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:15 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:15 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:15 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2175.201315] binder: undelivered TRANSACTION_ERROR: 29201
14:33:15 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:15 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2175.313073] binder: 5091:5098 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2175.313196] binder: 5091:5098 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2175.313221] binder: 5091:5098 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:15 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:15 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:15 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:15 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:15 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2175.313229] binder: 5091:5098 got reply transaction with no transaction stack
[ 2175.313238] binder: 5091:5098 transaction failed 29201/-71, size 0-0 line 2922
14:33:15 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:15 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:15 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:15 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2175.313423] binder: undelivered TRANSACTION_ERROR: 29201
[ 2175.444625] binder: 5107:5115 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2175.444748] binder: 5107:5115 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:15 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:15 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:15 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:15 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:15 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:15 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:15 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2175.446103] binder: undelivered TRANSACTION_ERROR: 29201
14:33:15 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:15 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:15 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 5 printk messages dropped ** [ 2175.562021] binder: undelivered TRANSACTION_ERROR: 29201
14:33:15 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:15 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:15 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:15 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:15 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2175.695380] binder: undelivered TRANSACTION_ERROR: 29201
14:33:15 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:15 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:16 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2175.818240] binder: 5159:5160 IncRefs 0 refcount change on invalid ref 0 ret -22
** 4 printk messages dropped ** [ 2175.818587] binder: undelivered TRANSACTION_ERROR: 29201
14:33:16 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:16 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:16 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2175.952855] binder: 5178:5179 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:16 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:16 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:16 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 4 printk messages dropped ** [ 2175.954178] binder: undelivered TRANSACTION_ERROR: 29201
14:33:16 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:16 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:16 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:16 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:16 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 5 printk messages dropped ** [ 2176.527657] binder: undelivered TRANSACTION_ERROR: 29201
14:33:16 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:16 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:16 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2176.653688] binder: 5223:5228 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:16 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:16 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2176.657311] binder: 5223:5228 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:16 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:16 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:16 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:16 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 4 printk messages dropped ** [ 2176.769114] binder: 5238:5243 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:16 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:16 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:16 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:16 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:16 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2176.769220] binder: 5238:5243 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2176.769244] binder: 5238:5243 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2176.769252] binder: 5238:5243 got reply transaction with no transaction stack
14:33:16 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:16 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:16 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:16 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 2 printk messages dropped ** [ 2176.860841] binder: 5255:5261 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2176.861004] binder: 5255:5261 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
** 4 printk messages dropped ** [ 2176.963342] binder: 5268:5270 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:16 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:16 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:16 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:16 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:16 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:16 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2176.964892] binder: 5268:5270 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:16 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:16 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:16 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 4 printk messages dropped ** [ 2177.072325] binder: 5285:5292 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2177.072448] binder: 5285:5292 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
** 4 printk messages dropped ** [ 2177.216635] binder: 5307:5308 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2177.216752] binder: 5307:5308 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2177.216777] binder: 5307:5308 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2177.216785] binder: 5307:5308 got reply transaction with no transaction stack
[ 2177.216795] binder: 5307:5308 transaction failed 29201/-71, size 0-0 line 2922
[ 2177.217075] binder: undelivered TRANSACTION_ERROR: 29201
14:33:16 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:16 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2177.337067] binder: 5328:5330 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2177.337190] binder: 5328:5330 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:17 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2177.337215] binder: 5328:5330 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2177.337223] binder: 5328:5330 got reply transaction with no transaction stack
[ 2177.337233] binder: 5328:5330 transaction failed 29201/-71, size 0-0 line 2922
[ 2177.338752] binder: undelivered TRANSACTION_ERROR: 29201
[ 2177.512082] binder: 5345:5355 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2177.512194] binder: 5345:5355 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2177.512219] binder: 5345:5355 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2177.512227] binder: 5345:5355 got reply transaction with no transaction stack
[ 2177.512237] binder: 5345:5355 transaction failed 29201/-71, size 0-0 line 2922
[ 2177.512454] binder: undelivered TRANSACTION_ERROR: 29201
[ 2177.619459] binder: 5368:5373 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2177.619563] binder: 5368:5373 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2177.619588] binder: 5368:5373 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2177.619595] binder: 5368:5373 got reply transaction with no transaction stack
[ 2177.619604] binder: 5368:5373 transaction failed 29201/-71, size 0-0 line 2922
[ 2177.619774] binder: undelivered TRANSACTION_ERROR: 29201
14:33:17 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:17 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:17 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2177.765213] binder: 5386:5389 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2177.765319] binder: 5386:5389 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2177.765355] binder: 5386:5389 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:17 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:17 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:17 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2177.765522] binder: 5386:5389 got reply transaction with no transaction stack
14:33:17 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:17 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2177.765532] binder: 5386:5389 transaction failed 29201/-71, size 0-0 line 2922
[ 2177.765717] binder: undelivered TRANSACTION_ERROR: 29201
14:33:17 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:17 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:17 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:17 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2177.870138] binder: 5405:5406 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2177.870255] binder: 5405:5406 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:17 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:17 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:17 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:17 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2177.870279] binder: 5405:5406 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:17 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:17 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:17 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:17 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2177.870287] binder: 5405:5406 got reply transaction with no transaction stack
14:33:17 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:17 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:17 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:17 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:17 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:17 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2177.870297] binder: 5405:5406 transaction failed 29201/-71, size 0-0 line 2922
[ 2177.870473] binder: undelivered TRANSACTION_ERROR: 29201
14:33:17 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:17 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:17 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:17 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:17 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2178.021364] binder: 5417:5423 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2178.021616] binder: 5417:5423 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:17 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:17 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:17 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:17 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2178.021641] binder: 5417:5423 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2178.021648] binder: 5417:5423 got reply transaction with no transaction stack
14:33:17 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:17 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:17 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:17 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:17 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:17 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 3 printk messages dropped ** [ 2178.168437] binder: 5441:5445 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:18 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:18 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2178.168460] binder: 5441:5445 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:18 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:18 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:18 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2178.310730] binder: 5463:5464 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:18 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:18 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:18 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:18 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 5 printk messages dropped ** [ 2178.427875] binder: 5479:5482 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2178.427899] binder: 5479:5482 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:18 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:18 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:18 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:18 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:18 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:18 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:18 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2178.533787] binder: 5496:5499 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:18 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:18 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:18 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:18 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2178.608731] binder: 5509:5512 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2178.608757] binder: 5509:5512 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:18 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:18 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:18 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:18 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:18 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2178.726662] binder: 5522:5527 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:18 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:18 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:18 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2178.726686] binder: 5522:5527 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:18 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:18 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2178.726694] binder: 5522:5527 got reply transaction with no transaction stack
14:33:18 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:18 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:18 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:18 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:18 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:18 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 3 printk messages dropped ** [ 2178.842115] binder: 5538:5543 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2178.842139] binder: 5538:5543 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:18 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:18 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 5 printk messages dropped ** [ 2178.942258] binder: 5557:5560 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2178.942266] binder: 5557:5560 got reply transaction with no transaction stack
14:33:18 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:18 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:18 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:18 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 4 printk messages dropped ** [ 2179.039733] binder: 5568:5572 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2179.039741] binder: 5568:5572 got reply transaction with no transaction stack
14:33:18 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:18 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:18 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:18 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:18 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2179.039750] binder: 5568:5572 transaction failed 29201/-71, size 0-0 line 2922
14:33:18 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:18 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:18 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2179.185909] binder: 5590:5593 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:18 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:19 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:19 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:19 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 5 printk messages dropped ** [ 2179.289820] binder: 5606:5610 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:19 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:19 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:19 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2179.289828] binder: 5606:5610 got reply transaction with no transaction stack
14:33:19 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:19 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:19 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:19 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2179.370574] binder: 5620:5622 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:19 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:19 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:19 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:19 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:19 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2179.370583] binder: 5620:5622 got reply transaction with no transaction stack
** 4 printk messages dropped ** [ 2179.459835] binder: 5635:5636 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:19 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:19 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:19 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:19 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2179.459843] binder: 5635:5636 got reply transaction with no transaction stack
** 4 printk messages dropped ** [ 2179.570690] binder: 5646:5655 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:19 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:19 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:19 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2179.570698] binder: 5646:5655 got reply transaction with no transaction stack
[ 2179.570708] binder: 5646:5655 transaction failed 29201/-71, size 0-0 line 2922
14:33:19 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:19 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:19 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:19 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:19 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2179.571165] binder: undelivered TRANSACTION_ERROR: 29201
[ 2179.694066] binder: 5669:5671 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:19 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:19 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 1 printk messages dropped ** [ 2179.694215] binder: 5669:5671 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:19 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:19 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2179.694223] binder: 5669:5671 got reply transaction with no transaction stack
14:33:19 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:19 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:19 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:19 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:19 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2179.823379] binder: 5679:5685 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2179.823387] binder: 5679:5685 got reply transaction with no transaction stack
[ 2179.823397] binder: 5679:5685 transaction failed 29201/-71, size 0-0 line 2922
14:33:19 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:19 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:19 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2179.823749] binder: undelivered TRANSACTION_ERROR: 29201
14:33:19 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:19 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:19 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:19 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 2 printk messages dropped ** [ 2179.950695] binder: 5697:5702 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2179.950703] binder: 5697:5702 got reply transaction with no transaction stack
14:33:19 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:19 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:19 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:19 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:19 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2180.070659] binder: 5714:5717 got reply transaction with no transaction stack
14:33:19 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:20 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:20 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:20 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:20 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:20 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 5 printk messages dropped ** [ 2180.164009] binder: 5730:5732 got reply transaction with no transaction stack
14:33:20 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:20 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:20 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:20 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2180.164018] binder: 5730:5732 transaction failed 29201/-71, size 0-0 line 2922
** 4 printk messages dropped ** [ 2180.290363] binder: 5747:5751 got reply transaction with no transaction stack
14:33:20 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:20 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:20 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:20 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:20 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:20 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 5 printk messages dropped ** [ 2180.437713] binder: 5768:5772 got reply transaction with no transaction stack
14:33:20 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:20 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:20 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:20 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:20 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2180.437723] binder: 5768:5772 transaction failed 29201/-71, size 0-0 line 2922
14:33:20 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:20 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:20 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:20 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2180.546843] binder: 5784:5787 got reply transaction with no transaction stack
14:33:20 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:20 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:20 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:20 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:20 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:20 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2180.672834] binder: 5797:5803 got reply transaction with no transaction stack
14:33:20 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:20 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:20 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2180.672843] binder: 5797:5803 transaction failed 29201/-71, size 0-0 line 2922
14:33:20 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:20 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:20 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:20 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2180.804340] binder: 5818:5821 got reply transaction with no transaction stack
14:33:20 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:20 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2180.804349] binder: 5818:5821 transaction failed 29201/-71, size 0-0 line 2922
14:33:20 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:20 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2180.908143] binder: 5834:5837 got reply transaction with no transaction stack
14:33:20 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:20 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:20 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2180.908153] binder: 5834:5837 transaction failed 29201/-71, size 0-0 line 2922
14:33:20 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:20 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:20 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2181.011166] binder: 5850:5851 got reply transaction with no transaction stack
14:33:20 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:20 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:20 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:20 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:20 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2181.011176] binder: 5850:5851 transaction failed 29201/-71, size 0-0 line 2922
14:33:21 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:21 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:21 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2181.104261] binder: 5862:5864 got reply transaction with no transaction stack
14:33:21 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:21 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:21 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2181.104271] binder: 5862:5864 transaction failed 29201/-71, size 0-0 line 2922
14:33:21 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:21 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:21 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:21 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 4 printk messages dropped ** [ 2181.724253] binder: 5898:5901 got reply transaction with no transaction stack
14:33:21 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:21 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:21 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:21 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:21 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 5 printk messages dropped ** [ 2181.820660] binder: 5913:5914 got reply transaction with no transaction stack
14:33:21 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:21 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:21 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:21 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2181.820668] binder: 5913:5914 transaction failed 29201/-71, size 0-0 line 2922
[ 2181.820848] binder: undelivered TRANSACTION_ERROR: 29201
14:33:21 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:21 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 3 printk messages dropped ** [ 2181.952806] binder: 5927:5931 got reply transaction with no transaction stack
14:33:21 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:21 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:21 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:21 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2181.952815] binder: 5927:5931 transaction failed 29201/-71, size 0-0 line 2922
** 4 printk messages dropped ** [ 2182.087500] binder: 5950:5951 got reply transaction with no transaction stack
14:33:21 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:21 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:21 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:21 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:21 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:21 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2182.087509] binder: 5950:5951 transaction failed 29201/-71, size 0-0 line 2922
[ 2182.087684] binder: undelivered TRANSACTION_ERROR: 29201
14:33:21 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:21 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 3 printk messages dropped ** [ 2182.224930] binder: 5967:5970 got reply transaction with no transaction stack
14:33:21 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:21 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:21 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:21 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:21 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:21 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 5 printk messages dropped ** [ 2182.337033] binder: 5986:5990 got reply transaction with no transaction stack
14:33:21 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:21 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:21 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:21 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:21 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 5 printk messages dropped ** [ 2182.472110] binder: 6007:6010 got reply transaction with no transaction stack
14:33:21 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:21 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2182.472118] binder: 6007:6010 transaction failed 29201/-71, size 0-0 line 2922
[ 2182.478086] binder: undelivered TRANSACTION_ERROR: 29201
14:33:21 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:21 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:21 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:21 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [ 2182.587475] binder: 6024:6025 transaction failed 29201/-71, size 0-0 line 2922
14:33:22 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:22 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2182.587643] binder: undelivered TRANSACTION_ERROR: 29201
[ 2182.752466] binder: 6041:6049 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2182.752920] binder: 6041:6049 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2182.752945] binder: 6041:6049 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2182.752953] binder: 6041:6049 got reply transaction with no transaction stack
[ 2182.752963] binder: 6041:6049 transaction failed 29201/-71, size 0-0 line 2922
[ 2182.753255] binder: undelivered TRANSACTION_ERROR: 29201
[ 2182.859652] binder: 6061:6063 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2182.862725] binder: 6061:6063 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:22 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:22 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:22 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:22 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2182.862749] binder: 6061:6063 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2182.862758] binder: 6061:6063 got reply transaction with no transaction stack
[ 2182.862767] binder: 6061:6063 transaction failed 29201/-71, size 0-0 line 2922
[ 2182.863124] binder: undelivered TRANSACTION_ERROR: 29201
[ 2183.005140] binder: 6078:6082 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:22 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2183.005646] binder: 6078:6082 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2183.005672] binder: 6078:6082 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2183.005679] binder: 6078:6082 got reply transaction with no transaction stack
[ 2183.005688] binder: 6078:6082 transaction failed 29201/-71, size 0-0 line 2922
[ 2183.005870] binder: undelivered TRANSACTION_ERROR: 29201
14:33:22 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:22 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:22 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:22 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:22 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2183.124770] binder: 6098:6105 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:22 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:22 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2183.124889] binder: 6098:6105 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2183.124914] binder: 6098:6105 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:22 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:22 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2183.124922] binder: 6098:6105 got reply transaction with no transaction stack
[ 2183.124931] binder: 6098:6105 transaction failed 29201/-71, size 0-0 line 2922
[ 2183.125108] binder: undelivered TRANSACTION_ERROR: 29201
14:33:22 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:22 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:22 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2183.283218] binder: 6115:6122 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2183.283341] binder: 6115:6122 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:22 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:22 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2183.283375] binder: 6115:6122 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:22 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:22 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:22 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:22 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2183.283384] binder: 6115:6122 got reply transaction with no transaction stack
[ 2183.283393] binder: 6115:6122 transaction failed 29201/-71, size 0-0 line 2922
14:33:22 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:22 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:22 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2183.285792] binder: undelivered TRANSACTION_ERROR: 29201
[ 2183.382378] binder: 6137:6139 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:22 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:22 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:22 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:22 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:22 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2183.382525] binder: 6137:6139 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2183.382549] binder: 6137:6139 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2183.382557] binder: 6137:6139 got reply transaction with no transaction stack
[ 2183.382565] binder: 6137:6139 transaction failed 29201/-71, size 0-0 line 2922
14:33:23 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:23 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:23 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:23 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2183.382747] binder: undelivered TRANSACTION_ERROR: 29201
[ 2183.567331] binder: 6151:6162 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:23 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:23 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:23 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2183.567445] binder: 6151:6162 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2183.567469] binder: 6151:6162 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:23 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:23 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:23 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:23 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:23 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 1 printk messages dropped ** [ 2183.567487] binder: 6151:6162 transaction failed 29201/-71, size 0-0 line 2922
[ 2183.567662] binder: undelivered TRANSACTION_ERROR: 29201
14:33:23 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:23 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:23 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:23 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:23 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2183.688000] binder: 6178:6180 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2183.689196] binder: 6178:6180 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2183.689221] binder: 6178:6180 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:23 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:23 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:23 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:23 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 1 printk messages dropped ** [ 2183.689240] binder: 6178:6180 transaction failed 29201/-71, size 0-0 line 2922
[ 2183.689423] binder: undelivered TRANSACTION_ERROR: 29201
14:33:23 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:23 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2183.794499] binder: 6196:6197 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:23 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 3 printk messages dropped ** [ 2183.798945] binder: 6196:6197 transaction failed 29201/-71, size 0-0 line 2922
[ 2183.799320] binder: undelivered TRANSACTION_ERROR: 29201
[ 2183.890496] binder: 6208:6209 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:23 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:23 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:23 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:23 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2183.890810] binder: undelivered TRANSACTION_ERROR: 29201
14:33:23 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:23 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:23 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2184.030705] binder: 6230:6232 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:23 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:23 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:23 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:23 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2184.031594] binder: undelivered TRANSACTION_ERROR: 29201
14:33:23 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2184.132575] binder: 6238:6243 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2184.137023] binder: 6238:6243 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:23 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:23 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2184.137049] binder: 6238:6243 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:23 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:23 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:23 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 2 printk messages dropped ** [ 2184.139843] binder: undelivered TRANSACTION_ERROR: 29201
14:33:23 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:23 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:23 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:23 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2184.268281] binder: 6257:6260 IncRefs 0 refcount change on invalid ref 0 ret -22
** 4 printk messages dropped ** [ 2184.268792] binder: undelivered TRANSACTION_ERROR: 29201
14:33:23 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:23 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:23 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:23 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:24 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:24 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:24 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2184.410998] binder: 6284:6287 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:24 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:24 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:24 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:24 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 4 printk messages dropped ** [ 2184.411344] binder: undelivered TRANSACTION_ERROR: 29201
14:33:24 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:24 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2184.533785] binder: 6299:6304 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:24 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:24 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:24 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:24 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:24 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:24 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2184.535711] binder: undelivered TRANSACTION_ERROR: 29201
14:33:24 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:24 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:24 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2184.665975] binder: 6317:6326 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:24 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:24 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:24 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:24 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2184.667150] binder: undelivered TRANSACTION_ERROR: 29201
14:33:24 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:24 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:24 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:24 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:24 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 5 printk messages dropped ** [ 2184.801348] binder: undelivered TRANSACTION_ERROR: 29201
14:33:24 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:24 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:24 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:24 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:24 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:24 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2184.940049] binder: 6366:6368 IncRefs 0 refcount change on invalid ref 0 ret -22
** 4 printk messages dropped ** [ 2184.941675] binder: undelivered TRANSACTION_ERROR: 29201
14:33:24 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:24 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:24 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:24 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2185.070706] binder: undelivered TRANSACTION_ERROR: 29201
14:33:24 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:24 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:24 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:24 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:24 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:24 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2185.178799] binder: 6398:6404 IncRefs 0 refcount change on invalid ref 0 ret -22
** 4 printk messages dropped ** [ 2185.179186] binder: undelivered TRANSACTION_ERROR: 29201
14:33:24 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:24 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:24 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:24 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:24 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2185.319823] binder: 6421:6426 IncRefs 0 refcount change on invalid ref 0 ret -22
** 5 printk messages dropped ** [ 2185.451503] binder: 6441:6442 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:24 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:24 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:24 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2185.451628] binder: 6441:6442 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:25 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:25 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:25 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:25 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2185.560864] binder: 6453:6456 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:25 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:25 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:25 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:25 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2185.560993] binder: 6453:6456 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2185.561017] binder: 6453:6456 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:25 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:25 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:25 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:25 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2185.677222] binder: 6469:6475 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:25 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:25 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:25 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:25 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:25 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 5 printk messages dropped ** [ 2185.822751] binder: 6489:6495 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:25 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:25 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:25 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:25 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:25 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2185.822868] binder: 6489:6495 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2185.822892] binder: 6489:6495 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:25 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:25 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:25 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:25 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 3 printk messages dropped ** [ 2186.017677] binder: 6515:6519 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:25 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:25 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:25 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:25 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:25 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:25 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:25 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:25 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2186.092892] binder: 6530:6533 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:25 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:25 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:25 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:25 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2186.235632] binder: 6548:6551 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:25 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:25 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:25 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:25 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:25 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 6 printk messages dropped ** [ 2186.314326] binder: 6563:6564 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2186.314349] binder: 6563:6564 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:25 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2186.314365] binder: 6563:6564 got reply transaction with no transaction stack
14:33:25 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:25 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:25 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:25 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2186.445514] binder: 6576:6580 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:25 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:25 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:25 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:26 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2186.445539] binder: 6576:6580 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:26 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:26 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:26 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2186.982581] binder: 6604:6611 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:26 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:26 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2186.982606] binder: 6604:6611 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:26 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:26 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:26 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:26 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:26 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 4 printk messages dropped ** [ 2187.083087] binder: 6622:6624 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2187.083111] binder: 6622:6624 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:26 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:26 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2187.083118] binder: 6622:6624 got reply transaction with no transaction stack
14:33:26 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:26 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:26 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:26 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 3 printk messages dropped ** [ 2187.195735] binder: 6637:6638 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:26 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:26 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2187.195759] binder: 6637:6638 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:26 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:26 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:26 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2187.195767] binder: 6637:6638 got reply transaction with no transaction stack
14:33:26 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:26 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 3 printk messages dropped ** [ 2187.310107] binder: 6653:6656 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:26 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:26 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:26 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:26 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2187.310131] binder: 6653:6656 DecRefs 0 refcount change on invalid ref 0 ret -22
** 4 printk messages dropped ** [ 2187.389835] binder: 6670:6671 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:26 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:26 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:26 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2187.389872] binder: 6670:6671 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2187.389879] binder: 6670:6671 got reply transaction with no transaction stack
14:33:26 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2187.389889] binder: 6670:6671 transaction failed 29201/-71, size 0-0 line 2922
14:33:26 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:26 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:26 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:26 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2187.390284] binder: undelivered TRANSACTION_ERROR: 29201
** 1 printk messages dropped ** [ 2187.529434] binder: 6687:6689 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:26 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:26 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2187.529462] binder: 6687:6689 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:26 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:26 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:26 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2187.529471] binder: 6687:6689 got reply transaction with no transaction stack
14:33:26 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:26 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 3 printk messages dropped ** [ 2187.659352] binder: 6706:6709 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:26 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:26 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:26 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:26 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2187.791235] binder: 6721:6727 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:26 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:26 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:26 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:26 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:26 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2187.791260] binder: 6721:6727 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2187.791268] binder: 6721:6727 got reply transaction with no transaction stack
14:33:27 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:27 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:27 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:27 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 3 printk messages dropped ** [ 2187.877742] binder: 6736:6741 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:27 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:27 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 6 printk messages dropped ** [ 2188.009420] binder: 6756:6759 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2188.009428] binder: 6756:6759 got reply transaction with no transaction stack
14:33:27 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:27 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:27 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:27 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:27 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:27 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2188.009437] binder: 6756:6759 transaction failed 29201/-71, size 0-0 line 2922
14:33:27 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:27 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [ 2188.166182] binder: 6776:6778 DecRefs 0 refcount change on invalid ref 0 ret -22
** 5 printk messages dropped ** [ 2188.250129] binder: 6787:6794 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2188.250137] binder: 6787:6794 got reply transaction with no transaction stack
[ 2188.250146] binder: 6787:6794 transaction failed 29201/-71, size 0-0 line 2922
[ 2188.250332] binder: undelivered TRANSACTION_ERROR: 29201
[ 2188.387272] binder: 6806:6812 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2188.387388] binder: 6806:6812 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2188.387413] binder: 6806:6812 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2188.387421] binder: 6806:6812 got reply transaction with no transaction stack
[ 2188.387431] binder: 6806:6812 transaction failed 29201/-71, size 0-0 line 2922
[ 2188.387609] binder: undelivered TRANSACTION_ERROR: 29201
[ 2188.501598] binder: 6826:6830 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2188.502266] binder: 6826:6830 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2188.502291] binder: 6826:6830 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2188.502299] binder: 6826:6830 got reply transaction with no transaction stack
[ 2188.502309] binder: 6826:6830 transaction failed 29201/-71, size 0-0 line 2922
14:33:27 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:27 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:27 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2188.502636] binder: undelivered TRANSACTION_ERROR: 29201
[ 2188.628141] binder: 6844:6850 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2188.628251] binder: 6844:6850 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2188.628275] binder: 6844:6850 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2188.628284] binder: 6844:6850 got reply transaction with no transaction stack
14:33:27 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:27 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:27 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2188.628293] binder: 6844:6850 transaction failed 29201/-71, size 0-0 line 2922
[ 2188.630133] binder: undelivered TRANSACTION_ERROR: 29201
[ 2188.737817] binder: 6861:6865 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2188.737943] binder: 6861:6865 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2188.737967] binder: 6861:6865 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2188.737975] binder: 6861:6865 got reply transaction with no transaction stack
[ 2188.737991] binder: 6861:6865 transaction failed 29201/-71, size 0-0 line 2922
[ 2188.738359] binder: undelivered TRANSACTION_ERROR: 29201
[ 2188.881992] binder: 6881:6886 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2188.882269] binder: 6881:6886 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2188.882293] binder: 6881:6886 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2188.882301] binder: 6881:6886 got reply transaction with no transaction stack
14:33:27 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2188.882310] binder: 6881:6886 transaction failed 29201/-71, size 0-0 line 2922
[ 2188.882637] binder: undelivered TRANSACTION_ERROR: 29201
[ 2189.050394] binder: 6906:6909 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2189.050502] binder: 6906:6909 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2189.050527] binder: 6906:6909 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2189.050535] binder: 6906:6909 got reply transaction with no transaction stack
14:33:27 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:27 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:27 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2189.050544] binder: 6906:6909 transaction failed 29201/-71, size 0-0 line 2922
[ 2189.050716] binder: undelivered TRANSACTION_ERROR: 29201
[ 2189.193665] binder: 6924:6928 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2189.194282] binder: 6924:6928 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2189.194305] binder: 6924:6928 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:27 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:27 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2189.194313] binder: 6924:6928 got reply transaction with no transaction stack
[ 2189.194322] binder: 6924:6928 transaction failed 29201/-71, size 0-0 line 2922
14:33:27 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:27 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:27 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:27 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:27 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2189.197728] binder: undelivered TRANSACTION_ERROR: 29201
14:33:27 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:28 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:28 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2189.314497] binder: 6943:6945 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2189.314656] binder: 6943:6945 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:28 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:28 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:28 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:28 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2189.314679] binder: 6943:6945 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2189.314687] binder: 6943:6945 got reply transaction with no transaction stack
14:33:28 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:28 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:28 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2189.314696] binder: 6943:6945 transaction failed 29201/-71, size 0-0 line 2922
14:33:28 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:28 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:28 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2189.314895] binder: undelivered TRANSACTION_ERROR: 29201
14:33:28 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:28 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2189.470599] binder: 6959:6962 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2189.470773] binder: 6959:6962 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:28 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:28 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:28 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:28 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:28 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:28 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:28 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:28 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2189.470799] binder: 6959:6962 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2189.470808] binder: 6959:6962 got reply transaction with no transaction stack
14:33:28 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:28 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2189.470819] binder: 6959:6962 transaction failed 29201/-71, size 0-0 line 2922
[ 2189.471169] binder: undelivered TRANSACTION_ERROR: 29201
[ 2189.548565] binder: 6973:6979 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:28 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:28 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:28 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:28 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2189.548685] binder: 6973:6979 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2189.548710] binder: 6973:6979 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2189.548718] binder: 6973:6979 got reply transaction with no transaction stack
14:33:28 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2189.548728] binder: 6973:6979 transaction failed 29201/-71, size 0-0 line 2922
14:33:28 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:28 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:28 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:28 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:28 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2189.548925] binder: undelivered TRANSACTION_ERROR: 29201
[ 2189.689315] binder: 6997:6999 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:28 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:28 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:28 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:28 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2189.689448] binder: 6997:6999 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:28 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:28 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:28 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:28 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:28 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2189.689474] binder: 6997:6999 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2189.689482] binder: 6997:6999 got reply transaction with no transaction stack
14:33:28 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:28 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:28 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:28 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2189.689491] binder: 6997:6999 transaction failed 29201/-71, size 0-0 line 2922
14:33:28 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:28 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:29 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2189.689690] binder: undelivered TRANSACTION_ERROR: 29201
[ 2189.789769] binder: 7007:7012 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:29 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:29 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:29 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:29 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:29 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 2 printk messages dropped ** [ 2189.789921] binder: 7007:7012 got reply transaction with no transaction stack
14:33:29 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:29 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:29 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:29 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:29 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2189.789930] binder: 7007:7012 transaction failed 29201/-71, size 0-0 line 2922
[ 2189.790097] binder: undelivered TRANSACTION_ERROR: 29201
14:33:29 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:29 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2189.932213] binder: 7024:7031 got reply transaction with no transaction stack
14:33:29 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:29 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:29 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:29 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 5 printk messages dropped ** [ 2190.010912] binder: 7040:7041 got reply transaction with no transaction stack
14:33:29 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:29 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:29 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2190.010922] binder: 7040:7041 transaction failed 29201/-71, size 0-0 line 2922
14:33:29 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:29 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:29 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2190.156183] binder: 7059:7062 got reply transaction with no transaction stack
14:33:29 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:29 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:29 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2190.156193] binder: 7059:7062 transaction failed 29201/-71, size 0-0 line 2922
14:33:29 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:29 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2190.156549] binder: undelivered TRANSACTION_ERROR: 29201
14:33:29 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:29 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:29 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 3 printk messages dropped ** [ 2190.285788] binder: 7074:7077 got reply transaction with no transaction stack
14:33:29 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:29 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:29 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2190.401008] binder: 7092:7095 got reply transaction with no transaction stack
14:33:29 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:29 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:29 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:29 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2190.401018] binder: 7092:7095 transaction failed 29201/-71, size 0-0 line 2922
14:33:29 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:29 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 5 printk messages dropped ** [ 2190.549228] binder: 7107:7113 transaction failed 29201/-71, size 0-0 line 2922
14:33:29 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:29 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:29 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:29 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2190.549425] binder: undelivered TRANSACTION_ERROR: 29201
[ 2190.665502] binder: 7129:7134 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:29 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:29 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:29 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2190.666563] binder: 7129:7134 transaction failed 29201/-71, size 0-0 line 2922
14:33:29 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:29 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:29 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 5 printk messages dropped ** [ 2190.805001] binder: 7147:7154 transaction failed 29201/-71, size 0-0 line 2922
14:33:29 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:30 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:30 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:30 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:30 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:30 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2190.805177] binder: undelivered TRANSACTION_ERROR: 29201
** 4 printk messages dropped ** [ 2190.902288] binder: 7167:7170 transaction failed 29201/-71, size 0-0 line 2922
14:33:30 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:30 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:30 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2190.914805] binder: undelivered TRANSACTION_ERROR: 29201
[ 2191.022847] binder: 7183:7187 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2191.022982] binder: 7183:7187 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:30 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:30 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:30 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:30 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:30 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 2 printk messages dropped ** [ 2191.023023] binder: 7183:7187 transaction failed 29201/-71, size 0-0 line 2922
14:33:30 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:30 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2191.023206] binder: undelivered TRANSACTION_ERROR: 29201
14:33:30 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:30 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:30 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2191.152622] binder: 7202:7204 IncRefs 0 refcount change on invalid ref 0 ret -22
** 3 printk messages dropped ** [ 2191.152769] binder: 7202:7204 transaction failed 29201/-71, size 0-0 line 2922
14:33:30 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:30 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:30 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:30 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:30 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:30 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:30 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:30 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:30 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2191.152962] binder: undelivered TRANSACTION_ERROR: 29201
[ 2191.265568] binder: 7216:7219 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:30 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:30 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:30 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2191.265737] binder: 7216:7219 transaction failed 29201/-71, size 0-0 line 2922
14:33:30 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:30 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:30 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:30 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:30 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2191.364459] binder: 7227:7240 transaction failed 29201/-71, size 0-0 line 2922
14:33:30 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:30 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:30 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:30 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2191.364639] binder: undelivered TRANSACTION_ERROR: 29201
** 4 printk messages dropped ** [ 2191.493382] binder: 7251:7254 transaction failed 29201/-71, size 0-0 line 2922
14:33:30 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:30 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:30 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:30 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:30 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:30 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 5 printk messages dropped ** [ 2191.603458] binder: 7266:7273 transaction failed 29201/-71, size 0-0 line 2922
[ 2191.603870] binder: undelivered TRANSACTION_ERROR: 29201
14:33:30 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:30 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:30 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2191.744163] binder: 7284:7288 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:30 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:30 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:30 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:31 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:31 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:31 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2191.744280] binder: 7284:7288 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
** 2 printk messages dropped ** [ 2191.744320] binder: 7284:7288 transaction failed 29201/-71, size 0-0 line 2922
14:33:31 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:31 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:31 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:31 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:31 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:31 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2191.744499] binder: undelivered TRANSACTION_ERROR: 29201
** 5 printk messages dropped ** [ 2192.043104] binder: undelivered TRANSACTION_ERROR: 29201
14:33:31 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:31 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2192.311410] binder: 7313:7316 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:31 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:31 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:31 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:31 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:31 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2192.311819] binder: undelivered TRANSACTION_ERROR: 29201
14:33:31 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:31 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:31 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:31 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2192.405242] binder: 7331:7333 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:31 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:31 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:31 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:31 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:31 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:31 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2192.405581] binder: undelivered TRANSACTION_ERROR: 29201
** 5 printk messages dropped ** [ 2192.524371] binder: undelivered TRANSACTION_ERROR: 29201
14:33:31 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:31 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2192.639453] binder: 7361:7364 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:31 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:31 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:31 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2192.639570] binder: 7361:7364 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:31 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:31 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:31 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 3 printk messages dropped ** [ 2192.639790] binder: undelivered TRANSACTION_ERROR: 29201
14:33:31 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:31 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:31 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2192.774548] binder: undelivered TRANSACTION_ERROR: 29201
14:33:31 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:31 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:31 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:31 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:31 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2192.876874] binder: 7396:7398 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2192.876993] binder: 7396:7398 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2192.877018] binder: 7396:7398 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:31 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:31 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:31 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:31 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 2 printk messages dropped ** [ 2192.877203] binder: undelivered TRANSACTION_ERROR: 29201
14:33:31 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:31 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:31 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 5 printk messages dropped ** [ 2193.004948] binder: undelivered TRANSACTION_ERROR: 29201
14:33:31 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:31 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:31 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:32 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2193.139932] binder: 7433:7434 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2193.140038] binder: 7433:7434 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:32 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:32 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:32 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:32 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2193.140062] binder: 7433:7434 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:32 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:32 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 2 printk messages dropped ** [ 2193.140242] binder: undelivered TRANSACTION_ERROR: 29201
14:33:32 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:32 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:32 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:32 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2193.284458] binder: undelivered TRANSACTION_ERROR: 29201
14:33:32 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2193.386254] binder: 7471:7473 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:32 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:32 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:32 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:32 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2193.386370] binder: 7471:7473 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:32 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:32 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:32 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2193.528374] binder: 7488:7492 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:32 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:32 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:32 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:32 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:32 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2193.528493] binder: 7488:7492 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
** 4 printk messages dropped ** [ 2193.641825] binder: 7505:7510 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:32 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:32 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:32 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2193.642370] binder: 7505:7510 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2193.642398] binder: 7505:7510 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:32 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:32 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [ 2193.791100] binder: 7528:7529 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:32 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2193.791222] binder: 7528:7529 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2193.791247] binder: 7528:7529 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:32 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:32 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:32 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2193.791255] binder: 7528:7529 got reply transaction with no transaction stack
14:33:32 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:32 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 2 printk messages dropped ** [ 2193.924606] binder: 7543:7547 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:32 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:32 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:33 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:33 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:33 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:33 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:33 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:33 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2193.924712] binder: 7543:7547 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:33 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2193.924737] binder: 7543:7547 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2193.924746] binder: 7543:7547 got reply transaction with no transaction stack
14:33:33 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:33 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:33 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:33 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:33 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 2 printk messages dropped ** [ 2194.030231] binder: 7567:7569 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:33 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:33 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:33 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 5 printk messages dropped ** [ 2194.150041] binder: 7579:7581 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:33 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:33 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:33 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:33 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2194.150161] binder: 7579:7581 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2194.150195] binder: 7579:7581 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:33 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:33 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:33 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:33 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:33 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:33 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 3 printk messages dropped ** [ 2194.268323] binder: 7595:7599 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:33 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:33 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:33 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2194.268484] binder: 7595:7599 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:33 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:33 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:33 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2194.412428] binder: 7611:7617 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:33 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:33 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:33 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:33 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:33 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 6 printk messages dropped ** [ 2194.521979] binder: 7630:7634 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:33 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:33 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:33 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:33 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:33 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:33 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2194.675716] binder: 7649:7652 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2194.675740] binder: 7649:7652 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:33 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:33 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:33 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:33 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:33 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:33 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:33 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2194.802541] binder: 7664:7673 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2194.802566] binder: 7664:7673 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:33 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:33 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:33 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:34 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:34 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 4 printk messages dropped ** [ 2194.903272] binder: 7681:7682 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:34 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:34 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:34 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:34 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2195.037524] binder: 7696:7699 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:34 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:34 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:34 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2195.037549] binder: 7696:7699 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:34 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:34 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 4 printk messages dropped ** [ 2195.110928] binder: 7712:7714 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:34 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:34 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:34 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:34 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:34 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2195.110952] binder: 7712:7714 DecRefs 0 refcount change on invalid ref 0 ret -22
** 4 printk messages dropped ** [ 2195.253141] binder: 7728:7731 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:34 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:34 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:34 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:34 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2195.253165] binder: 7728:7731 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:34 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:34 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [ 2195.378193] binder: 7747:7752 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:34 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:34 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:34 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:34 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:34 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:34 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2195.378218] binder: 7747:7752 DecRefs 0 refcount change on invalid ref 0 ret -22
** 4 printk messages dropped ** [ 2195.461858] binder: 7761:7767 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:34 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:34 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:34 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2195.461884] binder: 7761:7767 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:34 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:34 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:34 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2195.597347] binder: 7784:7786 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:34 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:34 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:34 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:34 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2195.597369] binder: 7784:7786 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:34 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:34 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2195.683959] binder: 7795:7801 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:34 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:34 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:34 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:34 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:34 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:34 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:34 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2195.769633] binder: 7804:7807 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:34 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:34 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2195.769641] binder: 7804:7807 got reply transaction with no transaction stack
14:33:34 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:35 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 4 printk messages dropped ** [ 2195.848981] binder: 7817:7822 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:35 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:35 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2195.848988] binder: 7817:7822 got reply transaction with no transaction stack
14:33:35 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [ 2195.963699] binder: 7832:7839 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:35 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:35 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:35 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:35 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2195.963707] binder: 7832:7839 got reply transaction with no transaction stack
14:33:35 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:35 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:35 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2195.963716] binder: 7832:7839 transaction failed 29201/-71, size 0-0 line 2922
14:33:35 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:35 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 3 printk messages dropped ** [ 2196.079967] binder: 7858:7860 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2196.079975] binder: 7858:7860 got reply transaction with no transaction stack
14:33:35 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:35 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:35 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2196.079984] binder: 7858:7860 transaction failed 29201/-71, size 0-0 line 2922
14:33:35 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:35 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2196.080173] binder: undelivered TRANSACTION_ERROR: 29201
[ 2196.201825] binder: 7873:7876 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:35 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:35 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:35 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 1 printk messages dropped ** [ 2196.202170] binder: 7873:7876 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:35 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:35 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:35 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:35 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2196.279298] binder: 7883:7889 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:35 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:35 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2196.279306] binder: 7883:7889 got reply transaction with no transaction stack
14:33:35 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:35 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:35 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 4 printk messages dropped ** [ 2196.394501] binder: 7897:7903 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:35 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:35 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2196.394510] binder: 7897:7903 got reply transaction with no transaction stack
14:33:35 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:35 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:35 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:35 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:35 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:35 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:35 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2196.493746] binder: 7914:7920 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2196.493754] binder: 7914:7920 got reply transaction with no transaction stack
14:33:35 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:35 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:35 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:35 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:35 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2196.652381] binder: 7934:7939 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:35 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:35 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:35 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:35 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:35 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2196.652389] binder: 7934:7939 got reply transaction with no transaction stack
[ 2196.652399] binder: 7934:7939 transaction failed 29201/-71, size 0-0 line 2922
14:33:35 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:36 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:36 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:36 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2196.748506] binder: 7951:7954 got reply transaction with no transaction stack
** 5 printk messages dropped ** [ 2196.859124] binder: 7965:7968 got reply transaction with no transaction stack
14:33:36 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:36 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2196.859132] binder: 7965:7968 transaction failed 29201/-71, size 0-0 line 2922
[ 2196.859315] binder: undelivered TRANSACTION_ERROR: 29201
[ 2197.003626] binder: 7981:7993 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2197.007618] binder: 7981:7993 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:36 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:36 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:36 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2197.007644] binder: 7981:7993 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2197.007653] binder: 7981:7993 got reply transaction with no transaction stack
[ 2197.007663] binder: 7981:7993 transaction failed 29201/-71, size 0-0 line 2922
14:33:36 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:36 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2197.111309] binder: undelivered TRANSACTION_ERROR: 29201
[ 2197.510651] binder: 8005:8015 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:36 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:36 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:36 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:36 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:36 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2197.511007] binder: 8005:8015 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:36 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:36 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 1 printk messages dropped ** [ 2197.511040] binder: 8005:8015 got reply transaction with no transaction stack
14:33:36 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:36 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:36 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:36 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2197.511050] binder: 8005:8015 transaction failed 29201/-71, size 0-0 line 2922
** 4 printk messages dropped ** [ 2197.599583] binder: 8026:8027 got reply transaction with no transaction stack
14:33:36 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:36 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:36 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:36 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2197.599593] binder: 8026:8027 transaction failed 29201/-71, size 0-0 line 2922
14:33:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:36 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:36 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:36 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2197.599751] binder: undelivered TRANSACTION_ERROR: 29201
** 3 printk messages dropped ** [ 2197.739982] binder: 8041:8044 got reply transaction with no transaction stack
[ 2197.739991] binder: 8041:8044 transaction failed 29201/-71, size 0-0 line 2922
[ 2197.740309] binder: undelivered TRANSACTION_ERROR: 29201
14:33:36 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:36 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:36 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:36 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:36 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2197.869853] binder: 8063:8064 IncRefs 0 refcount change on invalid ref 0 ret -22
** 2 printk messages dropped ** [ 2197.871019] binder: 8063:8064 got reply transaction with no transaction stack
14:33:36 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:36 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:36 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2197.871028] binder: 8063:8064 transaction failed 29201/-71, size 0-0 line 2922
** 4 printk messages dropped ** [ 2197.998466] binder: 8078:8081 got reply transaction with no transaction stack
14:33:36 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:36 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:36 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:36 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2197.998476] binder: 8078:8081 transaction failed 29201/-71, size 0-0 line 2922
14:33:36 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:36 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:36 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:37 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2198.115030] binder: 8096:8098 got reply transaction with no transaction stack
[ 2198.115040] binder: 8096:8098 transaction failed 29201/-71, size 0-0 line 2922
[ 2198.115219] binder: undelivered TRANSACTION_ERROR: 29201
14:33:37 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:37 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:37 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:37 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:37 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2198.231658] binder: 8111:8115 IncRefs 0 refcount change on invalid ref 0 ret -22
** 2 printk messages dropped ** [ 2198.231809] binder: 8111:8115 got reply transaction with no transaction stack
14:33:37 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:37 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:37 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2198.231818] binder: 8111:8115 transaction failed 29201/-71, size 0-0 line 2922
[ 2198.231999] binder: undelivered TRANSACTION_ERROR: 29201
14:33:37 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:37 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:37 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:37 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2198.361761] binder: 8132:8137 got reply transaction with no transaction stack
14:33:37 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:37 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:37 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:37 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:37 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:37 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:37 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2198.361769] binder: 8132:8137 transaction failed 29201/-71, size 0-0 line 2922
** 5 printk messages dropped ** [ 2198.502087] binder: 8148:8153 transaction failed 29201/-71, size 0-0 line 2922
14:33:37 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:37 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:37 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:37 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:37 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2198.502251] binder: undelivered TRANSACTION_ERROR: 29201
14:33:37 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:37 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:37 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [ 2198.608634] binder: 8167:8169 transaction failed 29201/-71, size 0-0 line 2922
[ 2198.608812] binder: undelivered TRANSACTION_ERROR: 29201
14:33:37 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:37 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 4 printk messages dropped ** [ 2198.723507] binder: 8185:8189 transaction failed 29201/-71, size 0-0 line 2922
14:33:37 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:37 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:37 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2198.729312] binder: undelivered TRANSACTION_ERROR: 29201
[ 2198.859793] binder: 8202:8206 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:37 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:37 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:37 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:37 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:37 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 3 printk messages dropped ** [ 2198.859947] binder: 8202:8206 transaction failed 29201/-71, size 0-0 line 2922
[ 2198.860128] binder: undelivered TRANSACTION_ERROR: 29201
[ 2198.991568] binder: 8218:8225 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2198.992631] binder: 8218:8225 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2198.992712] binder: 8218:8225 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2198.992719] binder: 8218:8225 got reply transaction with no transaction stack
[ 2198.992726] binder: 8218:8225 transaction failed 29201/-71, size 0-0 line 2922
[ 2198.993449] binder: undelivered TRANSACTION_ERROR: 29201
[ 2199.100176] binder: 8236:8237 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2199.100295] binder: 8236:8237 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2199.100320] binder: 8236:8237 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2199.100328] binder: 8236:8237 got reply transaction with no transaction stack
14:33:37 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2199.100338] binder: 8236:8237 transaction failed 29201/-71, size 0-0 line 2922
[ 2199.100505] binder: undelivered TRANSACTION_ERROR: 29201
[ 2199.254265] binder: 8250:8257 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:38 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2199.254388] binder: 8250:8257 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2199.254413] binder: 8250:8257 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2199.254421] binder: 8250:8257 got reply transaction with no transaction stack
14:33:38 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:38 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2199.254431] binder: 8250:8257 transaction failed 29201/-71, size 0-0 line 2922
14:33:38 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:38 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:38 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:38 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:38 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:38 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:38 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2199.254715] binder: undelivered TRANSACTION_ERROR: 29201
[ 2199.362587] binder: 8271:8276 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2199.362924] binder: 8271:8276 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:38 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:38 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2199.362949] binder: 8271:8276 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:38 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:38 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2199.362956] binder: 8271:8276 got reply transaction with no transaction stack
14:33:38 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:38 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:38 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2199.362965] binder: 8271:8276 transaction failed 29201/-71, size 0-0 line 2922
[ 2199.363237] binder: undelivered TRANSACTION_ERROR: 29201
14:33:38 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:38 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:38 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2199.439504] binder: 8285:8288 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2199.440989] binder: 8285:8288 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:38 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:38 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:38 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:38 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:38 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2199.441011] binder: 8285:8288 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2199.441019] binder: 8285:8288 got reply transaction with no transaction stack
14:33:38 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:38 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2199.441028] binder: 8285:8288 transaction failed 29201/-71, size 0-0 line 2922
14:33:38 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:38 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:38 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2199.441212] binder: undelivered TRANSACTION_ERROR: 29201
[ 2199.521307] binder: 8302:8303 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:38 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:38 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2199.521437] binder: 8302:8303 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:38 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:38 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:38 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:38 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:38 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2199.521462] binder: 8302:8303 DecRefs 0 refcount change on invalid ref 0 ret -22
** 1 printk messages dropped ** [ 2199.521479] binder: 8302:8303 transaction failed 29201/-71, size 0-0 line 2922
14:33:38 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:38 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:38 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:38 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:38 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2199.521660] binder: undelivered TRANSACTION_ERROR: 29201
** 5 printk messages dropped ** [ 2199.664873] binder: undelivered TRANSACTION_ERROR: 29201
14:33:38 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:38 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:39 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2199.780963] binder: 8335:8341 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2199.781176] binder: 8335:8341 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:39 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:39 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:39 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:39 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 3 printk messages dropped ** [ 2199.785025] binder: undelivered TRANSACTION_ERROR: 29201
14:33:39 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:39 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2199.917413] binder: 8351:8357 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:39 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:39 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:39 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2199.924508] binder: undelivered TRANSACTION_ERROR: 29201
14:33:39 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:39 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2200.037726] binder: 8373:8376 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:39 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:39 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:39 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 4 printk messages dropped ** [ 2200.038151] binder: undelivered TRANSACTION_ERROR: 29201
14:33:39 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2200.148148] binder: 8387:8389 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:39 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:39 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:39 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2200.150976] binder: undelivered TRANSACTION_ERROR: 29201
[ 2200.259877] binder: 8405:8407 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:39 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:39 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2200.276953] binder: 8405:8407 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:39 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:39 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2200.276979] binder: 8405:8407 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:39 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:39 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:39 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 2 printk messages dropped ** [ 2200.277178] binder: undelivered TRANSACTION_ERROR: 29201
[ 2200.408428] binder: 8422:8424 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2200.408539] binder: 8422:8424 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:39 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:39 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:39 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 3 printk messages dropped ** [ 2200.408759] binder: undelivered TRANSACTION_ERROR: 29201
14:33:39 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:39 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:39 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2200.507283] binder: undelivered TRANSACTION_ERROR: 29201
14:33:39 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:39 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:39 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2200.616436] binder: 8456:8457 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2200.620126] binder: 8456:8457 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:39 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:39 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:39 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:39 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:39 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 3 printk messages dropped ** [ 2200.620372] binder: undelivered TRANSACTION_ERROR: 29201
[ 2200.756849] binder: 8473:8474 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:39 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:40 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:40 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2200.756974] binder: 8473:8474 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
** 3 printk messages dropped ** [ 2200.757201] binder: undelivered TRANSACTION_ERROR: 29201
14:33:40 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:40 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:40 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:40 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2200.855708] binder: 8487:8488 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2200.855829] binder: 8487:8488 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:40 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:40 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [ 2200.856055] binder: undelivered TRANSACTION_ERROR: 29201
14:33:40 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:40 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:40 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2200.941190] binder: 8500:8503 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2200.941308] binder: 8500:8503 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:40 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:40 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:40 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:40 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:40 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:40 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2200.941332] binder: 8500:8503 DecRefs 0 refcount change on invalid ref 0 ret -22
** 3 printk messages dropped ** [ 2201.117048] binder: 8517:8525 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:40 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:40 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:40 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:40 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2201.117921] binder: 8517:8525 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
** 4 printk messages dropped ** [ 2201.240169] binder: 8543:8547 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:40 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:40 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:40 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:40 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:40 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:40 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2201.240287] binder: 8543:8547 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:40 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:40 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:40 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:40 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:40 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [ 2201.368081] binder: 8559:8561 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:40 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2201.452498] binder: 8571:8574 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:40 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2201.452608] binder: 8571:8574 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:40 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:40 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:40 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:40 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2201.452631] binder: 8571:8574 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2201.452638] binder: 8571:8574 got reply transaction with no transaction stack
14:33:40 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:40 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:40 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 2 printk messages dropped ** [ 2201.587027] binder: 8592:8594 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:40 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:40 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:40 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:40 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2201.587144] binder: 8592:8594 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2201.587168] binder: 8592:8594 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:40 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:40 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:40 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2201.697455] binder: 8607:8611 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:40 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:40 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2201.697580] binder: 8607:8611 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:41 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:41 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:41 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:41 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2201.836075] binder: 8626:8629 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:41 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:41 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:41 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 6 printk messages dropped ** [ 2201.944250] binder: 8639:8644 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:41 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:41 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:41 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2201.944275] binder: 8639:8644 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2201.944283] binder: 8639:8644 got reply transaction with no transaction stack
[ 2201.944293] binder: 8639:8644 transaction failed 29201/-71, size 0-0 line 2922
14:33:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2201.944488] binder: undelivered TRANSACTION_ERROR: 29201
[ 2202.009273] binder: 8653:8656 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:41 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:41 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:41 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2202.009407] binder: 8653:8656 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:41 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:41 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:41 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:41 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2202.009432] binder: 8653:8656 DecRefs 0 refcount change on invalid ref 0 ret -22
** 4 printk messages dropped ** [ 2202.129116] binder: 8669:8671 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:41 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:41 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:41 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:41 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2202.129141] binder: 8669:8671 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2202.129149] binder: 8669:8671 got reply transaction with no transaction stack
14:33:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:41 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:41 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 3 printk messages dropped ** [ 2202.463119] binder: 8692:8693 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:41 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:41 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:41 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 5 printk messages dropped ** [ 2202.774260] binder: 8709:8710 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:41 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2202.774283] binder: 8709:8710 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2202.774291] binder: 8709:8710 got reply transaction with no transaction stack
14:33:41 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:41 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:41 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2202.774300] binder: 8709:8710 transaction failed 29201/-71, size 0-0 line 2922
14:33:41 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:41 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:41 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 2 printk messages dropped ** [ 2202.905150] binder: 8725:8731 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:41 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:41 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:41 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:41 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:41 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2202.905174] binder: 8725:8731 DecRefs 0 refcount change on invalid ref 0 ret -22
** 4 printk messages dropped ** [ 2203.025347] binder: 8744:8752 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:41 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:41 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2203.025371] binder: 8744:8752 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:41 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:41 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:41 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:41 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2203.025379] binder: 8744:8752 got reply transaction with no transaction stack
14:33:42 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:42 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:42 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:42 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [ 2203.148206] binder: 8762:8764 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2203.148232] binder: 8762:8764 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:42 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:42 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:42 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:42 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:42 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

** 4 printk messages dropped ** [ 2203.222102] binder: 8778:8783 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:42 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2203.222127] binder: 8778:8783 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:42 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:42 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:42 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 4 printk messages dropped ** [ 2203.352651] binder: 8794:8798 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:42 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:42 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:42 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:42 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

** 5 printk messages dropped ** [ 2203.467702] binder: 8811:8817 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:42 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:42 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:42 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2203.467727] binder: 8811:8817 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2203.467735] binder: 8811:8817 got reply transaction with no transaction stack
14:33:42 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:42 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:42 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:42 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:42 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2203.573210] binder: 8823:8830 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:42 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:42 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:42 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:42 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 5 printk messages dropped ** [ 2203.698299] binder: 8843:8847 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:42 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:42 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2203.698307] binder: 8843:8847 got reply transaction with no transaction stack
14:33:42 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:42 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:42 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:42 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:42 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2203.698317] binder: 8843:8847 transaction failed 29201/-71, size 0-0 line 2922
14:33:42 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:42 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:42 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:42 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [ 2203.815239] binder: 8863:8866 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:42 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:42 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2203.925555] binder: 8875:8880 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:42 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:42 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:42 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:42 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:42 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2203.925562] binder: 8875:8880 got reply transaction with no transaction stack
** 4 printk messages dropped ** [ 2204.041618] binder: 8894:8897 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:42 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:42 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:42 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:43 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2204.041627] binder: 8894:8897 got reply transaction with no transaction stack
[ 2204.041637] binder: 8894:8897 transaction failed 29201/-71, size 0-0 line 2922
[ 2204.041821] binder: undelivered TRANSACTION_ERROR: 29201
14:33:43 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2204.120250] binder: 8907:8908 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.120886] binder: 8907:8908 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2204.120911] binder: 8907:8908 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.120919] binder: 8907:8908 got reply transaction with no transaction stack
[ 2204.120929] binder: 8907:8908 transaction failed 29201/-71, size 0-0 line 2922
[ 2204.121553] binder: undelivered TRANSACTION_ERROR: 29201
[ 2204.281618] binder: 8926:8929 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.282063] binder: 8926:8929 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2204.282087] binder: 8926:8929 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.282095] binder: 8926:8929 got reply transaction with no transaction stack
[ 2204.282104] binder: 8926:8929 transaction failed 29201/-71, size 0-0 line 2922
14:33:43 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:43 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2204.285945] binder: undelivered TRANSACTION_ERROR: 29201
[ 2204.382159] binder: 8942:8945 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.382284] binder: 8942:8945 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2204.382309] binder: 8942:8945 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.382317] binder: 8942:8945 got reply transaction with no transaction stack
[ 2204.382326] binder: 8942:8945 transaction failed 29201/-71, size 0-0 line 2922
[ 2204.382518] binder: undelivered TRANSACTION_ERROR: 29201
[ 2204.541106] binder: 8959:8965 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.541641] binder: 8959:8965 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2204.541866] binder: 8959:8965 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.541874] binder: 8959:8965 got reply transaction with no transaction stack
[ 2204.541883] binder: 8959:8965 transaction failed 29201/-71, size 0-0 line 2922
[ 2204.542165] binder: undelivered TRANSACTION_ERROR: 29201
[ 2204.656489] binder: 8980:8984 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.656595] binder: 8980:8984 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2204.656619] binder: 8980:8984 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.656626] binder: 8980:8984 got reply transaction with no transaction stack
[ 2204.656635] binder: 8980:8984 transaction failed 29201/-71, size 0-0 line 2922
[ 2204.659859] binder: undelivered TRANSACTION_ERROR: 29201
[ 2204.762913] binder: 8997:9000 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.763504] binder: 8997:9000 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2204.763621] binder: 8997:9000 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.763629] binder: 8997:9000 got reply transaction with no transaction stack
14:33:43 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:43 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2204.763639] binder: 8997:9000 transaction failed 29201/-71, size 0-0 line 2922
[ 2204.763820] binder: undelivered TRANSACTION_ERROR: 29201
[ 2204.893447] binder: 9015:9018 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2204.895270] binder: 9015:9018 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2204.895295] binder: 9015:9018 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:43 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:43 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:43 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:43 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2204.895303] binder: 9015:9018 got reply transaction with no transaction stack
[ 2204.895313] binder: 9015:9018 transaction failed 29201/-71, size 0-0 line 2922
14:33:43 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2204.895483] binder: undelivered TRANSACTION_ERROR: 29201
[ 2204.989414] binder: 9029:9033 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:43 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:43 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:43 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:43 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:43 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:43 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:43 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2204.990264] binder: 9029:9033 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2204.990288] binder: 9029:9033 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:43 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:43 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:43 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:43 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2204.990296] binder: 9029:9033 got reply transaction with no transaction stack
[ 2204.990306] binder: 9029:9033 transaction failed 29201/-71, size 0-0 line 2922
14:33:43 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:43 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:43 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:43 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2204.990466] binder: undelivered TRANSACTION_ERROR: 29201
[ 2205.135199] binder: 9042:9054 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:43 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:43 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:43 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2205.139586] binder: 9042:9054 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
14:33:43 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:43 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:43 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2205.139716] binder: 9042:9054 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2205.139725] binder: 9042:9054 got reply transaction with no transaction stack
14:33:44 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:44 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:44 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:44 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2205.139735] binder: 9042:9054 transaction failed 29201/-71, size 0-0 line 2922
[ 2205.139917] binder: undelivered TRANSACTION_ERROR: 29201
14:33:44 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:44 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:44 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2205.253707] binder: 9063:9070 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:44 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:44 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:44 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:44 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2205.253836] binder: 9063:9070 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2205.253870] binder: 9063:9070 DecRefs 0 refcount change on invalid ref 0 ret -22
14:33:44 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:44 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:44 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:44 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2205.253879] binder: 9063:9070 got reply transaction with no transaction stack
14:33:44 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:44 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2205.253888] binder: 9063:9070 transaction failed 29201/-71, size 0-0 line 2922
14:33:44 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:44 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:44 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:44 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2205.254060] binder: undelivered TRANSACTION_ERROR: 29201
[ 2205.351205] binder: 9085:9090 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:44 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:44 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:44 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:44 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:44 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

[ 2205.351317] binder: 9085:9090 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
** 1 printk messages dropped ** [ 2205.351348] binder: 9085:9090 got reply transaction with no transaction stack
14:33:44 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:44 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:44 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2205.351368] binder: 9085:9090 transaction failed 29201/-71, size 0-0 line 2922
14:33:44 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:44 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

** 4 printk messages dropped ** [ 2205.471259] binder: 9102:9107 got reply transaction with no transaction stack
14:33:44 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:44 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:44 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2205.471268] binder: 9102:9107 transaction failed 29201/-71, size 0-0 line 2922
14:33:44 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:44 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:44 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [ 2205.563077] binder: 9118:9127 got reply transaction with no transaction stack
14:33:44 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:44 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:44 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:44 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

[ 2205.563086] binder: 9118:9127 transaction failed 29201/-71, size 0-0 line 2922
14:33:44 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:44 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:44 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:44 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:44 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 4 printk messages dropped ** [ 2205.696923] binder: 9135:9138 got reply transaction with no transaction stack
14:33:44 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:44 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:44 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2205.696932] binder: 9135:9138 transaction failed 29201/-71, size 0-0 line 2922
** 4 printk messages dropped ** [ 2205.782932] binder: 9148:9152 got reply transaction with no transaction stack
14:33:45 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:45 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:45 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:45 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:45 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:45 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

[ 2205.782941] binder: 9148:9152 transaction failed 29201/-71, size 0-0 line 2922
14:33:45 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:45 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:45 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 5 printk messages dropped ** [ 2205.928782] binder: 9170:9174 transaction failed 29201/-71, size 0-0 line 2922
14:33:45 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:45 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:45 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2205.928970] binder: undelivered TRANSACTION_ERROR: 29201
** 4 printk messages dropped ** [ 2206.032833] binder: 9185:9186 transaction failed 29201/-71, size 0-0 line 2922
14:33:45 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:45 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:45 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:45 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

[ 2206.033015] binder: undelivered TRANSACTION_ERROR: 29201
14:33:45 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:45 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:45 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

[ 2206.156801] binder: 9202:9203 IncRefs 0 refcount change on invalid ref 0 ret -22
14:33:45 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:45 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

** 3 printk messages dropped ** [ 2206.156948] binder: 9202:9203 transaction failed 29201/-71, size 0-0 line 2922
14:33:45 executing program 0:
r0 = memfd_create(0x0, 0x0)
read(0xffffffffffffffff, &(0x7f0000000200)=""/250, 0xfffffffffffffef6)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
close(0xffffffffffffffff)
openat$random(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x2, 0x0)
r2 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x200004)
sendfile(r1, r2, 0x0, 0x8000ffffffff)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c)
ioctl$sock_ifreq(0xffffffffffffffff, 0x0, &(0x7f0000000640)={'eq[\x00\x00\x00\x00\x00\x00\x00\x04\x00', @ifru_mtu=0x4})
fcntl$setlease(r0, 0x400, 0x0)

14:33:45 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f0000000080)=""/4, 0x4}, {&(0x7f00000000c0)=""/235, 0xeb}, {&(0x7f00000001c0)=""/146, 0x92}, {&(0x7f0000000280)=""/191, 0xbf}, {&(0x7f0000000340)=""/164, 0xa4}, {&(0x7f0000000400)=""/203, 0xcb}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000000600)=""/27, 0x1b}, {&(0x7f0000000640)=""/104, 0x68}], 0x9, 0x0)

14:33:45 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

14:33:45 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

** 5 printk messages dropped ** [ 2206.312414] binder: 9220:9223 transaction failed 29201/-71, size 0-0 line 2922
14:33:45 executing program 5:
socket$inet(0x2, 0x4000000000000001, 0x0)
clone(0x6102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x10020000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)

14:33:45 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f0000000280)=0x58, 0x4)
sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f000020d000)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c)

14:33:45 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0x200002, 0x0)
fchdir(0xffffffffffffffff)
r0 = creat(&(0x7f0000000040)='./file1\x00', 0x0)
ioctl$FS_IOC_RESVSP(r0, 0x402c5828, &(0x7f0000000400)={0x0, 0x0, 0x80000000000007})

14:33:45 executing program 4:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000000)=[@increfs], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x5c, 0x0, &(0x7f0000000200)=[@request_death, @decrefs, @reply={0x40406301, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})

[ 2206.312648] binder: undelivered TRANSACTION_ERROR: 29201
[ 2206.421577] binder: 9237:9241 IncRefs 0 refcount change on invalid ref 0 ret -22
** 146 printk messages dropped ** [ 2209.904361] binder: 9671:9678 got reply transaction with no transaction stack
[ 2209.904370] binder: 9671:9678 transaction failed 29201/-71, size 0-0 line 2922
[ 2209.904551] binder: undelivered TRANSACTION_ERROR: 29201
[ 2210.027309] binder: 9691:9695 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.027434] binder: 9691:9695 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2210.027459] binder: 9691:9695 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.027467] binder: 9691:9695 got reply transaction with no transaction stack
[ 2210.027477] binder: 9691:9695 transaction failed 29201/-71, size 0-0 line 2922
[ 2210.027657] binder: undelivered TRANSACTION_ERROR: 29201
[ 2210.127659] binder: 9707:9712 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.136217] binder: 9707:9712 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2210.136241] binder: 9707:9712 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.136249] binder: 9707:9712 got reply transaction with no transaction stack
[ 2210.136257] binder: 9707:9712 transaction failed 29201/-71, size 0-0 line 2922
[ 2210.143932] binder: undelivered TRANSACTION_ERROR: 29201
[ 2210.299412] binder: 9728:9732 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.299522] binder: 9728:9732 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2210.299546] binder: 9728:9732 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.299554] binder: 9728:9732 got reply transaction with no transaction stack
[ 2210.299563] binder: 9728:9732 transaction failed 29201/-71, size 0-0 line 2922
[ 2210.299721] binder: undelivered TRANSACTION_ERROR: 29201
[ 2210.418750] binder: 9746:9749 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.418871] binder: 9746:9749 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2210.418896] binder: 9746:9749 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.418904] binder: 9746:9749 got reply transaction with no transaction stack
[ 2210.418913] binder: 9746:9749 transaction failed 29201/-71, size 0-0 line 2922
[ 2210.419096] binder: undelivered TRANSACTION_ERROR: 29201
[ 2210.565378] binder: 9762:9766 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.565491] binder: 9762:9766 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2210.565516] binder: 9762:9766 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.565524] binder: 9762:9766 got reply transaction with no transaction stack
[ 2210.565533] binder: 9762:9766 transaction failed 29201/-71, size 0-0 line 2922
[ 2210.565811] binder: undelivered TRANSACTION_ERROR: 29201
[ 2210.693320] binder: 9783:9786 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.693445] binder: 9783:9786 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2210.693469] binder: 9783:9786 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.693478] binder: 9783:9786 got reply transaction with no transaction stack
[ 2210.693488] binder: 9783:9786 transaction failed 29201/-71, size 0-0 line 2922
[ 2210.706455] binder: undelivered TRANSACTION_ERROR: 29201
[ 2210.850028] binder: 9800:9803 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.851154] binder: 9800:9803 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2210.851178] binder: 9800:9803 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.851186] binder: 9800:9803 got reply transaction with no transaction stack
[ 2210.851196] binder: 9800:9803 transaction failed 29201/-71, size 0-0 line 2922
[ 2210.851424] binder: undelivered TRANSACTION_ERROR: 29201
[ 2210.957270] binder: 9817:9823 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.957403] binder: 9817:9823 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2210.957428] binder: 9817:9823 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2210.957435] binder: 9817:9823 got reply transaction with no transaction stack
[ 2210.957444] binder: 9817:9823 transaction failed 29201/-71, size 0-0 line 2922
[ 2210.957630] binder: undelivered TRANSACTION_ERROR: 29201
[ 2211.078628] binder: 9840:9843 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.078750] binder: 9840:9843 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2211.078774] binder: 9840:9843 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.078781] binder: 9840:9843 got reply transaction with no transaction stack
[ 2211.078791] binder: 9840:9843 transaction failed 29201/-71, size 0-0 line 2922
[ 2211.078974] binder: undelivered TRANSACTION_ERROR: 29201
[ 2211.193099] binder: 9856:9860 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.193205] binder: 9856:9860 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2211.193229] binder: 9856:9860 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.193238] binder: 9856:9860 got reply transaction with no transaction stack
[ 2211.193247] binder: 9856:9860 transaction failed 29201/-71, size 0-0 line 2922
[ 2211.194780] binder: undelivered TRANSACTION_ERROR: 29201
[ 2211.326845] binder: 9878:9880 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.326966] binder: 9878:9880 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2211.326991] binder: 9878:9880 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.326999] binder: 9878:9880 got reply transaction with no transaction stack
[ 2211.327007] binder: 9878:9880 transaction failed 29201/-71, size 0-0 line 2922
[ 2211.327171] binder: undelivered TRANSACTION_ERROR: 29201
[ 2211.399297] binder: 9890:9892 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.399659] binder: 9890:9892 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2211.399703] binder: 9890:9892 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.399711] binder: 9890:9892 got reply transaction with no transaction stack
[ 2211.399721] binder: 9890:9892 transaction failed 29201/-71, size 0-0 line 2922
[ 2211.399936] binder: undelivered TRANSACTION_ERROR: 29201
[ 2211.557053] binder: 9906:9908 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.557174] binder: 9906:9908 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2211.557199] binder: 9906:9908 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.557208] binder: 9906:9908 got reply transaction with no transaction stack
[ 2211.557218] binder: 9906:9908 transaction failed 29201/-71, size 0-0 line 2922
[ 2211.557515] binder: undelivered TRANSACTION_ERROR: 29201
[ 2211.667330] binder: 9923:9927 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.667445] binder: 9923:9927 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2211.667476] binder: 9923:9927 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.668541] binder: 9923:9927 got reply transaction with no transaction stack
[ 2211.668549] binder: 9923:9927 transaction failed 29201/-71, size 0-0 line 2922
[ 2211.669093] binder: undelivered TRANSACTION_ERROR: 29201
[ 2211.787815] binder: 9939:9943 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.788312] binder: 9939:9943 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2211.788336] binder: 9939:9943 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.788344] binder: 9939:9943 got reply transaction with no transaction stack
[ 2211.788354] binder: 9939:9943 transaction failed 29201/-71, size 0-0 line 2922
[ 2211.788522] binder: undelivered TRANSACTION_ERROR: 29201
[ 2211.881722] binder: 9955:9958 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.881845] binder: 9955:9958 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2211.881869] binder: 9955:9958 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2211.881877] binder: 9955:9958 got reply transaction with no transaction stack
[ 2211.881886] binder: 9955:9958 transaction failed 29201/-71, size 0-0 line 2922
[ 2211.882070] binder: undelivered TRANSACTION_ERROR: 29201
[ 2212.009785] binder: 9967:9973 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.009899] binder: 9967:9973 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2212.009924] binder: 9967:9973 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.009932] binder: 9967:9973 got reply transaction with no transaction stack
[ 2212.009942] binder: 9967:9973 transaction failed 29201/-71, size 0-0 line 2922
[ 2212.010225] binder: undelivered TRANSACTION_ERROR: 29201
[ 2212.121029] binder: 9986:9989 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.121136] binder: 9986:9989 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2212.121160] binder: 9986:9989 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.121168] binder: 9986:9989 got reply transaction with no transaction stack
[ 2212.121178] binder: 9986:9989 transaction failed 29201/-71, size 0-0 line 2922
[ 2212.121344] binder: undelivered TRANSACTION_ERROR: 29201
[ 2212.236544] binder: 10002:10005 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.236677] binder: 10002:10005 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2212.236825] binder: 10002:10005 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.236833] binder: 10002:10005 got reply transaction with no transaction stack
[ 2212.236840] binder: 10002:10005 transaction failed 29201/-71, size 0-0 line 2922
[ 2212.237128] binder: undelivered TRANSACTION_ERROR: 29201
[ 2212.348215] binder: 10018:10019 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.348329] binder: 10018:10019 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2212.348362] binder: 10018:10019 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.348371] binder: 10018:10019 got reply transaction with no transaction stack
[ 2212.348380] binder: 10018:10019 transaction failed 29201/-71, size 0-0 line 2922
[ 2212.348664] binder: undelivered TRANSACTION_ERROR: 29201
[ 2212.498552] binder: 10036:10037 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.499913] binder: 10036:10037 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2212.499938] binder: 10036:10037 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.499946] binder: 10036:10037 got reply transaction with no transaction stack
[ 2212.499955] binder: 10036:10037 transaction failed 29201/-71, size 0-0 line 2922
[ 2212.500139] binder: undelivered TRANSACTION_ERROR: 29201
[ 2212.594047] binder: 10052:10053 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.594158] binder: 10052:10053 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2212.594183] binder: 10052:10053 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.594191] binder: 10052:10053 got reply transaction with no transaction stack
[ 2212.594201] binder: 10052:10053 transaction failed 29201/-71, size 0-0 line 2922
[ 2212.594399] binder: undelivered TRANSACTION_ERROR: 29201
[ 2212.705413] binder: 10069:10072 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.705536] binder: 10069:10072 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2212.705561] binder: 10069:10072 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.705569] binder: 10069:10072 got reply transaction with no transaction stack
[ 2212.705578] binder: 10069:10072 transaction failed 29201/-71, size 0-0 line 2922
[ 2212.705761] binder: undelivered TRANSACTION_ERROR: 29201
[ 2212.824205] binder: 10087:10088 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.824334] binder: 10087:10088 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2212.824371] binder: 10087:10088 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2212.824379] binder: 10087:10088 got reply transaction with no transaction stack
[ 2212.824389] binder: 10087:10088 transaction failed 29201/-71, size 0-0 line 2922
[ 2212.824613] binder: undelivered TRANSACTION_ERROR: 29201
[ 2213.309180] binder: 10103:10106 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.309302] binder: 10103:10106 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2213.309327] binder: 10103:10106 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.309334] binder: 10103:10106 got reply transaction with no transaction stack
[ 2213.309344] binder: 10103:10106 transaction failed 29201/-71, size 0-0 line 2922
[ 2213.309539] binder: undelivered TRANSACTION_ERROR: 29201
[ 2213.407465] binder: 10117:10123 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.407589] binder: 10117:10123 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2213.407614] binder: 10117:10123 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.407622] binder: 10117:10123 got reply transaction with no transaction stack
[ 2213.407632] binder: 10117:10123 transaction failed 29201/-71, size 0-0 line 2922
[ 2213.407814] binder: undelivered TRANSACTION_ERROR: 29201
[ 2213.534309] binder: 10133:10138 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.536371] binder: 10133:10138 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2213.536402] binder: 10133:10138 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.536444] binder: 10133:10138 got reply transaction with no transaction stack
[ 2213.536454] binder: 10133:10138 transaction failed 29201/-71, size 0-0 line 2922
[ 2213.538685] binder: undelivered TRANSACTION_ERROR: 29201
[ 2213.624299] binder: 10148:10150 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.624797] binder: 10148:10150 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2213.624821] binder: 10148:10150 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.624829] binder: 10148:10150 got reply transaction with no transaction stack
[ 2213.624839] binder: 10148:10150 transaction failed 29201/-71, size 0-0 line 2922
[ 2213.625011] binder: undelivered TRANSACTION_ERROR: 29201
[ 2213.709200] binder: 10167:10168 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.709317] binder: 10167:10168 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2213.709342] binder: 10167:10168 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.709350] binder: 10167:10168 got reply transaction with no transaction stack
[ 2213.709358] binder: 10167:10168 transaction failed 29201/-71, size 0-0 line 2922
[ 2213.709967] binder: undelivered TRANSACTION_ERROR: 29201
[ 2213.824974] binder: 10177:10183 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.825093] binder: 10177:10183 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2213.825118] binder: 10177:10183 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.825126] binder: 10177:10183 got reply transaction with no transaction stack
[ 2213.825136] binder: 10177:10183 transaction failed 29201/-71, size 0-0 line 2922
[ 2213.825283] binder: undelivered TRANSACTION_ERROR: 29201
[ 2213.942250] binder: 10191:10195 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.942373] binder: 10191:10195 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2213.942539] binder: 10191:10195 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2213.942548] binder: 10191:10195 got reply transaction with no transaction stack
[ 2213.942557] binder: 10191:10195 transaction failed 29201/-71, size 0-0 line 2922
[ 2213.942738] binder: undelivered TRANSACTION_ERROR: 29201
[ 2214.054251] binder: 10208:10209 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.054417] binder: 10208:10209 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2214.054442] binder: 10208:10209 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.054450] binder: 10208:10209 got reply transaction with no transaction stack
[ 2214.054459] binder: 10208:10209 transaction failed 29201/-71, size 0-0 line 2922
[ 2214.054637] binder: undelivered TRANSACTION_ERROR: 29201
[ 2214.142514] binder: 10221:10224 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.142633] binder: 10221:10224 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2214.142658] binder: 10221:10224 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.142667] binder: 10221:10224 got reply transaction with no transaction stack
[ 2214.142675] binder: 10221:10224 transaction failed 29201/-71, size 0-0 line 2922
[ 2214.142869] binder: undelivered TRANSACTION_ERROR: 29201
[ 2214.247556] binder: 10237:10239 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.247657] binder: 10237:10239 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2214.247681] binder: 10237:10239 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.247688] binder: 10237:10239 got reply transaction with no transaction stack
[ 2214.247698] binder: 10237:10239 transaction failed 29201/-71, size 0-0 line 2922
[ 2214.248829] binder: undelivered TRANSACTION_ERROR: 29201
[ 2214.376777] binder: 10254:10257 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.376894] binder: 10254:10257 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2214.376918] binder: 10254:10257 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.376926] binder: 10254:10257 got reply transaction with no transaction stack
[ 2214.376935] binder: 10254:10257 transaction failed 29201/-71, size 0-0 line 2922
[ 2214.377113] binder: undelivered TRANSACTION_ERROR: 29201
[ 2214.467652] binder: 10267:10270 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.467769] binder: 10267:10270 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2214.467794] binder: 10267:10270 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.467802] binder: 10267:10270 got reply transaction with no transaction stack
[ 2214.467811] binder: 10267:10270 transaction failed 29201/-71, size 0-0 line 2922
[ 2214.469213] binder: undelivered TRANSACTION_ERROR: 29201
[ 2214.611466] binder: 10289:10290 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.611582] binder: 10289:10290 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2214.611607] binder: 10289:10290 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.611615] binder: 10289:10290 got reply transaction with no transaction stack
[ 2214.611624] binder: 10289:10290 transaction failed 29201/-71, size 0-0 line 2922
[ 2214.611803] binder: undelivered TRANSACTION_ERROR: 29201
[ 2214.706659] binder: 10304:10305 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.706772] binder: 10304:10305 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2214.706798] binder: 10304:10305 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.706806] binder: 10304:10305 got reply transaction with no transaction stack
[ 2214.706816] binder: 10304:10305 transaction failed 29201/-71, size 0-0 line 2922
[ 2214.707095] binder: undelivered TRANSACTION_ERROR: 29201
[ 2214.797939] binder: 10313:10315 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.798056] binder: 10313:10315 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2214.798081] binder: 10313:10315 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.798089] binder: 10313:10315 got reply transaction with no transaction stack
[ 2214.798099] binder: 10313:10315 transaction failed 29201/-71, size 0-0 line 2922
[ 2214.798282] binder: undelivered TRANSACTION_ERROR: 29201
[ 2214.910837] binder: 10325:10330 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.911911] binder: 10325:10330 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2214.911936] binder: 10325:10330 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2214.911944] binder: 10325:10330 got reply transaction with no transaction stack
[ 2214.911955] binder: 10325:10330 transaction failed 29201/-71, size 0-0 line 2922
[ 2214.912147] binder: undelivered TRANSACTION_ERROR: 29201
[ 2215.009605] binder: 10341:10344 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.009725] binder: 10341:10344 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2215.009749] binder: 10341:10344 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.009757] binder: 10341:10344 got reply transaction with no transaction stack
[ 2215.009767] binder: 10341:10344 transaction failed 29201/-71, size 0-0 line 2922
[ 2215.009947] binder: undelivered TRANSACTION_ERROR: 29201
[ 2215.143430] binder: 10358:10367 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.143616] binder: 10358:10367 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2215.143642] binder: 10358:10367 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.143650] binder: 10358:10367 got reply transaction with no transaction stack
[ 2215.143658] binder: 10358:10367 transaction failed 29201/-71, size 0-0 line 2922
[ 2215.143840] binder: undelivered TRANSACTION_ERROR: 29201
[ 2215.247639] binder: 10375:10379 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.247758] binder: 10375:10379 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2215.247782] binder: 10375:10379 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.247790] binder: 10375:10379 got reply transaction with no transaction stack
[ 2215.247798] binder: 10375:10379 transaction failed 29201/-71, size 0-0 line 2922
[ 2215.254936] binder: undelivered TRANSACTION_ERROR: 29201
[ 2215.376611] binder: 10392:10399 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.377500] binder: 10392:10399 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2215.377523] binder: 10392:10399 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.377531] binder: 10392:10399 got reply transaction with no transaction stack
[ 2215.377540] binder: 10392:10399 transaction failed 29201/-71, size 0-0 line 2922
[ 2215.377710] binder: undelivered TRANSACTION_ERROR: 29201
[ 2215.521894] binder: 10413:10421 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.522994] binder: 10413:10421 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2215.523020] binder: 10413:10421 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.523028] binder: 10413:10421 got reply transaction with no transaction stack
[ 2215.523037] binder: 10413:10421 transaction failed 29201/-71, size 0-0 line 2922
[ 2215.523215] binder: undelivered TRANSACTION_ERROR: 29201
[ 2215.639533] binder: 10433:10436 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.650247] binder: 10433:10436 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2215.650274] binder: 10433:10436 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.650283] binder: 10433:10436 got reply transaction with no transaction stack
[ 2215.650293] binder: 10433:10436 transaction failed 29201/-71, size 0-0 line 2922
[ 2215.650467] binder: undelivered TRANSACTION_ERROR: 29201
[ 2215.769129] binder: 10450:10454 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.769243] binder: 10450:10454 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2215.769267] binder: 10450:10454 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.769276] binder: 10450:10454 got reply transaction with no transaction stack
[ 2215.769286] binder: 10450:10454 transaction failed 29201/-71, size 0-0 line 2922
[ 2215.769454] binder: undelivered TRANSACTION_ERROR: 29201
[ 2215.896658] binder: 10463:10470 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.897078] binder: 10463:10470 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2215.897103] binder: 10463:10470 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2215.897111] binder: 10463:10470 got reply transaction with no transaction stack
[ 2215.897120] binder: 10463:10470 transaction failed 29201/-71, size 0-0 line 2922
[ 2215.897288] binder: undelivered TRANSACTION_ERROR: 29201
[ 2216.006639] binder: 10482:10486 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.006746] binder: 10482:10486 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2216.006771] binder: 10482:10486 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.006779] binder: 10482:10486 got reply transaction with no transaction stack
[ 2216.006788] binder: 10482:10486 transaction failed 29201/-71, size 0-0 line 2922
[ 2216.006965] binder: undelivered TRANSACTION_ERROR: 29201
[ 2216.146569] binder: 10499:10502 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.146676] binder: 10499:10502 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2216.146700] binder: 10499:10502 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.146708] binder: 10499:10502 got reply transaction with no transaction stack
[ 2216.146718] binder: 10499:10502 transaction failed 29201/-71, size 0-0 line 2922
[ 2216.146895] binder: undelivered TRANSACTION_ERROR: 29201
[ 2216.236760] binder: 10511:10517 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.236886] binder: 10511:10517 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2216.236912] binder: 10511:10517 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.236920] binder: 10511:10517 got reply transaction with no transaction stack
[ 2216.236929] binder: 10511:10517 transaction failed 29201/-71, size 0-0 line 2922
[ 2216.237113] binder: undelivered TRANSACTION_ERROR: 29201
[ 2216.382189] binder: 10534:10539 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.382349] binder: 10534:10539 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2216.382374] binder: 10534:10539 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.382383] binder: 10534:10539 got reply transaction with no transaction stack
[ 2216.382392] binder: 10534:10539 transaction failed 29201/-71, size 0-0 line 2922
[ 2216.382559] binder: undelivered TRANSACTION_ERROR: 29201
[ 2216.473391] binder: 10552:10554 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.473499] binder: 10552:10554 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2216.473612] binder: 10552:10554 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.473620] binder: 10552:10554 got reply transaction with no transaction stack
[ 2216.473630] binder: 10552:10554 transaction failed 29201/-71, size 0-0 line 2922
[ 2216.473794] binder: undelivered TRANSACTION_ERROR: 29201
[ 2216.622645] binder: 10574:10579 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.622765] binder: 10574:10579 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2216.622789] binder: 10574:10579 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.622797] binder: 10574:10579 got reply transaction with no transaction stack
[ 2216.622806] binder: 10574:10579 transaction failed 29201/-71, size 0-0 line 2922
[ 2216.622981] binder: undelivered TRANSACTION_ERROR: 29201
[ 2216.749712] binder: 10588:10592 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.749822] binder: 10588:10592 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2216.749847] binder: 10588:10592 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.749866] binder: 10588:10592 got reply transaction with no transaction stack
[ 2216.749876] binder: 10588:10592 transaction failed 29201/-71, size 0-0 line 2922
[ 2216.753440] binder: undelivered TRANSACTION_ERROR: 29201
[ 2216.840429] binder: 10605:10609 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.840975] binder: 10605:10609 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2216.841002] binder: 10605:10609 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.841010] binder: 10605:10609 got reply transaction with no transaction stack
[ 2216.841020] binder: 10605:10609 transaction failed 29201/-71, size 0-0 line 2922
[ 2216.841201] binder: undelivered TRANSACTION_ERROR: 29201
[ 2216.996345] binder: 10626:10630 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.996465] binder: 10626:10630 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2216.996490] binder: 10626:10630 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2216.996498] binder: 10626:10630 got reply transaction with no transaction stack
[ 2216.996507] binder: 10626:10630 transaction failed 29201/-71, size 0-0 line 2922
[ 2216.996670] binder: undelivered TRANSACTION_ERROR: 29201
[ 2217.129157] binder: 10641:10648 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.130100] binder: 10641:10648 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2217.130125] binder: 10641:10648 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.130134] binder: 10641:10648 got reply transaction with no transaction stack
[ 2217.130143] binder: 10641:10648 transaction failed 29201/-71, size 0-0 line 2922
[ 2217.130510] binder: undelivered TRANSACTION_ERROR: 29201
[ 2217.240070] binder: 10660:10664 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.241683] binder: 10660:10664 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2217.241708] binder: 10660:10664 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.241716] binder: 10660:10664 got reply transaction with no transaction stack
[ 2217.241726] binder: 10660:10664 transaction failed 29201/-71, size 0-0 line 2922
[ 2217.241909] binder: undelivered TRANSACTION_ERROR: 29201
[ 2217.365907] binder: 10675:10679 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.367156] binder: 10675:10679 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2217.367178] binder: 10675:10679 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.367186] binder: 10675:10679 got reply transaction with no transaction stack
[ 2217.367195] binder: 10675:10679 transaction failed 29201/-71, size 0-0 line 2922
[ 2217.367647] binder: undelivered TRANSACTION_ERROR: 29201
[ 2217.481702] binder: 10693:10697 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.481821] binder: 10693:10697 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2217.481844] binder: 10693:10697 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.481861] binder: 10693:10697 got reply transaction with no transaction stack
[ 2217.481870] binder: 10693:10697 transaction failed 29201/-71, size 0-0 line 2922
[ 2217.485647] binder: undelivered TRANSACTION_ERROR: 29201
[ 2217.611153] binder: 10710:10714 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.611272] binder: 10710:10714 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2217.611296] binder: 10710:10714 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.611303] binder: 10710:10714 got reply transaction with no transaction stack
[ 2217.611312] binder: 10710:10714 transaction failed 29201/-71, size 0-0 line 2922
[ 2217.614406] binder: undelivered TRANSACTION_ERROR: 29201
[ 2217.747105] binder: 10730:10736 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.747206] binder: 10730:10736 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2217.747230] binder: 10730:10736 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.747237] binder: 10730:10736 got reply transaction with no transaction stack
[ 2217.747247] binder: 10730:10736 transaction failed 29201/-71, size 0-0 line 2922
[ 2217.747426] binder: undelivered TRANSACTION_ERROR: 29201
[ 2217.819333] binder: 10746:10748 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.819465] binder: 10746:10748 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2217.819489] binder: 10746:10748 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.819498] binder: 10746:10748 got reply transaction with no transaction stack
[ 2217.819508] binder: 10746:10748 transaction failed 29201/-71, size 0-0 line 2922
[ 2217.819683] binder: undelivered TRANSACTION_ERROR: 29201
[ 2217.955198] binder: 10762:10765 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.955316] binder: 10762:10765 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2217.955341] binder: 10762:10765 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2217.955348] binder: 10762:10765 got reply transaction with no transaction stack
[ 2217.955356] binder: 10762:10765 transaction failed 29201/-71, size 0-0 line 2922
[ 2217.960302] binder: undelivered TRANSACTION_ERROR: 29201
[ 2218.151584] binder: 10781:10784 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2218.151702] binder: 10781:10784 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2218.151727] binder: 10781:10784 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2218.151736] binder: 10781:10784 got reply transaction with no transaction stack
[ 2218.151746] binder: 10781:10784 transaction failed 29201/-71, size 0-0 line 2922
[ 2218.151988] binder: undelivered TRANSACTION_ERROR: 29201
[ 2218.559214] binder: 10799:10804 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2218.559328] binder: 10799:10804 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2218.559364] binder: 10799:10804 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2218.559374] binder: 10799:10804 got reply transaction with no transaction stack
[ 2218.559384] binder: 10799:10804 transaction failed 29201/-71, size 0-0 line 2922
[ 2218.559564] binder: undelivered TRANSACTION_ERROR: 29201
[ 2218.657629] binder: 10819:10824 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2218.658425] binder: 10819:10824 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2218.658456] binder: 10819:10824 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2218.659516] binder: 10819:10824 got reply transaction with no transaction stack
[ 2218.659524] binder: 10819:10824 transaction failed 29201/-71, size 0-0 line 2922
[ 2218.661268] binder: undelivered TRANSACTION_ERROR: 29201
[ 2218.789579] binder: 10836:10839 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2218.789696] binder: 10836:10839 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2218.789721] binder: 10836:10839 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2218.789729] binder: 10836:10839 got reply transaction with no transaction stack
[ 2218.789739] binder: 10836:10839 transaction failed 29201/-71, size 0-0 line 2922
[ 2218.789936] binder: undelivered TRANSACTION_ERROR: 29201
[ 2218.933758] binder: 10852:10859 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2218.933979] binder: 10852:10859 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2218.934796] binder: 10852:10859 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2218.934805] binder: 10852:10859 got reply transaction with no transaction stack
[ 2218.934814] binder: 10852:10859 transaction failed 29201/-71, size 0-0 line 2922
[ 2218.934995] binder: undelivered TRANSACTION_ERROR: 29201
[ 2219.082333] binder: 10869:10877 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.082451] binder: 10869:10877 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2219.082476] binder: 10869:10877 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.082484] binder: 10869:10877 got reply transaction with no transaction stack
[ 2219.082493] binder: 10869:10877 transaction failed 29201/-71, size 0-0 line 2922
[ 2219.082675] binder: undelivered TRANSACTION_ERROR: 29201
[ 2219.190421] binder: 10892:10895 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.190916] binder: 10892:10895 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2219.190941] binder: 10892:10895 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.190950] binder: 10892:10895 got reply transaction with no transaction stack
[ 2219.190959] binder: 10892:10895 transaction failed 29201/-71, size 0-0 line 2922
[ 2219.191143] binder: undelivered TRANSACTION_ERROR: 29201
[ 2219.334687] binder: 10908:10910 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.334794] binder: 10908:10910 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2219.334818] binder: 10908:10910 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.334826] binder: 10908:10910 got reply transaction with no transaction stack
[ 2219.334836] binder: 10908:10910 transaction failed 29201/-71, size 0-0 line 2922
[ 2219.335016] binder: undelivered TRANSACTION_ERROR: 29201
[ 2219.466490] binder: 10923:10930 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.466617] binder: 10923:10930 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2219.466641] binder: 10923:10930 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.466649] binder: 10923:10930 got reply transaction with no transaction stack
[ 2219.466658] binder: 10923:10930 transaction failed 29201/-71, size 0-0 line 2922
[ 2219.475529] binder: undelivered TRANSACTION_ERROR: 29201
[ 2219.577855] binder: 10942:10945 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.577973] binder: 10942:10945 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2219.577997] binder: 10942:10945 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.578005] binder: 10942:10945 got reply transaction with no transaction stack
[ 2219.578015] binder: 10942:10945 transaction failed 29201/-71, size 0-0 line 2922
[ 2219.578193] binder: undelivered TRANSACTION_ERROR: 29201
[ 2219.667295] binder: 10954:10958 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.667413] binder: 10954:10958 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2219.667437] binder: 10954:10958 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.667445] binder: 10954:10958 got reply transaction with no transaction stack
[ 2219.667455] binder: 10954:10958 transaction failed 29201/-71, size 0-0 line 2922
[ 2219.667639] binder: undelivered TRANSACTION_ERROR: 29201
[ 2219.815694] binder: 10973:10976 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.816636] binder: 10973:10976 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2219.816661] binder: 10973:10976 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.816669] binder: 10973:10976 got reply transaction with no transaction stack
[ 2219.816678] binder: 10973:10976 transaction failed 29201/-71, size 0-0 line 2922
[ 2219.817187] binder: undelivered TRANSACTION_ERROR: 29201
[ 2219.937732] binder: 10993:10998 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.937841] binder: 10993:10998 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2219.937864] binder: 10993:10998 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2219.937872] binder: 10993:10998 got reply transaction with no transaction stack
[ 2219.937881] binder: 10993:10998 transaction failed 29201/-71, size 0-0 line 2922
[ 2219.938099] binder: undelivered TRANSACTION_ERROR: 29201
[ 2220.096480] binder: 11017:11019 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.096592] binder: 11017:11019 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2220.096617] binder: 11017:11019 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.096625] binder: 11017:11019 got reply transaction with no transaction stack
[ 2220.096634] binder: 11017:11019 transaction failed 29201/-71, size 0-0 line 2922
[ 2220.096794] binder: undelivered TRANSACTION_ERROR: 29201
[ 2220.229375] binder: 11028:11035 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.229585] binder: 11028:11035 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2220.229610] binder: 11028:11035 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.229618] binder: 11028:11035 got reply transaction with no transaction stack
[ 2220.229627] binder: 11028:11035 transaction failed 29201/-71, size 0-0 line 2922
[ 2220.233629] binder: undelivered TRANSACTION_ERROR: 29201
[ 2220.359765] binder: 11046:11052 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.360259] binder: 11046:11052 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2220.360284] binder: 11046:11052 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.360292] binder: 11046:11052 got reply transaction with no transaction stack
[ 2220.360302] binder: 11046:11052 transaction failed 29201/-71, size 0-0 line 2922
[ 2220.360501] binder: undelivered TRANSACTION_ERROR: 29201
[ 2220.496355] binder: 11066:11071 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.496828] binder: 11066:11071 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2220.496866] binder: 11066:11071 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.496874] binder: 11066:11071 got reply transaction with no transaction stack
[ 2220.496884] binder: 11066:11071 transaction failed 29201/-71, size 0-0 line 2922
[ 2220.497027] binder: undelivered TRANSACTION_ERROR: 29201
[ 2220.650514] binder: 11083:11088 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.650631] binder: 11083:11088 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2220.650656] binder: 11083:11088 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.650665] binder: 11083:11088 got reply transaction with no transaction stack
[ 2220.650675] binder: 11083:11088 transaction failed 29201/-71, size 0-0 line 2922
[ 2220.651010] binder: undelivered TRANSACTION_ERROR: 29201
[ 2220.693056] binder: 11096:11101 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.693171] binder: 11096:11101 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2220.693196] binder: 11096:11101 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.693203] binder: 11096:11101 got reply transaction with no transaction stack
[ 2220.693213] binder: 11096:11101 transaction failed 29201/-71, size 0-0 line 2922
[ 2220.693594] binder: undelivered TRANSACTION_ERROR: 29201
[ 2220.815588] binder: 11113:11114 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.815697] binder: 11113:11114 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2220.815721] binder: 11113:11114 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.815729] binder: 11113:11114 got reply transaction with no transaction stack
[ 2220.815738] binder: 11113:11114 transaction failed 29201/-71, size 0-0 line 2922
[ 2220.819048] binder: undelivered TRANSACTION_ERROR: 29201
[ 2220.925679] binder: 11127:11130 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.925785] binder: 11127:11130 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2220.925810] binder: 11127:11130 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2220.925818] binder: 11127:11130 got reply transaction with no transaction stack
[ 2220.925827] binder: 11127:11130 transaction failed 29201/-71, size 0-0 line 2922
[ 2220.935218] binder: undelivered TRANSACTION_ERROR: 29201
[ 2221.020681] binder: 11138:11145 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.020819] binder: 11138:11145 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2221.020845] binder: 11138:11145 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.020853] binder: 11138:11145 got reply transaction with no transaction stack
[ 2221.020861] binder: 11138:11145 transaction failed 29201/-71, size 0-0 line 2922
[ 2221.021047] binder: undelivered TRANSACTION_ERROR: 29201
[ 2221.171044] binder: 11161:11168 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.182204] binder: 11161:11168 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2221.182231] binder: 11161:11168 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.182240] binder: 11161:11168 got reply transaction with no transaction stack
[ 2221.182251] binder: 11161:11168 transaction failed 29201/-71, size 0-0 line 2922
[ 2221.183115] binder: undelivered TRANSACTION_ERROR: 29201
[ 2221.258197] binder: 11176:11179 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.258305] binder: 11176:11179 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2221.258331] binder: 11176:11179 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.258339] binder: 11176:11179 got reply transaction with no transaction stack
[ 2221.258349] binder: 11176:11179 transaction failed 29201/-71, size 0-0 line 2922
[ 2221.258513] binder: undelivered TRANSACTION_ERROR: 29201
[ 2221.424851] binder: 11195:11204 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.424972] binder: 11195:11204 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2221.424996] binder: 11195:11204 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.425004] binder: 11195:11204 got reply transaction with no transaction stack
[ 2221.425014] binder: 11195:11204 transaction failed 29201/-71, size 0-0 line 2922
[ 2221.434278] binder: undelivered TRANSACTION_ERROR: 29201
[ 2221.556128] binder: 11219:11223 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.556826] binder: 11219:11223 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2221.556850] binder: 11219:11223 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.556868] binder: 11219:11223 got reply transaction with no transaction stack
[ 2221.556877] binder: 11219:11223 transaction failed 29201/-71, size 0-0 line 2922
[ 2221.560813] binder: undelivered TRANSACTION_ERROR: 29201
[ 2221.669588] binder: 11232:11239 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.670709] binder: 11232:11239 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2221.670734] binder: 11232:11239 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.670742] binder: 11232:11239 got reply transaction with no transaction stack
[ 2221.670751] binder: 11232:11239 transaction failed 29201/-71, size 0-0 line 2922
[ 2221.670939] binder: undelivered TRANSACTION_ERROR: 29201
[ 2221.788254] binder: 11251:11253 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.792215] binder: 11251:11253 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2221.792240] binder: 11251:11253 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.792249] binder: 11251:11253 got reply transaction with no transaction stack
[ 2221.792258] binder: 11251:11253 transaction failed 29201/-71, size 0-0 line 2922
[ 2221.792621] binder: undelivered TRANSACTION_ERROR: 29201
[ 2221.901272] binder: 11268:11271 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.901396] binder: 11268:11271 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2221.901420] binder: 11268:11271 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2221.901428] binder: 11268:11271 got reply transaction with no transaction stack
[ 2221.901438] binder: 11268:11271 transaction failed 29201/-71, size 0-0 line 2922
[ 2221.901607] binder: undelivered TRANSACTION_ERROR: 29201
[ 2222.034207] binder: 11284:11290 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.034326] binder: 11284:11290 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2222.034350] binder: 11284:11290 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.034370] binder: 11284:11290 got reply transaction with no transaction stack
[ 2222.034379] binder: 11284:11290 transaction failed 29201/-71, size 0-0 line 2922
[ 2222.034560] binder: undelivered TRANSACTION_ERROR: 29201
[ 2222.180077] binder: 11305:11308 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.181139] binder: 11305:11308 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2222.181163] binder: 11305:11308 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.181171] binder: 11305:11308 got reply transaction with no transaction stack
[ 2222.181180] binder: 11305:11308 transaction failed 29201/-71, size 0-0 line 2922
[ 2222.181343] binder: undelivered TRANSACTION_ERROR: 29201
[ 2222.279618] binder: 11317:11318 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.279723] binder: 11317:11318 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2222.279750] binder: 11317:11318 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.279759] binder: 11317:11318 got reply transaction with no transaction stack
[ 2222.279768] binder: 11317:11318 transaction failed 29201/-71, size 0-0 line 2922
[ 2222.279944] binder: undelivered TRANSACTION_ERROR: 29201
[ 2222.412908] binder: 11336:11340 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.413025] binder: 11336:11340 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2222.413049] binder: 11336:11340 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.413057] binder: 11336:11340 got reply transaction with no transaction stack
[ 2222.413067] binder: 11336:11340 transaction failed 29201/-71, size 0-0 line 2922
[ 2222.413244] binder: undelivered TRANSACTION_ERROR: 29201
[ 2222.539806] binder: 11357:11359 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.540929] binder: 11357:11359 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2222.540954] binder: 11357:11359 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.540962] binder: 11357:11359 got reply transaction with no transaction stack
[ 2222.540971] binder: 11357:11359 transaction failed 29201/-71, size 0-0 line 2922
[ 2222.541149] binder: undelivered TRANSACTION_ERROR: 29201
[ 2222.692578] binder: 11375:11377 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.705396] binder: 11375:11377 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2222.705422] binder: 11375:11377 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.705431] binder: 11375:11377 got reply transaction with no transaction stack
[ 2222.705441] binder: 11375:11377 transaction failed 29201/-71, size 0-0 line 2922
[ 2222.705643] binder: undelivered TRANSACTION_ERROR: 29201
[ 2222.843265] binder: 11390:11397 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.843379] binder: 11390:11397 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2222.843404] binder: 11390:11397 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.843412] binder: 11390:11397 got reply transaction with no transaction stack
[ 2222.843422] binder: 11390:11397 transaction failed 29201/-71, size 0-0 line 2922
[ 2222.843749] binder: undelivered TRANSACTION_ERROR: 29201
[ 2222.892971] binder: 11402:11403 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.893077] binder: 11402:11403 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2222.893121] binder: 11402:11403 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2222.893129] binder: 11402:11403 got reply transaction with no transaction stack
[ 2222.893139] binder: 11402:11403 transaction failed 29201/-71, size 0-0 line 2922
[ 2222.893318] binder: undelivered TRANSACTION_ERROR: 29201
[ 2223.023185] binder: 11422:11426 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.023294] binder: 11422:11426 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2223.023318] binder: 11422:11426 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.023326] binder: 11422:11426 got reply transaction with no transaction stack
[ 2223.023336] binder: 11422:11426 transaction failed 29201/-71, size 0-0 line 2922
[ 2223.023880] binder: undelivered TRANSACTION_ERROR: 29201
[ 2223.124903] binder: 11441:11444 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.125018] binder: 11441:11444 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2223.125042] binder: 11441:11444 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.125050] binder: 11441:11444 got reply transaction with no transaction stack
[ 2223.125059] binder: 11441:11444 transaction failed 29201/-71, size 0-0 line 2922
[ 2223.125237] binder: undelivered TRANSACTION_ERROR: 29201
[ 2223.226248] binder: 11454:11459 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.227366] binder: 11454:11459 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2223.227393] binder: 11454:11459 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.227402] binder: 11454:11459 got reply transaction with no transaction stack
[ 2223.227412] binder: 11454:11459 transaction failed 29201/-71, size 0-0 line 2922
[ 2223.227773] binder: undelivered TRANSACTION_ERROR: 29201
[ 2223.314575] binder: 11467:11471 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.314702] binder: 11467:11471 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2223.314726] binder: 11467:11471 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.314734] binder: 11467:11471 got reply transaction with no transaction stack
[ 2223.314743] binder: 11467:11471 transaction failed 29201/-71, size 0-0 line 2922
[ 2223.324320] binder: undelivered TRANSACTION_ERROR: 29201
[ 2223.605244] binder: 11482:11483 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.605372] binder: 11482:11483 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2223.605397] binder: 11482:11483 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.605406] binder: 11482:11483 got reply transaction with no transaction stack
[ 2223.605415] binder: 11482:11483 transaction failed 29201/-71, size 0-0 line 2922
[ 2223.605720] binder: undelivered TRANSACTION_ERROR: 29201
[ 2223.871202] binder: 11494:11498 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.871310] binder: 11494:11498 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2223.871335] binder: 11494:11498 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.871343] binder: 11494:11498 got reply transaction with no transaction stack
[ 2223.871352] binder: 11494:11498 transaction failed 29201/-71, size 0-0 line 2922
[ 2223.871532] binder: undelivered TRANSACTION_ERROR: 29201
[ 2223.986168] binder: 11512:11515 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.997921] binder: 11512:11515 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2223.997949] binder: 11512:11515 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2223.997958] binder: 11512:11515 got reply transaction with no transaction stack
[ 2223.997968] binder: 11512:11515 transaction failed 29201/-71, size 0-0 line 2922
[ 2223.998165] binder: undelivered TRANSACTION_ERROR: 29201
[ 2224.118353] binder: 11529:11532 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.118478] binder: 11529:11532 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2224.118502] binder: 11529:11532 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.118511] binder: 11529:11532 got reply transaction with no transaction stack
[ 2224.118520] binder: 11529:11532 transaction failed 29201/-71, size 0-0 line 2922
[ 2224.118706] binder: undelivered TRANSACTION_ERROR: 29201
[ 2224.246031] binder: 11547:11551 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.246154] binder: 11547:11551 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2224.246178] binder: 11547:11551 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.246186] binder: 11547:11551 got reply transaction with no transaction stack
[ 2224.246195] binder: 11547:11551 transaction failed 29201/-71, size 0-0 line 2922
[ 2224.246372] binder: undelivered TRANSACTION_ERROR: 29201
[ 2224.349224] binder: 11560:11565 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.349343] binder: 11560:11565 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2224.349377] binder: 11560:11565 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.349385] binder: 11560:11565 got reply transaction with no transaction stack
[ 2224.349395] binder: 11560:11565 transaction failed 29201/-71, size 0-0 line 2922
[ 2224.349583] binder: undelivered TRANSACTION_ERROR: 29201
[ 2224.480458] binder: 11577:11580 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.480571] binder: 11577:11580 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2224.480596] binder: 11577:11580 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.480604] binder: 11577:11580 got reply transaction with no transaction stack
[ 2224.480614] binder: 11577:11580 transaction failed 29201/-71, size 0-0 line 2922
[ 2224.480791] binder: undelivered TRANSACTION_ERROR: 29201
[ 2224.612006] binder: 11593:11597 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.612155] binder: 11593:11597 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2224.612181] binder: 11593:11597 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.612189] binder: 11593:11597 got reply transaction with no transaction stack
[ 2224.612199] binder: 11593:11597 transaction failed 29201/-71, size 0-0 line 2922
[ 2224.612413] binder: undelivered TRANSACTION_ERROR: 29201
[ 2224.718903] binder: 11610:11613 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.719185] binder: 11610:11613 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2224.719402] binder: 11610:11613 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.719410] binder: 11610:11613 got reply transaction with no transaction stack
[ 2224.719419] binder: 11610:11613 transaction failed 29201/-71, size 0-0 line 2922
[ 2224.719602] binder: undelivered TRANSACTION_ERROR: 29201
[ 2224.811247] binder: 11623:11628 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.811351] binder: 11623:11628 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2224.811375] binder: 11623:11628 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.811382] binder: 11623:11628 got reply transaction with no transaction stack
[ 2224.811400] binder: 11623:11628 transaction failed 29201/-71, size 0-0 line 2922
[ 2224.820179] binder: undelivered TRANSACTION_ERROR: 29201
[ 2224.914888] binder: 11641:11644 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.915701] binder: 11641:11644 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2224.915726] binder: 11641:11644 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2224.915735] binder: 11641:11644 got reply transaction with no transaction stack
[ 2224.915745] binder: 11641:11644 transaction failed 29201/-71, size 0-0 line 2922
[ 2224.916360] binder: undelivered TRANSACTION_ERROR: 29201
[ 2225.040232] binder: 11655:11664 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.040357] binder: 11655:11664 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2225.040381] binder: 11655:11664 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.040389] binder: 11655:11664 got reply transaction with no transaction stack
[ 2225.040399] binder: 11655:11664 transaction failed 29201/-71, size 0-0 line 2922
[ 2225.040839] binder: undelivered TRANSACTION_ERROR: 29201
[ 2225.178430] binder: 11678:11683 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.179588] binder: 11678:11683 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2225.179613] binder: 11678:11683 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.179621] binder: 11678:11683 got reply transaction with no transaction stack
[ 2225.179631] binder: 11678:11683 transaction failed 29201/-71, size 0-0 line 2922
[ 2225.179810] binder: undelivered TRANSACTION_ERROR: 29201
[ 2225.288134] binder: 11696:11699 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.289231] binder: 11696:11699 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2225.289256] binder: 11696:11699 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.289264] binder: 11696:11699 got reply transaction with no transaction stack
[ 2225.289273] binder: 11696:11699 transaction failed 29201/-71, size 0-0 line 2922
[ 2225.289461] binder: undelivered TRANSACTION_ERROR: 29201
[ 2225.383059] binder: 11707:11710 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.383180] binder: 11707:11710 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2225.383204] binder: 11707:11710 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.383212] binder: 11707:11710 got reply transaction with no transaction stack
[ 2225.383221] binder: 11707:11710 transaction failed 29201/-71, size 0-0 line 2922
[ 2225.383405] binder: undelivered TRANSACTION_ERROR: 29201
[ 2225.526340] binder: 11724:11730 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.526460] binder: 11724:11730 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2225.526484] binder: 11724:11730 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.526492] binder: 11724:11730 got reply transaction with no transaction stack
[ 2225.526500] binder: 11724:11730 transaction failed 29201/-71, size 0-0 line 2922
[ 2225.526682] binder: undelivered TRANSACTION_ERROR: 29201
[ 2225.625112] binder: 11742:11746 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.625219] binder: 11742:11746 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2225.625243] binder: 11742:11746 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.625251] binder: 11742:11746 got reply transaction with no transaction stack
[ 2225.625260] binder: 11742:11746 transaction failed 29201/-71, size 0-0 line 2922
[ 2225.625431] binder: undelivered TRANSACTION_ERROR: 29201
[ 2225.715557] binder: 11757:11758 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.716317] binder: 11757:11758 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2225.716342] binder: 11757:11758 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.716350] binder: 11757:11758 got reply transaction with no transaction stack
[ 2225.716367] binder: 11757:11758 transaction failed 29201/-71, size 0-0 line 2922
[ 2225.716516] binder: undelivered TRANSACTION_ERROR: 29201
[ 2225.847347] binder: 11775:11777 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.847569] binder: 11775:11777 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2225.847594] binder: 11775:11777 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.847602] binder: 11775:11777 got reply transaction with no transaction stack
[ 2225.847611] binder: 11775:11777 transaction failed 29201/-71, size 0-0 line 2922
[ 2225.847765] binder: undelivered TRANSACTION_ERROR: 29201
[ 2225.952034] binder: 11790:11792 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.953202] binder: 11790:11792 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2225.953226] binder: 11790:11792 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2225.953234] binder: 11790:11792 got reply transaction with no transaction stack
[ 2225.953244] binder: 11790:11792 transaction failed 29201/-71, size 0-0 line 2922
[ 2225.953489] binder: undelivered TRANSACTION_ERROR: 29201
[ 2226.067239] binder: 11807:11810 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.068435] binder: 11807:11810 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2226.068460] binder: 11807:11810 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.068469] binder: 11807:11810 got reply transaction with no transaction stack
[ 2226.068479] binder: 11807:11810 transaction failed 29201/-71, size 0-0 line 2922
[ 2226.068650] binder: undelivered TRANSACTION_ERROR: 29201
[ 2226.182169] binder: 11820:11825 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.182276] binder: 11820:11825 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2226.182302] binder: 11820:11825 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.182310] binder: 11820:11825 got reply transaction with no transaction stack
[ 2226.182319] binder: 11820:11825 transaction failed 29201/-71, size 0-0 line 2922
[ 2226.182498] binder: undelivered TRANSACTION_ERROR: 29201
[ 2226.343138] binder: 11843:11844 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.343257] binder: 11843:11844 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2226.343281] binder: 11843:11844 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.343289] binder: 11843:11844 got reply transaction with no transaction stack
[ 2226.343298] binder: 11843:11844 transaction failed 29201/-71, size 0-0 line 2922
[ 2226.343479] binder: undelivered TRANSACTION_ERROR: 29201
[ 2226.492772] binder: 11862:11867 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.492903] binder: 11862:11867 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2226.492928] binder: 11862:11867 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.492935] binder: 11862:11867 got reply transaction with no transaction stack
[ 2226.492944] binder: 11862:11867 transaction failed 29201/-71, size 0-0 line 2922
[ 2226.493133] binder: undelivered TRANSACTION_ERROR: 29201
[ 2226.583000] binder: 11879:11884 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.583123] binder: 11879:11884 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2226.583147] binder: 11879:11884 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.583155] binder: 11879:11884 got reply transaction with no transaction stack
[ 2226.583164] binder: 11879:11884 transaction failed 29201/-71, size 0-0 line 2922
[ 2226.585801] binder: undelivered TRANSACTION_ERROR: 29201
[ 2226.704104] binder: 11897:11900 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.719724] binder: 11897:11900 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2226.719751] binder: 11897:11900 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.719759] binder: 11897:11900 got reply transaction with no transaction stack
[ 2226.719769] binder: 11897:11900 transaction failed 29201/-71, size 0-0 line 2922
[ 2226.719967] binder: undelivered TRANSACTION_ERROR: 29201
[ 2226.835775] binder: 11914:11919 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.835903] binder: 11914:11919 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2226.835927] binder: 11914:11919 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2226.835935] binder: 11914:11919 got reply transaction with no transaction stack
[ 2226.835944] binder: 11914:11919 transaction failed 29201/-71, size 0-0 line 2922
[ 2226.875143] binder: undelivered TRANSACTION_ERROR: 29201
[ 2227.011575] binder: 11932:11939 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.011686] binder: 11932:11939 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2227.011710] binder: 11932:11939 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.011719] binder: 11932:11939 got reply transaction with no transaction stack
[ 2227.011728] binder: 11932:11939 transaction failed 29201/-71, size 0-0 line 2922
[ 2227.011901] binder: undelivered TRANSACTION_ERROR: 29201
[ 2227.130772] binder: 11953:11960 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.130882] binder: 11953:11960 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2227.130907] binder: 11953:11960 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.130915] binder: 11953:11960 got reply transaction with no transaction stack
[ 2227.130924] binder: 11953:11960 transaction failed 29201/-71, size 0-0 line 2922
[ 2227.131088] binder: undelivered TRANSACTION_ERROR: 29201
[ 2227.242957] binder: 11968:11978 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.243237] binder: 11968:11978 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2227.243262] binder: 11968:11978 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.243270] binder: 11968:11978 got reply transaction with no transaction stack
[ 2227.243280] binder: 11968:11978 transaction failed 29201/-71, size 0-0 line 2922
[ 2227.243462] binder: undelivered TRANSACTION_ERROR: 29201
[ 2227.361506] binder: 11986:11995 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.361804] binder: 11986:11995 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2227.361829] binder: 11986:11995 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.361837] binder: 11986:11995 got reply transaction with no transaction stack
[ 2227.361847] binder: 11986:11995 transaction failed 29201/-71, size 0-0 line 2922
[ 2227.362010] binder: undelivered TRANSACTION_ERROR: 29201
[ 2227.477868] binder: 12014:12015 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.477989] binder: 12014:12015 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2227.478015] binder: 12014:12015 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.478023] binder: 12014:12015 got reply transaction with no transaction stack
[ 2227.478032] binder: 12014:12015 transaction failed 29201/-71, size 0-0 line 2922
[ 2227.478277] binder: undelivered TRANSACTION_ERROR: 29201
[ 2227.598871] binder: 12025:12031 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.599434] binder: 12025:12031 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2227.599458] binder: 12025:12031 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.599466] binder: 12025:12031 got reply transaction with no transaction stack
[ 2227.599475] binder: 12025:12031 transaction failed 29201/-71, size 0-0 line 2922
[ 2227.599654] binder: undelivered TRANSACTION_ERROR: 29201
[ 2227.691508] binder: 12043:12046 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.691637] binder: 12043:12046 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2227.691754] binder: 12043:12046 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.691763] binder: 12043:12046 got reply transaction with no transaction stack
[ 2227.691772] binder: 12043:12046 transaction failed 29201/-71, size 0-0 line 2922
[ 2227.692004] binder: undelivered TRANSACTION_ERROR: 29201
[ 2227.801135] binder: 12053:12058 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.801236] binder: 12053:12058 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2227.801260] binder: 12053:12058 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.801268] binder: 12053:12058 got reply transaction with no transaction stack
[ 2227.801277] binder: 12053:12058 transaction failed 29201/-71, size 0-0 line 2922
[ 2227.801576] binder: undelivered TRANSACTION_ERROR: 29201
[ 2227.916827] binder: 12075:12077 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.916945] binder: 12075:12077 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2227.916970] binder: 12075:12077 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2227.916978] binder: 12075:12077 got reply transaction with no transaction stack
[ 2227.916988] binder: 12075:12077 transaction failed 29201/-71, size 0-0 line 2922
[ 2227.920913] binder: undelivered TRANSACTION_ERROR: 29201
[ 2228.093479] binder: 12091:12097 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2228.093669] binder: 12091:12097 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2228.093693] binder: 12091:12097 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2228.093701] binder: 12091:12097 got reply transaction with no transaction stack
[ 2228.093710] binder: 12091:12097 transaction failed 29201/-71, size 0-0 line 2922
[ 2228.094056] binder: undelivered TRANSACTION_ERROR: 29201
[ 2228.177434] binder: 12114:12116 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2228.177553] binder: 12114:12116 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2228.177784] binder: 12114:12116 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2228.177793] binder: 12114:12116 got reply transaction with no transaction stack
[ 2228.177802] binder: 12114:12116 transaction failed 29201/-71, size 0-0 line 2922
[ 2228.178187] binder: undelivered TRANSACTION_ERROR: 29201
[ 2228.297999] binder: 12124:12128 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2228.298120] binder: 12124:12128 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2228.298145] binder: 12124:12128 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2228.298152] binder: 12124:12128 got reply transaction with no transaction stack
[ 2228.298162] binder: 12124:12128 transaction failed 29201/-71, size 0-0 line 2922
[ 2228.313596] binder: undelivered TRANSACTION_ERROR: 29201
[ 2228.453720] binder: 12146:12149 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2228.453831] binder: 12146:12149 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2228.453855] binder: 12146:12149 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2228.453862] binder: 12146:12149 got reply transaction with no transaction stack
[ 2228.453871] binder: 12146:12149 transaction failed 29201/-71, size 0-0 line 2922
[ 2228.454042] binder: undelivered TRANSACTION_ERROR: 29201
[ 2228.561879] binder: 12165:12168 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2228.573665] binder: 12165:12168 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2228.573693] binder: 12165:12168 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2228.573703] binder: 12165:12168 got reply transaction with no transaction stack
[ 2228.573714] binder: 12165:12168 transaction failed 29201/-71, size 0-0 line 2922
[ 2228.573901] binder: undelivered TRANSACTION_ERROR: 29201
[ 2229.033155] binder: 12194:12197 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.033272] binder: 12194:12197 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2229.033297] binder: 12194:12197 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.033305] binder: 12194:12197 got reply transaction with no transaction stack
[ 2229.033314] binder: 12194:12197 transaction failed 29201/-71, size 0-0 line 2922
[ 2229.033494] binder: undelivered TRANSACTION_ERROR: 29201
[ 2229.185830] binder: 12212:12214 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.185961] binder: 12212:12214 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2229.185986] binder: 12212:12214 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.185993] binder: 12212:12214 got reply transaction with no transaction stack
[ 2229.186002] binder: 12212:12214 transaction failed 29201/-71, size 0-0 line 2922
[ 2229.186184] binder: undelivered TRANSACTION_ERROR: 29201
[ 2229.307906] binder: 12227:12232 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.308025] binder: 12227:12232 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2229.308050] binder: 12227:12232 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.308058] binder: 12227:12232 got reply transaction with no transaction stack
[ 2229.308068] binder: 12227:12232 transaction failed 29201/-71, size 0-0 line 2922
[ 2229.308244] binder: undelivered TRANSACTION_ERROR: 29201
[ 2229.462653] binder: 12249:12252 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.462763] binder: 12249:12252 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2229.462788] binder: 12249:12252 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.462795] binder: 12249:12252 got reply transaction with no transaction stack
[ 2229.462805] binder: 12249:12252 transaction failed 29201/-71, size 0-0 line 2922
[ 2229.462998] binder: undelivered TRANSACTION_ERROR: 29201
[ 2229.585083] binder: 12263:12271 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.585202] binder: 12263:12271 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2229.585227] binder: 12263:12271 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.585235] binder: 12263:12271 got reply transaction with no transaction stack
[ 2229.585244] binder: 12263:12271 transaction failed 29201/-71, size 0-0 line 2922
[ 2229.585522] binder: undelivered TRANSACTION_ERROR: 29201
[ 2229.684555] binder: 12281:12285 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.684722] binder: 12281:12285 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2229.684752] binder: 12281:12285 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.684760] binder: 12281:12285 got reply transaction with no transaction stack
[ 2229.684769] binder: 12281:12285 transaction failed 29201/-71, size 0-0 line 2922
[ 2229.685080] binder: undelivered TRANSACTION_ERROR: 29201
[ 2229.765158] binder: 12298:12301 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.765835] binder: 12298:12301 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2229.765870] binder: 12298:12301 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.765878] binder: 12298:12301 got reply transaction with no transaction stack
[ 2229.765887] binder: 12298:12301 transaction failed 29201/-71, size 0-0 line 2922
[ 2229.766071] binder: undelivered TRANSACTION_ERROR: 29201
[ 2229.885069] binder: 12314:12317 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.885173] binder: 12314:12317 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2229.885198] binder: 12314:12317 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.885206] binder: 12314:12317 got reply transaction with no transaction stack
[ 2229.885216] binder: 12314:12317 transaction failed 29201/-71, size 0-0 line 2922
[ 2229.885392] binder: undelivered TRANSACTION_ERROR: 29201
[ 2229.975367] binder: 12328:12331 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.975759] binder: 12328:12331 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2229.975783] binder: 12328:12331 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2229.975791] binder: 12328:12331 got reply transaction with no transaction stack
[ 2229.975800] binder: 12328:12331 transaction failed 29201/-71, size 0-0 line 2922
[ 2229.975996] binder: undelivered TRANSACTION_ERROR: 29201
[ 2230.066647] binder: 12344:12346 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.066803] binder: 12344:12346 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2230.066828] binder: 12344:12346 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.066836] binder: 12344:12346 got reply transaction with no transaction stack
[ 2230.066845] binder: 12344:12346 transaction failed 29201/-71, size 0-0 line 2922
[ 2230.067012] binder: undelivered TRANSACTION_ERROR: 29201
[ 2230.215273] binder: 12360:12363 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.222551] binder: 12360:12363 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2230.222577] binder: 12360:12363 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.222587] binder: 12360:12363 got reply transaction with no transaction stack
[ 2230.222597] binder: 12360:12363 transaction failed 29201/-71, size 0-0 line 2922
[ 2230.224417] binder: undelivered TRANSACTION_ERROR: 29201
[ 2230.327879] binder: 12376:12378 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.327987] binder: 12376:12378 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2230.328012] binder: 12376:12378 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.328019] binder: 12376:12378 got reply transaction with no transaction stack
[ 2230.328029] binder: 12376:12378 transaction failed 29201/-71, size 0-0 line 2922
[ 2230.328197] binder: undelivered TRANSACTION_ERROR: 29201
[ 2230.434693] binder: 12393:12396 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.434800] binder: 12393:12396 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2230.434824] binder: 12393:12396 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.434832] binder: 12393:12396 got reply transaction with no transaction stack
[ 2230.434842] binder: 12393:12396 transaction failed 29201/-71, size 0-0 line 2922
[ 2230.435047] binder: undelivered TRANSACTION_ERROR: 29201
[ 2230.527251] binder: 12405:12408 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.527680] binder: 12405:12408 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2230.527705] binder: 12405:12408 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.527713] binder: 12405:12408 got reply transaction with no transaction stack
[ 2230.527721] binder: 12405:12408 transaction failed 29201/-71, size 0-0 line 2922
[ 2230.527920] binder: undelivered TRANSACTION_ERROR: 29201
[ 2230.648690] binder: 12422:12425 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.648810] binder: 12422:12425 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2230.648835] binder: 12422:12425 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.648843] binder: 12422:12425 got reply transaction with no transaction stack
[ 2230.648851] binder: 12422:12425 transaction failed 29201/-71, size 0-0 line 2922
[ 2230.649020] binder: undelivered TRANSACTION_ERROR: 29201
[ 2230.766698] binder: 12433:12438 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.767882] binder: 12433:12438 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2230.767907] binder: 12433:12438 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.767915] binder: 12433:12438 got reply transaction with no transaction stack
[ 2230.767924] binder: 12433:12438 transaction failed 29201/-71, size 0-0 line 2922
[ 2230.768226] binder: undelivered TRANSACTION_ERROR: 29201
[ 2230.886976] binder: 12454:12458 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.887385] binder: 12454:12458 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2230.887410] binder: 12454:12458 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.887418] binder: 12454:12458 got reply transaction with no transaction stack
[ 2230.887427] binder: 12454:12458 transaction failed 29201/-71, size 0-0 line 2922
[ 2230.887617] binder: undelivered TRANSACTION_ERROR: 29201
[ 2230.984693] binder: 12468:12470 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.985557] binder: 12468:12470 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2230.985581] binder: 12468:12470 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2230.985590] binder: 12468:12470 got reply transaction with no transaction stack
[ 2230.985600] binder: 12468:12470 transaction failed 29201/-71, size 0-0 line 2922
[ 2230.988152] binder: undelivered TRANSACTION_ERROR: 29201
[ 2231.094568] binder: 12481:12486 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.095167] binder: 12481:12486 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2231.095192] binder: 12481:12486 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.095200] binder: 12481:12486 got reply transaction with no transaction stack
[ 2231.095209] binder: 12481:12486 transaction failed 29201/-71, size 0-0 line 2922
[ 2231.095381] binder: undelivered TRANSACTION_ERROR: 29201
[ 2231.213689] binder: 12501:12504 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.219078] binder: 12501:12504 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2231.219103] binder: 12501:12504 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.219112] binder: 12501:12504 got reply transaction with no transaction stack
[ 2231.219122] binder: 12501:12504 transaction failed 29201/-71, size 0-0 line 2922
[ 2231.219306] binder: undelivered TRANSACTION_ERROR: 29201
[ 2231.367486] binder: 12521:12524 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.367592] binder: 12521:12524 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2231.367617] binder: 12521:12524 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.367625] binder: 12521:12524 got reply transaction with no transaction stack
[ 2231.367634] binder: 12521:12524 transaction failed 29201/-71, size 0-0 line 2922
[ 2231.367811] binder: undelivered TRANSACTION_ERROR: 29201
[ 2231.454392] binder: 12532:12537 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.455987] binder: 12532:12537 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2231.456012] binder: 12532:12537 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.456021] binder: 12532:12537 got reply transaction with no transaction stack
[ 2231.456030] binder: 12532:12537 transaction failed 29201/-71, size 0-0 line 2922
[ 2231.456237] binder: undelivered TRANSACTION_ERROR: 29201
[ 2231.583039] binder: 12551:12557 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.583172] binder: 12551:12557 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2231.583196] binder: 12551:12557 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.583203] binder: 12551:12557 got reply transaction with no transaction stack
[ 2231.583212] binder: 12551:12557 transaction failed 29201/-71, size 0-0 line 2922
[ 2231.583423] binder: undelivered TRANSACTION_ERROR: 29201
[ 2231.687018] binder: 12567:12570 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.687477] binder: 12567:12570 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2231.687500] binder: 12567:12570 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.687508] binder: 12567:12570 got reply transaction with no transaction stack
[ 2231.687518] binder: 12567:12570 transaction failed 29201/-71, size 0-0 line 2922
[ 2231.687713] binder: undelivered TRANSACTION_ERROR: 29201
[ 2231.842213] binder: 12588:12593 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.842334] binder: 12588:12593 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2231.842357] binder: 12588:12593 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.842365] binder: 12588:12593 got reply transaction with no transaction stack
[ 2231.842375] binder: 12588:12593 transaction failed 29201/-71, size 0-0 line 2922
[ 2231.842560] binder: undelivered TRANSACTION_ERROR: 29201
[ 2231.954279] binder: 12608:12610 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.961964] binder: 12608:12610 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2231.961991] binder: 12608:12610 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2231.962000] binder: 12608:12610 got reply transaction with no transaction stack
[ 2231.962010] binder: 12608:12610 transaction failed 29201/-71, size 0-0 line 2922
[ 2231.962633] binder: undelivered TRANSACTION_ERROR: 29201
[ 2232.040966] binder: 12620:12622 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.041074] binder: 12620:12622 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2232.041100] binder: 12620:12622 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.041108] binder: 12620:12622 got reply transaction with no transaction stack
[ 2232.041118] binder: 12620:12622 transaction failed 29201/-71, size 0-0 line 2922
[ 2232.044873] binder: undelivered TRANSACTION_ERROR: 29201
[ 2232.219945] binder: 12641:12642 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.220080] binder: 12641:12642 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2232.220105] binder: 12641:12642 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.220113] binder: 12641:12642 got reply transaction with no transaction stack
[ 2232.220123] binder: 12641:12642 transaction failed 29201/-71, size 0-0 line 2922
[ 2232.220288] binder: undelivered TRANSACTION_ERROR: 29201
[ 2232.350680] binder: 12657:12662 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.351061] binder: 12657:12662 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2232.351084] binder: 12657:12662 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.351092] binder: 12657:12662 got reply transaction with no transaction stack
[ 2232.351100] binder: 12657:12662 transaction failed 29201/-71, size 0-0 line 2922
[ 2232.351286] binder: undelivered TRANSACTION_ERROR: 29201
[ 2232.461947] binder: 12673:12674 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.462682] binder: 12673:12674 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2232.462707] binder: 12673:12674 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.462715] binder: 12673:12674 got reply transaction with no transaction stack
[ 2232.462724] binder: 12673:12674 transaction failed 29201/-71, size 0-0 line 2922
[ 2232.463043] binder: undelivered TRANSACTION_ERROR: 29201
[ 2232.596414] binder: 12691:12695 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.596522] binder: 12691:12695 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2232.596546] binder: 12691:12695 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.596555] binder: 12691:12695 got reply transaction with no transaction stack
[ 2232.596563] binder: 12691:12695 transaction failed 29201/-71, size 0-0 line 2922
[ 2232.596742] binder: undelivered TRANSACTION_ERROR: 29201
[ 2232.729513] binder: 12708:12718 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.730643] binder: 12708:12718 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2232.730667] binder: 12708:12718 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.730675] binder: 12708:12718 got reply transaction with no transaction stack
[ 2232.730685] binder: 12708:12718 transaction failed 29201/-71, size 0-0 line 2922
[ 2232.731516] binder: undelivered TRANSACTION_ERROR: 29201
[ 2232.826826] binder: 12723:12728 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.826951] binder: 12723:12728 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2232.826976] binder: 12723:12728 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.826984] binder: 12723:12728 got reply transaction with no transaction stack
[ 2232.826994] binder: 12723:12728 transaction failed 29201/-71, size 0-0 line 2922
[ 2232.827169] binder: undelivered TRANSACTION_ERROR: 29201
[ 2232.957735] binder: 12741:12745 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.957917] binder: 12741:12745 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2232.957941] binder: 12741:12745 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2232.957949] binder: 12741:12745 got reply transaction with no transaction stack
[ 2232.957958] binder: 12741:12745 transaction failed 29201/-71, size 0-0 line 2922
[ 2232.958259] binder: undelivered TRANSACTION_ERROR: 29201
[ 2233.083374] binder: 12761:12763 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2233.083496] binder: 12761:12763 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2233.083596] binder: 12761:12763 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2233.083605] binder: 12761:12763 got reply transaction with no transaction stack
[ 2233.083615] binder: 12761:12763 transaction failed 29201/-71, size 0-0 line 2922
[ 2233.083904] binder: undelivered TRANSACTION_ERROR: 29201
[ 2233.236183] binder: 12780:12783 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2233.236303] binder: 12780:12783 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2233.236329] binder: 12780:12783 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2233.236337] binder: 12780:12783 got reply transaction with no transaction stack
[ 2233.236346] binder: 12780:12783 transaction failed 29201/-71, size 0-0 line 2922
[ 2233.236530] binder: undelivered TRANSACTION_ERROR: 29201
[ 2233.357459] binder: 12800:12805 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2233.357589] binder: 12800:12805 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2233.357614] binder: 12800:12805 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2233.357622] binder: 12800:12805 got reply transaction with no transaction stack
[ 2233.357631] binder: 12800:12805 transaction failed 29201/-71, size 0-0 line 2922
[ 2233.357818] binder: undelivered TRANSACTION_ERROR: 29201
[ 2233.446424] binder: 12810:12815 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2233.447506] binder: 12810:12815 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2233.447530] binder: 12810:12815 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2233.447538] binder: 12810:12815 got reply transaction with no transaction stack
[ 2233.447548] binder: 12810:12815 transaction failed 29201/-71, size 0-0 line 2922
[ 2233.447923] binder: undelivered TRANSACTION_ERROR: 29201
[ 2233.534413] binder: 12825:12827 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2233.534556] binder: 12825:12827 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2233.534580] binder: 12825:12827 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2233.534589] binder: 12825:12827 got reply transaction with no transaction stack
[ 2233.534599] binder: 12825:12827 transaction failed 29201/-71, size 0-0 line 2922
[ 2233.534944] binder: undelivered TRANSACTION_ERROR: 29201
[ 2233.714386] binder: 12842:12846 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2233.714642] binder: 12842:12846 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2233.714666] binder: 12842:12846 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2233.714674] binder: 12842:12846 got reply transaction with no transaction stack
[ 2233.714684] binder: 12842:12846 transaction failed 29201/-71, size 0-0 line 2922
[ 2233.715469] binder: undelivered TRANSACTION_ERROR: 29201
[ 2234.152324] binder: 12872:12874 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.152449] binder: 12872:12874 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2234.152474] binder: 12872:12874 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.152484] binder: 12872:12874 got reply transaction with no transaction stack
[ 2234.152494] binder: 12872:12874 transaction failed 29201/-71, size 0-0 line 2922
[ 2234.152671] binder: undelivered TRANSACTION_ERROR: 29201
[ 2234.351056] binder: 12892:12896 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.353663] binder: 12892:12896 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2234.353689] binder: 12892:12896 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.353697] binder: 12892:12896 got reply transaction with no transaction stack
[ 2234.353706] binder: 12892:12896 transaction failed 29201/-71, size 0-0 line 2922
[ 2234.353937] binder: undelivered TRANSACTION_ERROR: 29201
[ 2234.475060] binder: 12906:12910 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.475171] binder: 12906:12910 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2234.475196] binder: 12906:12910 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.475204] binder: 12906:12910 got reply transaction with no transaction stack
[ 2234.475213] binder: 12906:12910 transaction failed 29201/-71, size 0-0 line 2922
[ 2234.482228] binder: undelivered TRANSACTION_ERROR: 29201
[ 2234.609658] binder: 12923:12927 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.610438] binder: 12923:12927 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2234.610463] binder: 12923:12927 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.610472] binder: 12923:12927 got reply transaction with no transaction stack
[ 2234.610483] binder: 12923:12927 transaction failed 29201/-71, size 0-0 line 2922
[ 2234.610674] binder: undelivered TRANSACTION_ERROR: 29201
[ 2234.729983] binder: 12939:12946 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.730262] binder: 12939:12946 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2234.730288] binder: 12939:12946 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.730298] binder: 12939:12946 got reply transaction with no transaction stack
[ 2234.730307] binder: 12939:12946 transaction failed 29201/-71, size 0-0 line 2922
[ 2234.740605] binder: undelivered TRANSACTION_ERROR: 29201
[ 2234.851234] binder: 12957:12961 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.851339] binder: 12957:12961 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2234.851363] binder: 12957:12961 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.851371] binder: 12957:12961 got reply transaction with no transaction stack
[ 2234.851380] binder: 12957:12961 transaction failed 29201/-71, size 0-0 line 2922
[ 2234.851564] binder: undelivered TRANSACTION_ERROR: 29201
[ 2234.972353] binder: 12972:12978 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.972477] binder: 12972:12978 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2234.972501] binder: 12972:12978 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2234.972510] binder: 12972:12978 got reply transaction with no transaction stack
[ 2234.972519] binder: 12972:12978 transaction failed 29201/-71, size 0-0 line 2922
[ 2234.972699] binder: undelivered TRANSACTION_ERROR: 29201
[ 2235.102389] binder: 12989:12992 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.102509] binder: 12989:12992 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2235.102534] binder: 12989:12992 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.102543] binder: 12989:12992 got reply transaction with no transaction stack
[ 2235.102554] binder: 12989:12992 transaction failed 29201/-71, size 0-0 line 2922
[ 2235.102741] binder: undelivered TRANSACTION_ERROR: 29201
[ 2235.225743] binder: 13007:13009 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.225851] binder: 13007:13009 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2235.225887] binder: 13007:13009 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.225896] binder: 13007:13009 got reply transaction with no transaction stack
[ 2235.225905] binder: 13007:13009 transaction failed 29201/-71, size 0-0 line 2922
[ 2235.226179] binder: undelivered TRANSACTION_ERROR: 29201
[ 2235.347688] binder: 13026:13031 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.352922] binder: 13026:13031 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2235.352948] binder: 13026:13031 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.352956] binder: 13026:13031 got reply transaction with no transaction stack
[ 2235.352965] binder: 13026:13031 transaction failed 29201/-71, size 0-0 line 2922
[ 2235.353155] binder: undelivered TRANSACTION_ERROR: 29201
[ 2235.444195] binder: 13043:13045 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.444312] binder: 13043:13045 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2235.444338] binder: 13043:13045 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.444346] binder: 13043:13045 got reply transaction with no transaction stack
[ 2235.444355] binder: 13043:13045 transaction failed 29201/-71, size 0-0 line 2922
[ 2235.444542] binder: undelivered TRANSACTION_ERROR: 29201
[ 2235.563867] binder: 13057:13061 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.563992] binder: 13057:13061 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2235.564016] binder: 13057:13061 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.564024] binder: 13057:13061 got reply transaction with no transaction stack
[ 2235.564033] binder: 13057:13061 transaction failed 29201/-71, size 0-0 line 2922
[ 2235.574992] binder: undelivered TRANSACTION_ERROR: 29201
[ 2235.676626] binder: 13072:13076 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.676745] binder: 13072:13076 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2235.676769] binder: 13072:13076 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.676777] binder: 13072:13076 got reply transaction with no transaction stack
[ 2235.676785] binder: 13072:13076 transaction failed 29201/-71, size 0-0 line 2922
[ 2235.676984] binder: undelivered TRANSACTION_ERROR: 29201
[ 2235.751211] binder: 13084:13088 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.751319] binder: 13084:13088 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2235.751344] binder: 13084:13088 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.751362] binder: 13084:13088 got reply transaction with no transaction stack
[ 2235.751372] binder: 13084:13088 transaction failed 29201/-71, size 0-0 line 2922
[ 2235.751538] binder: undelivered TRANSACTION_ERROR: 29201
[ 2235.889151] binder: 13104:13106 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.889368] binder: 13104:13106 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2235.889393] binder: 13104:13106 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2235.889401] binder: 13104:13106 got reply transaction with no transaction stack
[ 2235.889411] binder: 13104:13106 transaction failed 29201/-71, size 0-0 line 2922
[ 2235.889724] binder: undelivered TRANSACTION_ERROR: 29201
[ 2236.000455] binder: 13117:13120 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.000567] binder: 13117:13120 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2236.000592] binder: 13117:13120 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.000600] binder: 13117:13120 got reply transaction with no transaction stack
[ 2236.000609] binder: 13117:13120 transaction failed 29201/-71, size 0-0 line 2922
[ 2236.000790] binder: undelivered TRANSACTION_ERROR: 29201
[ 2236.137373] binder: 13136:13141 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.137480] binder: 13136:13141 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2236.137503] binder: 13136:13141 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.137511] binder: 13136:13141 got reply transaction with no transaction stack
[ 2236.137521] binder: 13136:13141 transaction failed 29201/-71, size 0-0 line 2922
[ 2236.137700] binder: undelivered TRANSACTION_ERROR: 29201
[ 2236.267391] binder: 13155:13158 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.268105] binder: 13155:13158 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2236.268130] binder: 13155:13158 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.268138] binder: 13155:13158 got reply transaction with no transaction stack
[ 2236.268147] binder: 13155:13158 transaction failed 29201/-71, size 0-0 line 2922
[ 2236.268338] binder: undelivered TRANSACTION_ERROR: 29201
[ 2236.396800] binder: 13173:13176 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.396932] binder: 13173:13176 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2236.396956] binder: 13173:13176 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.396964] binder: 13173:13176 got reply transaction with no transaction stack
[ 2236.396973] binder: 13173:13176 transaction failed 29201/-71, size 0-0 line 2922
[ 2236.397147] binder: undelivered TRANSACTION_ERROR: 29201
[ 2236.539345] binder: 13191:13193 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.539466] binder: 13191:13193 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2236.539489] binder: 13191:13193 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.539498] binder: 13191:13193 got reply transaction with no transaction stack
[ 2236.539508] binder: 13191:13193 transaction failed 29201/-71, size 0-0 line 2922
[ 2236.539683] binder: undelivered TRANSACTION_ERROR: 29201
[ 2236.637076] binder: 13208:13210 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.637280] binder: 13208:13210 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2236.637303] binder: 13208:13210 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.637311] binder: 13208:13210 got reply transaction with no transaction stack
[ 2236.637320] binder: 13208:13210 transaction failed 29201/-71, size 0-0 line 2922
[ 2236.637498] binder: undelivered TRANSACTION_ERROR: 29201
[ 2236.791008] binder: 13224:13229 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.791128] binder: 13224:13229 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2236.791152] binder: 13224:13229 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.791160] binder: 13224:13229 got reply transaction with no transaction stack
[ 2236.791169] binder: 13224:13229 transaction failed 29201/-71, size 0-0 line 2922
[ 2236.791353] binder: undelivered TRANSACTION_ERROR: 29201
[ 2236.909175] binder: 13242:13245 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.909421] binder: 13242:13245 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2236.909445] binder: 13242:13245 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2236.909452] binder: 13242:13245 got reply transaction with no transaction stack
[ 2236.909461] binder: 13242:13245 transaction failed 29201/-71, size 0-0 line 2922
[ 2236.909648] binder: undelivered TRANSACTION_ERROR: 29201
[ 2237.045848] binder: 13259:13264 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.045979] binder: 13259:13264 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2237.046002] binder: 13259:13264 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.046011] binder: 13259:13264 got reply transaction with no transaction stack
[ 2237.046020] binder: 13259:13264 transaction failed 29201/-71, size 0-0 line 2922
[ 2237.046243] binder: undelivered TRANSACTION_ERROR: 29201
[ 2237.136936] binder: 13277:13278 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.137055] binder: 13277:13278 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2237.137080] binder: 13277:13278 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.137087] binder: 13277:13278 got reply transaction with no transaction stack
[ 2237.137097] binder: 13277:13278 transaction failed 29201/-71, size 0-0 line 2922
[ 2237.137278] binder: undelivered TRANSACTION_ERROR: 29201
[ 2237.278459] binder: 13295:13296 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.278568] binder: 13295:13296 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2237.278593] binder: 13295:13296 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.278601] binder: 13295:13296 got reply transaction with no transaction stack
[ 2237.278612] binder: 13295:13296 transaction failed 29201/-71, size 0-0 line 2922
[ 2237.278904] binder: undelivered TRANSACTION_ERROR: 29201
[ 2237.389897] binder: 13313:13316 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.390017] binder: 13313:13316 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2237.390041] binder: 13313:13316 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.390048] binder: 13313:13316 got reply transaction with no transaction stack
[ 2237.390057] binder: 13313:13316 transaction failed 29201/-71, size 0-0 line 2922
[ 2237.390222] binder: undelivered TRANSACTION_ERROR: 29201
[ 2237.516686] binder: 13332:13335 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.516791] binder: 13332:13335 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2237.516816] binder: 13332:13335 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.516824] binder: 13332:13335 got reply transaction with no transaction stack
[ 2237.516833] binder: 13332:13335 transaction failed 29201/-71, size 0-0 line 2922
[ 2237.517025] binder: undelivered TRANSACTION_ERROR: 29201
[ 2237.595461] binder: 13345:13348 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.595583] binder: 13345:13348 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2237.595606] binder: 13345:13348 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.595614] binder: 13345:13348 got reply transaction with no transaction stack
[ 2237.595623] binder: 13345:13348 transaction failed 29201/-71, size 0-0 line 2922
[ 2237.595793] binder: undelivered TRANSACTION_ERROR: 29201
[ 2237.743479] binder: 13358:13365 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.744633] binder: 13358:13365 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2237.744659] binder: 13358:13365 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.744667] binder: 13358:13365 got reply transaction with no transaction stack
[ 2237.744676] binder: 13358:13365 transaction failed 29201/-71, size 0-0 line 2922
[ 2237.744984] binder: undelivered TRANSACTION_ERROR: 29201
[ 2237.861959] binder: 13380:13383 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.862079] binder: 13380:13383 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2237.862104] binder: 13380:13383 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.862112] binder: 13380:13383 got reply transaction with no transaction stack
[ 2237.862121] binder: 13380:13383 transaction failed 29201/-71, size 0-0 line 2922
[ 2237.862299] binder: undelivered TRANSACTION_ERROR: 29201
[ 2237.985245] binder: 13397:13402 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.985360] binder: 13397:13402 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2237.985384] binder: 13397:13402 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2237.985392] binder: 13397:13402 got reply transaction with no transaction stack
[ 2237.985400] binder: 13397:13402 transaction failed 29201/-71, size 0-0 line 2922
[ 2237.985581] binder: undelivered TRANSACTION_ERROR: 29201
[ 2238.063449] binder: 13413:13415 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.083264] binder: 13413:13415 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2238.083291] binder: 13413:13415 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.083299] binder: 13413:13415 got reply transaction with no transaction stack
[ 2238.083309] binder: 13413:13415 transaction failed 29201/-71, size 0-0 line 2922
[ 2238.088296] binder: undelivered TRANSACTION_ERROR: 29201
[ 2238.216432] binder: 13429:13433 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.216546] binder: 13429:13433 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2238.216570] binder: 13429:13433 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.216578] binder: 13429:13433 got reply transaction with no transaction stack
[ 2238.216587] binder: 13429:13433 transaction failed 29201/-71, size 0-0 line 2922
[ 2238.223492] binder: undelivered TRANSACTION_ERROR: 29201
[ 2238.324479] binder: 13448:13449 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.324588] binder: 13448:13449 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2238.324611] binder: 13448:13449 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.324619] binder: 13448:13449 got reply transaction with no transaction stack
[ 2238.324627] binder: 13448:13449 transaction failed 29201/-71, size 0-0 line 2922
[ 2238.326225] binder: undelivered TRANSACTION_ERROR: 29201
[ 2238.443184] binder: 13463:13465 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.443390] binder: 13463:13465 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2238.443413] binder: 13463:13465 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.443421] binder: 13463:13465 got reply transaction with no transaction stack
[ 2238.443430] binder: 13463:13465 transaction failed 29201/-71, size 0-0 line 2922
[ 2238.444324] binder: undelivered TRANSACTION_ERROR: 29201
[ 2238.541523] binder: 13478:13480 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.541648] binder: 13478:13480 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2238.541673] binder: 13478:13480 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.541681] binder: 13478:13480 got reply transaction with no transaction stack
[ 2238.541690] binder: 13478:13480 transaction failed 29201/-71, size 0-0 line 2922
[ 2238.544664] binder: undelivered TRANSACTION_ERROR: 29201
[ 2238.718598] binder: 13502:13505 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.718743] binder: 13502:13505 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2238.718768] binder: 13502:13505 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.718776] binder: 13502:13505 got reply transaction with no transaction stack
[ 2238.718784] binder: 13502:13505 transaction failed 29201/-71, size 0-0 line 2922
[ 2238.719170] binder: undelivered TRANSACTION_ERROR: 29201
[ 2238.803826] binder: 13518:13520 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.803962] binder: 13518:13520 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2238.807931] binder: 13518:13520 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.807940] binder: 13518:13520 got reply transaction with no transaction stack
[ 2238.807949] binder: 13518:13520 transaction failed 29201/-71, size 0-0 line 2922
[ 2238.808141] binder: undelivered TRANSACTION_ERROR: 29201
[ 2238.915675] binder: 13531:13534 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.915784] binder: 13531:13534 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2238.915804] binder: 13531:13534 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2238.915810] binder: 13531:13534 got reply transaction with no transaction stack
[ 2238.915818] binder: 13531:13534 transaction failed 29201/-71, size 0-0 line 2922
[ 2238.915994] binder: undelivered TRANSACTION_ERROR: 29201
[ 2239.166528] binder: 13551:13558 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2239.166676] binder: 13551:13558 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2239.166701] binder: 13551:13558 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2239.166711] binder: 13551:13558 got reply transaction with no transaction stack
[ 2239.166721] binder: 13551:13558 transaction failed 29201/-71, size 0-0 line 2922
[ 2239.290506] binder: undelivered TRANSACTION_ERROR: 29201
[ 2239.528580] binder: 13562:13565 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2239.528690] binder: 13562:13565 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2239.528714] binder: 13562:13565 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2239.528722] binder: 13562:13565 got reply transaction with no transaction stack
[ 2239.528732] binder: 13562:13565 transaction failed 29201/-71, size 0-0 line 2922
[ 2239.528928] binder: undelivered TRANSACTION_ERROR: 29201
[ 2239.628731] binder: 13578:13580 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2239.628848] binder: 13578:13580 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2239.628885] binder: 13578:13580 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2239.628893] binder: 13578:13580 got reply transaction with no transaction stack
[ 2239.628902] binder: 13578:13580 transaction failed 29201/-71, size 0-0 line 2922
[ 2239.629086] binder: undelivered TRANSACTION_ERROR: 29201
[ 2239.739694] binder: 13594:13595 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2239.739814] binder: 13594:13595 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2239.739839] binder: 13594:13595 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2239.739848] binder: 13594:13595 got reply transaction with no transaction stack
[ 2239.739868] binder: 13594:13595 transaction failed 29201/-71, size 0-0 line 2922
[ 2239.740055] binder: undelivered TRANSACTION_ERROR: 29201
[ 2239.818503] binder: 13607:13609 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2239.828615] binder: 13607:13609 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2239.828643] binder: 13607:13609 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2239.828652] binder: 13607:13609 got reply transaction with no transaction stack
[ 2239.828662] binder: 13607:13609 transaction failed 29201/-71, size 0-0 line 2922
[ 2239.828878] binder: undelivered TRANSACTION_ERROR: 29201
[ 2239.927251] binder: 13620:13625 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2239.927371] binder: 13620:13625 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2239.927395] binder: 13620:13625 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2239.927403] binder: 13620:13625 got reply transaction with no transaction stack
[ 2239.927412] binder: 13620:13625 transaction failed 29201/-71, size 0-0 line 2922
[ 2239.927598] binder: undelivered TRANSACTION_ERROR: 29201
[ 2240.001406] binder: 13631:13633 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.001520] binder: 13631:13633 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2240.001546] binder: 13631:13633 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.001554] binder: 13631:13633 got reply transaction with no transaction stack
[ 2240.001564] binder: 13631:13633 transaction failed 29201/-71, size 0-0 line 2922
[ 2240.001749] binder: undelivered TRANSACTION_ERROR: 29201
[ 2240.120570] binder: 13647:13651 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.120678] binder: 13647:13651 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2240.120703] binder: 13647:13651 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.120711] binder: 13647:13651 got reply transaction with no transaction stack
[ 2240.120721] binder: 13647:13651 transaction failed 29201/-71, size 0-0 line 2922
[ 2240.120942] binder: undelivered TRANSACTION_ERROR: 29201
[ 2240.238062] binder: 13661:13662 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.238173] binder: 13661:13662 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2240.238197] binder: 13661:13662 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.238205] binder: 13661:13662 got reply transaction with no transaction stack
[ 2240.238214] binder: 13661:13662 transaction failed 29201/-71, size 0-0 line 2922
[ 2240.238393] binder: undelivered TRANSACTION_ERROR: 29201
[ 2240.364245] binder: 13679:13684 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.364366] binder: 13679:13684 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2240.364390] binder: 13679:13684 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.364398] binder: 13679:13684 got reply transaction with no transaction stack
[ 2240.364407] binder: 13679:13684 transaction failed 29201/-71, size 0-0 line 2922
[ 2240.364591] binder: undelivered TRANSACTION_ERROR: 29201
[ 2240.483690] binder: 13696:13701 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.484889] binder: 13696:13701 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2240.484914] binder: 13696:13701 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.484922] binder: 13696:13701 got reply transaction with no transaction stack
[ 2240.484930] binder: 13696:13701 transaction failed 29201/-71, size 0-0 line 2922
[ 2240.488096] binder: undelivered TRANSACTION_ERROR: 29201
[ 2240.623275] binder: 13715:13721 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.623428] binder: 13715:13721 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2240.623453] binder: 13715:13721 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.623461] binder: 13715:13721 got reply transaction with no transaction stack
[ 2240.623471] binder: 13715:13721 transaction failed 29201/-71, size 0-0 line 2922
[ 2240.623803] binder: undelivered TRANSACTION_ERROR: 29201
[ 2240.736158] binder: 13732:13736 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.736265] binder: 13732:13736 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2240.736289] binder: 13732:13736 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.736297] binder: 13732:13736 got reply transaction with no transaction stack
[ 2240.736307] binder: 13732:13736 transaction failed 29201/-71, size 0-0 line 2922
[ 2240.736479] binder: undelivered TRANSACTION_ERROR: 29201
[ 2240.878881] binder: 13752:13757 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.879000] binder: 13752:13757 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2240.879024] binder: 13752:13757 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.879032] binder: 13752:13757 got reply transaction with no transaction stack
[ 2240.879040] binder: 13752:13757 transaction failed 29201/-71, size 0-0 line 2922
[ 2240.882120] binder: undelivered TRANSACTION_ERROR: 29201
[ 2240.999751] binder: 13769:13772 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.999867] binder: 13769:13772 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2240.999893] binder: 13769:13772 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2240.999901] binder: 13769:13772 got reply transaction with no transaction stack
[ 2240.999911] binder: 13769:13772 transaction failed 29201/-71, size 0-0 line 2922
[ 2241.000093] binder: undelivered TRANSACTION_ERROR: 29201
[ 2241.108343] binder: 13782:13787 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2241.108467] binder: 13782:13787 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2241.108492] binder: 13782:13787 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2241.108500] binder: 13782:13787 got reply transaction with no transaction stack
[ 2241.108509] binder: 13782:13787 transaction failed 29201/-71, size 0-0 line 2922
[ 2241.108692] binder: undelivered TRANSACTION_ERROR: 29201
[ 2241.218782] binder: 13802:13804 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2241.218900] binder: 13802:13804 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2241.218925] binder: 13802:13804 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2241.218933] binder: 13802:13804 got reply transaction with no transaction stack
[ 2241.218943] binder: 13802:13804 transaction failed 29201/-71, size 0-0 line 2922
[ 2241.219120] binder: undelivered TRANSACTION_ERROR: 29201
[ 2241.340469] binder: 13815:13818 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2241.340583] binder: 13815:13818 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2241.340607] binder: 13815:13818 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2241.340614] binder: 13815:13818 got reply transaction with no transaction stack
[ 2241.340624] binder: 13815:13818 transaction failed 29201/-71, size 0-0 line 2922
[ 2241.344750] binder: undelivered TRANSACTION_ERROR: 29201
[ 2241.441568] binder: 13834:13836 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2241.441675] binder: 13834:13836 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2241.441699] binder: 13834:13836 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2241.441707] binder: 13834:13836 got reply transaction with no transaction stack
[ 2241.441718] binder: 13834:13836 transaction failed 29201/-71, size 0-0 line 2922
[ 2241.441909] binder: undelivered TRANSACTION_ERROR: 29201
[ 2241.564303] binder: 13841:13850 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 2241.564408] binder: 13841:13850 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 2241.564431] binder: 13841:13850 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 2241.564439] binder: 13841:13850 got reply transaction with no transaction stack
[ 2241.564447] binder: 13841:13850 transaction failed 29201/-71, size 0-0 line 2922
[ 2241.564623] binder: undelivered TRANSACTION_ERROR: 29201
[ 2241.573686] INFO: task init:19663 blocked for more than 140 seconds.
[ 2241.573691]       Not tainted 4.4.174+ #17
[ 2241.573694] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 2241.573714] init            D ffff8800b6fcf718 29280 19663      1 0x00000000
[ 2241.573727]  ffff8800b6fcf718 ffff8801d0342f80 c4c8057ad3501abb ffff8801d0342f80
[ 2241.573737]  0000000000000000 ffff8801d0343800 ffff8801db71f180 ffff8801db71f1a8
[ 2241.573747]  ffff8801db71e898 ffff8801d11ac740 ffff8801d0342f80 ffffed0016df9001
[ 2241.573749] Call Trace:
[ 2241.573765]  [<ffffffff82709b79>] schedule+0x99/0x1d0
[ 2241.573774]  [<ffffffff8270a333>] schedule_preempt_disabled+0x13/0x20
[ 2241.573783]  [<ffffffff8270c492>] mutex_lock_nested+0x3c2/0xb80
[ 2241.573793]  [<ffffffff81c8b2aa>] ? tty_open+0x56a/0xf50
[ 2241.573801]  [<ffffffff81b0ab03>] ? assoc_array_gc+0x1233/0x12e0
[ 2241.573810]  [<ffffffff8270c0d0>] ? mutex_trylock+0x500/0x500
[ 2241.573819]  [<ffffffff814801a3>] ? kmem_cache_alloc_trace+0x123/0x2d0
[ 2241.573827]  [<ffffffff81c8b2aa>] tty_open+0x56a/0xf50
[ 2241.573836]  [<ffffffff81c8ad40>] ? tty_init_dev+0x420/0x420
[ 2241.573844]  [<ffffffff814a3d5a>] ? chrdev_open+0xca/0x630
[ 2241.573862]  [<ffffffff81c8ad40>] ? tty_init_dev+0x420/0x420
[ 2241.573870]  [<ffffffff814a3ec0>] chrdev_open+0x230/0x630
[ 2241.573878]  [<ffffffff814a3c90>] ? cdev_put.part.0+0x50/0x50
[ 2241.573889]  [<ffffffff8149154f>] do_dentry_open+0x38f/0xbd0
[ 2241.573897]  [<ffffffff814b6d8e>] ? __inode_permission2+0x9e/0x250
[ 2241.573905]  [<ffffffff814a3c90>] ? cdev_put.part.0+0x50/0x50
[ 2241.573912]  [<ffffffff81494d3b>] vfs_open+0x10b/0x210
[ 2241.573920]  [<ffffffff814c4947>] ? may_open.isra.0+0xe7/0x210
[ 2241.573927]  [<ffffffff814c5ddf>] path_openat+0x136f/0x4470
[ 2241.573935]  [<ffffffff81483f86>] ? kasan_kmalloc.part.0+0xc6/0xf0
[ 2241.573944]  [<ffffffff814c4a70>] ? may_open.isra.0+0x210/0x210
[ 2241.573953]  [<ffffffff811ff5b0>] ? trace_hardirqs_on+0x10/0x10
[ 2241.573961]  [<ffffffff814ccab1>] do_filp_open+0x1a1/0x270
[ 2241.573969]  [<ffffffff814cc910>] ? user_path_mountpoint_at+0x50/0x50
[ 2241.573978]  [<ffffffff814f32ea>] ? __alloc_fd+0x1ea/0x490
[ 2241.573986]  [<ffffffff82717f6d>] ? _raw_spin_unlock+0x2d/0x50
[ 2241.573993]  [<ffffffff81495668>] do_sys_open+0x2f8/0x600
[ 2241.574000]  [<ffffffff81495370>] ? filp_open+0x70/0x70
[ 2241.574007]  [<ffffffff811ff385>] ? trace_hardirqs_on_caller+0x385/0x5a0
[ 2241.574014]  [<ffffffff8149599d>] SyS_open+0x2d/0x40
[ 2241.574022]  [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
[ 2241.574028] 1 lock held by init/19663:
[ 2241.574046]  #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81c8b2aa>] tty_open+0x56a/0xf50
[ 2241.574050] Sending NMI to all CPUs:
[ 2241.575347] NMI backtrace for cpu 0
[ 2241.575351] CPU: 0 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #17
[ 2241.575354] task: ffff8801da6f4740 task.stack: ffff8800001c0000
[ 2241.575357] RIP: 0010:[<ffffffff8109b617>]  [<ffffffff8109b617>] flat_send_IPI_mask+0xf7/0x1b0
[ 2241.575361] RSP: 0018:ffff8800001c7c88  EFLAGS: 00000046
[ 2241.575365] RAX: 0000000000000000 RBX: 0000000000000c00 RCX: 0000000000000000
[ 2241.575368] RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fc300
[ 2241.575372] RBP: ffff8800001c7cb8 R08: 0000000000000018 R09: 0000000000000000
[ 2241.575375] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000246
[ 2241.575379] R13: 0000000003000000 R14: ffffffff82e5f2e0 R15: 0000000000000002
[ 2241.575383] FS:  0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
[ 2241.575386] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2241.575390] CR2: 0000000000607304 CR3: 00000000b7d5c000 CR4: 00000000001606b0
[ 2241.575392] Stack:
[ 2241.575396]  0000000000000001 ffffffff82e5f2e0 ffffffff831a6ac0 fffffbfff0634c34
[ 2241.575400]  000000000001b6c0 0000000000000008 ffff8800001c7cd8 ffffffff81092bee
[ 2241.575403]  0000000000000008 ffffffff82924260 ffff8800001c7d30 ffffffff81ab8252
[ 2241.575405] Call Trace:
[ 2241.575409]  [<ffffffff81092bee>] nmi_raise_cpu_backtrace+0x5e/0x80
[ 2241.575412]  [<ffffffff81ab8252>] nmi_trigger_all_cpu_backtrace.cold+0xa1/0xae
[ 2241.575415]  [<ffffffff813ab1a4>] ? print_lock+0xa8/0xab
[ 2241.575418]  [<ffffffff81092b90>] ? irq_force_complete_move+0x330/0x330
[ 2241.575422]  [<ffffffff81092ca4>] arch_trigger_all_cpu_backtrace+0x14/0x20
[ 2241.575425]  [<ffffffff813b4762>] watchdog.cold+0xd3/0xee
[ 2241.575428]  [<ffffffff81309bec>] ? watchdog+0xac/0xa00
[ 2241.575431]  [<ffffffff81309b40>] ? reset_hung_task_detector+0x20/0x20
[ 2241.575434]  [<ffffffff811342c3>] kthread+0x273/0x310
[ 2241.575438]  [<ffffffff81134050>] ? kthread_create_on_node+0x4c0/0x4c0
[ 2241.575441]  [<ffffffff82718079>] ? _raw_spin_unlock_irq+0x39/0x60
[ 2241.575444]  [<ffffffff81159431>] ? finish_task_switch+0x1e1/0x660
[ 2241.575448]  [<ffffffff81159403>] ? finish_task_switch+0x1b3/0x660
[ 2241.575451]  [<ffffffff827081ff>] ? __schedule+0x7af/0x1ee0
[ 2241.575454]  [<ffffffff827081f3>] ? __schedule+0x7a3/0x1ee0
[ 2241.575457]  [<ffffffff827081ff>] ? __schedule+0x7af/0x1ee0
[ 2241.575460]  [<ffffffff81134050>] ? kthread_create_on_node+0x4c0/0x4c0
[ 2241.575463]  [<ffffffff82718fc5>] ret_from_fork+0x55/0x80
[ 2241.575467]  [<ffffffff81134050>] ? kthread_create_on_node+0x4c0/0x4c0
[ 2241.575474] Code: 00 c3 5f ff 80 e6 10 75 e1 41 c1 e5 18 44 89 2c 25 10 c3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 c3 5f ff <41> f7 c4 00 02 00 00 75 1e 4c 89 e7 57 9d 0f 1f 44 00 00 e8 f1 
[ 2241.575477] NMI backtrace for cpu 1
[ 2241.575480] CPU: 1 PID: 469 Comm: udevd Not tainted 4.4.174+ #17
[ 2241.575483] task: ffff8800b8eec740 task.stack: ffff8801d6530000
[ 2241.575487] RIP: 0010:[<ffffffff812009a2>]  [<ffffffff812009a2>] __lock_acquire+0x13f2/0x4f50
[ 2241.575490] RSP: 0018:ffff8801d6537860  EFLAGS: 00000046
[ 2241.575494] RAX: 0000000000000000 RBX: 000000000000029f RCX: 0000000000000000
[ 2241.575498] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8800b8eecfd4
[ 2241.575501] RBP: ffff8801d65379d8 R08: 0000000000000001 R09: 1ffff100171dda05
[ 2241.575504] R10: ffffffff82836880 R11: 0000000000000000 R12: ffff8800b8eec740
[ 2241.575508] R13: ffff8800b8eed030 R14: 0000000000000002 R15: 0000000000000000
[ 2241.575512] FS:  00007f074297b7a0(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
[ 2241.575515] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2241.575519] CR2: 00000000091fa1b4 CR3: 00000001d7371000 CR4: 00000000001606b0
[ 2241.575521] Stack:
[ 2241.575524]  ffff8801d1105400 ffff8801da402140 ffff8801d1104400 ffffffff81ab5c21
[ 2241.575528]  ffff8801d6537ac0 ffffffff8148488a 000000400000000d ffff8801d65378a8
[ 2241.575532]  ffff8800b8eed048 ffff8800b8eed000 ffff8800b8eed050 ffffffff00000000
[ 2241.575534] Call Trace:
[ 2241.575537]  [<ffffffff81ab5c21>] ? kobject_uevent_env+0x251/0xba0
[ 2241.575540]  [<ffffffff8148488a>] ? kasan_slab_free+0x11a/0x190
[ 2241.575543]  [<ffffffff816152ce>] ? sysfs_kf_write+0x10e/0x160
[ 2241.575546]  [<ffffffff811ff5b0>] ? trace_hardirqs_on+0x10/0x10
[ 2241.575550]  [<ffffffff812aef8c>] ? is_module_text_address+0x2c/0x50
[ 2241.575553]  [<ffffffff81205f6e>] lock_acquire+0x15e/0x450
[ 2241.575556]  [<ffffffff8156cb72>] ? inotify_poll+0xa2/0xf0
[ 2241.575559]  [<ffffffff8156cb72>] ? inotify_poll+0xa2/0xf0
[ 2241.575562]  [<ffffffff8270c191>] mutex_lock_nested+0xc1/0xb80
[ 2241.575566]  [<ffffffff8156cb72>] ? inotify_poll+0xa2/0xf0
[ 2241.575569]  [<ffffffff8270c0d0>] ? mutex_trylock+0x500/0x500
[ 2241.575572]  [<ffffffff811ff5b0>] ? trace_hardirqs_on+0x10/0x10
[ 2241.575575]  [<ffffffff811ff385>] ? trace_hardirqs_on_caller+0x385/0x5a0
[ 2241.575579]  [<ffffffff8156cb72>] inotify_poll+0xa2/0xf0
[ 2241.575582]  [<ffffffff8156f4ab>] ep_send_events_proc+0x36b/0xa60
[ 2241.575585]  [<ffffffff8156f140>] ? ep_read_events_proc+0x540/0x540
[ 2241.575589]  [<ffffffff8271802a>] ? _raw_spin_unlock_irqrestore+0x5a/0x70
[ 2241.575592]  [<ffffffff811ff385>] ? trace_hardirqs_on_caller+0x385/0x5a0
[ 2241.575595]  [<ffffffff8156f140>] ? ep_read_events_proc+0x540/0x540
[ 2241.575598]  [<ffffffff8157174a>] ep_scan_ready_list+0x20a/0x890
[ 2241.575601]  [<ffffffff81571540>] ? ep_poll_safewake+0x70/0x70
[ 2241.575604]  [<ffffffff8271802a>] ? _raw_spin_unlock_irqrestore+0x5a/0x70
[ 2241.575607]  [<ffffffff811ff385>] ? trace_hardirqs_on_caller+0x385/0x5a0
[ 2241.575609]  [<ffffffff81571fb7>] ep_poll+0x157/0xae0
[ 2241.575612]  [<ffffffff814fbc30>] ? mnt_get_count+0x180/0x180
[ 2241.575616]  [<ffffffff814ddef1>] ? dput.part.0+0x171/0x770
[ 2241.575619]  [<ffffffff814dddaa>] ? dput.part.0+0x2a/0x770
[ 2241.575622]  [<ffffffff81571e60>] ? ep_poll_readyevents_proc+0x90/0x90
[ 2241.575625]  [<ffffffff8112f3a1>] ? task_work_run+0x251/0x2b0
[ 2241.575628]  [<ffffffff8123a761>] ? debug_lockdep_rcu_enabled+0x71/0xa0
[ 2241.575632]  [<ffffffff814f20e3>] ? __fget_light+0xa3/0x1f0
[ 2241.575635]  [<ffffffff81575ff6>] SyS_epoll_wait+0x166/0x1f0
[ 2241.575638]  [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
[ 2241.575646] Code: 08 84 d2 0f 85 e0 30 00 00 8b 05 3a e3 13 02 85 c0 0f 8f 8d 20 00 00 80 05 0b be dd 02 02 e9 ef f8 ff ff 85 d2 0f 85 2a 03 00 00 <49> 8d bc 24 b4 08 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 
[ 2241.575766] Kernel panic - not syncing: hung_task: blocked tasks
[ 2241.575775] CPU: 0 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #17
[ 2241.575784]  0000000000000000 90c0850a03137dbf ffff8800001c7c60 ffffffff81aad1a1
[ 2241.575794]  ffff8801d0342f80 ffffffff82872120 dffffc0000000000 0000000000000003
[ 2241.575803]  00000000003ffedb ffff8800001c7d40 ffffffff813a48c2 0000000041b58ab3
[ 2241.575805] Call Trace:
[ 2241.575814]  [<ffffffff81aad1a1>] dump_stack+0xc1/0x120
[ 2241.575823]  [<ffffffff813a48c2>] panic+0x1b9/0x37b
[ 2241.575831]  [<ffffffff813a4709>] ? add_taint.cold+0x16/0x16
[ 2241.575839]  [<ffffffff81af10f4>] ? find_next_bit+0x44/0x50
[ 2241.575848]  [<ffffffff81ab8046>] ? nmi_trigger_all_cpu_backtrace+0x3c6/0x490
[ 2241.575866]  [<ffffffff81ab8046>] ? nmi_trigger_all_cpu_backtrace+0x3c6/0x490
[ 2241.575874]  [<ffffffff813b4773>] watchdog.cold+0xe4/0xee
[ 2241.575881]  [<ffffffff81309bec>] ? watchdog+0xac/0xa00
[ 2241.575889]  [<ffffffff81309b40>] ? reset_hung_task_detector+0x20/0x20
[ 2241.575897]  [<ffffffff811342c3>] kthread+0x273/0x310
[ 2241.575906]  [<ffffffff81134050>] ? kthread_create_on_node+0x4c0/0x4c0
[ 2241.575913]  [<ffffffff82718079>] ? _raw_spin_unlock_irq+0x39/0x60
[ 2241.575920]  [<ffffffff81159431>] ? finish_task_switch+0x1e1/0x660
[ 2241.575926]  [<ffffffff81159403>] ? finish_task_switch+0x1b3/0x660
[ 2241.575934]  [<ffffffff827081ff>] ? __schedule+0x7af/0x1ee0
[ 2241.575941]  [<ffffffff827081f3>] ? __schedule+0x7a3/0x1ee0
[ 2241.575948]  [<ffffffff827081ff>] ? __schedule+0x7af/0x1ee0
[ 2241.575957]  [<ffffffff81134050>] ? kthread_create_on_node+0x4c0/0x4c0
[ 2241.575964]  [<ffffffff82718fc5>] ret_from_fork+0x55/0x80
[ 2241.575972]  [<ffffffff81134050>] ? kthread_create_on_node+0x4c0/0x4c0
[ 2241.576293] Kernel Offset: disabled
[ 2253.323235] Rebooting in 86400 seconds..