last executing test programs: 52.722996117s ago: executing program 3 (id=177): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000002c0)={0x18, 0x3, r2, r3, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000280)}) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000100)={0x30, r4, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0}) 52.332861849s ago: executing program 3 (id=181): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x44, 0x4, 0x2}, 0x50) socketpair(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000005c0)={r0, &(0x7f00000003c0), &(0x7f0000000580)=@tcp=r2}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r0, &(0x7f00000003c0)="01b4", &(0x7f0000000300)=@tcp=r1, 0x1}, 0x20) r3 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000380)={r0, &(0x7f0000000600), &(0x7f0000000340)=@udp6=r3, 0x1}, 0x20) 52.047253747s ago: executing program 3 (id=186): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x80800) ioctl$HIDIOCSREPORT(r1, 0x400c4808, &(0x7f00000000c0)={0x2, 0x1, 0x64a}) 49.810069227s ago: executing program 3 (id=202): syz_mount_image$minix(&(0x7f0000000080), &(0x7f00000001c0)='./file1\x00', 0x8, &(0x7f0000000480)=ANY=[@ANYBLOB="0049cef4df796851925f86c004000000e4cf62dc777d55387afc4a70d087ede499a199c4d7e87a07cdb3e45fc513a1f97b0b9047144790d8f3affa2044cbd987208cf1dcd4ec17f5138b1f4efbdc2a7be39782db000000000000002c2e5cf00c404f4a3246fb740282b4265c2c2c686173682c00181f302d7cd22530b02054463a3dd16b847ce0f9c3bd119a1498eb8cc1ae04dee8bfa77d492c96fd54cb0abb83366c6b4d4785b8103b6ea5ce14afc0ebaae0f62832e93c0cd17b2130111d313bea3d9ab4738453538e448d770b602e104974e6cd92f7d589103fde2331f870b425e8776f9e2152dec6551ec1f61ced64b19c9e56"], 0x5, 0x18e, &(0x7f0000002780)="$eJzs299ummAYx/EfCurcZtzcTpYdkOxgO5lOzf54tt3DbsAoM0ZcTe2JpknTi+gF9KwXV5P2BmoDERqxTRMrYPX7OeLHI/CivviQiADsLVu2DBmyvPCxUD6pGGkPCUBC5pJu5gD2U/bq3rXetQHATpv9kUaSLq+PO8pa0fbgrCTpd1DP5FZeMDuVPpiLupFXIdpfnEufg+2NF6sNSFkqhvXiStnb/5dPwfFf6pVeqyTvHuWN3i7q3XD7909th4C9YqgazUsrMvrXd51vYbb8XA9zzs+NSG6GOe/naufA7cZ1CgDWlHlk/mcj89+MzH8Az9d4Mh20Xdc53N4Fw5S2YBiT6SDJYeQkxX8sO8n30FY6H1xw15n692ejC+ZG9nNhPVRK+cIEIHa1o+GoNp5Mv/aH7Z7Tc/43fjVaP5rf6z9bNb/zz2up/wewO+5+9NMeCQAAAAAAAAAAAAAAWFdF79IeAgAAAICE+P///RvvE0tpnyMAAAAAAAAAAAAAAAAAAACwK24DAAD//3/aFdo=") r0 = creat(&(0x7f0000000300)='./bus\x00', 0x0) mount(&(0x7f0000000440)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x400, 0x0, 0x0, 0x1, 0x0, "ef35af413bb901527fe4d0ce5d29c3ee5e5c3676345a41499db7aac63a01000000000000004faa2ae2c084a0ea0000000000000000000c00002000", "036c47c67808200400000000000000335263bdbcef549ba197fce47ddfdd753abd950100002a00ffffffffffffffff00000000e8f20000000200", "b7326736181c208220000000b9000000000000000000f0fffffffff2ff00", [0x4]}) fdatasync(r0) 49.306898175s ago: executing program 3 (id=208): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000f1ffffff0000000000100000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000340)='io_uring_register\x00', r0, 0x0, 0x6}, 0x18) r1 = io_uring_setup(0x4928, &(0x7f00000004c0)={0x0, 0x108b899, 0x10, 0x0, 0x237}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.stat\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000001, 0x12, r2, 0x0) io_uring_register$IORING_REGISTER_FILE_ALLOC_RANGE(r1, 0x19, &(0x7f0000000000)={0x80, 0xfffffffb, 0x5}, 0x0) 48.77951695s ago: executing program 3 (id=213): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000080)={0x8}, 0x1) sendto$inet6(r0, &(0x7f0000000400)='j', 0x1, 0x2040, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r0, 0x1) 48.224045214s ago: executing program 32 (id=213): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r0, 0x84, 0x15, &(0x7f0000000080)={0x8}, 0x1) sendto$inet6(r0, &(0x7f0000000400)='j', 0x1, 0x2040, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r0, 0x1) 26.003457084s ago: executing program 2 (id=374): prctl$PR_SET_SECUREBITS(0x1c, 0x1d) setuid(0xee01) setresgid(0x0, 0xee00, 0x0) r0 = semget$private(0x0, 0x4, 0x29b) semop(r0, &(0x7f0000000180)=[{0x0, 0x203}, {}], 0x2) semctl$GETNCNT(r0, 0x4, 0xe, 0x0) 25.060043813s ago: executing program 2 (id=383): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000002, &(0x7f0000000080), 0x1, 0x560, &(0x7f0000000b00)="$eJzs3d9vW1cdAPDvvYnjrOuaFvYAE9ACg4Kq2o27VdNetr6A0DQJMfGAeOhC4kahdl1qZyyhEtnfMCSQeII/gQckHpD2xANvPCLxgJDGA1KBCtQigWR0rx3XS5zFm39t8ecj3d577vE933Oa2Of4OL4ngLl1ISL2ImIpIl6PiJXu+aS7xcudLXvcwwf31h89uLeeRLv92j+SPD87l19QfFzmk90ylyPiW1+P+F5yOG5zZ/fWWq1WvdtNl1v1O+Xmzu7lrfraZnWzertSubZ67coLV5+vjK2t5+u/uv+1rVe+/dvffPbdP+x99UdZtU5383rtGLNO0wu9OJnFiHhlEsFmYKG7X5pxPfhw0oj4RER8IX/+r8RC/tsJAJxk7fZKtFf60wDASZfmc2BJWoqINO0OAkqdObyn41RaazRbl242tm9vdObKzkYhvblVq145V/zTD/IHF5IsvZrn5fl5unIgfTUizkXET4pP5OnSeqO2MZshDwDMvSf7+/+I+HcxTUuloS4d8KkeAPCxsTzrCgAAU6f/B4D5o/8HgPkzRP/f/bB/b+J1AQCm44O9/z8zsXoAANNj/h8A5o/+HwDmyjdffTXb2o+697/eeGNn+1bjjcsb1eatUn17vbTeuHuntNlobOb37KkfV16t0biz+lxsv1luVZutcnNn90a9sX27dSO/r/eNamEqrQIA3s+58+/8MYmIvRefyLfoW8tBXw0nWzrrCgAzszDKxQYI8LFmtS+YX0N14fkg4fcTrwswGwNv5r088PC9ftbZvT1MEH9nBB8pFz89/Py/NZ7hZDH/D/Prw83/vzT2egDTZ/4f5le7nRxc83+plwUAnEgj/Alf+8fjGoQAM3XcYt7Hff4PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8+h0RHw/krSUrwWeZv+mpVLEUxFxNgrJza1a9UpEnInzEVEoZunVWVcaABhR+reku/7XxZVnTx/MXUr+U8z3EfHDn7/20zfXWq27q9n5f/bOF/eXD6s8vm6EdQUBgDHL++9Kd9/3Rv7hg3vr+9vgKxcnUp/71+N/3aWI1x89uJdv+/GykxHL+Vji1L+SXg2WI+KZiFgYQ/y9tyLiU4Pan+RzI2e7K5/2x49u7KfGFT+JJI6Nn74nfprndfbZ4OuTY6gLzJt3rkfEy4Oe/2lcyPeDn//LY3pFvH+9U9j+a9+jvviL3UgLA+Jnz/kLw8Z47nffOHSyvdLJeyvimcVB8ZNe/OSI+M8OGf/Pn/nc2y8dkdf+RcTFGBy/P1a5Vb9Tbu7sXt6qr21WN6u3K5Vrq9euvHD1+Uo5n6Mu789UH/b3Fy+dOapuWftPHRF/eWD7l3rXfmnI9v/yv69/9/OPk8WD8b/yxcE//6cHxu/I+sQvDxl/7dSvj1y+O4u/cUT7j/v5Xxoy/rt/3d0Y8qEAwBQ0d3ZvrdVq1bsjHWTvQsdRzqGDrIrDPXh/uDha0L/EJFox7MGByhcm9b868YPF3lhxvCV/JytxQFa6/0uSvVV6/3KW4qisxRh4VTr2Vox08HBasWb3mgRMR1/nAwAAAAAAAAAAAAAAfEQd/32gwuhfawMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAJ+X8AAAD//7xIx1c=") r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='.\x00', 0x0, 0x0) getdents64(r1, &(0x7f0000000f80)=""/4096, 0x1000) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) 23.896314406s ago: executing program 2 (id=400): symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') r0 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='.\x00', 0x0, 0x0) renameat2(r1, &(0x7f00000001c0)='./file0\x00', r1, &(0x7f0000000200)='.\x02\x00', 0x4) renameat2(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', r1, &(0x7f00000000c0)='.\x02\x00', 0x2) 23.352349016s ago: executing program 2 (id=406): unshare(0x28040680) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000280)='./file0\x00', &(0x7f0000000000)='./file0/../file0\x00') 23.084955851s ago: executing program 2 (id=411): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) syz_mount_image$f2fs(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x8, &(0x7f0000005880)=ANY=[@ANYBLOB="6e6f646973636172642c6e6f636865636b706f696e745f6d657267652c616c6c6f635f6d6f64653d64656661756c742c6163746976655f6c6f67733d362c757365725f78617474722c6661756c745f696e6a656374696f6e3d30303030303030303030303030303030303031362c646973636172642c6e6f61636c2c6673796e635f6d6f64653d706f7369782c616c6c6f635f6d6f64653d64656661756c742c6e6f657874656e745f63616368652c6163746976655f6c6f67733d322c6661756c745f747970653d30303030303030303030303031363737373231342c0084538367d8b9c04bebbf0f4ea4d5617c063f0a30b5325e5d939d497829d8452e38794f1563bf34cdaaf9b70591db2f2a066e339d0c0b7c189bac05d8e91e9d1f4670d79a57f83b67f1f98b905d3b06be7de7829439d0b21d1744d7fad3fe3f3f9b3361f4bfa2c2e375c048af0d6ecac62d07c6a85e2558b9e8639b050137830520aea2c9243f9f9eca12969def7d15c8bac687164c38cf349d738c"], 0x1, 0x5512, &(0x7f0000005a00)="$eJzs3L1vG2UYAPDHSdM2bSkRYmDrSRVSItVWnI8KtgCt+BCpogIDEzi2Y7m1fVHsOCETAyNi4D9BIDEx8jcwMLMhBhAbEsh3F2j4qBB1YpL8ftL5uXvv9XPPa0WRnjvLAZxbc8nPP5biesxGxHREXIvI9kvFllnLw3MRcSMiph7ZSsX47wMXI+JKRFwfJc9zlopTn94a3lz94Y2fvvrm0oWrn3357eRWDUza8xHR3c7397p5TFt5fFCM14btLHZXhkXMT3QfFsdpHveam1mGvdrhvFoWl1v5/HR7tz+KW51afRRb7a1sfLuXX7A/bB3myd7woLaTHTeam1ls99Mstg7yuvYP8v9tB/1BnqdR5PsgSx+DwWHMx5v7zXw92w+zWO8NivE8b9po7o/isIjF5aKedhpZHZtP8kn/v73Z7u3uJ8PmTr+d9pLVSvWFSvV2ubqTNpqD5kq51m3cXknmW53RtPKgWeuutdK01WlW6ml3IZlv1evlajWZv9PcbNd6SbVaWa4sllcXir1byav33kk6jWR+FF9u93YH7U4/2Up3kvwdC8lSZfnFheRmNXlrfSPZuH/37vrG2+/deffeS+uvv1JM+ktZyfzS4tJSubpYXqounKP1f1QUPcb1wxMpTboAgNNH/w8ci9nHnz6+/n/nfsTx9/+h/x+LU9X/Pqb//69tyFlZP0yE/h8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Nz6bubz17Kdufz4ajH+VDH0THFcioipiPj1b0zHxSM5p4s8M/8wf+ZPNXxdiizD6BqXiu1KRKwV2y9PH/enAAAAAGfXFx/e+CTv1vOXuUkXxEnKb9pMXXt/TPlKETEz9/2Ysk2NXp4dU7Ls7/tC7I8pW3YD6/KYkuW33C6MK9u/Mn0kXH4klPIwdaLlAAAAJ+JoJ3CyXQgAAAAn6eNJF8BklOLwUebhs+Dsm/d/PBCcPXIEAAAAnEKlSRcAAAAAHLus//f7fwAAAHC25b//BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/MbO/dwmDkRxAH42eGH/adFq79vK3qCMLWGPe4woIE1QQA6khTRADeSWEiKI8DgEIg6RPLaV6PskZzKW+fEGwWFmpAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAu3Vfrxe3V7+u2Obt9O3lGAwAAAFyyrdaL+p9Z6n9t7n9vbv1s+kVElBFxae4+ik9nmaMmp3p5/ub0+epVDXcRdcLhPSbN9SUi/jTX44+uPwUAAAD4uDbL1TzN1tOf2dAF0ae0aFN++5spr4iIavaQKa085P3KFFZ/v8fxP1NavYA1zRSWltzGudLepP65H1ftpidNkZry4suORWYbOwAA0KPRWdPvLAQAAIA+/Ru6AIZRxPNW5nErcJKaZnvv81kPAAAAeIeKoQsAAAAAOlfP/3s6/2/v/D8AAAAYRjr/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgC5tq/Vis1zN2+bs9u3kGQ0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDE/ryrUAgDMADNffjapN/rx0tAV1eXc6CQJnQoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATz7XyfcOv4Y9yb9tw9R6JJmTHL0sndqsnRu2PhgvfwYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABO9uclBUIgCKJgzvjfSd//sJKgZxAhAhoeVdSiAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+KTf/fJ/YmqcSeZOG0vHI8naVWPrqrH3oHH0YLz9GwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudu7nNY4qDgD4d2Z2trYqxig5RETBg15suq2tvYkHJXjwTxBCuq2xW3+0OdhSxFy8Sc69iB5FBCXe+j/03EIv9dbDHip4jszsTHbaFFx/dGbbfD7w5n13GOZ93yyEfOe9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACojd+dxllxWJjEaXXu5r2r60V/64G+cH379nLRijhpM+nHw8vND8lSd4kAAABwcGR1fR8Rd/Kd1aJPF8r6P6+vKWr+75+dxHU9/2DdX/d17V+03369++LeQAuTcYqbnt0YDY/tT6X36GY535772yt65ZMv371k5ReSfrD1wjgvn2fy7Y0b7/XL8FAb2QIA/8bRuq+C+vehoh90mRgAB0avUXjX9X+20G1OAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG0Yb8XTdZxExHJvGhdu3bu6/rD++vbt5bqdunZtO76e3rO4RR4RZzdGw2Otzma+Xbp85fzaaDS82H7wSkR0Nfo71fTPfzTDxRGdPB/B/xSk1Zc9L/k8HkGHP5QAAHgi5VUr6vo7+c5qcS5ZjNj94f76//VGHDPW/3c/PnWzOVaz/h+0NsP5t7J54fOVS5evvLlxYe3c8Nzw07eOD94enDh98uTplfJdyYo3JgAAAPw3/ao16/90cf/6/5FGHDPW/198N/iqOVam/o/Y3d13arro10lGAAAAVJ5/9c8/koecT/r9+HJtc/PiYHLc+3x8cuwg1X/sUNWa9X+22HVWAAAAQBvGW8l96/9nGnHMuP7/zI8v/dy8ZxYRh6v1/6Prn43OtDedudbGnxN3PUcAAAC6dbhqzfX/vNz/n+5teUgj4o3XJnH1bwBnqv+z97/5qTlWc///ifamOJfSpcnzKPuliN5S1xkBAADwJHuqakWx/3u+s/rJL0c+7Nv/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANC2vwIAAP//3rpBAw==") r0 = open(&(0x7f0000000240)='./file1\x00', 0x145142, 0x189) lsetxattr$security_capability(&(0x7f0000000080)='./file1\x00', &(0x7f00000000c0), 0x0, 0x0, 0x0) write$bt_hci(r0, 0x0, 0xb) 22.097056174s ago: executing program 2 (id=415): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000180)="a1818f", 0x3}], 0x1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000740)=[0x2], 0x0, 0x0, 0x1}}, 0x40) 21.28857096s ago: executing program 33 (id=415): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) writev(r0, &(0x7f0000000100)=[{&(0x7f0000000180)="a1818f", 0x3}], 0x1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000740)=[0x2], 0x0, 0x0, 0x1}}, 0x40) 17.003064309s ago: executing program 1 (id=455): r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000240)={0x84, @multicast2, 0x4e22, 0x3, 'sed\x00', 0x7, 0x400000, 0x68}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @empty, 0x4e23, 0x3, 'lc\x00', 0x8, 0x323b, 0x55}, {@rand_addr=0x64010100, 0x4e23, 0x4, 0x44, 0x12d5c, 0x12d5c}}, 0x44) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 16.813972062s ago: executing program 1 (id=458): socket$packet(0x11, 0x3, 0x300) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040bd28090900000000000109022400cc0000000009040000020310000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000000c0)={0x18, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\a'], 0x0, 0x0, 0x0, 0x0}, 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) 14.359110574s ago: executing program 1 (id=470): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000300000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000001700)=ANY=[@ANYBLOB="160000000000000061b1000002"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2, 0xffffffffffffffff}, 0x0, &(0x7f0000000040)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000200)={r3, 0x0, &(0x7f0000001780)=""/4096}, 0x20) 14.155090316s ago: executing program 1 (id=474): r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x1) r2 = openat(r1, &(0x7f0000000040)='.\x00', 0x0, 0x1) lseek(r2, 0x3, 0x1) getdents64(r2, 0x0, 0x22) 14.008564685s ago: executing program 1 (id=476): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSKBENT(r0, 0x4b47, &(0x7f0000000000)={0x0, 0xab, 0xc8f6}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='.\x00', 0x0, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r1, 0x80045518, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000280)=0x20) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000001c0)) 13.933213852s ago: executing program 1 (id=479): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) dup(r0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder1\x00', 0x1002, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@ipv4={'\x00', '\xff\xff', @loopback}, 0x20801, 0x0, 0x3, 0x5, 0xfffd, 0x3}, 0x20) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_usb_connect$uac1(0x3, 0xa4, &(0x7f0000000040)=ANY=[@ANYBLOB="2a01000020000040b708000000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3ff000005024524", @ANYRES8=r1, @ANYBLOB="05"], 0x0) 7.995355735s ago: executing program 5 (id=508): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) futex(0x0, 0xd, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000)=0x2000800, 0x300) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) 4.869122228s ago: executing program 5 (id=520): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x56a, 0x331, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x4f8}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x4}}}}}]}}]}}, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$packet(0xffffffffffffffff, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x14) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 4.456804932s ago: executing program 6 (id=523): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f00000000c0)=@ccm_128={{0x304}, "a801e6bda44feb02", "1b3a12962ce1da1b06c78fea8a5d2834", '\x00', "9ecd950160c1e2e3"}, 0x28) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(0xffffffffffffffff, 0x84, 0x15, &(0x7f00000000c0)={0x9}, 0x1) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) 4.356520101s ago: executing program 6 (id=524): r0 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4043, 0x1ff) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) read$FUSE(r0, &(0x7f0000000640)={0x2020}, 0x2020) execve(&(0x7f0000000180)='./file1\x00', 0x0, &(0x7f00000002c0)={[&(0x7f0000000940)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94u\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x8c\x06\xcd\x8b\xcd\t\x01', &(0x7f0000000440)='\x7f\xb7\xc3\x7f\xa5a\xd6A*c\x9b\xd8R\xf02b\xefA|uiWb\x8f\xee\x1c\xc5\xdb^\x11\x16h\x83\x94y\x89\xf1Y{\x87\xd5\xf3\xccMr\xc5\xbdT\x9e\xc4\x84\x06\xcd\x8b\xcd\t\x01\xb4\xb6K~\xf2\xdf/Wc\xf8-\t\x15|a\xd3\xdc\x97\xa8T\xb4\x83@~\x99\xc2 \xf24\xe3>\xc3\xfcW\xf9\xda\xee+\x17\xf7\x9cv)D2\xeay\x006\xf9\xa4\x8f\x82W1\xea\xf5\x88\x93\x16\xb2\x84T\x1d\xc1\x8f\x9c\x1b*_\xd0\x8e\x85\r\xa9\"\x05\x1aP\xa7E:\xe4\xba3\xff\x9c\"8i\x7f+I\xcb\xfe]!\xf3\xac\x80\x04\x9e\x02\xe3#\xda\xaa\xd7\xcd\x9c\xd2\x99\xb3\x81\x0e\xdc\xb8\x89\x17tH\xd5\xe2fR\xce\xa9\x8c\xd4\xdf\xe8U@+D\xdf\x16\xb2\x14\xef\xd3}\xa0\xbd\xdfa\x81\x7f\xca3\ax\xa5\x89\xa3R]\xe9\xfc\xec@\x83\xc1\x10\xdc/\x85\xd8\tK =\x99>\x8a`\xae\x9d\x90,\x83\xfeoiA\xa7C\xbcg&.\xbdm\xf3\xf6\x18Uk\xd60x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000002c0)={0x1, &(0x7f0000000200)=[{0x36, 0x0, 0x0, 0x4}]}, 0x8) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_LINK_TIMEOUT={0xf, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) 2.742669015s ago: executing program 5 (id=538): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x75}, @ringbuf_output={{}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r0 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x15523ea56aa22b9a, 0x0, 0x0, 0x0, 0x12345}) io_uring_enter(r0, 0x39d0, 0x40000000, 0x0, 0x0, 0x0) 2.60913138s ago: executing program 4 (id=539): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f00000000c0)=0x6382, 0x4) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000000080)=0x1, 0x4) sendmmsg$inet6(r0, &(0x7f00000002c0)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0x0, @loopback, 0x8}, 0x1c, 0x0}}], 0x1, 0x40000) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) recvmmsg(r0, &(0x7f0000000940)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000001f80)=""/129, 0xfffffffffffffcea}, 0x5}], 0x1, 0x40002042, 0x0) 2.335801507s ago: executing program 4 (id=540): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000340)='I', 0x1, 0x4c001, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9025a01c95d4a068ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 2.30037622s ago: executing program 5 (id=541): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) write(r0, &(0x7f0000000180)="2cd889f0", 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)=[0x3], 0x0, 0x0, 0x1}}, 0x40) 2.009237643s ago: executing program 5 (id=542): syz_mount_image$jfs(&(0x7f0000000000), &(0x7f0000000080)='./bus\x00', 0x4000, &(0x7f0000000040)=ANY=[], 0xff, 0x60c7, &(0x7f00000013c0)="$eJzs3U1vHVf9B/DfffC147RpVP1V5R+xcFMeWkrznEB5asqCBSxAQl2TyHWrlBRQEhCtIuLKC8QGeAmw6YZFJV4BL6CvASGxJVLSVReUQWOf44xvrn3tJp659vl8pJuZ35w7vmfyveOZ65m5EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA/OD7PznXi4irv04Tjkc8FYOIfsSRul6KeuRKfv4wIk7EenM8FxGD+Yh6/vV/nom4GBEfH4u4/+DOcj35/C77cens7Zuf/fB7//jdH9dOvPPmTz8cb//x/1346Pd3I47/6NWPPrv7ZJYdAAAASlFVVdVLH/NPps/3/a47BQC0Im//qyRPV6vVavUTrf/Q38vznzradX/Vh7Ruqia72ywiYrU5T73P4HA8ABwwq/Fp112gQ/Iv2jAijnbdCWCm9bruAPvi/oM7y72Ub6+5PVjaaM9/p9yS/2pv8/qO7YbTjJ9j0tb7ay0G8ew2/TnSUh9mSc6/P57/1Y32UXrefufflu3yH21c+lScnP9gPP8xW/L/U0Qc2Pz7E/MvVc5/uJf8VwcHeP2XPwAAAAAAh1/++//xjo//zj/+ouzKTsd/l1rqAwAAAAAAAAA8aY97/79N7v8HAAAAM6v+rF7787GH07b7LrZ6+hu9iKfHng8UZqnx5YAAAAAAAAAAAAAAQDuGEYvpvP65iHh6cbGqqvrRNF7v1ePOf9CVvvxQsq5/yQMAwIaPj41dy9+LWIiIN9J3/c0tLi5W1VxELFZH5vP+7Gh+oTrS+Fybh/W0+dEudoiHo6r+YQuN+ZqmfV6e1j7+8+rXGlWDXXSsHR0GDgARsbE1um+LdMhU1TPR9V4OB4P1//Cx/rMbXb9PAQAAgP1XVVXVS1/nfTId8+933SkAoBV5+z9+XECtVquLqT/ZmDgz/VGr97Fuqia72ywiYrU5T73P4Hb8AHDArManXXeBDsm/aMOIONF1J4CZ1uu6A+yL+w/uLPdSvr3m9mBpoz2fC7Il/9Xe+nx5/knDacbPMWnr/bUWg3h2m/4811IfZknOvz+e/9WN9nyL/818FvYn/7Zsl3+9nMc76E/Xcv6D8fzH7Pf635a16E/Mv1Q5/+Ge8h/IHwAAAAAAZlj++/9xx3/zIgMAAAAAAADAgXP/wZ3lfN1rPv7/hQnP6zXHXP95aOT8e7vO3/W/h0nOvz+e/9gJOYPG+L3XH+b/yYM7yx/e/vf/5+HM5z83GNWvPdfrD4bpnJ9q7q24HjdiJc4+8vzhlvZzj7TPbWk/P6X9wiPto7r9SG4/Hcvxi7gRb262z085MWphSns1pT3nP7D+FynnP2w86vwXU3tvbFi790H/kfW+OZz0Olf++p8vP7p2tWG4pVqLweayNRyr/znVWp8eWv8/OTqKX91auXn6N9du3755LtJgy9TzkQZPWM5/Lj1y/i++sNGef+8319d7H4z2nP+sWIvhpPzX398vNMbr5X2p5b51Iec/So+cf94CTV7/D3L+E9f/9eV7uYP+AAAAAAAAAAAAAAAAwE6qqlq/RPRKRFxO1/90dW0mANCuvP2vkjxdre6g/tffZqs/arVavbXuzVh/PkfdVE32WrOIiL8356n3GX476YcBALPsvxHxz647QWfkX7D8fX/18ItddwZo1a333v/ZtRs3Vm7e6ronAAAAAAAAAMDnle//udS4//P6eUBj943ecv/X12PpwN7/sz8arN/rPC3Q87Hz/b9Pxc73/x5Oeb25Ke2jKe3zU9oXprRPvNCjIef/fMo4538yLVhJ9399sYP+dC3nfyrd6znn/5Wx5zXzr/5ykPPvb8n/zO13f3nm1nvvv3L93Wtvr7y98vNzZy9fvHDp4oVLl868df3GytmNfzvs8f7K+ed7XzsPtCw5/5y5/MuS8/9SquVflpT/5m6o/MuS1/+8vyf/suT882cf+Zcl5/9SquVflpz/V1Mt/7Lk/F9OtfzLkvP/WqrlX5ac/yupln9Zcv6nUy3/suT8z6Ra/mXJ+ecjXPIvS84/n9kg/7Lk/M+nWv5lyflfSLX8y5Lzv5hq+Zcl538p1fIvS87/cqrlX5ac/9dTLf+y5Py/kWr5lyXn/2qq5V+WnP83Uy3/suT8v5Vq+Zcl5//tVO+U/zst9ot25Py/k2rrf1ly/t9NtfzLkvN/LdXyL8vD7/83sueRxdnoRpsjVRUxA90wsu8jXf9mAgAAAAAAAAAAAADGtXE6cdfLCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwP/YgQMBAAAAACD/10aoqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwg4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRX27jVGrrO+H/izV6+TQPwnIYQQiO1cMGST3fUtMcFgrv809JIGQksLdYy9dgy+1buGBKFmaWgLAqmR2hf0RSkgQEhtlahCKpUoilSk9k1VXhVFlVArIdWVoDIRVKICtjpznufZmdnZmV3vrj1zzueD4p+9M2fmmTNnZve76DsHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABotuNts380FEIo/mv8sS2E64q/bw2Hin8u7L/aKwQAAADW6+eNP//q+vyFQ6vYqOk6//iaf/n64uLiYvjgixd/8SeLi/mC7SGMbAmhcVnyTz/9yWLzdaKnw8TQcNO/h3vc/UiPy0d7XD7W4/LxHpdv6XH5RI/Ll+2AZbaWv49p3Ngdjb9uK3dpuDGMNS67o8NWTw9tGR5Ov8tpGGpsszh2PJwMp8JsmF62zVDjfyF8c0dxXw+GdF/DTfd1awjh0o8+fjStYSju4ztCy501ND93P3xL2P7ijz5+9KvzP3hlp9lzNyxbaQi7dhbr/GQIS7+uCkNhS94naZ3DTeu8tcM6R1rWOdTYrvh7+zovrXKd6XFPxHV+p8s6b41fe+L2EMJCWPE67Z4Ow+GatnvN+3uiPCKK2yieypeF0TUdJztWcZwU23z/9tbjpP2YTPt/R9wnoyusofnp+OEnxpft98s9TopH3Q/HanHbDxd3OjHR/KvVlmO1uM7H71z5GOj43HU4BvKx3HQM7Ox1DAyPjzSOgeGlNe9sOQZmlm0zHIYa93Xxzu7HwNT86XNTc09+7J6Tp4+cmD0xe2Zmev/ePfv27tm3b+r4yVOz0+Wfa9ulA+SaMJyPwZ3xvSYdg69tu27zIbn4xY17HUz0yeugeOzvuatY0HXDYYVjvLjOJ3et/3WQv+83vQ5Gm14HHd9TO7wORlfxOiiuc2nX6r5njjb912kNm/VeuK3pGLia3w+L+3z/61Z+L7w1rutTr1/r98ORZcdAelhD8bVXfCX/vDdxf9wvy4+LW4oLrh0PF+Zmz9/7xJH5+fMzIY4r4oam56r9eLmm6TGFZcfL8JqPl0N/+bO7bunw9W1xX03cvfRcjXd4Horr7J3s/lw13t0778+Wr+4OcWywK70/O303K/ZnzhJdjv3iOp+8Z/0/C+Zc0vT+N9br/W9kbLR8/xvJe2Os5f1v+VMz0lhZCJfuWd3731j870q//93YJ+9/xb56/73dj4HiOp+aWusxMNr1/e/2OIfiel4XE8NEU+7/RePyhfIwbXouex43o6Nj8bgZTffYetzsWbZNcWvFfe+avrzjZtftrc9Vy88tFTxuin31p9Pdj5viOs/PrP+9Y2v6a9N7x3ivY2BsZLxY71g+CMr3u8Wt6Ri4NxwNZ8OpcCxvUzzLxX1N7l7dMTAe/7vS7x0398kxUOyrz+3ufgwU1/n2no392WlX/Eq+TtPPTu2/X1gp898yunR77bttozN/sc637+3+u6HiOj/Yu9ac0X0/3R2/cm2H/dT++lnpmD4Wrsx+ujmu89S+7r+bKq5z4/5VHk+HQggvzLzQ+H1X/P3u31z416+3/N630++UX5h54aGpR767lvUDAHD5ftH4c2G8/Fmz6f+xXs3//w8AAAAMhJT7h+PM5H8AAACojJT7R+LM5H8AAACojJT7R+PMapL/H7//wLM/fyrkTwNcjNLlaTc8/KbyeqnjvRD/vX1xSfH1t3557NlPP7W6+x4OIfzsoVd1vP7jb0rrKp1L63xD69eXufm2Vd3/Y48uXa/58xMuHShvPz2e1R4Gqav8zandjdvd/uRMYz7/UGjMRxY+9XR5++W/0/Uv7imv/+fxQ0sOHR9q2X5XXM8dcW6Pnynz8KGl/VDMtN2zt77mH25479L9pe2Gdr608TA/93vl7abPiHrmhvL66XGvtP6//8zXni2u/8Sdndf/1HDn9V+Mt/v9OH96sLx+8z7/dNP6/yCuP91f2u7eL32r4/qfe0V5/eficfGFONvX/5Y/fvXPOz1f6X4OPVBul+5/+n/2NrZLt5duv339E0/NtOyP9tt//sXydg5+5McjzddPX0/3kzz2QOvxPRSf35YeeQjha38YWvZzeGO53d+1rT/d3rkHOq//7rZ1nhu6rbH90uPZ1vK4Pv+V3R0fb1rPob/e1vJ4nnlH3H8vTn27uN2Lj8TjMV7+v98pb6/9s0yfe0fr+026/he2la/bdHtTbet/pm39C7cV+673+h98sVz/c2/e0rL+Q++Mx9OD5ey1/hN/cX3L9l/8avl8nP/o5JmzcxdOHosPZlvb63jLxNZrrr3uJS+9Pr6Xtv/78Nn5x2fPb5/ePh3C9gH8yMDNXv+X4vzvcixs/D2Uvvvj8rj77LvK71uv/Un572fi1x+Lz2f6/vj5PxtrOV7bn/eFN5dzvet/fVzHar3iM/9xW4cv/+eyz/y9+IFvXvjb3/9B+88F6fGce/lE4/F9bsdNjcuGni8vb3+/6uXfX976uv7e6HRjfiPu18X4ycw7byrvr/3202eTfPbd5es3/SSXtg9tnyeybaT1cax3/d+LP8d86+bW9790fHzjqbZPc94WhoolLMT3h7BQXp6ulfb3Zy/d1PH+0ufwhIVXrmWZK5p7cm7q1MkzF56Ymp+dm5+ae/Jjh0+fvXBm/nDjs0sPf6jX9kuv72sar+9js/v3hsar/Ww5NtnVXv+5R48eu2/6rmOzx49cOD7/6LnZ8yeOzs0dnT02d9eR48dnP9pr+5PHDs7sPrDnvt2TJ04eO3j/gQN7DkyePHO2WEa5qB72T3948sz5w41N5g7uPTCzb9/e6cnTZ4/NHrxvenryQq/tG9+bJoutPzJ5fvbUkfmTp2cn505+bPbgzIH9+3f3/PTH0+eOz22fOn/hzNSFudnzU+Vj2T7f+HLxva/X9tTD3Nn4ftdmKP50/r679+fPxy18+RMr3lR5ldYfT8MP42dBpe9vvf6dcv9YnFlN8j8AAADUQcr98YP/ly6Q/wEAAKAyUu7fEmcm/wMAAEBlpNw/EWdWk/yv/6//r/+v/6//fwX7/0H/f6Pp/29I/385/f9V0f/X/9f/1/+nu37r/6fcvzWEWuZ/AAAAqIOU+6+JM5P/AQAAoDJS7r82zkz+BwAAgMpIuf+6OLN65P+x9r/q/+v/6/839//TdfX/g/6//v9l0v/X/+9G/1//f5DX34f9/636//Sbfuv/p9z/kjizeuR/AAAAqIWU+18aZyb/AwAAQGWk3H99nJn8DwAAAJWRcv+2OLOa5P8NPP//Z+JF+v/6/4Pe/z+djmPn/9f/1/9fP/1//f9u9P/1/wd5/X3Y/3f+f/pOv/X/U+7/f3FmNcn/AAAAUAcp978szkz+BwAAgMpIuf+GODP5HwAAACoj5f4b48xqkv83sP/v/P/6/1Xp/zed/1//v5n+v/7/5dD/1//vRv9f/3/j1z8Uf0zQ/++1vf4/V0K/9f9T7n95nFlN8j8AAADUQcr9N8WZyf8AAABQGSn3vyLOTP4HAACAyki5/+Y4s5rkf/1//X/9f/1//X/9/82k/6//343+v/7/IK9f/1//n976rf+fcv8r48xqkv8BAACgDlLuvyXOTP4HAACAyki5/1VxZvI/AAAAVEbK/bfGmdUk/+v/91X//8mg/7+8/z+s/6//X1pr/79hoff69f8312D1/4dXvET/v6T/30r/X/9f/1//n+76rf+fcv+r48xqkv8BAACgDlLuf02cmfwPAAAAlZFy/21xZvI/AAAAVEbK/dvjzGqS//X/+6r/7/z/zv+v/+/8/0v9//kh/f9VcP5//f+g/3/ZrnZ/ftDXr/+v/09v/db/T7l/R5xZTfI/AAAA1EHK/TvjzOR/AAAAqIyU+2+PM5P/AQAAoDJS7r8jzqwm+V///zL7/1tb/6n/33n9+v/6//r/zv+v/6//343+v/7/IK9f/391/f/xXjdEpfVb/z/l/jvjzGqS/wEAAKAOUu6/K85M/gcAAIDKSLn/tXFm8j8AAABURsr9u+LMapL/9f+d/1//X/9f/1//fzPp/6+6/7/1cta1Kf3/9Car/9+T/r/+/6D0/yc6bO/8/1wJ/db/T7n/dXFmNcn/AAAAUAcp978+zkz+BwAAgMpIuf/uODP5HwAAACoj5f7JOLOa5H/9f/1//X/9f/1//f/NVNX+f34fdf5//X/9f/3/Te7/f2WF7Qfl/P/UW7/1/1PuvyfOrCb5HwAAAOog5f5748zkfwAAAKiMlPun4szkfwAAAKiMlPun48xqkv+r3/9vbxaX9P9L+v/6/0H/X/9/k1W1/99+/v8Qgv6//n+m/6//32/n/+9E/58rYf39//G8SePPdfb/U+6fiTOrSf4HAACAOki5f3ecmfwPAAAAlZFy/544M/kfAAAAKiPl/r1xZjXJ/9Xv/3em/1/S/9f/D/r/+v+brC79f+f/Ly/X/y/p/+v/6//r/9fRcIevrb//v7RJ48919v9T7t8XZ1aT/A8AAAB1kHL//jgz+R8AAAAqI+X+++LM5H8AAACojJT7748zq0n+1//X/9f/1//v3/5/6/1vXv//v/T/N5H+v/5/N/r/+v+DvH79f/1/etvY/v/16+7/p9x/IM6sJvkfAAAA6iDl/jfEmcn/AAAAUBkp9z8QZyb/AwAAwEDpdB7CJOX+N8aZ1ST/6/9Xvf+/uEX/X/9/cPv/rfvT+f/1/zuJb5/6/6tUr/7/1mX3p//f6mr35wd9/fr/+v/0trH9/2U/nq65/59y/8E4s5rkfwAAAKiDlPvfFGcm/wMAAEBlpNz/5jgz+R8AAAAqI+X+Q3FmNcn/+v9V7//33/n/h8Lg9v9H9f/1//X/18z5//X/u3H+/8Hs/6fP3dD/75/+f3EM6f/Tj/qt/59y/1vizGqS/wEAAKAOUu5/a5yZ/A8AAACVkXL/2+LM5H8AAACojJT73x5nVpP8r/+v/+/8/87/r/+v/7+Z9P/1/7vR/x/M/n+i/98//X/n/6df9Vv/P+X+d8SZ1ST/AwAAQB2k3P/OODP5HwAAACoj5f7/H2cm/wMAAEBlpNz/YJxZTfJ/hfr/Y3Hq/+v/6//r/zfo//eHq9b/H93Y+9H/L+n/t9L/1//X/9f/p7t+6/+n3P9LcWY1yf8AAABQByn3PxRnJv8DAABAZaTc/644M/kfAAAAKiPl/l+OM6tJ/q9Q/7/Up+f/H863r/+v/6//r/+v/7+RBvT8/xP6/yX9f/3/QV6//r/+P731W/8/5f5fiTOrSf4HAACAOki5/1fjzOR/AAAAqIyU+38tzkz+BwAAgMpIuf/hOLOa5H/9f+f/1//X/+/b/v9o6/7U/9f/72RA+//O/x/p/+v/D/L69f/1/+mt3/r/Kff/epxZTfI/AAAA1EHK/Y/Emcn/AAAAUBkp9787zkz+BwAAgMpIuf89cWY1yf/6//r/+v/6/33b/2/bn/r//dr//7eul+r/6/93o/+v/z/I69f/1/+nt37r/6fc/2icWU3yPwAAANRByv3vjTOT/wEAAKAyUu7/jTgz+R8AAAAqI+X+34wzG8z8P7zWDfT/9f/1//X/V93/Xwgh6P/r/6+R/v/y/n/xHnY1+//jq7mi/v+q6P/r/+v/6//TXb/1/1Puf1+c2WDmfwAAAKCDlPt/K85M/gcAAIDKSLn/t+PM5H8AAACojJT73x9nVpP8r/+v/6//r//v/P/6/5tJ/79e5/8fD/r/Qf9f/1//X/+frN/6/yn3fyDOrCb5HwAAAOog5f7fiTOT/wEAAKAyUu4/HGcm/wMAAEBlpNz/WJxZTfK//v9V6v9vLa+v/6//X53+/6L+v/5/R/r/9er/O/9/Sf9f/1//X/+fUr/1/1PuPxJnVpP8DwAAAHWQcv8H48zkfwAAAKiMlPuPxpnJ/wAAAFAZKfcfizOrSf7X/3f+f/1//X/n/9f/30z6//r/3ej/6/8P8vr1//X/6a3f+v8p98/GmdUk/wMAAEAdpNx/PM5M/gcAAIDKSLn/RJyZ/A8AAACVkXL/43FmNcn/+v/6/6vq/48F/X/9f/1//f/Lov+v/9+N/r/+/yCvX/9f/5/eNq7//88b0v9Puf9knFlN8j8AAADUQcr9H4ozk/8BAACgMlLu/3CcmfwPAAAAlZFy/6k4s5rkf/1//X/n/69g/39U/z/o//cN/X/9/270//X/B3n9+v/6//Q2FDaq/x82pP+fcv/pOLOa5H8AAACog5T7z8SZyf8AAABQGSn3n40zk/8BAACgMlLuPxdnVpP8r/+v/6//X8H+v/P/N+j/9wf9f/3/bvT/9f8Hef36//r/9LZx5//fmP5/yv2/G2dWk/wPAADA/7F3H01y3tUex1vXkkcq1627unveAjt28A78Gtiwpcg5RwMmJ5NzzslEk3POweScDCaDocqUNecce6Se7tZoevp5/ufzWXA8Zqx5rKGG+pXqWw8d5O6/d9xi/wMAAMAwcvffJ26x/wEAAGAYufvvG7c02f/6f/2//l//r//X/2+T/l//v4r+fz79/5kl/7z+X/+v/2edqfX/ufvvF7c02f8AAADQQe7++8ct9j8AAAAMI3f/A+IW+x8AAACGkbv/gXFLk/2v/9f/6/8n0//vd376f/2//v+S6P/1/4td9//n4oPB+/9l9P/6f/0/60yt/8/d/6C4pcn+BwAAgA5y9z84brH/AQAAYBi5+x8St9j/AAAAMIzc/Q+NW5rsf/2//n/c/n9vbv2/9//n93XE/v/U7V9W/3+89P/6/8Wu+/8m7/9fRv+v/9f/s87U+v/c/Q+LW5rsfwAAAOggd//D4xb7HwAAAIaRu/8RcYv9DwAAAMPI3f/IuKXJ/tf/6//H7f9n9/5//X9+X4fo/8/Vr+P9//p//f/h9P/6/zk/v/5f/896U+v/c/c/Km5psv8BAACgg9z9j45b7H8AAAAYRu7+x8Qt9j8AAAAMI3f/Y+OWJvtf/6//1//r//X/J/D+f/2//l//v5T+X/8/5+fX/+v/WW9q/X/u/sfFLU32PwAAAHSQu//xcYv9DwAAAMPI3f+EuMX+BwAAgGHk7n9i3NJk/19a/39K/38I/f/y59f/6//1//p//b/+fxX9v/5/zs+v/9f/s97W+/+rrzl/N+3/c/dfE7c02f8AAADQQe7+J8Ut9j8AAAAMI3f/k+MW+x8AAACGkbv/KXFLk/2/pP+/YjHj9/+f3exL6//j6x/s/289pf/X/0+z/78lfsro//X/F5t3/39W/7+z/n9P/7+yn9/sd0L/r//X/7PO1vv/Nb3/hR/n7r82bmmy/wEAAKCD3P1PjVvsfwAAABhG7v6nxS32PwAAAAwjd//T45Ym+//S3v8//f7f+/93+/7//HW30P+fWfb8+v8u/f8+7//X/y8z7/7f+/+32P/fI38zvf//cLvu5+f+/Kv6/7tu8Pz6fzqYWv+fu/8ZcUuT/Q8AAAAd5O5/Ztxi/wMAAMAwcvc/K26x/wEAAGAYufufHbc02P+n9f/1HEn/7/3/G/X/5/b/ef3/wefR/+v/l9H/6/9X2d37//X/iwn083N/fu//X9//X7XuF2F4U+v/c/c/J25psP8BAACgi9z9z41b7H8AAAAYRu7+58Ut9j8AAAAMI3f/8+OWJvtf/6//1/97//9l9f9XbKP/P73091P/r/9fRv+v/1+ceP9/Zf2V/l//r//3/n9Wm1r/n7v/urilht/pI/xbAgAAAFOSu/8FcUuTP/8HAACADnL3vzBusf8BAABgGLn7XxS3NNn/+n/9v/5f/+/9//r/bdL/D9f/n9L/307/r//X/+v/WW1q/X/u/hfHLU32PwAAAHSQu/8lcYv9DwAAAMPI3f/SuMX+BwAAgGHk7n9Z3NJk/+v/9f/6f/2//l//v036/+H6f+//vwP9v/5f/6//Z7Wp9f+5+18etzTZ/wAAANBB7v5XxC32PwAAAAwjd/8r4xb7HwAAAIaRu/9Vccvs9v+FBe1m9P/6f/2//l//r//fpun3/2c2+iz9/z79/0Hb6v/PHvL19P/Tev7j6f/zu6//Z0wT6P/vdsePc/e/Om6Z3f4HAAAADpO7/zVxi/0PAAAAw8jd/9q4xf4HAACAYeTuf13c0mT/H9b/33zV/n+/pv/P3zD9f1z9v/5/of8v+n/9/2IW/f9m9P/79P8Hef+//t/7//X/rDaB/v/Ax7n7Xx+3NNn/AAAA0EHu/jfELfY/AAAADCN3/xvjFvsfAAAAhpG7/01xS5P97/3/+n/9v/5f/6//3yb9v/5/lRn1/3vL/qb+X/+v/9f/s9rU+v/c/W+OW5rsfwAAAOggd/9b4hb7HwAAAIaRu/+tcYv9DwAAAMPI3f+2uKXJ/tf/6/933v//z5D9//lH1P/r//X/+n/9/2oz6v+X0v/r//X/+n9Wm1r/n7v/7XFLk/0PAAAAHeTuf0fcYv8DAADAMHL3vzNusf8BAABgGLn73xW3NNn/+n/9/877f+//L/r/+L7q//X/l0D/r/9f6P+PbNf9/NyfX/+v/2e9qfX/ufvfHbc02f8AAADQQe7+98Qt9j8AAAAMI3f/9XGL/Q8AAADDyN3/3rilyf7X/+v/9f/6f/2//n+b9P/6/1VOtv+/9mb9/0G77ufn/vz6f/0/602t/8/d/764pcn+BwAAgA5y978/brH/AQAAYBi5+z8Qt9j/AAAAMIzc/R+MW5rsf/3/3Pv/u98UTzC1/j8/Rf+v/1/Z/+8tLqb/1/9fCv2//n+xlff/X/iTYjn9v/5f/6//Z7UT6//vefW97nLbX6zp/3P3fyhuabL/AQAAoIPc/TfELfY/AAAADCN3/4fjFvsfAAAAhpG7/yNxS5P936P/P3PRp43T/3v/v/5/0v1//lD1/n/9v/5f/7/UdPv/zej/9f/6f/0/q03t/f+5+z8atzTZ/wAAANBB7v6PxS32PwAAAAwjd//H4xb7HwAAAIaRu/8TcUuT/d+j/7+Y/n/fsff/t/6f/l//XzZ5/7/+X/9/ufT/+v+F/v/Idt3Pz/35h+7/Ty30/xyLqfX/ufs/Gbc02f8AAADQQe7+T8Ut9j8AAAAMI3f/p+MW+x8AAACGkbv/M3HDnf93d490ovT/+n/v/9f/6//1/9uk/z9C/3/q9MbPpf/fp/8/ml3383N//qH7f+//55hMrf/P3f/ZuMWf/wMAAMAwcvd/Lm6x/wEAAGAYufs/H7fY/wAAADCA/d49d/8X4pYm+39N/7+Xn3fk/v/c4V9b/6//X+j/9f/6f/3/ZRqy/78E+v99+v+j2XU/P/fnn13/f/3BD/X/nIQl/f/5n8S76v9z938xbmmy/wEAAKCD3P1filvsfwAAABhG7v4vxy32PwAAAAwjd/9X4pYm+39p/7/n/f/6f/2//n+h/9f/Hwv9v/5/Ff2//n/Ozz+7/v8C+n9OwtTe/5+7/6txS5P9DwAAAB3k7v9a3GL/AwAAwDBy9389brH/AQAAYBi5+78RtzTZ/2ve/6//3+xfRf+v/1/6vwf9v/5/w/7/zEL/f2T6f/3/Qv9/ZLvu5+f+/JfT/5/T/9PE1Pr/3P3fjFua7H8AAADoIHf/t+IW+x8AAACGkbv/23GL/Q8AAADDyN3/nbilyf4fuf9f9Wn6/336f/3/Qv8/hf7f+/8vg/5f/7/Q/x/Zrvv5uT+/9//r/1lvav1/7v7vxi1N9j8AAAB0kLv/e3GL/Q8AAADDyN1/42Jxg/0PAAAAY7rx/H+eXXw/bmmy/0fu/1fR/+/T/+v/F/p//f+W6f/1/6vo//X/c35+/b/+n/Wm1v/n7v9B3NJk/wMAAEAHuft/GLfY/wAAADCM3P0/ilvsfwAAABhG7v4fxy1N9r/+X/+v/9f/6//1/9uk/9f/r6L/1//P+fn1//p/1pta/5+7/ydxS5P9DwAAAB3k7v9p3GL/AwAAwDBy9/8sbrH/AQAAYBi5+38etzTZ//p//b/+X/+v/9f/b5P+X/+/iv5f/z/n59f/6/9Zb2r9f+7+X8QtTfY/AAAAdJC7/5dxi/0PAAAAw8jd/6u4xf4HAACAYeTu/3Xc0mT/6/9ve45z9ff1//p//b/+P+n/j0fb/v+2/1vV/6+l/9f/z/n59f/6f9abWv+fu/83cUuT/Q8AAAAd5O7/bdxi/wMAAMAwcvf/Lm6x/wEAAGAYuft/H7c02f/6f+//1//r/+fR/1+p/9f/LzXZ/t/7/zei/9f/z/n59f/6f9abWv+fu/+muKXJ/gcAAIAOcvf/IW6x/wEAAGAYufv/GLfY/wAAADCM3P03xy1N9r/+X/8/ZP+/p/8fr//3/v9Z9v930v/r/1fT/+v/5/z8+n/9P+tNrf/P3f+nuKXJ/gcAAIAOcvf/OW6x/wEAAGAYufv/ErfY/wAAADCM3P1/jVua7H/9v/5/yP7f+//1//r/ydD/6/9X0f/r/+f8/Pp//T/rTa3/z93/t7ilyf4HAACADnL3/z1usf8BAABgGLn7/xG32P8AAAAwjNz9/4xbmux//b/+X/+v/9f/6/+3Sf8/3/7/ysUR+v/rFvp//b/+X/+v/6dMrf/P3f+vuKXJ/gcAAIAOcvffErcs3f//f0JPBQAAAByn3P3/jlv8+T8AAAAMI3f/f+KWJvtf/6//1//r//X/+v9t0v/Pt//3/v/19P/6f/2//p/Vptb/5+7/bwAAAP//jST+1g==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0xc6081, 0xcc) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x82200, 0x0) sendfile(r0, r1, 0x0, 0x20fffe85) openat(0xffffffffffffff9c, &(0x7f0000000d80)='./file1\x00', 0x1c3902, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) 1.814539565s ago: executing program 6 (id=543): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0xf3a, 0x0) write(r0, 0x0, 0x0) 1.809077406s ago: executing program 0 (id=544): write$binfmt_register(0xffffffffffffffff, &(0x7f0000000300)={0x3a, 'syz0', 0x3a, 'M', 0x3a, 0xfffffffffffffffa, 0x3a, 'i\x11\xb1\x00\x00\x00\x00\x00\x00\x00\x135}\x1e\xd8\"\fj`s\x8e\v\xd6f\x8b\x81;\x1f0\xf2\xed\xcb#\x9a7\xfd\x91\xed\xacv+\xf5?\x8c\xa3\xa8\xbeD!=\x8e\'\'\x1bt+\x8a\xcf\xf9S\x00.\x87F\xa8\x95\xd8\xca\x0f%`\xc6s8!\x82d\x16q\xafl*:\x83:|\x82Oa\t\x14\xd8\xf2\xfa\xcd\xaa\xd1\xf9%\xf7\x8fR\x95\xf5\xfd\xecu', 0x3a, '/dev/kvm\x00', 0x3a, './cgroup.cpu/cpuset.cpus'}, 0xac) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="6c0000001000010400"/20, @ANYBLOB="5d580000000000001c001a8018000a801400070000000000000000000000000000000001140003006970766c616e310000000000000000001c0012800b0001006970766c616e00000c"], 0x6c}, 0x1, 0x0, 0x0, 0x840}, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendto$packet(r0, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) 1.334888666s ago: executing program 6 (id=545): syz_mount_image$xfs(&(0x7f0000000200), &(0x7f0000000100)='./file1\x00', 0x8000, &(0x7f0000000040), 0x4, 0x9836, &(0x7f0000009b80)="$eJzs3Qm8rXPBuP11ODjmoUQqZEqjMUNK5qGkjJE5c8aQUOahDBUlVBSKpBRCReZZZjLP8zzP4/s5ziGdLvL83+d59Liu62PvNd177Xv9vvfvtte+91lrhUWWWWAwmGgwoldP/9FZ+92y6rLjL7HZ8fsMvfqgPZe8f+TVY444mXi+kafzjzxdYDAYDBl5P0NGXDd03uOOH20wdDD8v3803tjjjDbeYDDOyIsj72cw54iTcQ9/dbmXR4lXdOrh326PER+vNP7wOxl+ZuXVX9x4MBgMe93XD1+vmf/lgUpbYf5FF/mH1Wtuo428ecg/bnvldOiIj3EPHQzGPXjwxtvH8GXHeN3X/m82/HtONO1guVvehu/9f64V5l908VH8h8/F0UdeN+fwOT7qHDQ26na+5zIb3DtyCIeMHLihr5svb8d2///UCvMvssTgjefxYMmFt73n5Vf2m0MXGgyGLjwYDF1kMBi66NvtUf89va0bX1VVVb0tzb/AbMOfs482ys8Dw179uZZ+LjzvhVnuGAyGLjnieeLQ1V99LlhVVVVVVVVV/5nNv8BsC8Lz/4ne7Pn/1CftMnHP/6uqqqqqqqr+77T4/AvMNvy5/ijP/yd/s+f/j9x31GEj/vZ/vjlHfNVLb++DqKqqqqqqqqo3bZHF8fn/1G/2/P+C46a+uOf/VVVVVVVVVf93Wnq2RRYcvO519kZePeOrt9Pz/5PvvmmVt2t9q6qqqqqqquq/3ksPnnjKP17zfcrBKK/3/kojfy8w5OjTLr30bVvR/4yG/OvvQ3Z4u9fp/2/DnYcdOfVgsPFyb/eq1NvQ/5nXqq//kfJ3l7+7/N3l7y5/d/m7y99d/u7yd5e/u/zd5e8uf3FvcPz/tdf/P/nYNV99L/gPTT/bNSf+4ytfee//oUsu/uCOb9Oqvx29U4//D9YfMhiM9J1o/cFgsOT8Sy8742AwOPGa2aafbvDabXMNv22eSUZ/5Q3iX/1nIgtPzHe8wzQjTodvKIN3v3YfR79y/4u/fMjoQ0ZZidc18QmHHbbeCk/PPurpDG/8OEZ77dz4x9/36r9lGW2UhYa9wRe/ev+vPpZRnUeu+4zD132mLTbadKbNt97m4+tvtMa6a6+79sZzzzrHLLPPPfccc8y0zvobrj3ziM9vNGZTv/J5wbcyZuONOmYPzv/6MRv1sb3RmE395mP2yj3ue/6wz746ZkP/i2O24JuP2dTrj/xGE883xmD1V8ZmyGAw8UJjDLYafmGWsQaDiRceuezkw5f99CSjDQZ7/+OBDj831mvb4JAdhi+zwiLLLDBiNzUY/OP0H73B+9mPOXLN5xt5Ov/I0wVGfJuJBv/YFIfOe9zxow0fi38ajvHGHme08QaDcUZeHHk/g7lHnIxz0qvLvcH7rI+yoq+8zMoeIz5eafzBYDDu8DNTrnHyrsOH/n/hfdr/n/7//y9ecw15bXscMvJj5DIjvOZfdPF/fK9XhmH42I0+8ro5h5v8N7+1/T/1L+s79bDB1G+yvm/yujivRNvXhidOutN/1+vi0PpO/ibr+yav4/uG67v8HQfcO+Ku/tvWd5R93RKvfJ7vrezrBm++rxud7mDtiz4w6r7u82+8iv+0u3x1jMYaZaE32tdNfuBUOwy///nefF+3xPB1H+Of9nWjDQYTL/jqvm74jm+RMQZ7D78w6/ALi44xOGL4hdleuTD24LThFz6x5iYbrjX8isX+dTuYccg//YEmzLNFRplnQ1732IeM8vedQ0ecjnvoq+/h9Ab7zSEjH9a/3VfQdjvRm6zvm7z/FI7z8OvWOmbYpP9d7z9F6zvszdf3jd4v+w3Xd6+nTr7lv3l9X5tnY7xuuBZ7K/Ns6n+eZ8Mf4uivmxlv9eewtWD5Eecnf+3ettzuvtd+phhjlPv9dz9TLPbm82yi9Uf5ut0PHgx5s7FZ9K2Mzfv/ZR+04+vH5q3+vDXjtCNuH/1NxmasuVed4dWxGfO/ODaL/lfHZr7B6P88NkMHCw8Gg+lG7h8WeStjM/mbj81b3W7GgeVHnF/7tasW2vPIc14dm1HH4t+NzSL/1bGZ+rXtZrpXbptmtMGYYw62WmOLLTabZcTnVy/OOuLzm8/Bhd7KWE703zOWUwx9o7H8x6Y63h0XH/pv5uC/7NNfvf+F/qtjOXhtLAfrjzpZ6j+1fv/nLn93+bvL313+7vJ3l7+4Nzj+/9rr/+8/0Tz7jPzlxhgXTzXZbm/3+r7NvaOP/4/0/afj/7tNNtXFow1eu+1Nj8+OWOY/8vjsnCNOxj381eVGPT7IK/rGx2cPnnvOXf6Xjs/+P/XqXH0Lv4dr/+8uf3f5u8vfXf7u8neXv7v83eXvLn93+bvL313+7vIX9wbH/2d+9e8A7p5lqcdGHggd4/6dV1rq7V7ft7l39PH/kb7/dPx/qZV2vn+0wWu3venx/xHLOI7/3/b8Inv9Jx//f3Wudvy//k35u0P/UV8DpN6xNf/d5e8uf3f5u8vfXf7u8neXv7v83eXvLn9xb3D8f75X/w7gqKMO2ObVvwe4cuI9Tny71/dt7p16/L/3//fW/t9d/u7yd5e/u/zd5e8uf3f5u8vfXf7u8neXv7v83eUvbuTx/8Eob2/5pbYLDI7//9/uDfyXyh+z+C+dPzXaYODwXyZ/zDL/l80fs/gvlz9m8V8+f8zi/+X8MYv/CvljFv8V88cs/l/JH7P4r5Q/ZvFfOX/M4r9K/pjFf9X8MYv/avljFv/V88cs/mvkj1n8v5o/ZvFfM3/M4r9W/pjFf+38MYv/OvljFv9188cs/uvlj1n8188fs/h/LX/M4r9B/pjFf8P8MYv/RvljFv+N88cs/pvkj1n8N80fs/h/PX/M4r9Z/pjFf/P8MYv/FvljFv9v5I9Z/LfMH7P4fzN/zOK/Vf6YxX/r/DGL/zb5Yxb/b+WPWfy/nT9m8d82f8ziv13+mMV/+/wxi/8O+WMW/x3zxyz+O+WPWfx3zh+z+O+SP2bx3zV/zOK/W/6Yxf87+WMW/+/mj1n8d88fs/jvkT9m8d8zf8ziv1f+mMX/e/ljFv/v549Z/H+QP2bx3zt/zOK/T/6Yxf+H+WMW/x/lj1n8980fs/j/OH/M4r9f/pjFf//8MYv/AfljFv+f5I9Z/H+aP2bx/1n+mMX/wPwxi/9B+WMW/5/nj1n8f5E/ZvE/OH/M4n9I/pjF/9D8MYv/L/PHLP6/yh+z+B+WP2bxPzx/zOL/6/wxi/8R+WMW/9/kj1n8j8wfs/j/Nn/M4v+7/DGL/1H5Yxb/3+ePWfz/kD9m8T86f8zif0z+mMX/2Pwxi/8f88cs/sflj1n8j88fs/ifkD9m8f9T/pjF/8/5Yxb/v+SPWfxPzB+z+J+UP2bx/2v+mMX/5Pwxi/8p+WMW/1Pzxyz+p+WPWfxPzx+z+J+RP2bxPzN/zOJ/Vv6Yxf/s/DGL/zn5Yxb/c/PHLP7n5Y9Z/M/PH7P4X5A/ZvH/W/6Yxf/C/DGL/0X5Yxb/i/PHLP6X5I9Z/C/NH7P4X5Y/ZvG/PH/M4n9F/pjF/8r8MYv/3/PHLP5X5Y9Z/K/OH7P4X5M/ZvG/Nn/M4n9d/pjF//r8MYv/DfljFv8b88cs/jflj1n8b84fs/jfkj9m8b81f8zif1v+mMX/9vwxi/8d+WMW/zvzxyz+d+WPWfzvzh+z+N+TP2bxvzd/zOJ/X/6Yxf/+/DGL/wP5Yxb/B/PHLP4P5Y9Z/B/OH7P4P5I/ZvF/NH/M4v9Y/pjF//H8MYv/E/ljFv8n88cs/k/lj1n8n84fs/g/kz9m8X82f8zi/1z+mMX/+fwxi/8L+WMW/xfzxyz+L+WPWfxfzh+T+A8Z5I9Z/Ifkj1n8R8sfs/iPnj9m8R+aP2bxHyN/zOI/Zv6YxX+s/DGL/7D8MYv/2PljFv9x8scs/uPmj1n8x8sfs/iPnz9m8Z8gf8ziP2H+mMV/ovwxi//E+WMW/0nyxyz+78ofs/i/O3/M4j9p/pjF/z35Yxb/yfLHLP6T549Z/N+bP2bxnyJ/zOL/vvwxi//788cs/h/IH7P4T5k/ZvGfKn/M4j91/pjF/4P5Yxb/afLHLP7T5o9Z/KfLH7P4T58/ZvGfIX/M4v+h/DGL/4z5Yxb/D+ePWfw/kj9m8f9o/pjF/2P5Yxb/j+ePWfw/kT9m8Z8pf8ziP3P+mMV/lvwxi/+s+WMW/9nyxyz+s+ePWfw/mT9m8Z8jf8ziP2f+mMV/rvwxi//c+WMW/0/lj1n858kfs/h/On/M4v+Z/DGL/7z5Yxb/z+aPWfznyx+z+M+fP2bxXyB/zOK/YP6YxX+h/DGL/8L5Yxb/RfLHLP6L5o9Z/BfLH7P4L54/ZvH/XP6Yxf/z+WMW/yXyxyz+X8gfs/gvmT9m8f9i/pjF/0v5Yxb/pfLHLP5L549Z/JfJH7P4L5s/ZvFfLn/M4r98/pjF/8v5Yxb/FfLHLP4r5o9Z/L+SP2bxXyl/zOK/cv6YxX+V/DGL/6r5Yxb/1fLHLP6r549Z/NfIH7P4fzV/zOK/Zv6YxX+t/DGL/9r5Yxb/dfLHLP7r5o9Z/NfLH7P4r58/ZvH/Wv6YxX+D/DGL/4b5Yxb/jXT+Y7+lpSz+G+v831oW/03yxyz+m+aPWfy/nj9m8d8sf8ziv3n+mMV/i/wxi/838scs/lvmj1n8v5k/ZvHfKn/M4r91/pjFf5v8MYv/t/LHLP7fzh+z+G+bP2bx3y5/zOK/ff6YxX+H/DGL/475Yxb/nfLHLP47549Z/HfJH7P475o/ZvHfLX/M4v+d/DGL/3fzxyz+u+ePWfz3yB+z+O+ZP2bx3yt/zOL/vfwxi//388cs/j/IH7P4750/ZvHfJ3/M4v/D/DGL/4/yxyz+++aPWfx/nD9m8d9vhP8Ub9dq/adm8d+/+Y9Z/A/IH7P4/yR/zOL/0/wxi//P8scs/gfmj1n8D8ofs/j/PH/M4v+L/DGL/8H5Yxb/Q/LHLP6H5o9Z/H+ZP2bx/1X+mMX/sPwxi//h+WMW/1//s/9d/+vr9R+axf+I5j9m8f9N/pjF/8j8MYv/b/PHLP6/yx+z+B+VP2bx/33+mMX/D/ljFv+j88cs/sfkj1n8j80fs/j/MX/M4n9c/pjF//j8MYv/CfljFv8/5Y9Z/P+cP2bx/0v+mMX/xPwxi/9J+WMW/7/mj1n8T84fs/ifkj9m8T81f8zif1r+mMX/9Pwxi/8Z+WMW/zP/jf+w/+n1+g/N4n9W8x+z+J+dP2bxPyd/zOJ/bv6Yxf+8/DGL//n5Yxb/C/LHJP6vlP+/JvEfcmH+mMX/ovwxi//F+WMW/0vyxyz+l+aPWfwvyx+z+F+eP2bxvyJ/zOJ/Zf6Yxf/v+WMW/6vyxyz+V+ePWfyvyR+z+F+bP2bxvy5/zOJ/ff6jNHTkqcP/hvwxy/y/MX/M4n9T/pjF/+b8MYv/LfljFv9b88cs/rflj1n8b88fs/jfkT9m8b8zf8zif1f+mMX/7vwxi/89+WMW/3vzxyz+9+WPWfzvzx+z+D+QP2bxfzB/zOL/UP6Yxf/h/DGL/yP5Yxb/R/PHLP6P5Y9Z/B/PH7P4P5E/ZvF/Mn/M4v9U/pjF/+n8MYv/M/ljFv9n88cs/s/lj1n8n88fs/i/kD9m8X8xf8zi/1L+mMX/5fwxif8rZ/P/1yz+Q/LHLP6j5Y9Z/EfPH7P4D80fs/iPkT9m8R8zf8ziP1b+mMV/WP6YxX/s/DGL/zj5Yxb/cfPHLP7j5Y9Z/MfPH7P4T5A/ZvGfMH/M4j9R/pjFf+L8MYv/JPljFv935Y9Z/N+dP2bxnzR/zOL/nvwxi/9k+WMW/8nzxyz+780fs/hPkT9m8X9f/pjF//35Yxb/D+SPWfynzB+z+E+VP2bxnzp/zOL/wfwxi/80+WMW/2nzxyz+0+WPWfynzx+z+M+QP2bx/1D+mMV/xvwxi/+H88cs/h/JH7P4fzR/zOL/sfwxi//H88cs/p/IH7P4z5Q/ZvGfOX9syFn7jTEYDN7x/rPkj1nm/6z5Yxb/2fLHLP6z549Z/D+ZP2bxnyN/zOI/Z/6YxX+u/DGL/9z5Yxb/T+WPWfznyR+z+H86f8zi/5n8MYv/vPljFv/P5o9Z/OfLH7P4z58/ZvFfIH/M4r9g/pjFf6H8MYv/wvljFv9F8scs/ovmj1n8F8sfs/gvnj9m8f9c/pjF//P5Yxb/JfLHLP5fyB+z+C+ZP2bx/2L+mMX/S/ljFv+l8scs/kvnj1n8l8kfs/gvmz9m8V8uf8ziv3z+mMX/y/ljFv8V8scs/ivmj1n8v5I/ZvFfKX/M4r9y/pjFf5X8MYv/qvljFv/V8scs/qvnj1n818gfs/h/NX/M4r9m/pjFf638MYv/2vljFv918scs/uvmj1n818sfs/ivnz9m8f9a/pjFf4P8MYv/hvljFv+N8scs/hvnj1n8N8kfs/hvmj9m8f96/pjFf7P8MYv/5vljFv8t8scs/t/IH7P4b5k/ZvH/Zv6YxX+r/DGL/9b5Yxb/bfLHLP7fyh+z+H87f8ziv23+mMV/u/wxi//2+WMW/x3yxyz+O+aPWfx3yh+z+O+cP2bx3yV/zOK/a/6YxX+3/DGL/3fyxyz+380fs/jvnj9m8d8jf8ziv2f+mMV/r/wxi//38scs/t/PH7P4/yB/zOK/d/6YxX+f/DGL/w/zxyz+P8ofs/jvmz9m8f9x/pjFf7/8MYv//vljFv8D8scs/j/JH7P4/zR/zOL/s/wxi/+B+WMW/4Pyxyz+P88fs/j/In/M4n9w/pjF/5D8MYv/ofljFv9f5o9Z/H+VP2bxPyx/zOJ/eP6Yxf/X+WMW/yPyxyz+v8kfs/gfmT9m8f9t/pjF/3f5Yxb/o/LHLP6/zx+z+P8hf8zif3T+mMX/mPwxi/+x+WMW/z/mj1n8j8sfs/gfnz9m8T8hf8zi/6f8MYv/n/PHLP5/yR+z+J+YP2bxPyl/zOL/1/wxi//J+WMW/1Pyxyz+p+aPWfxPyx+z+J+eP2bxPyN/zOJ/Zv6Yxf+s/DGL/9n5Yxb/c/LHLP7n5o9Z/M/LH7P4n58/ZvG/IH/M4v+3/DGL/4X5Yxb/i/LHLP4X549Z/C/JH7P4X5o/ZvG/LH/M4n95/pjF/4r8MYv/lfljFv+/549Z/K/KH7P4X50/ZvG/Jn/M4n9t/pjF/7r8MYv/9fljFv8b8scs/jfmj1n8b8ofs/jfnD9m8b8lf8zif2v+mMX/tvwxi//t+WMW/zvyxyz+d+aPWfzvyh+z+N+dP2bxvyd/zOJ/b/6Yxf++/DGL//35Yxb/B/LHLP4P5o9Z/B/KH7P4P5w/ZvF/JH/M4v9o/pjF/7H8MYv/4/ljFv8n8scs/k/mj1n8n8ofs/g/nT9m8X8mf8zi/2z+mMX/ufwxi//z+WMW/xfyxyz+L+aPWfxfyh+z+L+cPybxH32QP2bxH5I/ZvEfLX/M4j96/pjFf2j+mMV/jPwxi/+Y+WMW/7Hyxyz+w/LHLP5j549Z/MfJH7P4j5s/ZvEfL3/M4j9+/pjFf4L8MYv/hPljFv+J8scs/hPnj1n8J8kfs/i/K3/M4v/u/DGL/6T5Yxb/9+SPWfwnyx+z+E+eP2bxf2/+mMV/ivwxi//78scs/u/PH7P4fyB/zOI/Zf6YxX+q/DGL/9T5Yxb/D+aPWfynyR+z+E+bP2bxny5/zOI/ff6YxX+G/DGL/4fyxyz+M+aPWfw/nD9m8f9I/pjF/6P5Yxb/j+WPWfw/nj9m8f9E/pjFf6b8MYv/zPljFv9Z8scs/rPmj1n8Z8sfs/jPnj9m8f/km/uP9T++Xv+hWfznaP5jFv8588cs/nPlj1n8584fs/h/Kn/M4j9P/pjF/9P5Yxb/z+SPWfznzR+z+H82f8ziP1/+mMV//vwxi/8C+WMW/wXzxyz+C+WPWfwXzh+z+C+SP2bxXzR/zOK/WP6YxX/x/DGL/+fyxyz+n88fs/gvkT9m8f9C/pjFf8n8MYv/F/PHLP5fyh+z+C+VP2bxXzp/zOK/TP6YxX/Z/DGL/3L5Yxb/5fPHLP5fzh+z+K+QP2bxXzF/zOL/lfwxi/9K+WMW/5Xzxyz+q+SPWfxXzR+z+K+WP2bxXz1/zOK/Rv6Yxf+r+WMW/zXzxyz+a+WPWfzXzh+z+K+TP2bxXzd/zOK/Xv6YxX/9/DGL/9fyxyz+G+SPWfw3zB+z+G+UP2bx3zh/zOK/Sf6YxX/T/DGL/9fzxyz+m+WPWfw3zx+z+G+RP2bx/0b+mMV/y/wxi/8388cs/lvlj1n8t84fs/hvkz9m8f9W/pjF/9v5Yxb/bfPHLP7b5Y9Z/LfPH7P475A/ZvHfMX/M4r9T/pjFf+f8MYv/LvljFv9d88cs/rvlj1n8v5M/ZvH/bv6YxX/3/DGL/x75Yxb/PfPHLP575Y9Z/L+XP2bx/37+mMX/B/ljFv+988cs/vvkj1n8f5g/ZvH/Uf6YxX/f/DGL/4/zxyz+++WPWfz3zx+z+B+QP2bx/0n+mMX/p/ljFv+f5Y9Z/A/MH7P4H5Q/ZvH/ef6Yxf8X+WMW/4Pzxyz+h+SPWfwPzR+z+P8yf8zi/6v8MYv/YfljFv/D88cs/r/OH7P4H5E/ZvH/Tf6Yxf/I/DGL/2/zxyz+v8sfs/gflT9m8f99/tg73n/YK2dH/0P+2Dvef0SjH50/ZvE/Jn/M4n9s/pjF/4/5Yxb/4/LHLP7H549Z/E/IH7P4/yl/zOL/5/wxi/9f8scs/ifmj1n8T8ofs/j/NX/M4n9y/pjF/5T8MYv/qfljFv/T8scs/qfnj1n8z8gfs/ifmT9m8T8rf8zif3b+mMX/nPwxi/+5+WMW//Pyxyz+5+ePWfwvyB+z+P8tf8zif2H+mMX/ovwxi//F+WMW/0vyxyz+l+aPWfwvyx+z+F+eP2bxvyJ/zOJ/Zf6Yxf/v+WMW/6vyxyz+V+ePWfyvyR+z+F+bP2bxvy5/zOJ/ff6Yxf+G/DGL/435Yxb/m/LHLP43549Z/G/JH7P435o/ZvG/LX/M4n97/pjF/478MYv/nfljFv+78scs/nfnj1n878kfs/jfmz9m8b8vf8zif3/+mMX/gfwxi/+D+WMW/4fyxyz+D+ePWfwfyR+z+D+aP2bxfyx/zOL/eP6Yxf+J/DGL/5P5Yxb/p/LHLP5P549Z/J/JH7P4P5s/ZvF/Ln/M4v98/pjF/4X8MYv/i/ljFv+X8scs/i/nj0n8hw7yxyz+Q/LHLP6j5Y9Z/EfPH7P4D80fs/iPkT9m8R8zf8ziP1b+mMV/WP6YxX/s/DGL/zj5Yxb/cfPHLP7j5Y9Z/MfPH7P4T5A/ZvGfMH/M4j9R/pjFf+L8MYv/JPljFv935Y+96v/8sS+/0jvV/935Y5b5P2n+mMX/PfljFv/J8scs/pPnj1n835s/ZvGfIn/M4v++/DGL//vzxyz+H8gfs/hPmT9m8Z8qf8ziP3X+mMX/g/ljFv9p8scs/tPmj1n8p8sfs/hPnz9m8Z8hf8zi/6H8MYv/jPljFv8P549Z/D+SP2bx/2j+mMX/Y/ljFv+P549Z/D+RP2bxnyl/zOI/c/6YxX+W/DGL/6z5Yxb/2fLHLP6z549Z/D+ZP2bxnyN/zOI/Z/6YxX+u/DGL/9z5Yxb/T+WPWfznyR+z+H86f8zi/5n8MYv/vPljFv/P5o9Z/OfLH7P4z58/ZvFfIH/M4r9g/pjFf6H8MYv/wvljFv9F8scs/ovmj1n8F8sfs/gvnj9m8f9c/pjF//Nv4m/eLiz+S8id3yiL/xfyxyz+S+aPWfy/mD9m8f9S/pjFf6n8MYv/0vljFv9l8scs/svmj1n8l8sfs/gvnz9m8f9y/pjFf4X8MYv/ivljFv+v5I9Z/FfKH7P4r5w/ZvFfJX/M4r9q/pjFf7X8MYv/6vljFv818scs/l/NH7P4r5k/ZvFfK3/M4r92/pjFf538MYv/uvljFv/18scs/uvnj1n8v5Y/ZvHfIH/M4r9h/pjFf6P8MYv/xvljFv9N8scs/pvmjw05a7+hg8HgHe//9fwxy/zfLH/M4r95/pjFf4v8MYv/N/LHLP5b5o9Z/L+ZP2bx3yp/zOK/df6YxX+b/DGL/7fyxyz+384fs/hvmz9m8d8uf8ziv33+mMV/h/wxi/+O+WMW/53yxyz+O+ePWfx3yR+z+O+aP2bx3y1/zOL/nfwxi/9388cs/rvnj1n898gfs/jvmT9m8d8rf8zi/738MYv/9/PHLP4/yB+z+O+dP2bx3yd/zOL/w/wxi/+P8scs/vvmj1n8f5w/ZvHfL3/M4r9//pjF/4D8MYv/T/LHLP4/zR+z+P8sf8zif2D+mMX/oPwxi//P88cs/r/IH7P4H5w/ZvE/JH/M4n9o/pjF/5f5Yxb/X+WPWfwPyx+z+B+eP2bx/3X+mMX/iPwxi/9v8scs/kfmj1n8f5s/ZvH/Xf6Yxf+o/DGL/+/zxyz+f8gfs/gfnT9m8T8mf8zif2z+mMX/j/ljFv/j8scs/sfnj1n8T8gfs/j/KX/M4v/n/DGL/1/yxyz+J+aPWfxPyh+z+P81f8zif3L+mMX/lPwxi/+p+WMW/9Pyxyz+p+ePWfzPyB+z+J+ZP2bxPyt/zOJ/dv6Yxf+c/DGL/7n5Yxb/8/LHLP7n549Z/C/IH7P4/y1/zOJ/Yf6Yxf+i/DGL/8X5Yxb/S/LHLP6X5o9Z/C/LH7P4X54/ZvG/In/M4n9l/pjF/+/5Yxb/q/LHLP5X549Z/K/JH7P4X5s/ZvG/Ln/M4n99/pjF/4b8MYv/jfljFv+b8scs/jfnj1n8b8kfs/jfmj9m8b8tf8zif3v+mMX/jvwxi/+d+WMW/7vyxyz+d+ePWfzvyR+z+N+bP2bxvy9/zOJ/f/6Yxf+B/DGL/4P5Yxb/h/LHLP4P549Z/B/JH7P4P5o/ZvF/LH/M4v94/pjF/4n8MYv/k/ljFv+n8scs/k/nj1n8n8kfs/g/mz9m8X8uf8zi/3z+mMX/hfwxi/+L+WMW/5fyxyz+L+ePSfzHGOSPWfyH5I9Z/EfLH7P4j54/ZvEfmj9m8R8jf8ziP2b+mMV/rPwxi/+w/DGL/9j5Yxb/cfLHLP7j5o9Z/MfLH7P4j58/ZvGfIH/M4j9h/pjFf6L8MYv/xPljFv9J8scs/u/KH7P4vzt/zOI/af6Yxf89+WMW/8nyxyz+k+ePWfzfmz9m8Z8if8zi/778MYv/+/PHLP4fyB+z+E+ZP2bxnyp/zOI/df6Yxf+D+WMW/2nyxyz+0+aPWfynyx+z+E+fP2bxnyF/zOL/ofwxi/+M+WMW/w/nj1n8P5I/ZvH/aP6Yxf9j+WMW/4/nj1n8P5E/ZvGfKX/M4j9z/pjFf5b8MYv/rPljFv/Z8scs/rPnj1n8P5k/ZvGfI3/M4j9n/pjFf678MYv/3PljFv9P5Y9Z/OfJH7P4fzp/zOL/mfwxi/+8+WMW/8/mj1n858sfs/jPnz9m8V8gf8ziv2D+mMV/ofwxi//C+WMW/0Xyxyz+i+aPWfwXyx+z+C+eP2bx/1z+mMX/8/ljFv8l8scs/l/IH7P4L5k/ZvH/Yv6Yxf9L+WMW/6Xyxyz+S+ePWfyXyR+z+C+bP2bxXy5/zOK/fP6Yxf/L+WMW/xXyxyz+K+aPWfy/kj9m8V8pf8ziv3L+mMV/lfwxi/+q+WMW/9Xyxyz+q+ePWfzXyB+z+H81f8ziv2b+mMV/rfwxi//a+WMW/3Xyxyz+6+aPWfzXyx+z+K+fP2bx/1r+mMV/g/wxi/+G+WMW/43yxyz+G+ePWfw3yR+z+G+aP2bx/3r+mMV/s/wxi//m+WMW/y3yxyz+38gfs/hvmT9m8f9m/pjFf6v8MYv/1vljFv9t8scs/t/KH7P4fzt/zOK/bf6YxX+7/DGL//b5Yxb/HfLHLP475o9Z/HfKH7P475w/ZvHfJX/M4r9r/pjFf7f8MYv/d/LHLP7fzR+z+O+eP2bx3yN/zOK/Z/6YxX+v/DGL//fyxyz+388fs/j/IH/M4r93/pjFf5/8MYv/D/PHLP4/yh+z+O+bP2bx/3H+mMV/v/wxi//++WMW/wPyxyz+P8kfs/j/NH/M4v+z/DGL/4H5Yxb/g/LHLP4/zx+z+P8if8zif3D+mMX/kPwxi/+h+WMW/1/mj1n8f5U/ZvE/LH/M4n94/pjF/9f5Yxb/I/LHLP6/yR+z+B+ZP2bx/23+mMX/d/ljFv+j8scs/r/PH7P4/yF/zOJ/dP6Yxf+Y/DGL/7H5Yxb/P+aPWfyPyx+z+B+fP2bxPyF/zOL/p/wxi/+f88cs/n/JH7P4n5g/ZvE/KX/M4v/X/DGL/8n5Yxb/U/LHLP6n5o9Z/E/LH7P4n54/ZvE/I3/M4n9m/pjF/6z8MYv/2fljFv9z8scs/ufmj1n8z8sfs/ifnz9m8b8gf8zi/7f8MYv/hfljFv+L8scs/hfnj1n8L8kfs/hfmj9m8b8sf8zif3n+mMX/ivwxi/+V+WMW/7/nj1n8r8ofs/hfnT9m8b8mf8zif23+mMX/uvwxi//1+WMW/xvyxyz+N+aPWfxvyh+z+N+cP2bxvyV/zOJ/a/6Yxf+2/DGL/+35Yxb/O/LHLP535o9Z/O/KH7P4350/ZvG/J3/M4n9v/pjF/778MYv//fljFv8H8scs/g/mj1n8H8ofs/g/nD9m8X8kf8zi/2j+mMX/sfwxi//j+WMW/yfyxyz+T+aPWfyfyh+z+D+dP2bxfyZ/zOL/bP6Yxf+5/DGL//P5Yxb/F/LHLP4v5o9Z/F/KH7P4v5w/JvEfc5A/ZvEfkj9m8R8tf8ziP3r+mMV/aP6YxX+M/DGL/5j5Yxb/sfLHLP7D8scs/mPnj1n8x8kfs/iPmz9m8R8vf8ziP37+mMV/gvwxi/+E+WMW/4nyxyz+E+ePWfwnyR+z+L8rf8zi/+78MYv/pPljFv/35I9Z/CfLH7P4T54/ZvF/71vwH/o/uV7/oVn8p2j+Yxb/9+WPWfzfnz9m8f9A/pjFf8r8MYv/VPljFv+p88cs/h/MH7P4T5M/ZvGfNn/M4j9d/pjFf/r8MYv/DPljFv8P5Y9Z/GfMH7P4fzh/zOL/kfwxi/9H88cs/h/LH7P4fzx/zOL/ifwxi/9M+WMW/5nzxyz+s+SPWfxnzR+z+M+WP2bxnz1/zOL/yfwxi/8c+WMW/znzxyz+c+WPWfznzh+z+H8qf8ziP0/+mMX/0/ljFv/P5I9Z/OfNH7P4fzZ/zOI/X/6YxX/+/DGL/wL5Yxb/BfPHLP4L5Y9Z/BfOH7P4L5I/ZvFfNH/M4r9Y/pjFf/H8MYv/5/LHLP6fzx+z+C+RP2bx/0L+mMV/yfwxi/8X88cs/l/KH7P4L5U/ZvFfOn/M4r9M/pjFf9n8MYv/cvljFv/l88cs/l/OH7P4r5A/ZvFfMX/M4v+V/DGL/0r5Y+9Q/yGjWI+5cv7YO9T/lV4//1fJH7P4r5o/ZvFfLX/M4r96/pjFf438MYv/V/PHLP5r5o9Z/NfKH7P4r50/ZvFfJ3/M4r9u/pjFf738MYv/+vljFv+v5Y9Z/DfIH7P4b5g/ZvHfKH/M4r9x/pjFf5P8MYv/pvljFv+v549Z/DfLH7P4b54/ZvHfIn/M4v+N/DGL/5b5Yxb/b+aPWfy3yh+z+G+dP2bx3yZ/zOL/rfwxi/+388cs/tvmj1n8t8sfs/hvnz9m8d8hf8ziv2P+mMV/p/wxi//O+WMW/13yxyz+u+aPWfx3yx+z+H8nf8zi/938MYv/7vljFv898scs/nvmj1n898ofs/h/L3/M4v/9/DGL/w/yxyz+e+ePWfz3yR+z+P8wf8zi/6P8MYv/vvljFv8f549Z/PfLH7P4758/ZvE/IH/M4v+T/DGL/0/zxyz+P8sfs/gfmD9m8T8of8zi//P8MYv/L/LHLP4H549Z/A/JH7P4H5o/ZvH/Zf6Yxf9X+WMW/8Pyxyz+h+ePWfx/nT9m8T8if8zi/5v8MYv/kfljFv/f5o9Z/H+XP2bxPyp/zOL/+/wxi/8f8scs/kfnj1n8j8kfs/gfmz9m8f9j/pjF/7j8MYv/8fljFv8T8scs/n/KH7P4/9nnv/1bWcji/xef/1vK4n9i/pjF/6T8MYv/X53+D/+7BSz+Jzv9/20W/1Pyxyz+p+aPWfxPyx+z+J+eP2bxPyN/zOJ/Zv6Yxf+s/DGL/9n5Yxb/c/LHLP7n5o9Z/M9z+c9xx1tc0OJ/vsv/LWfxvyB/zOL/t/wxi/+F+WMW/4vyxyz+F+ePWfwvyR+z+F+aP2bxvyx/zOJ/ef6Yxf+K/DGL/5X5Yxb/v+ePWfyvyh+z+F+dP2bxvyZ/zOJ/bf6Yxf+6/DGL//X5Yxb/G/LHLP435o9Z/G/KH7P435w/ZvG/JX/M4n9r/pjF/7b8MYv/7fljFv878scs/nfmj1n878ofs/jfnT9m8b8nf8zif2/+mMX/vvwxi//9+WMW/wfyxyz+D+aPWfwfyh+z+D+cP2bxfyR/zOL/aP6Yxf+x/DGL/+P5Y6/4DwbveP8n8h+MDddZ5v+T+WMW/6fyxyz+T+ePWfyfyR+z+D+bP2bxfy5/zOL/fP6Yxf+F/DGL/4v5Yxb/l/LHLP4v549J/Mca5I9Z/Ifkj1n8R8sfs/iPnj9m8R+aP2bxHyN/zOI/Zv6YxX+s/DGL/7D8MYv/2PljFv9x8scs/uPmj1n8x8sfs/iPnz9m8Z8gf8ziP2H+mMV/ovwxi//E+Y9s2D9dsvhPkj9m8X9X/pjF/935Yxb/SfPHLP7vyR+z+E+WP2bxnzx/zOL/3vwxi/8U+WMW//flj1n8358/ZvH/QP6YxX/K/DGL/1T5Yxb/qfPHLP4fzB+z+E+TP2bxnzZ/zOI/Xf7YO9F/8MLLr/R6/+nzx96J/jT/Z8gfs/h/KH/M4j9j/pjF/8P5Yxb/j+SPWfw/mj9m8f9Y/pjF/+P5Yxb/T+SPWfxnyh+z+M+cP2bxnyV/zOI/a/6YxX+2/DGL/+z5Yxb/T+aPWfznyB+z+M+ZP2bxnyt/zOI/d/6Yxf9T+WMW/3nyxyz+n84fs/h/Jn/M4j9v/pjF/7P5Yxb/+fLHLP7z549Z/BfIH7P4L5g/ZvFfKH/M4r9w/pjFf5H8MYv/ovljFv/F8scs/ovnj1n8P5c/ZvH/fP6YxX+J/DGL/xfyxyz+S+aPWfy/mD9m8f9S/pjFf6n8MYv/0vljFv9l8scs/svmj1n8l8sfs/gvnz9m8f9y/pjFf4X8MYv/ivljFv+v5I9Z/FfKH7P4r5w/ZvFfJX/M4r9q/pjFf7X8MYv/6vljFv818scs/l/NH7P4r5k/ZvFfK3/M4r92/pjFf538MYv/uvljFv/18scs/uvnj1n8v5Y/ZvHfIH/M4r9h/pjFf6P8MYv/xvljFv9N8scs/pvmj1n8v54/ZvHfLH/M4r95/pjFf4v8MYv/N/LHLP5b5o9Z/L+ZP2bx3yp/zOK/df6YxX+b/DGL/7fyxyz+384fs/hvmz9m8d8uf8ziv33+mMV/h/wxi/+O+WMW/53yxyz+O+ePWfx3yR+z+O+K/m0RFv/d0sYs/t/JH7P4fzd/zOK/e/6YxX+P/DGL/575Yxb/vfLHLP7fyx+z+H8/f8zi/4P8MYv/3kb/sf79Ihb/fYz+byGL/w/zxyz+P8ofs/jvmz9m8f9x/pjFf7/8MYv//vljFv8D8scs/j/JH7P4/zR/zOL/s/wxi/+B+WMW/4Pyxyz+P88fs/j/In/M4n9w/pjF/5D8MYv/ofljFv9f5o9Z/H+VP2bxPyx/zOJ/eP6Yxf/X+WMW/yPyxyz+v8kfs/gfmT9m8f9t/pjF/3f5Yxb/o/LHLP6/zx+z+P8hf8zif3T+mMX/mPwxi/+x+WMW/z/mj1n8j8sfs/gfnz9m8T8hf8zi/6f8MYv/n/PHLP5/yR+z+J+YP2bxPyl/zOL/1/wxi//J+WMW/1Pyxyz+p+aPWfxPyx+z+J+eP2bxPyN/zOJ/Zv6Yxf+s/DGL/9n5Yxb/c/LHLP7n5o9Z/M/LH7P4n58/ZvG/IH/M4v+3/DGL/4X5Yxb/i/LHLP4X549Z/C/JH7P4X5o/ZvG/LH/M4n95/pjF/4r8MYv/lfljFv+/549Z/K/KH7P4X50/ZvG/Jn/M4n9t/pjF/7r8MYv/9fljFv8b8scs/jfmj1n8b8ofs/jfnD9m8b8lf8zif2v+mMX/tvwxi//t+WMW/zvyxyz+d+aPWfzvyh+z+N+dP2bxvyd/zOJ/b/6Yxf++/DGL//35Yxb/B/LHLP4P5o9Z/B/KH7P4P5w/ZvF/JH/M4v9o/pjF/7H8MYv/4/ljFv8n8scs/k/mj1n8n8ofs/g/nT9m8X8mf8zi/2z+mMX/ufwxi//z+WMW/xfyxyz+L+aPWfxfyh+z+L+cPybxHzbIH7P4D8kfs/iPlj9m8R89f8ziPzR/zOI/Rv6YxX/M/DGL/1j5Yxb/YfljFv+x88cs/uPkj1n8x80fs/iPlz9m8R8/f8ziP0H+mMV/wvwxi/9E+WMW/4nzxyz+k+SPWfzflT9m8X93/pjFf9L8MYv/e/LHLP6T5Y9Z/CfPH7P4vzd/zOI/Rf6Yxf99+WMW//fnj1n8P5A/ZvGfMn/M4j9V/pjFf+r8MYv/B/PHLP7T5I9Z/KfNH7P4T5c/ZvGfPn/M4j9D/pjF/0P5Yxb/GfPHLP4fzh+z+H8kf8zi/9H8MYv/x/LHLP4fzx+z+H8if8ziP1P+mMV/5vwxi/8s+WMW/1nzxyz+s+WPWfxnzx+z+H8yf8ziP0f+mMV/zvwxi/9c+WMW/7nzxyz+n8ofs/jPkz9m8f90/pjF/zP5Yxb/efPHLP6fzR+z+M+XP2bxnz9/zOK/QP6YxX/B/DGL/0L5Yxb/hfPHLP6L5I9Z/BfNH7P4L5Y/ZvFfPH/M4v+5/DGL/+fzxyz+S+SPWfy/kD9m8V8yf8zi/8X8MYv/l/LHLP5L5Y9Z/JfOH7P4L5M/ZvFfNn/M4r9c/pjFf/n8MYv/l/PHLP4r5I9Z/FfMH7P4fyV/zOK/Uv6YxX/l/DGL/yr5Yxb/VfPHLP6r5Y9Z/FfPH7P4r5E/ZvH/av6YxX/N/DGL/1r5Yxb/tfPHLP7r5I9Z/NfNH7P4r5c/ZvFfP3/M4v+1/DGL/wb5Yxb/DfPHLP4b5Y9Z/DfOH7P4b5I/ZvHfNH/M4v/1/DGL/2b5Yxb/zfPHLP5b5I9Z/L+RP2bx3zJ/zOL/zfwxi/9W+WMW/63zxyz+2+SPWfy/lT9m8f92/pjFf9v8MYv/dvljFv/t88cs/jvkj1n8d8wfs/jvlD9m8d85f8ziv0v+mMV/1/wxi/9u+WMW/+/kj1n8v5s/ZvHfPX/M4r9H/pjFf8/8MYv/XvljFv/v5Y9Z/L+fP2bx/0H+mMV/7/wxi/8++WMW/x/mj1n8f5Q/ZvHfN3/M4v/j/DGL/375Yxb//fPHLP4H5I9Z/H+SP2bx/2n+mMX/Z/ljFv8D88cs/gflj1n8f54/ZvH/Rf6Yxf/g/DGL/yH5Yxb/Q/PHLP6/zB+z+P8qf8zif1j+mMX/8Pwxi/+v88cs/kfkj1n8f2PxX/Ox/9LiFv8jLf7/xSz+v80fs/j/Ln/M4n9U/pjF//f5Yxb/P+SPWfyPzh+z+B+TP2bxPzZ/zOL/x/wxi/9x+WMW/+Pzxyz+J+SPWfz/lD9m8f9z/pjF/y/5Yxb/E/PHLP4n5Y9Z/P+aP2bxPzl/zOJ/Sv6Yxf/U/DGL/2n5Yxb/0/PHLP5n5I9Z/M/MH7P4n5U/ZvE/O3/M4n9O/pjF/9z8MYv/efljFv/z88cs/hfkj1n8/5Y/ZvG/MH/M4n9R/pjF/+L8MYv/JfljFv9L88cs/pflj1n8L88fs/hfkT9m8b8yf8zi//f8MYv/VfljFv+r88cs/tfkj1n8r80fs/hflz9m8b8+f8zif0P+mMX/xvwxi/9N+WMW/5vzxyz+t+SPWfxvzR+z+N+WP2bxvz1/zOJ/R/6Yxf/O/DGL/135Yxb/u/PHLP735I9Z/O/NH7P435c/ZvG/P3/M4v9A/pjF/8H8MYv/Q/ljFv+H88cs/o/kj1n8H80fs/g/lj9m8X88f8zi/0T+mMX/yfwxi/9T+WMW/6fzxyz+z+SPWfyfzR+z+D+XP2bxfz5/zOL/Qv6Yxf/F/DGL/0v5Yxb/l/PHJP5jD/LHLP5D8scs/qPlj1n8R88fs/gPzR+z+I+RP2bxHzN/zOI/Vv6YxX9Y/pjFf+z8MYv/OPljFv9x88cs/uPlj1n8x88fs/hPkD9m8Z8wf8ziP1H+mMV/4vwxi/8k+WMW/3flj1n8350/ZvGfNH/M4v+e/DGL/2T5Yxb/yfPHLP7vzR+z+E+RP2bxf1/+mMX//fljFv8P5I9Z/KfMH7P4T5U/ZvGfOn/M4v/B/DGL/zT5Yxb/afPHLP7T5Y9Z/KfPH7P4z5A/ZvH/UP6YxX/G/DGL/4fzxyz+H8kfs/h/NH/M4v+x/DGL/8fzxyz+n8gfs/jPlD9m8Z85f8ziP0v+mMV/1vwxi/9s+WOv+E81GAze4f6z549Z5v8n88cs/nPkj1n858wfs/jPlT9m8Z87f8zi/6n8MYv/PPljFv9P549Z/D+TP2bxnzd/zOL/2fwxi/98+WMW//nzxyz+C+SPWfwXzB+z+C+UP2bxXzh/zOK/SP6YxX/R/DGL/2L5Yxb/xfPHLP6fyx+z+H8+f8ziv0T+mMX/C/ljFv8l88cs/l/MH7P4fyl/zOK/VP6YxX/p/DGL/zL5Yxb/ZfPHLP7L5Y9Z/JfPH7P4fzl/zOK/Qv6YxX/F/DGL/1fyxyz+K+WPWfxXzh+z+K+SP2bxXzV/zOK/Wv6YxX/1/DGL/xr5Yxb/r+aPWfzXzB+z+K+VP2bxXzt/zOK/Tv6YxX/d/DGL/3r5Yxb/9fPHLP5fyx+z+G+QP2bx3zB/zOK/Uf6YxX/j/DGL/yb5Yxb/TfPHLP5fzx+z+G+WP2bx3zx/zOK/Rf6Yxf8b+WMW/y3zxyz+38wfs/hvlT9m8d86f8ziv03+mMX/W/ljFv9v549Z/LfNH7P4b5c/ZvHfPn/M4r9D/pjFf8f8MYv/TvljFv+d88cs/rvkj1n8d80fs/jvlj9m8f9O/pjF/7v5Yxb/3fPHhpy131Mjz76j/ffIH7PM/z3zxyz+e+WPWfy/lz9m8f9+/pjF/wf5Yxb/vfPHLP775I9Z/H+YP2bx/1H+mMV/3/wxi/+P88cs/vvlj1n8988fs/gfkD9m8f9J/pjF/6f5Yxb/n+WPWfwPzB+z+B+UP2bx/3n+mMX/F/ljFv+D88cs/ofkj1n8D80fs/j/Mn/M4v+r/DGL/2H5Yxb/w/PHLP6/zh+z+B+RP2bx/03+mMX/yPwxi/9v88cs/r/LH7P4H5U/ZvH/ff6Yxf8P+WMW/6Pzxyz+x+SPWfyPzR+z+P8xf8zif1z+mMX/+Pwxi/8J+WMW/z/lj1n8/5w/ZvH/S/6Yxf/E/DGL/0n5Yxb/v+aPWfxPzh+z+J+SP2bxPzV/zOJ/Wv6Yxf/0/DGL/xn5Yxb/M/PHLP5n5Y9Z/M/OH7P4n5M/ZvE/N3/M4n9e/pjF//z8MYv/BfljFv+/5Y9Z/C/MH7P4X5Q/ZvG/OH/M4n9J/pjF/9L8MYv/ZfljFv/L88cs/lfkj1n8r8wfs/j/PX/M4n9V/pjF/+r8MYv/NfljFv9r88cs/tflj1n8r88fs/jfkD9m8b8xf8zif1P+mMX/5vwxi/8t+WMW/1vzxyz+t+WPWfxvzx+z+N+RP2bxvzN/zOJ/V/6Yxf/u/DGL/z35Yxb/e/PHLP735Y9Z/O/PH7P4P5A/ZvF/MH/M4v9Q/pjF/+H8MYv/I/ljFv9H88cs/o/lj1n8H88fs/g/kT9m8X8yf8zi/1T+mMX/6fwxi/8z+WMW/2fzxyz+z+WPWfyfzx+z+L+QP2bxfzF/zOL/Uv6Yxf/l/DGJ/ziD/DGL/5D8MYv/aPljFv/R88cs/kPzxyz+Y+SPWfzHzB+z+I+VP2bxH5Y/ZvEfO3/M4j9O/pjFf9z8MYv/ePljFv/x88cs/hPkj1n8J8wfs/hPlD9m8Z84f8ziP0n+mMX/XfljFv93549Z/CfNH7P4vyd/zOI/Wf6YxX/y/DGL/3vzxyz+U+SPWfzflz9m8X9//pjF/wP5Yxb/KfPHLP5T5Y9Z/KfOH7P4fzB/zOI/Tf6YxX/a/DGL/3T5Yxb/6fPHLP4z5I9Z/D+UP2bxnzF/zOL/4fwxi/9H8scs/h/NH7P4fyx/zOL/8fwxi/8n8scs/jPlj1n8Z84fs/jPkj9m8Z81f8ziP1v+mMV/9vwxi/8n88cs/nPkj1n858wfs/jPlT9m8Z87f8zi/6n8MYv/PPljFv9P549Z/D+TP2bxnzd/zOL/2fwxi/98+WMW//nzxyz+C+SPWfwXzB+z+C+UP2bxXzh/zOK/SP6YxX/R/DGL/2L5Yxb/xfPHLP6fyx+z+H8+f8ziv0T+mMX/C/ljFv8l88cs/l/MH7P4fyl/zOK/VP6YxX/p/DGL/zL5Yxb/ZfPHLP7L5Y9Z/JfPH7P4fzl/zOK/Qv6YxX/F/DGL/1fyxyz+K+WPWfxXzh+z+K+SP2bxXzV/zOK/Wv6YxX/1/DGL/xr5Yxb/r+aPWfzXzB+z+K+VP2bxXzt/zOK/Tv6YxX/d/DGL/3r5Yxb/9fPHLP5fyx+z+G+QP2bx3zB/zOK/Uf6YxX/j/DGL/yb5Yxb/TfPHLP5fzx+z+G+WP2bx3zx/zOK/Rf6Yxf8b+WMW/y3zxyz+38wfs/hvlT9m8d86f8ziv03+mMX/W/ljFv9v549Z/LfNH7P4b5c/ZvHfPn/M4r9D/pjFf8f8MYv/TvljFv+d88cs/rvkj1n8d80fs/jvlj9m8f9O/pjF/7v5Yxb/3fPHLP575I9Z/PfMH7P475U/ZvH/Xv6Yxf/7+WMW/x/kj1n8984fs/jvkz9m8f9h/pjF/0f5Yxb/ffPHLP4/zh+z+O+XP2bx3z9/zOJ/QP6Yxf8n+WMW/5/mj1n8f5Y/ZvE/MH/M4n9Q/pjF/+f5Yxb/X+SPWfwPzh+z+B+SP2bxPzR/zOL/y/wxi/+v8scs/oflj1n8D88fs/j/On/M4n9E/pjF/zf5Yxb/I/PHLP6/zR+z+P8uf8zif1T+mMX/9/ljFv8/5I9Z/I/OH7P4H5M/ZvE/Nn/M4v/H/DGL/3H5Yxb/4/PHLP4n5I9Z/P+UP2bx/3P+mMX/L/ljFv8T88cs/iflj1n8/5o/ZvE/OX/M4n9K/pjF/9T8MYv/afljFv/T88cs/mfkj1n8z8wfs/iflT9m8T87f8zif07+mMX/3Pwxi/95+WMW//Pzxyz+F+SPWfz/lj9m8b8wf8zif1H+mMX/4vwxi/8l+WMW/0vzxyz+l+WPWfwvzx+z+F+RP2bxvzJ/zOL/9/wxi/9V+WMW/6vzxyz+1+SPWfyvzR+z+F+XP2bxvz5/zOJ/Q/6Yxf/G/DGL/035Yxb/m/PHLP635I9Z/G/NH7P435Y/ZvG/PX/M4n9H/oPB6P96lcX/zvwxi/9d+WMW/7vzxyz+9+SPWfzvzR+z+N+XP2bxvz9/zOL/QP6Yxf/B/DGL/0P5Yxb/h/PHLP6P5I9Z/B/NH7P4P5Y/ZvF/PH/M4v9E/pjF/8n8MYv/U/ljFv+n88cs/s/kj1n8n80fs/g/lz9m8X8+f8zi/0L+mMX/xfwxi/9L+WMW/5fzxyT+4w7yxyz+Q/LHLP6j5Y9Z/EfPH7P4D80fs/iPkT9m8R8zf8ziP1b+mMV/WP6YxX/s/DGL/zj5Yxb/cfPHLP7j5Y9Z/MfPH7P4T5A/ZvGfMH/M4j9R/pjFf+L8MYv/JPljFv935Y9Z/N+dP2bxnzR/zOL/nvwxi/9k+WMW/8nzxyz+780fs/hPkT9m8X9f/pjF//35Yxb/D+SPWfynzB+z+E+VP2bxnzp/zOL/wfwxi/80+WMW/2nzxyz+0+WPWfynzx+z+M+QP2bx/1D+mMV/xvwxi/+H88cs/h/JH7P4fzR/zOL/sfwxi//H88cs/p/IH7P4z5Q/ZvGfOX/M4j9L/pjFf9b8MYv/bPljFv/Z88cs/p/MH7P4z5E/ZvGfM3/M4j9X/pjFf+78MYv/p/LHLP7z5I9Z/D+dP2bx/0z+mMV/3vwxi/9n88cs/vPlj1n8588fs/gvkD9m8V8wf8ziv1D+mMV/4fwxi/8i+WMW/0Xzxyz+i+WPWfwXzx+z+H8uf8zi//n8MYv/EvljFv8v5I9Z/JfMH7P4fzF/zOL/pfwxi/9S+WMW/6Xzxyz+y+SPWfyXzR+z+C+XP2bxXz5/zOL/5fwxi/8K+WMW/xXzxyz+X8kfs/ivlD9m8V85f8ziv0r+mMV/1fwxi/9q+WMW/9Xzxyz+a+SPWfy/mj9m8V8zf8ziv1b+mMV/7fwxi/86+WMW/3Xzxyz+6+WPWfzXzx+z+H8tf8ziv0H+mMV/w/wxi/9G+WMW/43zxyz+m+SPWfw3zR+z+H89f8ziv1n+mMV/8/wxi/8W+WMW/2/kj1n8t8wfs/h/M3/M4r9V/pjFf+v8sXeu/xUvv95/m/yxd67/P8//b+WPWfy/nT9m8d82f8ziv13+mMV/+/wxi/8O+WMW/x3zxyz+O+WPWfx3zh+z+O+SP2bx3zV/zOK/W/6Yxf87+WMW/+/mj1n8d88fs/jvkT9m8d8zf8ziv1f+mMX/e/ljFv/v549Z/H+QP2bx3zt/zOK/T/6Yxf+H+WMW/x/lj1n8980fs/j/OH/M4r9f/pjFf//8MYv/AfljFv+f5I9Z/H+aP2bx/1n+mMX/wPwxi/9B+WMW/5/nj1n8f5E/ZvE/OH/M4n9I/pjF/9D8MYv/L/PHLP6/yh+z+B+WP2bxPzx/zOL/6/wxi/8R+WMW/9/kj1n8j8wfs/j/Nn/M4v+7/DGL/1H5Yxb/3+ePWfz/kD9m8T86f8zif0z+mMX/2Pwxi/8f88cs/sflj1n8j88fs/ifkD9m8f9T/pjF/8/5Yxb/v+SPWfxPzB+z+J+UP/aq/2DYYPBO9v9r/phl/p+cP2bxPyV/zOJ/av6Yxf+0/DGL/+n5Yxb/M/LHLP5n5o9Z/M/KH7P4n50/ZvE/J3/M4n9u/pjF/7z8MYv/+fljFv8L8scs/n/LH7P4X5g/ZvG/KH/M4n9x/pjF/5L8MYv/pfljFv/L8scs/pfnj1n8r8gfs/hfmT9m8f/7v/q3OYj8rwocs/hfnT9m8b8mf8zif23+mMX/uvwxi//1+WMW/xvyxyz+N+aPWfxvyh+z+N+cP2bxvyV/zOJ/a/6Yxf+2/DGL/+35YyP8B4PBDu9s/zvyxyzz/878MYv/XfljFv+788cs/vfkj1n8780fs/jflz9m8b8/f8zi/0D+mMX/wfwxi/9D+WMW/4fzxyz+j+SPWfwfzR+z+D+WP2bxfzx/zOL/RP6Yxf/J/DGL/1P5Yxb/p/PHLP7P5I9Z/J/NH7P4P5c/ZvF/Pn/M4v9C/pjF/8X8MYv/S/ljFv+X88ck/uMN8scs/kPyx97J/q/zHm+0/LF3sv/r5//o+WMW/6H5Yxb/Md7A/+prRl/tf2vV/hOz+I/Z/Mcs/mPlj1n8h+WPWfzHzh+z+I+TP2bxHzd/zOI/Xv6YxX/8/P+lHUT+E+SPWfwnzB+z+E+UP2bxnzh/zOI/Sf6Yxf9d+WMW/3fnj1n8J80fs/i/J3/M4j9Z/pjFf/L8MYv/e/PHLP5T5I9Z/N+XP2bxf3/+mMX/A/ljFv8p88cs/lPlj1n8p84fs/h/MH/M4j9N/pjFf9r8MYv/dPljFv/p88cs/jPkj1n8P5Q/ZvGfMX/M4v/h/DGL/0fyxyz+H80fs/h/LH/M4v/x/DGL/yfyxyz+M+WPWfxnzh+z+M+SP2bxnzV/zOI/W/6YxX/2/DGL/yfzxyz+c+SPWfznzB+z+M+VP2bxnzt/zOL/qfwxi/88+WMW/0/nj1n8P5M/ZvGfN3/M4v/Z/DGL/3z5Yxb/+fPHLP4L5I9Z/BfMH7P4L5Q/ZvFfOH/M4r9I/pjFf9H8MYv/YvljFv/F88cs/p/LH7P4fz5/zOK/RP6Yxf8L+WMW/yXzxyz+X8wfs/h/KX/M4r9U/pjFf+n8MYv/MvljFv9l88cs/svlj1n8l88fs/h/OX/M4r9C/pjFf8X8MYv/V/LHLP4r5Y9Z/FfOH7P4r5I/ZvFfNX/M4r9a/pjFf/X8MYv/GvljFv+v5o9Z/NfMH7P4r2X0fwsP2OK/ttH/LWTxXyd/zOK/bv6YxX+9/DGL//r5Yxb/r+WPWfw3yB+z+G+YP2bx3yh/zOK/cf6YxX+T/DGL/6b5Yxb/r+ePWfw3yx+z+G+eP2bx3yJ/zOL/jfwxi/+W+WMW/2/mj1n8t8ofs/hvnT9m8d8mf8zi/638MYv/t/PHLP7b5o9Z/LfLH7P4b58/ZvHfIX/M4r9j/pjFf6f8MYv/zvljFv9d8scs/rvmj1n8d8sfs/h/J3/M4v/d/DGL/+75Yxb/PfLHLP575o9Z/PfKH7P4fy9/zOL//fwxi/8P8scs/nvnj1n898kfs/j/MH/M4v+j/DGL/775Yxb/H+ePWfz3yx+z+O+fP2bxPyB/zOL/k/wxi/9P88cs/j/LH7P4H5g/ZvE/KH/M4v/z/DGL/y/yxyz+B+ePWfwPyR+z+B+aP2bx/2X+mMX/V/ljFv/D8scs/ofnj1n8f50/ZvE/In/M4v+b/DGL/5H5Yxb/3+aPWfx/lz9m8T8qf8zi//v8MYv/H/LHLP5H549Z/I/JH7P4H5s/ZvH/Y/6Yxf+4/DGL//H5Yxb/E/LHLP5/yh+z+P85f8zi/5f8MYv/ifljFv+T8scs/n/NH7P4n5w/ZvE/JX/M4n9q/pjF/7T8MYv/6fljFv8z8scs/mfmj1n8z8ofs/ifnT9m8T8nf8zif27+mMX/vPwxi//5+WMW/wvyxyz+f8sfs/hfmD9m8b8of8zif3H+mMX/kvwxi/+l+WMW/8vyxyz+l+ePWfyvyB+z+F+ZP2bx/3v+mMX/qvwxi//V+WMW/2vyxyz+1+aPWfyvyx+z+F+fP2bxvyF/zOJ/Y/6Yxf+m/DGL/835Yxb/W/LHLP635o9Z/G/LH7P4354/ZvG/I3/M4n9n/pjF/678MYv/3fljFv978scs/vfmj1n878sfs/jfnz9m8X8gf8zi/2D+mMX/ofwxi//D+WMW/0fyxyz+j+aPWfwfyx+z+D+eP2bxfyJ/zOL/ZP6Yxf+p/DGL/9P5Yxb/Z/LHLP7P5o9Z/J/LH7P4P58/ZvF/IX/M4v9i/pjF/6X8MYv/y/ljEv/xB/ljFv8h+WMW/9Hyxyz+o+ePWfyH5o9Z/MfIH7P4j5k/ZvEfK3/M4j8sf8ziP3b+mMV/nPwxi/+4+WMW//Hyxyz+4+ePWfwnyB+z+E+YP2bxnyh/zOI/cf6YxX+S/DGL/7vyxyz+784fs/hPmj9m8X9P/pjFf7L8MYv/5PljFv/35o9Z/KfIH7P4vy9/zOL//vwxi/8H8scs/lPmj1n8p8ofs/hPnT9m8f9g/pjFf5r8MYv/tPljFv/p8scs/tPnj1n8Z8gfs/h/KH/M4j9j/pjF/8P5Yxb/j+SPWfw/mj9m8f9Y/pjF/+P5Yxb/T+SPWfxnyh+z+M+cP2bxnyV/zOI/a/6YxX+2/DGL/+z5Yxb/T+aPWfznyB+z+M+ZP2bxnyt/zOI/d/6Yxf9T+WMW/3nyxyz+n84fs/h/Jn/M4j9v/pjF/7P5Yxb/+fLHLP7z549Z/BfIH7P4L5g/ZvFfKH/M4r9w/pjFf5H8MYv/ovljFv/F8scs/ovnj1n8P5c/ZvH/fP6YxX+J/DGL/xfyxyz+S+aPWfy/mD9m8f9S/pjFf6n8MYv/0vljFv9l8scs/svmj1n8l8sfs/gvnz9m8f9y/pjFf4X8MYv/ivljFv+v5I9Z/FfKH7P4r5w/ZvFfJX/M4r9q/pjFf7X8MYv/6vljFv818scs/l/NH7P4r5k/ZvFfK3/M4r92/pjFf538MYv/uvljFv/18scs/uvnj1n8v5Y/ZvHfIH/M4r9h/pjFf6P8MYv/xvljFv9N8scs/pvmj1n8v54/ZvHfLH/M4r95/pjFf4v8MYv/N/LHLP5b5o9Z/L+ZP2bx3yp/zOK/df6YxX8bq/+wN7/Z4v8tq/+/yeL/7fwxi/+2+WMW/+3yxyz+2+ePWfx3yB+z+O+YP2bx3yl/zOK/c/6YxX+X/DGL/675Yxb/3fLHLP7fyR+z+H83f8ziv3v+mMV/j/wxi/+e+WMW/73yxyz+38sfs/h/P3/M4v+D/DGL/975Yxb/ffLH3qn+w0bx/2H+2DvVfzCK/4/yxyz+++aPWfx/nD9m8d8vf8ziv3/+mMX/gPwxi/9P8scs/j/NH7P4/yx/zOJ/YP6Yxf+g/DGL/8/zxyz+v8gfs/gfnD9m8T8kf8zif2j+mMX/l/ljFv9f5Y9Z/A/LH7P4H54/ZvH/df6Yxf+I/DGL/2/yxyz+R+aPWfx/mz9m8f9d/pjF/6j8MYv/7/PHLP5/yB+z+B+dP2bxPyZ/zOJ/bP6Yxf+P+WMW/+Pyxyz+x+ePWfxPyB+z+P8pf8zi/+f8MYv/X/LHLP4n5o9Z/E/KH7P4/1XpP+zfLmHxP1np/++z+J+SP2bxPzV/zOJ/Wv6Yxf/0/DGL/xn5Yxb/M/PHLP5n5Y9Z/M/OH7P4n5M/ZvE/N3/M4n9e/pjF//z8MYv/BfljFv+/5Y9Z/C/MH7P4X5Q/ZvG/OH/M4n9J/pjF/9L8MYv/ZfljFv/L88cs/lfkj1n8r8wfs/j/PX/M4n9V/pjF/+r8MYv/NfljFv9r88cs/tflj1n8r88fs/jfkD9m8b8xf8zif1P+mMX/5vwxi/8t+WMW/1vzxyz+t+WPWfxvzx+z+N+RP2bxvzN/zOJ/V/6Yxf/u/DGL/z35Yxb/e/PHLP735f9KU49y2eJ/f/6Yxf+B/DGL/4P5Yxb/h/LHLP4P549Z/B/JH7P4P5o/ZvF/LH/M4v94/pjF/4n8MYv/k/ljFv+n8scs/k/nj1n8n8kfs/g/mz9m8X8uf8zi/3z+mMX/hfwxi/+L+WMW/5fyxyz+L+ePSfwnGOSPWfyH5I9Z/EfLH7P4j54/ZvEfmj9m8R8jf8ziP2b+mMV/rPwxi/+w/DGL/9j5Yxb/cfLHLP7j5o9Z/MfLH7P4j58/ZvGfIH/M4j9h/pjFf6L8MYv/xPljFv9J8scs/u/KH7P4vzt/zOI/af6Yxf89+WMW/8nyxyz+k+ePWfzfmz9m8Z8if8zi/778MYv/+/PHLP4fyB+z+E+ZP2bxnyp/zOI/df6Yxf+D+WMW/2nyxyz+0+aPWfynyx+z+E+fP2bxnyF/zOL/ofwxi/+M/+z/8uj/6yv2n5nF/8PNf8zi/5H8MYv/R/PHLP4fyx+z+H88f8zi/4n8MYv/TPljFv+Z88cs/rPkj1n8Z80fs/jPlj9m8Z89f8zi/8n8MYv/HPljFv8588cs/nPlj1n8584fs/h/Kn/M4j9P/pjF/9Ov+rcR/FMW/89Ej1n8580fs/h/Nn/M4j9f/pjFf/78MYv/AvljFv8F88cs/gvlj1n8F84fs/gvkj9m8V80f8ziv1j+mMV/8fwxi//n8scs/p/PH7P4L5E/ZvH/Qv6YxX/J/DGL/xfzxyz+X8ofs/gvlT9m8V86f8ziv0z+mMV/2fwxi/9y+WMW/+Xzxyz+X84fs/ivkD9m8V8xf8zi/5X8MYv/SvljFv+V88cs/qvkj1n8V80fs/ivlj9m8V89f8ziv0b+mMX/q/ljFv8188cs/mvlj1n8184fs/ivkz825Kz9VpxwxNl3tP+6+WOW+b9e/pjFf/38MYv/1/LHLP4b5I9Z/DfMH7P4b5Q/ZvHfWO+/PV5r8d9E789Z/DfNH7P4fz1/zOK/Wf6YxX/z/DGL/xb5Yxb/b+SPWfy3zB+z+H8zf8ziv1X+mMV/6/wxi/82+WMW/2/lj1n8v50/ZvHfNn/M4r9d/pjFf/v8MYv/DvljFv8d88cs/jvlj1n8d84fs/jvkj9m8d81f8ziv1v+mMX/O/ljFv/v5o9Z/HfPH7P475E/ZvHfM3/M4r9X/pjF/3v5Yxb/7+ePWfx/kD9m8d87f8ziv0/+mMX/h/ljFv8f5Y9Z/PfNH7P4/zh/zOK/X/6YxX///DGL/wH5Yxb/n+SPWfx/mj9m8f9Z/pjF/8D8MYv/QfljFv+f549Z/H+RP2bxPzh/zOJ/SP6Yxf/Q/DGL/y/zxyz+v8ofs/gflj9m8T88f8zi/+v8MYv/EfljFv/f5I9Z/I/MH7P4/zZ/zOL/u/wxi/9R+WMW/9/nj1n8/5A/ZvE/On/M4n9M/pjF/9j8MYv/H/PHLP7H5Y9Z/I/PH7P4n5A/ZvH/U/6Yxf/P+WMW/7/kj1n8T8wfs/iflD9m8f9r/pjF/+T8MYv/KfljFv9T88cs/qflj1n8T88fs/ifkT9m8T8zf8zif1b+mMX/7Pwxi/85+WMW/3Pzxyz+5+WPWfzPzx+z+F+QP2bx/1v+mMX/wvwxi/9F+WMW/4vzxyz+l+SPWfwvzR+z+F+WP2bxvzx/zOJ/Rf6Yxf/K/DGJ/5DBYIf8IYn/BFc1/zGL/9X5Yxb/a/LHLP7X5o9Z/K/LH7P4X58/ZvG/IX/M4n9j/pjF/6b8MYv/zfljFv9b8scs/rfmj1n8b8sfs/jfnj9m8b8jf8zif2f+mMX/rvwxi//d+WMW/3vyxyz+9+aPWfzvyx+z+N+fP2bxfyB/zOL/YP6Yxf+h/DGL/8P5Yxb/R/LHLP6P5o9Z/B/LH7P4P54/ZvF/In/M4v9k/pjF/6n8MYv/0/ljFv9n8scs/s/mj1n8n8sfs/g/nz9m8X8hf8zi/2L+mMX/pfwxi//L+WMS/wkH+WMW/yH5Yxb/0fLHLP6j549Z/Ifmj1n8x8gfs/iPmT9m8R8rf8ziPyx/zOI/dv6YxX+c/DGL/7j5Yxb/8fLHLP7j549Z/CfIH7P4T/j/sXP/4VrX9R3Hb36T5fRjm7q04dCYazMSGY1aiIri8ccpE838jXoEEkR+SIKpuNFKHZsudbNkUwvHnK1a4nBz/VrRsKzZGrG1yimuhTHmYKE5Y9eBc4hz9vZcnS/7fi3ej8cfcO77+L5DntfL++biutI/lKX/vvqHsvQv+oey9N9P/1CW/q/UP5Sl/8/qH8rS/+f0D2Xpv7/+oSz9D9A/lKX/gfqHsvT/ef1DWfq/Sv9Qlv4H6R/K0v9g/UNZ+r9a/1CW/r+gfyhL/xH6h7L0P0T/UJb+v6h/KEv/kfqHsvQ/VP9Qlv6H6R/K0v81+oey9B+lfyhL/1/SP5Sl/+H6h7L0/2X9Q1n6v1b/UJb+v6J/KEv/X9U/lKX/EfqHsvR/nf6hLP1H6x/K0v/1+oey9D9S/1CW/mP0D2Xpf5T+oSz9x+ofytL/1/QPZek/Tv9Qlv5v0D+Upf+v6x/K0n+8/qEs/d+ofyhL/zfpH8rS/zf0D2Xp/2b9Q1n6T9A/lKX/0fqHsvSfqH8oS/9j9A9l6X+s/qEs/Y/TP5Sl/yT9Q1n6H69/KEv/E/QPZek/Wf9Qlv4n6h/K0r9N/1CW/ifpH8rS/2T9Q1n6n6J/KEv/U/UPZenfrn8oS/+36B/K0v+t+oey9D9N/1CW/m/TP5Sl/+n6h7L0n6J/KEv/M/QPZel/pv6hLP3frn8oS/+z9A9l6f8O/UNZ+p+tfyhL/3P0D2Xpf67+oSz9z9M/lKX/+fqHsvS/QP9Qlv4X6h/K0n+q/qEs/S/SP5Sl/8X6h7L0v0T/UJb+HfqHsvS/VP9Qlv7T9A9l6T9d/1CW/jP0D2Xp/079Q1n6X6Z/KEv/mfqHsvSfpX8oS//L9Q9l6T9b/1CW/lfoH8rSf47+oSz95+ofytJ/nv6hLP3n6x/K0v9K/UNZ+i/QP5Sl/7v0D2Xpf5X+oSz9F+ofytJ/kf6hLP2v1j+Upf+79Q9l6X+N/qEs/a/VP5Sl/3X6h7L0X6x/KEv/6/UPZen/m/qHsvT/Lf1DWfov0T+Upf979A9l6f/b+oey9H+v/qEs/d+nfyhL/xv0D2Xpf6P+oSz9b9I/lKX/7+gfytJ/qf6hLP1/V/9Qlv6/p38oS/+b9Q9l6X+L/qEs/X9f/1CW/u/XP5Sl/636h7L0v03/UJb+t+sfytL/D/QPZen/h/qHsvS/Q/9Qlv4f0D+Upf8H9Q9l6X+n/qEs/ZfpH8rS/4/0D2Xp/8f6h7L0v0v/UJb+d+sfytL/Hv1DWfp/SP9Qlv4f1j+Upf/y3v1HNPzr+gmVpf+99h/K0v9P9A9l6b9C/1CW/n+qfyhL//v0D2Xp/2f6h/bE/oO6vty1//36h/bE/tH+P6J/KEv/P9c/lKX/R/UPZen/Mf1DWfp/XP9Qlv5/oX8oS/9P6B/K0v8B/UNZ+q/UP5Sl/4P6h7L0/0v9Q1n6r9I/lKX/Q/qHsvT/K/1DWfr/tf6hLP0f1j+Upf/f6B/K0v+T+oey9P+U/qEs/T+tfyhL/8/oH8rS/7P6h7L0/1v9Q1n6f07/UJb+n9c/lKX/av1DWfp/Qf9Qlv5/p38oS/81+oey9H9E/1CW/l/UP5Sl/5f0D2Xp/6j+oSz9v6x/KEv/r+gfytL/7/UPZen/mP6hLP2/qn8oS/9/0D+Upf/X9A9l6f+P+oey9F+rfyhL/6/rH8rSf53+oSz9/0n/UJb+/6x/KEv/b+gfytL/X/QPZen/Tf1DWfp/S/9Qlv7f1j+Upf/j+oey9P9X/UNZ+j+hfyhL/yf1D2Xpv17/UJb+T+kfytL/3/QPZen/Hf1DWfr/u/6hLP2/q38oS/8N+oey9H9a/1CW/t/TP5Sl/0b9Q1n6/4f+oSz9N+kfytL/P/UPZen/jP6hLP3/S/9Qlv6b9Q9l6b9F/1CW/v+tfyhL/+/rH8rSf6v+oSz9n9U/lKX/c/qHsvT/gf6hLP2f1z+Upf//6B/K0v8F/UNZ+v9Q/1CW/tv0DyXpv29L/1CW/gP0D2XpP1D/UJb+g/QPZek/WP9Qlv5D9A9l6T9U/1CW/sP0D2XpP1z/UJb+L9M/lKX/XvqHsvR/uf6hLP1foX8oS/+99Q9l6f8z+oey9N9H/9Ae1x8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOAnzbyFiy6bOnNmx1xf+MIXvtj5xUv9XyYAAOD/248+9L/UvxIAAAAAAAAAAAAAAAAAAADIq4n/O7GX+t8RAAAAAAAAAAAAAAB+2rW1H7Nx0IAeTw3a9cGrH+3Y/vPYrWdNX778wdL9c9e3Tw5ecuCuD7Zt27Zt2TMTJnU9HNZqtTr/1/btejy893Hn6y8eceeBOx6ViZ+7/fHzp+x9ytyVtwz++rKb2p8esv3ZIa0LL50xs+P1A1utctyQ1lWdD44c0GqVE4a0bu58MKbzweQhrRWdD47a/uBlrU93PnjdxbNnXtL5xImVf89gT9HWvrg1qMdiWz3+a7Dr/hePeGJ69899vGT3qw1ude1/5MovHtDre91eZP/dr1+O6b3/fv8LAi+qf/t/bl33z3285P95///Qmq2Lou+9+P67X78ca/9Qn+Dzf4+N9v7c3+vz/yHBS+68P3r4mls79992xn0Hdz01+Mf5/P+j1y/H9d7/wB6f/zs/x0/q/vw/rNUqx+/mbwek0tZ+/ca+3v/73v/gV/W6GbDr/u/58vpXdO7/3udbS7qeGtLP/U/q6/3/hl6/VqB/2trv3tbr/b8f+2+NCl5y5/43rNx7++f/9fdfvP8u3+vP/o/vvf/R82ddMXrewkVHzJg1dVrHtI7Lx48Zd+TY8ePHjRu9/RPBjh938zcFkti99//WXr1uBrRaHTvvV99306TO/W96aMmHu54a3s/9n9Dn+/8h3v8hNHJga+jQ1lVT58+fe+SOH7sfjtnx445/LNh/P/78f+jhXf9Y998ZDmi1Dtx5P+r88cM693/1nLKq66mh/dz/5D73P7Hn31UC/bOb7/+X9Lrpsf+jN1y7oHP/h31/v/VdT/X3z/8n9rn/u7z/w+5oa2/V+ibauf+jhl1/UrXr0ubv/6A+Tex/xOabt1S7LifZP9Snif1PWfqmi6pdl5PtH+rTxP4fnHXB0mrX5RT7h/o0sf8XXrnloGrX5VT7h/o0sf/HvvPU8mrXpd3+oT5N7P8Dd7QfVe26vMX+oT5N7P+IK5+dUO26vNX+oT5N7P/Sl5++otp1Oc3+oT5N7P+kbcfuX+26vM3+oT5N7H/A9d9dXO26nG7/UJ8m9v/k1KWzq12XKfYP9Wli/ytGjHqu2nU5w/6hPk3sf8nTb5hc7bqcaf9Qnyb2/5Xb7nys2nV5u/1DfZrY/8fP3e/OatflLPuH+jSx/x+MfGivatflHfYP9Wli/2vXrnig2nU52/6hPk3sf9mKQSOrXZdz7B/q08T+rztx2qPVrsu59g/1aWL/Y8d96Zxq1+U8+4f6NLH/Az/7zaeqXZfz7R/q08T+T394wbxq1+UC+4f6NLH/BQd97IfVrsuF9g/1aWL/b+44aHq16zLV/qE+Tey/3LLX2mrX5SL7h/o0sf+zN909sdp1udj+oT5N7H/VPp//aLXrcon9Q32a2P/mOZePr3ZdOuwf6tPE/r/9nuveW+26XGr/UJ8m9n/r818r1a7LNPuH+jSx/w1jzj632nWZbv9Qnyb2f/cpzzxS7brMsH+oTxP7X7rq8fnVrss77R/q08T+V68++Ylq1+Uy+4f6NLH/w0aN3rvns8/+mNdlpv1DfZrY/+yzlnyw2nWZZf9Qnyb2f9z9t72m2nW53P6hPk3sf/hXJ3yi2nWZbf9Qnyb2/6kJ7/tktetyhf1DfZrY/5aJhx5e7brMsX+oTxP7X/fAmNurXZe59g/1aWL/73/kjorXZZ79Q32a2P+c176wqdp1mW//UJ8m9v/GKWcurHZdrrR/qE8T+9//rslfqHZdFtg/1KeJ/Z/3re+dVu26vMv+oT5N7P/QAy46uNp1ucr+oT5N7H/6jDU3VrsuC+0f6tPE/ictWze22nVZZP9Qnyb2v8+T8+6pdl2utn+oTxP73zjogFOrXZd32z/Up4n933vNw9+odl2usX+oTxP7v/GGj3RUuy7X2j/Up4n9f2br0M3Vrst19g8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD/sgMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYUdOBAAAAAAAPJ/bYSqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoq7MCxAAAAAIAwf+sgejcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgKMAAAD//5dZ8pE=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x441, 0x20) r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file1\x00', 0xc4042, 0x1b) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x2000, 0x0) sendfile(r1, r2, 0x0, 0x20fffe82) fallocate(r0, 0x8, 0x4000, 0x4000) 1.252866452s ago: executing program 4 (id=546): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000002003f13c7160d7f89c701ff0000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a000000070000000080000001"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r0, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000d0039000000000000b4a518110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 678.152785ms ago: executing program 4 (id=547): openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x8020000) mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x920421, 0x0) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0xf}, 0x20) 652.827321ms ago: executing program 0 (id=548): syz_mount_image$hfs(&(0x7f0000002c80), &(0x7f00000000c0)='./file1\x00', 0x4490, &(0x7f0000002cc0)=ANY=[], 0xfd, 0x297, &(0x7f0000000480)="$eJzs3c1qE18Yx/HfmUyb/P8tdfoignRVLbiSvmzETUFyB25cidpEKIYKWkFdRdfiBbjPLXgBLl2Ja6G7rryA7CLnzBkzSWaSGBonid8PJEw655l5TuZMz3lSSgTgn3Wvet46vLAPI5VUknRXCiRVpFDSVV2rvDo9Ozlr1GvDDlRyEfZhFEeagTbHp/WsUBvnIrzIvgq1mv4ZpqPyQ83tlaKzQNHc3Z8hkMr+7nT7K389s+loFp1AwUxbbb3WWtF5AACK5ef/wM/zq379HgTSrp/24/k/WdXP+QTaLjqBKfsyYn9q/ndVVsfY63vF7erWe+5ih1ryQa3Di0lyWVY8snoWmGZUVelyCf57etKo3z5+3qgFeq8jb6nbbMs91+KhmzhvGVfT2u13g4fe8bXpmPVlUiGP1zrNFVbBku3DQTr/VJPNyz3jaOar+WYemkifVPu9/gs7xl4md6WivisV57+Xf0TXy2W5Vjm9XHcnue7P4A3tZUk5FYmSEbXedwGjnDzDnqiNvqi4d/v5vXNRm5lRByOitvqjuqM5P3LazEfzwOzopz6rmlr/B/bd3tU4d6Zt41r6kTG0P6FrGbn5xM8dze3MlsGkPcIEPuiJ7mjt5Zu3zx43GvUXC7th78QZSGOmNpJBMCv5LOyGfZMLOXsy70x+nPxfHXwsvzi6F/0PAxkEi8Kuu0xc/6XqlT23WLNPUe86vZyO7Yw6eOqI+zm1wYZ7/r+/gsupDYz76GEl46+Lg2ccWnPduCXdHOeMscjnOXuOJgkyVX3XIz7/BwAAAAAAAAAAAAAAAAAAmDeX9y8HFeXtKrqPAAAAAAAAAAAAAAAAAAAAAADMu4zv/y0X+v2/9xW/4vt/gan7FQAA//+pI3MQ") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x48041, 0x0) pwrite64(r0, &(0x7f0000000140)="f6", 0x6740413f, 0x1) truncate(&(0x7f0000000040)='./file1\x00', 0x1bfc) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x143142, 0x40) pwritev2(r1, &(0x7f0000000100)=[{&(0x7f0000000080)="ff", 0xabfb}], 0x1, 0x5405, 0x0, 0x0) 630.036827ms ago: executing program 7 (id=549): r0 = socket$inet6(0x10, 0x2, 0x4) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000000)='dctcp', 0x5) sendto$inet6(r0, &(0x7f0000000080)="4c00000012001f15b9409b8400feffffffffffff000000000017030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94acc000000000000000000000051d1ec0cffc8792cd8000080", 0x4c, 0x0, 0x0, 0x0) 489.049332ms ago: executing program 4 (id=550): r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r1 = syz_io_uring_setup(0x88f, &(0x7f00000010c0)={0x0, 0xc941, 0x0, 0x3, 0xbfdffffc}, &(0x7f0000000200)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r0, 0x80, &(0x7f00000000c0)=@in={0x2, 0x4e24, @remote}, 0x0, 0x0, 0x2}) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts-cbc-aes-neon\x00'}, 0x58) io_uring_enter(r1, 0x47f6, 0x0, 0x4, 0x0, 0x0) 352.802145ms ago: executing program 0 (id=551): r0 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) recvmmsg(r1, &(0x7f0000005cc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000004400)=""/211, 0xd3}}, {{0x0, 0xb, &(0x7f0000004600), 0x2}}, {{0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x40000}], 0x1}}], 0x3, 0x102, &(0x7f0000005ec0)={0x0, 0x3938700}) 351.795423ms ago: executing program 7 (id=552): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f00000008c0)=';', 0x1) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x2110, 0x4) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r0, &(0x7f0000000e00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000000bc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=""/81, 0x51}, 0xfffffff9}], 0x1, 0x12141, 0x0) 103.677564ms ago: executing program 7 (id=553): syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x21000, 0x0, 0x0, 0x0, 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000340)='./file0/file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0xb101e, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x2125099, 0x0) 81.918332ms ago: executing program 0 (id=554): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[], 0x28}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000240)="90", 0x1}], 0x1}, 0x0) r0 = syz_mount_image$btrfs(&(0x7f0000000200), &(0x7f0000005600)='./file0\x00', 0x1, &(0x7f0000000000), 0x0, 0x559e, &(0x7f000000ac40)="$eJzs3X9sVeX9B/BzWwoN+C39jhUYfxAgBoMkyJYtjqB4MQa24eKlgsKcCEQlBivYRDcYqUWSZcaghU4EF5GQaDJjscM/FMywy7CMZfzY5hZjs4JSaZZsAzVrHDG69N77XO49l9tembNOXy/SnvPcz3me+9yT88d9X/qcGwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAURUcSc9+d0f3i0ZE1X77/Hz+e+OjGn4zfvX/roVvu23T/gjMjbto5a1nf+mlN8zdsbDjS/PS+ObdGUSLdL5Htf9u136q/88bbvlsdBly+MLOtrS31lJmuJzON4QUP9vcr/FkRRVFVbIDK7PbV7E5FwQC53cbiAQf0Tuui6O7J8ya1dT01bklyYU/xS6df9VBPYKhkr6ue89dSMv27InZErp136SUKLtFM//gF96m8CADgY5mZSm9yb0ezb3Fz7eZ4PdZOxtotsXZ4h9CS37gYmXGHl5rnpHh9iOaZzESFESXnGatnz3+unYr3j7VjUeNjzLPw0GykqS41z7Wx+lDNEwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCzZOzxo2tWtD2y575fdtQceff9OVc+8KWOw22LT4y8eunKHWum/HTWsr7105rmb9jYcKT56X1zbo2i2nS/RKZ74kTL5b9NjZ3fvXfcG427n6vpq8yOG7bD8g6OXg87s0ZH0cq8Sk8Y9q81UZQqLKSb0Y7iwl3pnW+HAgAAAJ8nX0n/rsi1M3GwqqCdSKfJRPpfkAmL77Quiu6ePG9SW9dT45YkF/Zc/HipEuMlLzherl17/ieRF4xD/I2Pd74eDm0sGmdg8RHjef7SMWPefmty/eSvT5v7xA3PjOru+r8nZ2xJ/bGu5oUrru+tf/a6ovxfO3D+D2dO/gcAAOA/If/HxxnYYPn/jqVTt7z+i2Grft3a8MTB+h1/bv3OMzsXneq54Ud9L09N3v7o1UX5f1LBUxbl/zDjkP8roovL/wAAAPBZ9t/O/8micQY2WP5vONM3+wcHX6vr+PucxXt+9dAVi8+e/tv8U7t3DV9zR8v6uoeuLMr/M8vL/8Pypx0e/F2Y8OrRUTSz/JMKAAAAFAj/737+o4WQ1zOfHMTz+rX/vKp5380ffPMbD97zpzff/s2xA7MnrdteN/PgyzfVf1j5ve3dRfk/WV7+r/p0Xi4AAABQhuePrpw773jPucfPvtB18vDu3pMznjyzrqnvdOslLatXbTr2WlH+T5WX/0cMzcsBAAAALuDeO59bsfnVl/oe2H/X2Ck9FVc1XpK4ZduOqU0TPuq8tPfy7VuL8v/y8vL/yOw2u/Ih06kz/BVC6+goqu7fWZspHIparskVAAAAgE9IyOlbP1ixbOzOsb3jj59+rObQG4dn/2Vt55yN13RXdW/uXNZ4WdH9AkJiL3X//3Cng7D+v+D+f0Xr//MKmbv+zXZjAAAAAL6Iitfzh9vjZ765oNT375e7/n9J3cQTiba33lv11XMHzo1ZsP/7129aV9/be8+El37/wz9M/6i6KP83l5f/K/O3n+T3/wEAAMBF+F/7/r+lReMMbLD7/zdV9DWsWrd3+uota7csTCw7UH3qwdV731+w5l9Tb36+qea6A0X5v6W8/B+2o/JfXkc4P5tGR9H4/p3s3QR/Hqa7OlZor8orZE58rMeNoUe20D4ir5C2Ntbja6OjaHL/TnOs8P+h0BIrnK3JFnbFCsdCIXs95Ap7YoWOcKVtq8lON154MRSyCyzawwqKUbklEbEe75Xq0V+4YI+u3JMDAAB8oYTwnM2yVYXNKB5l2xODHTBysAMqBjugcrADhsUOiB9Y6vFoeWEhPH575yMbNjVMSb7y8NzHfvbms40T9j1+WV3v5g9f2XbvxJ3TW6YW5f9d5eX/cCqGZzal1v9HYf1/9nsNc+v/l4dCbazQHgqp+B0DUuE5MmH34fActalsj7PjcwUAAAD4XAufC1QO8TwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/s3evcdJVd0JAj/d9INumqaNE9GMk3TUgGakaWwNw+AoaoxGRZpZddxkNBBoEGmE8FgFURtQZxziZ3ztrJnoCAoiu+qHGFeDwUhcxIw6iWLiA/Cxjq7r+h6VGM2E/XTfOkXVrS67EFDa+X7/6DpVv/O89eg69946FwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/xjuPfjlk4YunP0PHzace8nqqqmL/kfH6Mv+cNW3vvjUPy5b9G9h/i9GnLll3kEXHjd/wbR/6Vi++ogzQmjtKleWFC977oqvPtS613HP3jFw48wbb63fUpWpNxMP/Tr/lGfuXBxbfbF/CHeXhVCRDgypSwKVmft1sb5960LYI2wLZEu01SYl0g2HB2pCWBK2BbJVra4JoS4ncMqG+++7vDNxTU0IXwkhVKfbeKY6aaMmHRhUlQRq04HpFUngt1sT2cBPypMA7LD4Zsi+6Fe15mdo6L5ckddf5U7r2KcrPbw+MdFQPN/rR+3iTuWoSj/QukNPW0F17BIFb4+13m294N1WsJ2v8LTlfpHKfEPZui1UHcontk0aP6d9dnykPDQ19SlW0y56np9+e/6E7Un3mtdh7EDDTnkdXvrYiun9lo2+9OrNvxqz4ayaA3a0m0/lbNLc9K5WHTKvuV7zPEajfJ70grdfwbekRl+6Qghbzz17xtfnTDz7iD63PLnu1QcfrNty9pwFvzhz4nmLLj55w7/Pf6lg/t/w0fP/+HKOt+V5uWOrH9Ync/P4SF1MvFmfzM0BAACg1+gNe01Xnv/6X73+/bWtMxed/u23Dj73w71afz3i/gFVB7yxrqn1/I2ff6Vg/t9Y2vH/eMi/Lne0a0MY1ZVYNCCEvbseTwIrY3e+OyCEL3elWvMDR6UCa0PYpytxULaqVIm+sURjKvByfSYwKhVYHwOtqcDyGLgiFbg4BlalAhNiYG0qcHQMhCn54/hqfWYcJQdqYmBcshFXxbMQ3qmPraW21aZsVQAAADtJZnZYmX8351yHHc0Qp5eranrKEM/ALpqhOlVDegabnVYVraGipxrKe6ohO+6Ojx5+Qc1lPdVccBpGWX6GG9f85X2LXjzsC2P3mvj5xUMvmPKz8eGst++uerx5yYtv7XvEzesK5v/NHz3/r+6mI2UFx/9DGNv1N+Yuz0Tas/FxrXkZAAAAgB1w0R//xR61Lw85oGHT+2X3zl/7xKMrfrl5j1NOf3/c8a//8PCaxnsL5v+jSjv/P+4T6ZOTOTwSd0NMHRBCc34gqXZkYSA56t0vEwAAAIDeIHs8PnssfErmNjlFOz2fLszfup3544H/Ud3m//09/7P2jq3/+mLZBd89d0TNgKX/9GrHhBNOPvqW47/1zj4VB/yyvGD+31ra+f+1+bdJJ9bHXlw9IIS+OYEHYy87A10aY+D5I/MDmfGvjxtgcawqc2JCtqrFscS4GGhOBZYUK/FotsTe+YHMk5VtfFF2HFMyJXICAAAA8ImLuwPicfl4/n/LGSNO++vvzfrbha88eN7qCy75q+Ed80eedP/THzbMvXJp2PTmEQXz/3Hbd/5/1zy44PT+9n4hDK0IoU/6hwGP1CYLA8ZAXVkmcW9tUlefdFULa0MY2TmwdFUvZNb/r0ivMfh4TVJVDOy93y1vD+pMLKsJYWhu4IlvLz2sMzEnFcg2flpNCF/qHG268bv6Jo1Xphu/tm8IX8wJZKua0DeEzsaq0lX9r+rMdQzSVa2qDmHPnEC2quHVIcwNAPRW8X/pxNwHZ82dN3V8e3vbzF2YiDvxa8KkKe1tTROmt0+sLtKniak+561jtKBwTKVe+mZTZo2ixSsnV5aSzv5QsDm3rcyO/IIzBzP345ehyq5xHlKZd7clPeQD9y9sIuR8lSo25PJdPOTa3Eq2PYkF9cf8VaFf6DtnVtvMpvPGz549c1jyt9TshyR/43GmZFsNS2+r2u76VsLLo+hyWSkfd1sNyq1k6OxpM4bOmjtvyJRp4ye3TW47p+XQP2sZMXz410YM7RxUc/K3h5EO6q7m1Ei3Li1xWDtxpF+oyKnkk/jQkJCQ6G2J/f7L5odH77n+nOt/9tqPz+/3zdPu3fvImT889KqpD1Xve/ji24ccWDD/n/HR8//4qRM/+DPrMxQ7/t8QD/Mnj287zD8uBpaUevy/odjR/OyJAY2pQEcMdDjMDwAAwGdD3B0Z92bGndKbb1m/buOSlrk/aHin5dY17Utvuum+U39y58ATvjQ47LXhuhM+VzD/7yjt9/87af3/7NL1JxRb5v+gWKK52Pr/6WX+s+v/dxRb/z+9zH92/f8ln8L6/3OygdQmecf6/wAAwGfBJ7f+f4/L+6cvEFCQocfl/dMXCCjI0OMy/qVeIGC71/9f8+Bff6Wq35g7/qTlN/WXvPZ39xzWeuS6zTP/5Etb10+877qxt6wpmP9fUdr838L9AAAAsPv4z5ddU3H02Xff0bJu6sZxbw5+98m3lgzq80HF0Q+3j3xh4Bu3nlcw/19S2vz/k1//LxQ7/7+xWKC12MKA1v8DAACglyq2/t89Q1sa/zCm/x+eHvab5Q/ePPqnj/z898v3+/mJPyvfZ8Gxz8+8bFLB/H9VafP/eNpFeV7u2JsP65M17UJ6Tbs367M/GQAAAIDeoTw0NVWWmDdvYdSjPn6bT2eWAv2odK7vvXLt2ZtfmH7c46ev+7uaEwbvOWHaBasa/2b4gXd+ftQley7ddGrB/H9tafP/vN9lXPrYiun9lo2+9MOrN/9qzIazag7YdvwfAAAA2HVK3S8BAAAAAAAAAAAAAAB8+s7tWHzhI8uOfe+bt//F/kcseXXwbXcd+Lsh/V664qoHJq1648zJXy/4/X8Y21Wu2O//43X/4u8L/igvd2y15/X/MvdPOfH2uV1LFj5SH8L+uYGpC6fuETLX5h+cG7jvjIMGdiYWpkusefbolzoT30kHjh/yuS2dicNTgXFxkcR90oF4VcUt/VOBuLzi4+lA3B6r0oGqTOCy/sk4ytLb6pW6ZFuVpbfVxroQBuQEstvq7rqkjbL0AK9JBbID/F46EAd4ciZQnu7V7f2SXsVAXSx6Q7+kVwAA7Lbit8DKMGlKe1tz/Aofb79QkX8b5S1ZtqCw2rISm9+UWZps8crJlaWk+6S/i2671nhlqO4cwrCCr6u5Wcq6Rrlzaulh0/1RkSH3tNpbeZFyadu76aqKj6gmGVHThOntEyt7HHhLz1kOqegxy7CCyU5ulvKuTVpCLSX0pYQRlbhtSuhyvF8empr6pHL9eQw2hDw9vSJK/b1+7jp/xV4FuXluO/TKt758zE+f++CfP/9E/2+cVnP7rO+/e+KvX7//wEOOuG5C05otBfP/htLm/9W549qSuRhAR7yy3sgBIYwrcUQAAADw2XfbRbfecfr09a9MWlvx5GOPTS0fc3rl1vl3zp93ycZ7Fx9/2cErdjR+2Fm//f5vBu//b89e9dJPR+7zwA03/58nD3v8z3//8I8eeqduZZ+x7xXM/xtLm//HPViZQ8HJ3o618fr/iwaE0HVp/YYksDIO97sDQvhyV6o1lkguqH9CLNGcBFbGHSYHxRLjWvOr6hsDq1KBl+szgbWpwPoYyOyluCVkduVcWR/CYV2psfklZsQSDanAmBhoTAWaYqA5FegfA6NSgdf6ZwKtqcDDMRCm5G+rH/fPbCsAAIDtkZlnVebfDel53qqKnjKU9ZShtqcM5T1lqO4pQ7FRxPt3xAyVqZNXynIyVaZrrUnVUpAhXgx/u/tVkCE8mp8zXbCg6Xj+QfZ8g7L8DFf+4NlT1w+e/tDqzcd8beBt/zhkz4Obp9e9t+CGp3475pzrnv/TQQXz/+bS5v+1+bdJ6+vj/H/b9f+SwIOxe1fHU8cbY+D5I/MDmR0D6+Nkd3G2qtZMicykfXEsMSoGGlOBGTEwKhUYNzYTWDIwP5CZaWcbX5RtfEqmRE4AAAAAPnFxB0HcTRPn/zce9YOr3x8wccuyeTPvH9vyxMmjv3H1XT+6d/9ld767YvCAce99p2D+P6q0+X9sr19uYxfH3rzYP4S7y7b1JhsYUpcE4n6Muvjz+H3rQtgjZwdHtkRbbVKiKtVweKAm+YV6Vbqq1TXJGgPx/ikb7r/v8s7ENTUhfCVn70u2jWeqkzZq0oFBVUmgNh2YXpEE4p6fbOAn5UkAdlh2r2B8QWVOdclq6L5ckdffZ+WaoOnhFewD7SZfd7+52lWq0w9k9qlmbd/TVlAdu0TB22Otd1tvfLc1eLflfpHKfEPZui1UHcontk0aP6d9dnwk95esBXbR85z7K9VS0jvhddjx8Xvbs+p0B5pTHx/N3Zfr/nVYFqu79LEV0/stG33p1Zt/NWbDWTUHlNyNIuIPhX+05X9XPpWzeXe16pB5zfW6z5NWnye98d9Ao6cthHDZ9cfsu+TdX+/33A3Pnbqu7Maxr/7lrHs2Lf+bysNHrXv/yaGjLy+Y/7eWNv+vSN12+V3cmLMGhHBgzsZ9JG7+YwYkn4M5geRTcs/CQHLI/V/ri35yAgAAwM6W3d2R3V8wJXObnBCenicX5m/dzvxxf8WobvOX2u9j121cedLQN6474G8vOPGNv7/28Kceuv6ysnXL//vYD1avuXzxe08UzP/HffT8v2+qm47/O/7PLuL4f7d2913RfdMPdOzQruiC6tglHP/v1u7+bnP8v1uO/zv+3x3H/3vg+H+3dvenreBb0gxfujonwdff+fPfTbzpg7mN+x180lPPHDrxun+6quXuu0555b+de9601761uWD+P6O0+b/1/7pftC+7/t+4Yuv/zSi2/l+H9f8AAIBdqshCc+l5XsHqfQUZ0qv3FWTocYHAHpcYtP7fdq//t3Dkv1904Q+fb7n2nTvHXb5m07Fnvvr0utXPzFpx3Lnnv9V6112tBfP/jtLm//Hl0C+39d6y/l/j2CJVXREDMywMCAAAwO6o2A4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPl2HnvbO+5d8/R/aBv1ixc1/f+v/+7/P1q594JvfuGn4L6f86RllazZcM+LMLfMOuvC4+Qum/UvH8tVHnBHClK5yZUnxsueu+OpDrXsd9+wdAzfOvPHW+i3VmXorM7d/nJc7tvphfQhLch6pi4k36zvvbAuccuLtcys6E4/Uh7B/bmDqwql7dCaW14cwODdw3xkHDexMLEyXWPPs0S91Jr6TDhw/5HNbOhOHZwJl6e5e1z/pblm6u5f3D2FATiDb3bP751eVbeO4TKA83caKuqSNGKiLRa+tS9qIgfZYYkrfEIZWhNAnXdU/VydV9UlXdU91UlWfdFUXVYcwMoRQka7quaqkqor0yB+tSqqKgb33u+XtQZ2JpVUhDM0NPPHtpYd1JmamAtnG/1NVCF/qfMmkG/9xZdJ4Zbrx/1oZwhdDCFXpEu9VJCWq0iVeqAhhz5zAto1YEcLcwGdD/PSZmPvgrLnzpo5vb2+buQsTVZm2asKkKe1tTROmt0+sTvWpmLKc9NYFH3/sm96eP6HzdvHKyZWlpCsy5Sq7unxIZd7dlt2997FftbmVbHs+CuqP+atCv9B3zqy2mU3njZ89e+aw5G+p2Q9J/vbJRJNtNay3bKtBuZUMnT1txtBZc+cNmTJt/OS2yW3ntBz6Zy0jhg//2oihnYNqTv7ujJEu/eRH+oWKnEo+ife/hIREb0uU5326Ne/un+MFX/S3dbQyVHd9QBdMK3KzlHWNcmcM+qiPOeKP8zWlxxENK5g4FGQ5pOcsLQWTiW1ZapIsXV/rCiaHuTWVd23SeL88NDX1KbYdGvLv5m7e13dg8z6d2XSlpgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/swIEAAAAAAJD/ayNUVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYQcOBAAAAACA/F8boaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqgo7cCwAAAAAIMzfOoyeDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4FAAA//8fSxmR") ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80809440, &(0x7f0000000180)) 20.913066ms ago: executing program 4 (id=555): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000080), 0x10) sendmsg$can_bcm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001200)=ANY=[@ANYBLOB="0500000008000000ed00000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="00000004"], 0x48}, 0x1, 0x0, 0x0, 0x2000c014}, 0x800) sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x1d, r1}, 0x10, &(0x7f0000000180)={&(0x7f0000000580)={0x7, 0x312, 0xe7, {0x0, 0xea60}, {0x0, 0x2710}, {}, 0x1, @can={{0x0, 0x1, 0x1, 0x1}, 0x5, 0x0, 0x0, 0x0, "b395ac5160fbdac3"}}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x8001) 0s ago: executing program 5 (id=556): bind$inet6(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000140)={0x28, 0x0, 0x2710, @host}, 0x10) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=@ipv4_delroute={0x4c, 0x19, 0x901, 0x70bd29, 0x80, {0x2, 0x18, 0x10, 0x0, 0x0, 0x0, 0xfd, 0x1}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_GATEWAY={0x8, 0x5, @private=0xa010102}, @RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @LWTUNNEL_IP6_SRC={0x14, 0x3, @private0}}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x0) kernel console output (not intermixed with test programs): 6108] Trying to free block not in datazone [ 104.215800][ T6118] EXT4-fs error (device loop5): ext4_orphan_get:1397: comm syz.5.58: couldn't read orphan inode 15 (err -117) [ 104.229784][ T6108] Trying to free block not in datazone [ 104.235451][ T6108] Trying to free block not in datazone [ 104.241204][ T6108] Trying to free block not in datazone [ 104.246666][ T6108] Trying to free block not in datazone [ 104.247204][ T6118] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 104.254048][ T6108] Trying to free block not in datazone [ 104.351662][ T6108] Trying to free block not in datazone [ 104.367433][ T6108] Trying to free block not in datazone [ 104.387661][ T6108] Trying to free block not in datazone [ 104.426381][ T6118] EXT4-fs error (device loop5): ext4_check_dx_root:2203: inode #2: comm syz.5.58: Corrupt dir, invalid name_len for '.', running e2fsck is recommended [ 104.440929][ T6108] Trying to free block not in datazone [ 104.474931][ T6108] Trying to free block not in datazone [ 104.492156][ T6108] Trying to free block not in datazone [ 104.519032][ T6108] Trying to free block not in datazone [ 104.545079][ T6108] Trying to free block not in datazone [ 104.565316][ T6108] Trying to free block not in datazone [ 104.590620][ T6108] Trying to free block not in datazone [ 104.596092][ T6108] Trying to free block not in datazone [ 104.620842][ T6108] Trying to free block not in datazone [ 104.648594][ T6108] Trying to free block not in datazone [ 104.679369][ T6108] Trying to free block not in datazone [ 104.698401][ T6108] Trying to free block not in datazone [ 104.721725][ T5843] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 104.731351][ T6108] Trying to free block not in datazone [ 104.737229][ T6108] Trying to free block not in datazone [ 104.783557][ T6108] Trying to free block not in datazone [ 104.810869][ T6108] Trying to free block not in datazone [ 104.830550][ T6108] Trying to free block not in datazone [ 104.856373][ T6108] Trying to free block not in datazone [ 104.896651][ T6108] Trying to free block not in datazone [ 104.930956][ T6108] Trying to free block not in datazone [ 104.936434][ T6108] Trying to free block not in datazone [ 104.978095][ T6108] Trying to free block not in datazone [ 105.000573][ T6108] Trying to free block not in datazone [ 105.026405][ T6108] Trying to free block not in datazone [ 105.042458][ T6108] Trying to free block not in datazone [ 105.070317][ T6108] Trying to free block not in datazone [ 105.090060][ T6140] Invalid source name [ 105.096620][ T6108] Trying to free block not in datazone [ 105.106756][ T6140] UBIFS error (pid: 6140): cannot open "./file0", error -22 [ 105.115328][ T6108] Trying to free block not in datazone [ 105.148203][ T6142] netlink: 4 bytes leftover after parsing attributes in process `syz.4.69'. [ 105.160104][ T6108] Trying to free block not in datazone [ 105.175871][ T6108] Trying to free block not in datazone [ 105.185986][ T6108] Trying to free block not in datazone [ 105.200571][ T6108] Trying to free block not in datazone [ 105.216359][ T6108] Trying to free block not in datazone [ 105.260884][ T6108] Trying to free block not in datazone [ 105.266380][ T6108] Trying to free block not in datazone [ 105.331754][ T6108] Trying to free block not in datazone [ 105.337247][ T6108] Trying to free block not in datazone [ 105.390543][ T6108] Trying to free block not in datazone [ 105.406676][ T6108] Trying to free block not in datazone [ 105.434099][ T6108] Trying to free block not in datazone [ 105.452543][ T6108] Trying to free block not in datazone [ 105.470233][ T6108] Trying to free block not in datazone [ 105.490546][ T6108] Trying to free block not in datazone [ 105.496049][ T6108] Trying to free block not in datazone [ 105.533445][ T6108] Trying to free block not in datazone [ 105.539592][ T6108] Trying to free block not in datazone [ 105.555811][ T6108] Trying to free block not in datazone [ 105.564529][ T6116] loop1: detected capacity change from 0 to 40427 [ 105.571159][ T6108] Trying to free block not in datazone [ 105.577347][ T6108] Trying to free block not in datazone [ 105.583893][ T6108] Trying to free block not in datazone [ 105.601067][ T6116] F2FS-fs: heap/no_heap options were deprecated [ 105.607497][ T6108] Trying to free block not in datazone [ 105.613362][ T6116] f2fs: Unknown parameter 'flus…_merge' [ 105.634116][ T6108] Trying to free block not in datazone [ 105.639736][ T6108] Trying to free block not in datazone [ 105.662616][ T6108] Trying to free block not in datazone [ 105.676898][ T6108] Trying to free block not in datazone [ 105.691152][ T5927] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 105.709601][ T6108] Trying to free block not in datazone [ 105.750388][ T6108] Trying to free block not in datazone [ 105.766784][ T6108] Trying to free block not in datazone [ 105.810963][ T6108] Trying to free block not in datazone [ 105.837790][ T6108] Trying to free block not in datazone [ 105.877938][ T6108] Trying to free block not in datazone [ 105.883997][ T6108] Trying to free block not in datazone [ 105.897338][ T5927] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 105.904292][ T6108] Trying to free block not in datazone [ 105.939222][ T5927] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 105.961196][ T6108] Trying to free block not in datazone [ 105.986976][ T6108] Trying to free block not in datazone [ 106.002367][ T5927] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 106.010533][ T6108] Trying to free block not in datazone [ 106.042455][ T6108] Trying to free block not in datazone [ 106.054693][ T5927] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 106.080100][ T6108] Trying to free block not in datazone [ 106.113086][ T5927] usb 5-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 106.120625][ T6108] Trying to free block not in datazone [ 106.127648][ T6108] Trying to free block not in datazone [ 106.143803][ T6108] Trying to free block not in datazone [ 106.150575][ T5927] usb 5-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 106.170608][ T6108] Trying to free block not in datazone [ 106.181644][ T5927] usb 5-1: Manufacturer: syz [ 106.192950][ T6108] Trying to free block not in datazone [ 106.211973][ T6108] Trying to free block not in datazone [ 106.217455][ T6108] Trying to free block not in datazone [ 106.220416][ T5927] usb 5-1: config 0 descriptor?? [ 106.275614][ T6108] Trying to free block not in datazone [ 106.300605][ T6108] Trying to free block not in datazone [ 106.327013][ T6108] Trying to free block not in datazone [ 106.348951][ T6108] Trying to free block not in datazone [ 106.374007][ T6163] loop5: detected capacity change from 0 to 4096 [ 106.388154][ T6108] Trying to free block not in datazone [ 106.400583][ T6108] Trying to free block not in datazone [ 106.426369][ T6108] Trying to free block not in datazone [ 106.473774][ T6108] Trying to free block not in datazone [ 106.522547][ T6108] Trying to free block not in datazone [ 106.528040][ T6108] Trying to free block not in datazone [ 106.575937][ T6169] raw_sendmsg: syz.3.80 forgot to set AF_INET. Fix it! [ 106.589514][ T6108] Trying to free block not in datazone [ 106.617596][ T6108] Trying to free block not in datazone [ 106.645209][ T6108] Trying to free block not in datazone [ 106.664309][ T5193] udevd[5193]: worker [5847] terminated by signal 33 (Unknown signal 33) [ 106.680380][ T5927] appleir 0003:05AC:8243.0001: unknown main item tag 0x0 [ 106.686641][ T6108] Trying to free block not in datazone [ 106.699669][ T5193] udevd[5193]: worker [5847] failed while handling '/devices/virtual/block/loop5' [ 106.708941][ T6108] Trying to free block not in datazone [ 106.708956][ T6108] Trying to free block not in datazone [ 106.708965][ T6108] Trying to free block not in datazone [ 106.708975][ T6108] Trying to free block not in datazone [ 106.708984][ T6108] Trying to free block not in datazone [ 106.708994][ T6108] Trying to free block not in datazone [ 106.709003][ T6108] Trying to free block not in datazone [ 106.709013][ T6108] Trying to free block not in datazone [ 106.709022][ T6108] Trying to free block not in datazone [ 106.709032][ T6108] Trying to free block not in datazone [ 106.709042][ T6108] Trying to free block not in datazone [ 106.709052][ T6108] Trying to free block not in datazone [ 106.709061][ T6108] Trying to free block not in datazone [ 106.709071][ T6108] Trying to free block not in datazone [ 106.709080][ T6108] Trying to free block not in datazone [ 106.709090][ T6108] Trying to free block not in datazone [ 106.709100][ T6108] Trying to free block not in datazone [ 106.709109][ T6108] Trying to free block not in datazone [ 106.709118][ T6108] Trying to free block not in datazone [ 106.709128][ T6108] Trying to free block not in datazone [ 106.709138][ T6108] Trying to free block not in datazone [ 106.709147][ T6108] Trying to free block not in datazone [ 106.709157][ T6108] Trying to free block not in datazone [ 106.709167][ T6108] Trying to free block not in datazone [ 106.709177][ T6108] Trying to free block not in datazone [ 106.709186][ T6108] Trying to free block not in datazone [ 106.709196][ T6108] Trying to free block not in datazone [ 106.709205][ T6108] Trying to free block not in datazone [ 106.709215][ T6108] Trying to free block not in datazone [ 106.709224][ T6108] Trying to free block not in datazone [ 106.709234][ T6108] Trying to free block not in datazone [ 106.709243][ T6108] Trying to free block not in datazone [ 106.709253][ T6108] Trying to free block not in datazone [ 106.709264][ T6108] Trying to free block not in datazone [ 106.709273][ T6108] Trying to free block not in datazone [ 106.709283][ T6108] Trying to free block not in datazone [ 106.709292][ T6108] Trying to free block not in datazone [ 106.709302][ T6108] Trying to free block not in datazone [ 106.709312][ T6108] Trying to free block not in datazone [ 106.709322][ T6108] Trying to free block not in datazone [ 106.709331][ T6108] Trying to free block not in datazone [ 106.709341][ T6108] Trying to free block not in datazone [ 106.709351][ T6108] Trying to free block not in datazone [ 106.709360][ T6108] Trying to free block not in datazone [ 106.709370][ T6108] Trying to free block not in datazone [ 106.709380][ T6108] Trying to free block not in datazone [ 106.709390][ T6108] Trying to free block not in datazone [ 106.752210][ T5927] appleir 0003:05AC:8243.0001: hiddev0,hidraw0: USB HID v0.00 Device [syz] on usb-dummy_hcd.4-1/input0 [ 106.788502][ T6173] loop0: detected capacity change from 0 to 512 [ 106.830674][ T6108] Trying to free block not in datazone [ 106.877517][ T6173] EXT4-fs: Ignoring removed i_version option [ 106.885778][ T975] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 106.910247][ T6108] Trying to free block not in datazone [ 106.990663][ T6173] EXT4-fs: Ignoring removed mblk_io_submit option [ 107.025872][ T6000] usb 5-1: USB disconnect, device number 3 [ 107.041623][ T6173] EXT4-fs (loop0): Test dummy encryption mode enabled [ 107.059287][ T6108] Trying to free block not in datazone [ 107.098711][ T6173] EXT4-fs error (device loop0): ext4_orphan_get:1392: comm syz.0.82: inode #13: comm syz.0.82: iget: illegal inode # [ 107.111603][ T975] usb 2-1: Using ep0 maxpacket: 32 [ 107.124034][ T975] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 107.127246][ T6108] Trying to free block not in datazone [ 107.138539][ T975] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 107.171316][ T975] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 107.191606][ T975] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.223660][ T975] usb 2-1: config 0 descriptor?? [ 107.239190][ T6108] Trying to free block not in datazone [ 107.259813][ T6173] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.82: couldn't read orphan inode 13 (err -117) [ 107.286678][ T6108] Trying to free block not in datazone [ 107.301614][ T6108] Trying to free block not in datazone [ 107.312260][ T6173] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 107.315747][ T6176] fido_id[6176]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 107.340003][ T6108] Trying to free block not in datazone [ 107.345576][ T6108] Trying to free block not in datazone [ 107.354508][ T6108] Trying to free block not in datazone [ 107.359996][ T6108] Trying to free block not in datazone [ 107.365671][ T6108] Trying to free block not in datazone [ 107.387640][ T6108] Trying to free block not in datazone [ 107.396563][ T6108] Trying to free block not in datazone [ 107.415368][ T6108] Trying to free block not in datazone [ 107.422554][ T6108] Trying to free block not in datazone [ 107.437267][ T6108] Trying to free block not in datazone [ 107.443515][ T6173] EXT4-fs (loop0): shut down requested (1) [ 107.449901][ T6108] Trying to free block not in datazone [ 107.455581][ T6108] Trying to free block not in datazone [ 107.470575][ T6108] Trying to free block not in datazone [ 107.485501][ T6108] Trying to free block not in datazone [ 107.500593][ T6108] Trying to free block not in datazone [ 107.506214][ T6108] Trying to free block not in datazone [ 107.516168][ T6108] Trying to free block not in datazone [ 107.530604][ T6108] Trying to free block not in datazone [ 107.536203][ T6108] Trying to free block not in datazone [ 107.547412][ T6108] Trying to free block not in datazone [ 107.549403][ T5824] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 107.560547][ T6108] Trying to free block not in datazone [ 107.571724][ T6108] Trying to free block not in datazone [ 107.585979][ T6183] loop3: detected capacity change from 0 to 4096 [ 107.597218][ T6108] Trying to free block not in datazone [ 107.603391][ T6108] Trying to free block not in datazone [ 107.608882][ T6108] Trying to free block not in datazone [ 107.616427][ T6108] Trying to free block not in datazone [ 107.622164][ T6183] ntfs3(loop3): Different NTFS sector size (1024) and media sector size (512). [ 107.633661][ T6108] Trying to free block not in datazone [ 107.668898][ T975] ft260 0003:0403:6030.0002: unknown main item tag 0x7 [ 107.684718][ T6108] Trying to free block not in datazone [ 107.721629][ T6108] Trying to free block not in datazone [ 107.736822][ T6108] Trying to free block not in datazone [ 107.776376][ T6108] Trying to free block not in datazone [ 107.806262][ T6184] overlayfs: upper fs does not support tmpfile. [ 107.814510][ T6108] Trying to free block not in datazone [ 107.820017][ T6108] Trying to free block not in datazone [ 107.846071][ T6184] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 107.864713][ T975] ft260 0003:0403:6030.0002: chip code: 6424 8183 [ 107.873488][ T6108] Trying to free block not in datazone [ 107.878946][ T6108] Trying to free block not in datazone [ 107.906498][ T6108] Trying to free block not in datazone [ 107.916605][ T6108] Trying to free block not in datazone [ 107.931873][ T6108] Trying to free block not in datazone [ 107.947548][ T6108] Trying to free block not in datazone [ 107.957681][ T6108] Trying to free block not in datazone [ 108.002687][ T6108] Trying to free block not in datazone [ 108.008217][ T6108] Trying to free block not in datazone [ 108.052141][ T6108] Trying to free block not in datazone [ 108.065462][ T975] ft260 0003:0403:6030.0002: USB HID v0.00 Device [HID 0403:6030] on usb-dummy_hcd.1-1/input0 [ 108.083746][ T6108] Trying to free block not in datazone [ 108.101088][ T6108] Trying to free block not in datazone [ 108.130599][ T6108] Trying to free block not in datazone [ 108.147676][ T6108] Trying to free block not in datazone [ 108.170896][ T6108] Trying to free block not in datazone [ 108.173186][ T6181] loop5: detected capacity change from 0 to 32768 [ 108.176396][ T6108] Trying to free block not in datazone [ 108.247695][ T6108] Trying to free block not in datazone [ 108.258236][ T6190] loop0: detected capacity change from 0 to 4096 [ 108.272679][ T975] ft260 0003:0403:6030.0002: failed to retrieve status: -71, no wakeup [ 108.277083][ T6108] Trying to free block not in datazone [ 108.293027][ T975] ft260 0003:0403:6030.0002: failed to retrieve status: -71 [ 108.309436][ T975] ft260 0003:0403:6030.0002: failed to reset I2C controller: -71 [ 108.316449][ T6108] Trying to free block not in datazone [ 108.324089][ T6181] XFS (loop5): DAX unsupported by block device. Turning off DAX. [ 108.332352][ T975] usb 2-1: USB disconnect, device number 2 [ 108.343350][ T6108] Trying to free block not in datazone [ 108.348817][ T6108] Trying to free block not in datazone [ 108.364186][ T6108] Trying to free block not in datazone [ 108.372389][ T6108] Trying to free block not in datazone [ 108.380577][ T6108] Trying to free block not in datazone [ 108.383708][ T6181] XFS (loop5): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 108.388505][ T6108] Trying to free block not in datazone [ 108.425943][ T6108] Trying to free block not in datazone [ 108.460248][ T6108] Trying to free block not in datazone [ 108.484531][ T6108] Trying to free block not in datazone [ 108.490103][ T6108] Trying to free block not in datazone [ 108.498470][ T6108] Trying to free block not in datazone [ 108.505642][ T6108] Trying to free block not in datazone [ 108.512216][ T6108] Trying to free block not in datazone [ 108.517671][ T6108] Trying to free block not in datazone [ 108.523296][ T6108] Trying to free block not in datazone [ 108.528786][ T6108] Trying to free block not in datazone [ 108.535332][ T6108] Trying to free block not in datazone [ 108.541467][ T6108] Trying to free block not in datazone [ 108.543809][ T6181] XFS (loop5): Ending clean mount [ 108.546919][ T6108] Trying to free block not in datazone [ 108.546931][ T6108] Trying to free block not in datazone [ 108.567882][ T6108] Trying to free block not in datazone [ 108.573446][ T6108] Trying to free block not in datazone [ 108.591344][ T6108] Trying to free block not in datazone [ 108.600419][ T6108] Trying to free block not in datazone [ 108.609700][ T6181] XFS (loop5): Quotacheck needed: Please wait. [ 108.618432][ T6108] Trying to free block not in datazone [ 108.620644][ T43] usb 5-1: new low-speed USB device number 4 using dummy_hcd [ 108.631926][ T6108] Trying to free block not in datazone [ 108.642513][ T6108] Trying to free block not in datazone [ 108.670461][ T6108] Trying to free block not in datazone [ 108.676108][ T6108] Trying to free block not in datazone [ 108.695796][ T6207] loop3: detected capacity change from 0 to 128 [ 108.720234][ T6108] Trying to free block not in datazone [ 108.740267][ T6181] XFS (loop5): Quotacheck: Done. [ 108.755060][ T6108] Trying to free block not in datazone [ 108.774211][ T6108] Trying to free block not in datazone [ 108.779692][ T6108] Trying to free block not in datazone [ 108.800584][ T6108] Trying to free block not in datazone [ 108.805795][ T6207] EXT4-fs (loop3): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 108.818161][ T6108] Trying to free block not in datazone [ 108.818174][ T6108] Trying to free block not in datazone [ 108.818184][ T6108] Trying to free block not in datazone [ 108.818194][ T6108] Trying to free block not in datazone [ 108.818204][ T6108] Trying to free block not in datazone [ 108.818214][ T6108] Trying to free block not in datazone [ 108.818224][ T6108] Trying to free block not in datazone [ 108.818234][ T6108] Trying to free block not in datazone [ 108.818244][ T6108] Trying to free block not in datazone [ 108.821609][ T6108] Trying to free block not in datazone [ 108.903043][ T43] usb 5-1: unable to get BOS descriptor or descriptor too short [ 108.940092][ T6207] ext4 filesystem being mounted at /21/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 108.967714][ T43] usb 5-1: config 7 has an invalid interface number: 67 but max is 0 [ 108.985167][ T5843] XFS (loop5): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 109.014044][ T43] usb 5-1: config 7 has no interface number 0 [ 109.029585][ T43] usb 5-1: string descriptor 0 read error: -22 [ 109.036148][ T43] usb 5-1: New USB device found, idVendor=16c0, idProduct=05df, bcdDevice=6b.16 [ 109.076360][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.273217][ T5829] EXT4-fs (loop3): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 109.414879][ T43] usb 5-1: USB disconnect, device number 4 [ 109.833758][ T6229] netlink: 96 bytes leftover after parsing attributes in process `syz.3.101'. [ 110.184813][ T6239] loop3: detected capacity change from 0 to 256 [ 110.247882][ T6239] exFAT-fs (loop3): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 110.407662][ T6245] input: syz0 as /devices/virtual/input/input5 [ 110.702684][ T6218] loop5: detected capacity change from 0 to 32768 [ 110.781602][ T6218] XFS (loop5): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 111.091538][ T6218] XFS (loop5): Ending clean mount [ 111.132555][ T6218] XFS (loop5): Quotacheck needed: Please wait. [ 111.235153][ T6267] loop3: detected capacity change from 0 to 4096 [ 111.242852][ T6218] XFS (loop5): Quotacheck: Done. [ 111.539952][ T6278] netlink: 8 bytes leftover after parsing attributes in process `syz.1.120'. [ 112.024092][ T6282] loop1: detected capacity change from 0 to 32768 [ 112.051707][ T5843] XFS (loop5): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 112.175506][ T6282] XFS (loop1): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 112.272575][ T6267] ntfs3(loop3): Mark volume as dirty due to NTFS errors [ 112.349846][ T6267] ntfs3(loop3): ino=1a, mi_enum_attr [ 112.385946][ T6267] ntfs3(loop3): ino=1a, mi_enum_attr [ 112.400876][ T6292] loop4: detected capacity change from 0 to 512 [ 112.418080][ T6282] XFS (loop1): Ending clean mount [ 112.424984][ T6267] ntfs3(loop3): Failed to initialize $Extend/$Reparse. [ 112.433153][ T6269] loop0: detected capacity change from 0 to 131072 [ 112.440569][ T6294] warning: `syz.2.125' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 112.472764][ T6269] F2FS-fs (loop0): invalid crc value [ 112.569020][ T6292] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 112.586807][ T6282] XFS (loop1): Quotacheck needed: Please wait. [ 112.616219][ T6269] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 112.630871][ T6269] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 112.649414][ T6267] ntfs3(loop3): ino=1e, "file1" attr_set_size [ 112.743808][ T6269] F2FS-fs (loop0): invalid namelen(0), ino:150994947, run fsck to fix. [ 112.810829][ T6282] XFS (loop1): Quotacheck: Done. [ 112.953194][ T5835] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.162085][ T6303] loop2: detected capacity change from 0 to 4096 [ 113.247187][ T5832] XFS (loop1): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 113.256086][ T6303] EXT4-fs (loop2): Test dummy encryption mode enabled [ 113.295019][ T6310] loop5: detected capacity change from 0 to 256 [ 113.454686][ T6303] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 113.629720][ T6303] fscrypt: AES-256-XTS using implementation "xts-aes-vaes-avx2" [ 113.674459][ T6318] EXT4-fs (loop2): shut down requested (1) [ 113.892118][ T5840] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.979067][ T6323] pim6reg: entered allmulticast mode [ 114.078793][ T6323] pim6reg: left allmulticast mode [ 114.090377][ T6325] netlink: 8 bytes leftover after parsing attributes in process `syz.4.136'. [ 114.121550][ T6325] netlink: 76 bytes leftover after parsing attributes in process `syz.4.136'. [ 114.242215][ T6325] macvlan0: entered promiscuous mode [ 114.272754][ T6325] batadv0: entered promiscuous mode [ 114.303599][ T6325] hsr1: entered allmulticast mode [ 114.319988][ T6325] macvlan0: entered allmulticast mode [ 114.337106][ T6325] veth1_vlan: entered allmulticast mode [ 114.375323][ T6325] batadv0: entered allmulticast mode [ 114.382511][ T6332] trusted_key: syz.1.137 sent an empty control message without MSG_MORE. [ 115.685344][ T6336] loop2: detected capacity change from 0 to 32768 [ 115.901095][ T6350] loop3: detected capacity change from 0 to 32768 [ 115.913719][ T6336] ocfs2: Mounting device (7,2) on (node local, slot 0) with ordered data mode. [ 115.918133][ T6350] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.145 (6350) [ 116.034496][ T6350] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 116.083409][ T6350] BTRFS info (device loop3): using crc32c (crc32c-lib) checksum algorithm [ 116.363077][ T6350] BTRFS info (device loop3): setting nodatasum [ 116.390542][ T6350] BTRFS info (device loop3): allowing degraded mounts [ 116.397328][ T6350] BTRFS info (device loop3): disabling tree log [ 116.407245][ T6350] BTRFS info (device loop3): turning on async discard [ 116.414678][ T6350] BTRFS info (device loop3): enabling free space tree [ 116.449350][ T5840] ocfs2: Unmounting device (7,2) on (node local) [ 116.566057][ T30] audit: type=1800 audit(1763519108.884:2): pid=6350 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.145" name="file1" dev="loop3" ino=260 res=0 errno=0 [ 116.956276][ T5829] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 117.083150][ T6440] loop0: detected capacity change from 0 to 16 [ 117.128982][ T6440] erofs (device loop0): mounted with root inode @ nid 36. [ 117.716362][ T6461] Bluetooth: MGMT ver 1.23 [ 117.807361][ T6463] netlink: 4 bytes leftover after parsing attributes in process `syz.3.173'. [ 117.811034][ T6459] loop0: detected capacity change from 0 to 128 [ 117.880306][ T6459] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 117.953683][ T6459] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 118.175819][ T6471] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 118.210449][ T1335] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 118.263582][ T6475] netlink: 24 bytes leftover after parsing attributes in process `syz.5.178'. [ 118.290677][ T6475] netlink: 40 bytes leftover after parsing attributes in process `syz.5.178'. [ 118.327955][ T6475] netlink: 24 bytes leftover after parsing attributes in process `syz.5.178'. [ 118.950589][ T975] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 118.987400][ T6496] loop4: detected capacity change from 0 to 512 [ 119.060977][ T5927] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 119.079253][ T6496] EXT4-fs error (device loop4): __ext4_fill_super:5512: inode #2: comm syz.4.189: inode has both inline data and extents flags [ 119.099820][ T6500] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 119.103420][ T6496] EXT4-fs (loop4): get root inode failed [ 119.127672][ T975] usb 6-1: New USB device found, idVendor=1a86, idProduct=7522, bcdDevice=35.36 [ 119.138012][ T975] usb 6-1: New USB device strings: Mfr=241, Product=2, SerialNumber=3 [ 119.149181][ T975] usb 6-1: Product: syz [ 119.153589][ T975] usb 6-1: Manufacturer: syz [ 119.158358][ T975] usb 6-1: SerialNumber: syz [ 119.167444][ T975] usb 6-1: config 0 descriptor?? [ 119.176088][ T6496] EXT4-fs (loop4): mount failed [ 119.195847][ T975] ch341 6-1:0.0: ch341-uart converter detected [ 119.234501][ T6503] loop2: detected capacity change from 0 to 1024 [ 119.240668][ T5927] usb 4-1: Using ep0 maxpacket: 32 [ 119.258853][ T5927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 119.288149][ T5927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 119.324052][ T5927] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 119.348334][ T5927] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 119.402173][ T5927] usb 4-1: config 0 descriptor?? [ 119.529087][ T3025] hfsplus: bad catalog file entry [ 119.587560][ T3025] hfsplus: b-tree write err: -5, ino 3 [ 119.787875][ T6511] overlayfs: refusing to follow metacopy origin for (/file1) [ 119.886575][ T5927] savu 0003:1E7D:2D5A.0003: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 120.247156][ T975] ch341-uart ttyUSB0: break control not supported, using simulated break [ 120.302534][ T6000] usb 4-1: USB disconnect, device number 2 [ 120.331181][ T43] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 120.342183][ T975] usb 6-1: ch341-uart converter now attached to ttyUSB0 [ 120.397558][ T975] usb 6-1: USB disconnect, device number 2 [ 120.451529][ T975] ch341-uart ttyUSB0: ch341-uart converter now disconnected from ttyUSB0 [ 120.482742][ T975] ch341 6-1:0.0: device disconnected [ 120.533269][ T43] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 120.544816][ T6519] fido_id[6519]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 120.563137][ T43] usb 2-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 120.595021][ T43] usb 2-1: config 0 interface 0 has no altsetting 0 [ 120.617233][ T43] usb 2-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 120.644228][ T6522] loop4: detected capacity change from 0 to 128 [ 120.654076][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 120.728290][ T43] usb 2-1: config 0 descriptor?? [ 121.083609][ T6532] loop3: detected capacity change from 0 to 64 [ 121.185603][ T43] hid-steam 0003:28DE:1102.0004: unknown main item tag 0x0 [ 121.201940][ T6532] loop3: detected capacity change from 64 to 0 [ 121.218961][ T43] hid-steam 0003:28DE:1102.0004: unknown main item tag 0x0 [ 121.236106][ C1] I/O error, dev loop3, sector 24 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 121.240466][ T6540] Unable to read inode block [ 121.269851][ T43] hid-steam 0003:28DE:1102.0004: unknown main item tag 0x0 [ 121.305839][ T43] hid-steam 0003:28DE:1102.0004: unknown main item tag 0x0 [ 121.340583][ T43] hid-steam 0003:28DE:1102.0004: unknown main item tag 0x0 [ 121.367647][ T43] hid-steam 0003:28DE:1102.0004: hidraw0: USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0 [ 121.395439][ T5829] Unable to read inode block [ 121.402536][ T6000] usb 6-1: new full-speed USB device number 3 using dummy_hcd [ 121.416897][ T5829] Unable to read inode block [ 121.446172][ T43] usb 2-1: USB disconnect, device number 3 [ 121.491629][ T6546] netlink: 8 bytes leftover after parsing attributes in process `syz.4.207'. [ 121.508925][ T6546] netlink: 'syz.4.207': attribute type 29 has an invalid length. [ 121.518520][ T6546] netlink: 8 bytes leftover after parsing attributes in process `syz.4.207'. [ 121.529707][ T6546] netlink: 8 bytes leftover after parsing attributes in process `syz.4.207'. [ 121.573785][ T6000] usb 6-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 121.613153][ T6546] netlink: 'syz.4.207': attribute type 29 has an invalid length. [ 121.616535][ T6544] fido_id[6544]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 121.621986][ T6000] usb 6-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 121.658157][ T6546] netlink: 8 bytes leftover after parsing attributes in process `syz.4.207'. [ 121.720336][ T6000] usb 6-1: config 0 interface 0 has no altsetting 0 [ 121.743830][ T6000] usb 6-1: New USB device found, idVendor=28de, idProduct=1102, bcdDevice= 0.00 [ 121.771701][ T6000] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.803575][ T6000] usb 6-1: config 0 descriptor?? [ 121.900629][ T5914] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 121.908663][ T3025] Unable to read inode block [ 122.085598][ T1335] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.101642][ T5914] usb 1-1: Using ep0 maxpacket: 16 [ 122.118816][ T5914] usb 1-1: config 0 has an invalid interface number: 16 but max is 0 [ 122.140910][ T5914] usb 1-1: config 0 has no interface number 0 [ 122.165782][ T5914] usb 1-1: New USB device found, idVendor=1a0a, idProduct=0101, bcdDevice=fe.d1 [ 122.181550][ T5914] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 122.199851][ T5914] usb 1-1: Product: syz [ 122.209968][ T5914] usb 1-1: Manufacturer: syz [ 122.228904][ T5914] usb 1-1: SerialNumber: syz [ 122.264439][ T5914] usb 1-1: config 0 descriptor?? [ 122.289903][ T6000] hid-steam 0003:28DE:1102.0005: unknown main item tag 0x0 [ 122.297798][ T5914] usb_ehset_test 1-1:0.16: probe with driver usb_ehset_test failed with error -32 [ 122.323594][ T1335] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.333998][ T6000] hid-steam 0003:28DE:1102.0005: unknown main item tag 0x0 [ 122.335205][ T6000] hid-steam 0003:28DE:1102.0005: : USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.5-1/input0 [ 122.432285][ T1335] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.451178][ T6000] hid-steam 0003:28DE:1102.0005: Steam Controller 'XXXXXXXXXX' connected [ 122.506851][ T6000] input: Steam Controller as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:28DE:1102.0005/input/input6 [ 122.529742][ T5914] usb 1-1: USB disconnect, device number 2 [ 122.618548][ T6000] hid-steam 0003:28DE:1102.0006: unknown main item tag 0x0 [ 122.672077][ T6000] hid-steam 0003:28DE:1102.0006: unknown main item tag 0x0 [ 122.741205][ T6000] hid-steam 0003:28DE:1102.0006: hidraw0: USB HID v0.01 Device [HID 28de:1102] on usb-dummy_hcd.5-1/input0 [ 122.819286][ T1335] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.933357][ T30] audit: type=1326 audit(1763519115.254:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6571 comm="syz.1.221" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc84018f6c9 code=0x0 [ 123.065111][ T5830] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0 [ 123.076096][ T5830] Bluetooth: hci2: Injecting HCI hardware error event [ 123.085874][ T5833] Bluetooth: hci2: hardware error 0x00 [ 123.431243][ T1335] bridge_slave_1: left allmulticast mode [ 123.469498][ T1335] bridge_slave_1: left promiscuous mode [ 123.485413][ T1335] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.573359][ T1335] bridge_slave_0: left allmulticast mode [ 123.579056][ T1335] bridge_slave_0: left promiscuous mode [ 123.601509][ T1335] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.629808][ T5914] usb 6-1: reset full-speed USB device number 3 using dummy_hcd [ 123.682313][ T6584] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 123.742256][ T5838] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 123.760981][ T5838] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 123.776030][ T5838] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 123.803280][ T5838] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 123.815960][ T5838] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 124.042463][ T6592] loop7: detected capacity change from 0 to 16384 [ 124.086131][ T6574] loop2: detected capacity change from 0 to 32768 [ 124.152119][ T6574] BTRFS: device fsid c6b85f58-0c7e-41ca-a553-c8d9f94f6663 devid 1 transid 8 /dev/loop2 (7:2) scanned by syz.2.222 (6574) [ 124.211804][ T6574] BTRFS info (device loop2): first mount of filesystem c6b85f58-0c7e-41ca-a553-c8d9f94f6663 [ 124.270741][ T6574] BTRFS info (device loop2): using blake2b (blake2b-256-generic) checksum algorithm [ 124.374263][ T6599] loop7: detected capacity change from 16384 to 0 [ 124.381619][ C1] I/O error, dev loop7, sector 8 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 124.493521][ T6574] BTRFS info (device loop2): enabling ssd optimizations [ 124.561342][ T6574] BTRFS info (device loop2): turning on async discard [ 124.568166][ T6574] BTRFS info (device loop2): enabling free space tree [ 124.652512][ T6574] BTRFS info (device loop2): use lzo compression, level 1 [ 124.800850][ T6000] usb 6-1: USB disconnect, device number 3 [ 124.986011][ T6000] hid-steam 0003:28DE:1102.0005: Steam Controller 'XXXXXXXXXX' disconnected [ 125.204897][ T5840] BTRFS info (device loop2): last unmount of filesystem c6b85f58-0c7e-41ca-a553-c8d9f94f6663 [ 125.291093][ T6633] loop5: detected capacity change from 0 to 4096 [ 125.304433][ T6633] ntfs3(loop5): Different NTFS sector size (1024) and media sector size (512). [ 125.309535][ T5833] Bluetooth: hci2: Opcode 0x0c03 failed: -110 [ 125.358415][ T6633] ntfs3(loop5): Mark volume as dirty due to NTFS errors [ 125.424487][ T30] audit: type=1800 audit(1763519117.734:4): pid=6633 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.235" name="file1" dev="loop5" ino=30 res=0 errno=0 [ 125.430674][ T5887] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 125.707162][ T5887] usb 5-1: Using ep0 maxpacket: 32 [ 125.721584][ T5887] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 125.745631][ T5887] usb 5-1: config 0 has no interface number 0 [ 125.762655][ T5887] usb 5-1: config 0 interface 184 has no altsetting 0 [ 125.775169][ T5887] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 125.804705][ T5887] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 125.834299][ T5887] usb 5-1: Product: syz [ 125.838515][ T5887] usb 5-1: Manufacturer: syz [ 125.853423][ T5887] usb 5-1: SerialNumber: syz [ 125.868416][ T5833] Bluetooth: hci1: command tx timeout [ 125.878028][ T5887] usb 5-1: config 0 descriptor?? [ 125.912736][ T5887] smsc75xx v1.0.0 [ 125.917006][ T6614] loop0: detected capacity change from 0 to 32768 [ 126.131195][ T1335] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 126.195588][ T1335] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 126.214513][ T1335] bond0 (unregistering): Released all slaves [ 126.333093][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 126.384168][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 126.402605][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 126.412880][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 126.548094][ T0] NOHZ tick-stop error: local softirq work is pending, handler #300!!! [ 126.619757][ T6643] loop1: detected capacity change from 0 to 1024 [ 126.672180][ T6645] netlink: 51 bytes leftover after parsing attributes in process `syz.5.239'. [ 126.937591][ T5887] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): EEPROM read operation timeout [ 127.009512][ T1144] hfsplus: bad catalog file entry [ 127.047814][ T1144] hfsplus: b-tree write err: -5, ino 3 [ 127.153152][ T5887] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 127.181735][ T5887] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 127.203765][ T5887] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 127.223999][ T5887] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 127.238267][ T5887] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 127.264061][ T5887] usb 5-1: USB disconnect, device number 5 [ 127.290797][ T5927] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 127.320854][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 127.329403][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 127.453527][ T5927] usb 1-1: Using ep0 maxpacket: 32 [ 127.467459][ T5927] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 127.505171][ T5927] usb 1-1: config 0 has no interface number 0 [ 127.548657][ T1335] hsr_slave_0: left promiscuous mode [ 127.549622][ T5927] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 127.570835][ T1335] hsr_slave_1: left promiscuous mode [ 127.578284][ T1335] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 127.595425][ T5927] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.607371][ T1335] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 127.614806][ T5927] usb 1-1: Product: syz [ 127.635642][ T1163] Bluetooth: hci6: Frame reassembly failed (-84) [ 127.639750][ T5927] usb 1-1: Manufacturer: syz [ 127.651586][ T1335] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 127.657765][ T5927] usb 1-1: SerialNumber: syz [ 127.659652][ T1335] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 127.697723][ T5927] usb 1-1: config 0 descriptor?? [ 127.733227][ T5927] asix 1-1:0.188: probe with driver asix failed with error -22 [ 127.787895][ T1335] veth1_macvtap: left promiscuous mode [ 127.807715][ T1335] veth0_macvtap: left promiscuous mode [ 127.829791][ T1335] veth1_vlan: left promiscuous mode [ 127.841086][ T1335] veth0_vlan: left promiscuous mode [ 127.945124][ T5838] Bluetooth: hci1: command tx timeout [ 127.955860][ T6671] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 128.522409][ T6664] loop1: detected capacity change from 0 to 40427 [ 128.548422][ T6664] F2FS-fs (loop1): build fault injection rate: 14 [ 128.563829][ T6664] F2FS-fs (loop1): build fault injection type: 0x3bfe8c [ 128.598397][ T6664] F2FS-fs (loop1): invalid crc value [ 128.627733][ C1] F2FS-fs (loop1): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 [ 128.655177][ C1] F2FS-fs (loop1): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 [ 128.741951][ T6664] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 128.752713][ T6664] F2FS-fs (loop1): inject page alloc in f2fs_grab_cache_folio of __get_meta_folio+0x157/0x4f0 [ 128.766440][ T6664] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 128.811913][ T6664] F2FS-fs (loop1): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_new_node_folio+0x1d9/0xa40 [ 128.834526][ T6664] F2FS-fs (loop1): inject dquot initialize in f2fs_dquot_initialize of f2fs_create+0x14c/0x5c0 [ 128.847804][ T6664] F2FS-fs (loop1): inject no more block in inc_valid_node_count of f2fs_new_node_folio+0x18b/0xa40 [ 128.907348][ T5832] syz-executor: attempt to access beyond end of device [ 128.907348][ T5832] loop1: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 128.937389][ T5832] CPU: 0 UID: 0 PID: 5832 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 128.937422][ T5832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 128.937437][ T5832] Call Trace: [ 128.937451][ T5832] [ 128.937461][ T5832] dump_stack_lvl+0x189/0x250 [ 128.937497][ T5832] ? preempt_schedule_thunk+0x16/0x30 [ 128.937528][ T5832] ? __pfx_dump_stack_lvl+0x10/0x10 [ 128.937560][ T5832] ? __pfx_queue_work_on+0x10/0x10 [ 128.937584][ T5832] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 128.937618][ T5832] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 128.937669][ T5832] f2fs_handle_critical_error+0x37c/0x540 [ 128.937717][ T5832] f2fs_write_end_io+0x886/0xb60 [ 128.937767][ T5832] __submit_merged_bio+0x27a/0x6a0 [ 128.937819][ T5832] __submit_merged_write_cond+0x255/0x530 [ 128.937865][ T5832] f2fs_write_data_pages+0x261d/0x3000 [ 128.937936][ T5832] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 128.937957][ T5832] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.938083][ T5832] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.938111][ T5832] ? __lock_acquire+0xab9/0xd20 [ 128.938148][ T5832] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.938175][ T5832] ? do_raw_spin_lock+0x121/0x290 [ 128.938216][ T5832] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.938248][ T5832] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.938275][ T5832] ? do_raw_spin_unlock+0x122/0x240 [ 128.938310][ T5832] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 128.938337][ T5832] do_writepages+0x32e/0x550 [ 128.938384][ T5832] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.938411][ T5832] ? preempt_schedule_thunk+0x16/0x30 [ 128.938451][ T5832] filemap_fdatawrite+0x199/0x240 [ 128.938485][ T5832] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 128.938575][ T5832] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.938609][ T5832] ? do_raw_spin_unlock+0x122/0x240 [ 128.938650][ T5832] f2fs_sync_dirty_inodes+0x31f/0x830 [ 128.938700][ T5832] f2fs_write_checkpoint+0x93e/0x2440 [ 128.938718][ T1335] team0 (unregistering): Port device team_slave_1 removed [ 128.938725][ T5832] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.938750][ T5832] ? __lock_acquire+0xab9/0xd20 [ 128.938819][ T5832] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 128.938927][ T5832] kill_f2fs_super+0x2cc/0x6d0 [ 128.938954][ T5832] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.938989][ T5832] ? __pfx_kill_f2fs_super+0x10/0x10 [ 128.939041][ T5832] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.939067][ T5832] ? shrinker_free+0x2ce/0x3e0 [ 128.939100][ T5832] deactivate_locked_super+0xbc/0x130 [ 128.939135][ T5832] cleanup_mnt+0x425/0x4c0 [ 128.939163][ T5832] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.939190][ T5832] ? lockdep_hardirqs_on+0x9c/0x150 [ 128.939230][ T5832] task_work_run+0x1d4/0x260 [ 128.939272][ T5832] ? __pfx_task_work_run+0x10/0x10 [ 128.939304][ T5832] ? __x64_sys_umount+0x122/0x160 [ 128.939344][ T5832] ? exit_to_user_mode_loop+0x40/0x130 [ 128.939374][ T5832] exit_to_user_mode_loop+0xe9/0x130 [ 128.939398][ T5832] do_syscall_64+0x2bd/0xfa0 [ 128.939433][ T5832] ? lockdep_hardirqs_on+0x9c/0x150 [ 128.939468][ T5832] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.939490][ T5832] ? srso_alias_return_thunk+0x5/0xfbef5 [ 128.939516][ T5832] ? exc_page_fault+0xab/0x100 [ 128.939554][ T5832] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 128.939577][ T5832] RIP: 0033:0x7fc8401909f7 [ 128.939599][ T5832] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 128.939617][ T5832] RSP: 002b:00007ffd342946f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 128.939641][ T5832] RAX: 0000000000000000 RBX: 00007fc840211d7d RCX: 00007fc8401909f7 [ 128.939657][ T5832] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd342947b0 [ 128.939672][ T5832] RBP: 00007ffd342947b0 R08: 0000000000000000 R09: 0000000000000000 [ 128.939686][ T5832] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd34295840 [ 128.939702][ T5832] R13: 00007fc840211d7d R14: 000000000001f758 R15: 00007ffd34295880 [ 128.939747][ T5832] [ 128.953502][ T5832] F2FS-fs (loop1): Stopped filesystem due to reason: 3 [ 129.382994][ T1335] team0 (unregistering): Port device team_slave_0 removed [ 129.711039][ T5838] Bluetooth: hci6: command 0x1003 tx timeout [ 129.711703][ T5833] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 129.874261][ T6689] netlink: 'syz.2.250': attribute type 6 has an invalid length. [ 130.018460][ T6671] netlink: 'syz.5.247': attribute type 12 has an invalid length. [ 130.032775][ T5833] Bluetooth: hci1: command tx timeout [ 130.040813][ T6671] netlink: 'syz.5.247': attribute type 29 has an invalid length. [ 130.056621][ T6671] netlink: 148 bytes leftover after parsing attributes in process `syz.5.247'. [ 130.066337][ T6671] netlink: 'syz.5.247': attribute type 2 has an invalid length. [ 130.083901][ T6671] netlink: 'syz.5.247': attribute type 3 has an invalid length. [ 130.108147][ T6671] netlink: 15 bytes leftover after parsing attributes in process `syz.5.247'. [ 130.232747][ T5887] usb 1-1: USB disconnect, device number 3 [ 130.382777][ T6701] block nbd5: NBD_DISCONNECT [ 130.393039][ T6701] block nbd5: Disconnected due to user request. [ 130.407445][ T6701] block nbd5: shutting down sockets [ 130.961927][ T6719] input: syz1 as /devices/virtual/input/input7 [ 131.115391][ T6727] netlink: 104 bytes leftover after parsing attributes in process `syz.5.262'. [ 131.340193][ T6729] loop1: detected capacity change from 0 to 512 [ 131.348568][ T6585] chnl_net:caif_netlink_parms(): no params data found [ 131.501879][ T6729] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 131.641140][ T30] audit: type=1800 audit(1763519123.964:5): pid=6729 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.263" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 131.755011][ T6738] loop0: detected capacity change from 0 to 4096 [ 131.895233][ T5832] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 132.002969][ T6749] input: syz1 as /devices/virtual/input/input8 [ 132.065013][ T6585] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.094845][ T6585] bridge0: port 1(bridge_slave_0) entered disabled state [ 132.121179][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.127715][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.127993][ T5833] Bluetooth: hci1: command tx timeout [ 132.148851][ T6585] bridge_slave_0: entered allmulticast mode [ 132.165033][ T6585] bridge_slave_0: entered promiscuous mode [ 132.175393][ T6585] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.186131][ T6585] bridge0: port 2(bridge_slave_1) entered disabled state [ 132.193561][ T6585] bridge_slave_1: entered allmulticast mode [ 132.201501][ T6585] bridge_slave_1: entered promiscuous mode [ 132.250233][ T1144] ntfs3(loop0): ino=5, mi_enum_attr [ 132.495897][ T6585] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 132.546649][ T6585] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 132.773352][ T6585] team0: Port device team_slave_0 added [ 132.791981][ T6585] team0: Port device team_slave_1 added [ 132.920981][ T6585] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 132.947769][ T6585] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 133.017934][ T6585] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 133.037394][ T6585] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 133.049077][ T6585] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 133.077285][ T6585] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 133.384791][ T6789] loop4: detected capacity change from 0 to 512 [ 133.468000][ T6789] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 133.651720][ T6789] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 133.670085][ T6789] ext4 filesystem being mounted at /55/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 133.847212][ T6759] loop0: detected capacity change from 0 to 40427 [ 133.951867][ T6759] F2FS-fs (loop0): invalid crc value [ 133.983840][ T6585] hsr_slave_0: entered promiscuous mode [ 134.003256][ T6585] hsr_slave_1: entered promiscuous mode [ 134.014327][ T6585] debugfs: 'hsr0' already exists in 'hsr' [ 134.052783][ T6585] Cannot create hsr debugfs directory [ 134.291219][ T5835] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 134.372135][ T6759] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 134.407771][ T6759] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 134.611636][ T6759] syz.0.270: attempt to access beyond end of device [ 134.611636][ T6759] loop0: rw=524288, sector=77824, nr_sectors = 256 limit=40427 [ 134.659263][ T6759] syz.0.270: attempt to access beyond end of device [ 134.659263][ T6759] loop0: rw=0, sector=77824, nr_sectors = 8 limit=40427 [ 134.706987][ T6759] syz.0.270: attempt to access beyond end of device [ 134.706987][ T6759] loop0: rw=0, sector=77824, nr_sectors = 8 limit=40427 [ 134.759669][ T6826] loop1: detected capacity change from 0 to 4096 [ 134.798638][ T6759] syz.0.270: attempt to access beyond end of device [ 134.798638][ T6759] loop0: rw=0, sector=77824, nr_sectors = 8 limit=40427 [ 134.865854][ T6826] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 134.877369][ T6759] syz.0.270: attempt to access beyond end of device [ 134.877369][ T6759] loop0: rw=34817, sector=77824, nr_sectors = 32 limit=40427 [ 134.989849][ T6829] loop5: detected capacity change from 0 to 4096 [ 135.159571][ T5824] syz-executor: attempt to access beyond end of device [ 135.159571][ T5824] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 135.205385][ T5824] CPU: 0 UID: 0 PID: 5824 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 135.205418][ T5824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 135.205433][ T5824] Call Trace: [ 135.205443][ T5824] [ 135.205453][ T5824] dump_stack_lvl+0x189/0x250 [ 135.205497][ T5824] ? __pfx_dump_stack_lvl+0x10/0x10 [ 135.205532][ T5824] ? __pfx_queue_work_on+0x10/0x10 [ 135.205559][ T5824] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 135.205594][ T5824] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 135.205646][ T5824] f2fs_handle_critical_error+0x37c/0x540 [ 135.205694][ T5824] f2fs_write_end_io+0x886/0xb60 [ 135.205747][ T5824] __submit_merged_bio+0x27a/0x6a0 [ 135.205802][ T5824] __submit_merged_write_cond+0x255/0x530 [ 135.205849][ T5824] f2fs_write_data_pages+0x261d/0x3000 [ 135.205925][ T5824] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 135.206011][ T5824] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.206044][ T5824] ? folio_unqueue_deferred_split+0x93/0x230 [ 135.206076][ T5824] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.206102][ T5824] ? folios_put_refs+0x584/0x670 [ 135.206143][ T5824] ? __pfx_folios_put_refs+0x10/0x10 [ 135.206167][ T5824] ? rcu_is_watching+0x15/0xb0 [ 135.206205][ T5824] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.206230][ T5824] ? __lock_acquire+0xab9/0xd20 [ 135.206277][ T5824] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 135.206304][ T5824] do_writepages+0x32e/0x550 [ 135.206344][ T5824] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.206377][ T5824] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.206402][ T5824] ? do_raw_spin_unlock+0x122/0x240 [ 135.206442][ T5824] filemap_fdatawrite+0x199/0x240 [ 135.206476][ T5824] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 135.206569][ T5824] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.206603][ T5824] ? do_raw_spin_unlock+0x122/0x240 [ 135.206644][ T5824] f2fs_sync_dirty_inodes+0x31f/0x830 [ 135.206694][ T5824] f2fs_write_checkpoint+0x93e/0x2440 [ 135.206719][ T5824] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.206746][ T5824] ? __lock_acquire+0xab9/0xd20 [ 135.206819][ T5824] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 135.206927][ T5824] kill_f2fs_super+0x2cc/0x6d0 [ 135.206955][ T5824] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.206991][ T5824] ? __pfx_kill_f2fs_super+0x10/0x10 [ 135.207043][ T5824] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.207069][ T5824] ? shrinker_free+0x2ce/0x3e0 [ 135.207102][ T5824] deactivate_locked_super+0xbc/0x130 [ 135.207138][ T5824] cleanup_mnt+0x425/0x4c0 [ 135.207166][ T5824] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.207192][ T5824] ? lockdep_hardirqs_on+0x9c/0x150 [ 135.207233][ T5824] task_work_run+0x1d4/0x260 [ 135.207275][ T5824] ? __pfx_task_work_run+0x10/0x10 [ 135.207307][ T5824] ? __x64_sys_umount+0x122/0x160 [ 135.207348][ T5824] ? exit_to_user_mode_loop+0x40/0x130 [ 135.207377][ T5824] exit_to_user_mode_loop+0xe9/0x130 [ 135.207401][ T5824] do_syscall_64+0x2bd/0xfa0 [ 135.207436][ T5824] ? lockdep_hardirqs_on+0x9c/0x150 [ 135.207471][ T5824] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.207493][ T5824] ? srso_alias_return_thunk+0x5/0xfbef5 [ 135.207520][ T5824] ? exc_page_fault+0xab/0x100 [ 135.207559][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 135.207582][ T5824] RIP: 0033:0x7f46123909f7 [ 135.207603][ T5824] Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 [ 135.207622][ T5824] RSP: 002b:00007fff6b9d0968 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 135.207647][ T5824] RAX: 0000000000000000 RBX: 00007f4612411d7d RCX: 00007f46123909f7 [ 135.207663][ T5824] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff6b9d0a20 [ 135.207678][ T5824] RBP: 00007fff6b9d0a20 R08: 0000000000000000 R09: 0000000000000000 [ 135.207693][ T5824] R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff6b9d1ab0 [ 135.207709][ T5824] R13: 00007f4612411d7d R14: 0000000000020ec8 R15: 00007fff6b9d1af0 [ 135.207755][ T5824] [ 135.207764][ T5824] F2FS-fs (loop0): Stopped filesystem due to reason: 3 [ 135.209509][ T5832] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 135.369340][ T6839] loop4: detected capacity change from 0 to 1024 [ 135.446119][ T6842] netlink: 108 bytes leftover after parsing attributes in process `syz.2.291'. [ 135.522708][ T6829] ntfs3(loop5): ino=b, mi_enum_attr [ 135.546487][ T6839] EXT4-fs (loop4): stripe (3) is not aligned with cluster size (16), stripe is disabled [ 135.586523][ T6829] ntfs3(loop5): Mark volume as dirty due to NTFS errors [ 135.681686][ T6839] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 135.698182][ T6829] ntfs3(loop5): Failed to load $Extend (-22). [ 135.727259][ T6829] ntfs3(loop5): Failed to initialize $Extend. [ 135.736308][ T6585] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 135.774412][ T6585] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 135.804677][ T6585] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 135.809404][ T6839] EXT4-fs warning (device loop4): ext4_expand_extra_isize_ea:2853: Unable to expand inode 12. Delete some EAs or run e2fsck. [ 135.848478][ T6585] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 135.924858][ T6846] EXT4-fs error (device loop4): ext4_xattr_inode_iget:441: inode #11: comm syz.4.294: missing EA_INODE flag [ 136.027446][ T6846] EXT4-fs (loop4): Remounting filesystem read-only [ 136.264001][ T5835] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 136.350843][ T5927] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 136.511372][ T975] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 136.534351][ T6585] 8021q: adding VLAN 0 to HW filter on device bond0 [ 136.541066][ T5927] usb 2-1: Using ep0 maxpacket: 16 [ 136.549001][ T5927] usb 2-1: config 0 has no interfaces? [ 136.559417][ T5927] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 136.579164][ T5927] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 136.589910][ T6585] 8021q: adding VLAN 0 to HW filter on device team0 [ 136.598214][ T5927] usb 2-1: Manufacturer: syz [ 136.613503][ T5927] usb 2-1: config 0 descriptor?? [ 136.623681][ T1144] bridge0: port 1(bridge_slave_0) entered blocking state [ 136.630874][ T1144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 136.672807][ T975] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 136.691355][ T1335] bridge0: port 2(bridge_slave_1) entered blocking state [ 136.693941][ T975] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 136.698595][ T1335] bridge0: port 2(bridge_slave_1) entered forwarding state [ 136.725134][ T975] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 136.781248][ T975] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 136.811502][ T975] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 136.849957][ T975] usb 3-1: config 0 descriptor?? [ 136.928943][ T5906] usb 2-1: USB disconnect, device number 4 [ 137.076968][ T5927] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 137.234266][ T5927] usb 1-1: Using ep0 maxpacket: 32 [ 137.246667][ T5927] usb 1-1: config 0 has no interfaces? [ 137.258873][ T6585] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 137.268872][ T5927] usb 1-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 137.282711][ T5927] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 137.298418][ T5927] usb 1-1: Product: syz [ 137.306461][ T5927] usb 1-1: Manufacturer: syz [ 137.311834][ T975] plantronics 0003:047F:FFFF.0007: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 137.330083][ T5927] usb 1-1: SerialNumber: syz [ 137.346305][ T5927] usb 1-1: config 0 descriptor?? [ 137.361230][ T5906] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 137.530563][ T5906] usb 5-1: Using ep0 maxpacket: 32 [ 137.555745][ T5906] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 137.591518][ T5906] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 137.626725][ T5906] usb 5-1: config 0 descriptor?? [ 137.751913][ T5887] usb 1-1: USB disconnect, device number 4 [ 137.864989][ T5906] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 137.909812][ T6000] usb 3-1: USB disconnect, device number 2 [ 137.914470][ T5906] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 137.958200][ T5906] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 137.968162][ T5906] usb 5-1: media controller created [ 138.049666][ T5906] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 138.147370][ T5906] az6027: usb out operation failed. (-71) [ 138.166971][ T5906] az6027: usb out operation failed. (-71) [ 138.174324][ T5906] stb0899_attach: Driver disabled by Kconfig [ 138.180306][ T5906] az6027: no front-end attached [ 138.180306][ T5906] [ 138.189822][ T5906] az6027: usb out operation failed. (-71) [ 138.208087][ T5906] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 138.226040][ T5906] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input9 [ 138.244515][ T6585] veth0_vlan: entered promiscuous mode [ 138.261188][ T5906] dvb-usb: schedule remote query interval to 400 msecs. [ 138.270969][ T6585] veth1_vlan: entered promiscuous mode [ 138.291237][ T5906] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 138.345968][ T5906] usb 5-1: USB disconnect, device number 6 [ 138.357516][ T6585] veth0_macvtap: entered promiscuous mode [ 138.386461][ T6585] veth1_macvtap: entered promiscuous mode [ 138.494434][ T6585] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 138.498444][ T5906] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 138.540424][ T6585] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 138.578985][ T1335] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.591910][ T1335] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.612527][ T1335] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.630162][ T1335] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 138.816392][ T1335] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 138.911386][ T1335] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 138.976686][ T6916] loop0: detected capacity change from 0 to 512 [ 139.027232][ T6916] EXT4-fs error (device loop0): ext4_orphan_get:1392: inode #15: comm syz.0.312: inode has both inline data and extents flags [ 139.057723][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 139.102700][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 139.110404][ T6916] EXT4-fs error (device loop0): ext4_orphan_get:1397: comm syz.0.312: couldn't read orphan inode 15 (err -117) [ 139.182909][ T6916] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 139.342524][ T5824] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 139.480622][ T43] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 139.670542][ T43] usb 3-1: Using ep0 maxpacket: 16 [ 139.677831][ T43] usb 3-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 139.686977][ T43] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 139.716633][ T43] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 139.754257][ T43] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 139.766490][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 139.790840][ T43] usb 3-1: Product: syz [ 139.795033][ T43] usb 3-1: Manufacturer: syz [ 139.799640][ T43] usb 3-1: SerialNumber: syz [ 140.232910][ T6944] loop4: detected capacity change from 0 to 512 [ 140.282373][ T43] usb 3-1: 0:2 : does not exist [ 140.288128][ T6944] EXT4-fs: Ignoring removed bh option [ 140.321531][ T6944] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 140.401091][ T6944] EXT4-fs (loop4): 1 truncate cleaned up [ 140.434640][ T6944] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 140.709580][ T5835] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 141.030640][ T5887] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 141.097154][ T43] usb 3-1: 1:0: failed to get current value for ch 0 (-22) [ 141.114572][ T6975] netlink: 96 bytes leftover after parsing attributes in process `syz.5.335'. [ 141.165514][ T43] usb 3-1: USB disconnect, device number 3 [ 141.197139][ T5887] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 141.228380][ T5887] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 141.248794][ T5887] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 141.263363][ T5887] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 141.278460][ T5887] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.289480][ T5887] usb 5-1: config 0 descriptor?? [ 141.309139][ T30] audit: type=1326 audit(1763519133.624:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6980 comm="syz.5.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 141.337906][ T30] audit: type=1326 audit(1763519133.654:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6980 comm="syz.5.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 141.362136][ T30] audit: type=1326 audit(1763519133.654:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6980 comm="syz.5.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 141.391603][ T30] audit: type=1326 audit(1763519133.654:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6980 comm="syz.5.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 141.418311][ T30] audit: type=1326 audit(1763519133.654:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6980 comm="syz.5.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 141.443042][ T30] audit: type=1326 audit(1763519133.654:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6980 comm="syz.5.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 141.466307][ T30] audit: type=1326 audit(1763519133.654:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6980 comm="syz.5.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 141.492418][ T5956] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 141.506193][ T30] audit: type=1326 audit(1763519133.654:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6980 comm="syz.5.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 141.531673][ T30] audit: type=1326 audit(1763519133.654:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6980 comm="syz.5.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 141.555095][ T30] audit: type=1326 audit(1763519133.654:15): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6980 comm="syz.5.337" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 141.676961][ T5956] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 141.687384][ T5956] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 141.716732][ T5956] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 141.733890][ T5887] plantronics 0003:047F:FFFF.0008: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.4-1/input0 [ 141.736217][ T5956] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 141.760929][ T6977] loop0: detected capacity change from 0 to 40427 [ 141.769226][ T6977] F2FS-fs (loop0): Invalid log_blocksize (268), supports only 12 [ 141.786295][ T6977] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock [ 141.805049][ T6977] F2FS-fs (loop0): invalid crc value [ 141.960836][ T6977] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 141.983516][ T6977] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 [ 141.990657][ T6977] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 142.005190][ T5956] usb 2-1: usb_control_msg returned -32 [ 142.011627][ T5956] usbtmc 2-1:16.0: can't read capabilities [ 142.320734][ T6999] loop2: detected capacity change from 0 to 4096 [ 142.348487][ T6999] ntfs3(loop2): Different NTFS sector size (2048) and media sector size (512). [ 142.372545][ C1] plantronics 0003:047F:FFFF.0008: hid_field_extract() called with n (132) > 32! (syz.1.336) [ 142.584805][ T43] usb 5-1: USB disconnect, device number 7 [ 143.061704][ T7013] loop6: detected capacity change from 0 to 32768 [ 143.076666][ T7013] XFS (loop6): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 143.102773][ T7013] XFS (loop6): Ending clean mount [ 143.180648][ T5956] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 143.199828][ T6585] XFS (loop6): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 143.350605][ T5956] usb 1-1: Using ep0 maxpacket: 32 [ 143.370679][ T5956] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 143.400592][ T5956] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 143.429052][ T5956] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 143.444842][ T5956] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.457319][ T5956] usb 1-1: config 0 descriptor?? [ 143.473522][ T5956] hub 1-1:0.0: USB hub found [ 143.531636][ T7036] loop4: detected capacity change from 0 to 4096 [ 143.585875][ T7036] ntfs3(loop4): Mark volume as dirty due to NTFS errors [ 143.625105][ T7036] ntfs3(loop4): Failed to load $Extend (-22). [ 143.633990][ T7036] ntfs3(loop4): Failed to initialize $Extend. [ 143.681305][ T5956] hub 1-1:0.0: 1 port detected [ 143.755910][ T7044] loop2: detected capacity change from 0 to 4096 [ 143.767544][ T7044] ntfs3(loop2): Different NTFS sector size (1024) and media sector size (512). [ 143.848341][ T7044] ntfs3(loop2): ino=0, attr_set_size [ 143.857095][ T7044] ntfs3(loop2): ino=0, attr_set_size [ 143.871612][ T7044] ntfs3(loop2): ino=0, attr_set_size [ 143.884704][ T7044] ntfs3(loop2): ino=0, attr_set_size [ 143.983077][ T7049] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 144.255848][ T7061] loop2: detected capacity change from 0 to 2048 [ 144.297496][ T5927] usb 2-1: USB disconnect, device number 5 [ 144.305829][ T5956] hub 1-1:0.0: activate --> -90 [ 144.351801][ T7061] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 144.496206][ T5840] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 144.642557][ T7059] loop4: detected capacity change from 0 to 32768 [ 144.672842][ T7059] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.364 (7059) [ 144.708284][ T5956] usb 1-1: USB disconnect, device number 5 [ 144.724688][ T7059] BTRFS info (device loop4): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 144.750765][ T5927] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 144.760584][ T7059] BTRFS info (device loop4): using sha256 (sha256-lib) checksum algorithm [ 144.857530][ T7059] BTRFS info (device loop4): rebuilding free space tree [ 144.899170][ T7059] BTRFS info (device loop4): disabling free space tree [ 144.920583][ T5927] usb 2-1: Using ep0 maxpacket: 8 [ 144.926025][ T7059] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 144.932692][ T5927] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 144.947040][ T7059] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 144.951072][ T5927] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 144.980713][ T5927] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 144.996548][ T7059] BTRFS info (device loop4): setting nodatasum [ 145.000620][ T5927] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 145.008960][ T7059] BTRFS info (device loop4): setting nodatacow [ 145.030624][ T7059] BTRFS info (device loop4): turning off barriers [ 145.037247][ T5927] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 145.061103][ T7059] BTRFS info (device loop4): force clearing of disk cache [ 145.070247][ T5927] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 145.090037][ T5927] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 145.203466][ T7107] loop6: detected capacity change from 0 to 4096 [ 145.291556][ T5835] BTRFS info (device loop4): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 145.315751][ T5927] usb 2-1: GET_CAPABILITIES returned 0 [ 145.322564][ T5927] usbtmc 2-1:16.0: can't read capabilities [ 145.576584][ T5906] usb 2-1: USB disconnect, device number 6 [ 145.708944][ T7115] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 145.757136][ T7119] loop2: detected capacity change from 0 to 512 [ 145.779665][ T7119] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 145.828080][ T7119] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 145.855086][ T7119] EXT4-fs error (device loop2): ext4_readdir:264: inode #2: block 3: comm syz.2.383: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=12, inode=514, rec_len=0, size=2048 fake=0 [ 145.919424][ T7119] EXT4-fs error (device loop2): ext4_readdir:264: inode #2: block 12: comm syz.2.383: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=5066064, rec_len=1, size=2048 fake=0 [ 145.961712][ T7119] EXT4-fs error (device loop2): ext4_readdir:264: inode #2: block 13: comm syz.2.383: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3653246737, rec_len=1, size=2048 fake=0 [ 145.984425][ T7134] io-wq is not configured for unbound workers [ 145.995076][ T7132] loop6: detected capacity change from 0 to 256 [ 146.009125][ T7119] EXT4-fs error (device loop2): ext4_readdir:264: inode #2: block 14: comm syz.2.383: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 146.046089][ T7132] exFAT-fs (loop6): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 146.060110][ T7119] EXT4-fs error (device loop2): ext4_readdir:264: inode #2: block 15: comm syz.2.383: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=5, rec_len=0, size=2048 fake=0 [ 146.089820][ T7119] EXT4-fs error (device loop2): ext4_readdir:264: inode #2: block 16: comm syz.2.383: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3653245223, rec_len=1, size=2048 fake=0 [ 146.116646][ T7119] EXT4-fs error (device loop2): ext4_readdir:264: inode #2: block 17: comm syz.2.383: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 146.138124][ T7119] EXT4-fs error (device loop2): ext4_map_blocks:778: inode #2: block 18: comm syz.2.383: lblock 23 mapped to illegal pblock 18 (length 1) [ 146.173453][ T7119] EXT4-fs error (device loop2): ext4_readdir:264: inode #2: block 19: comm syz.2.383: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=5, rec_len=0, size=2048 fake=0 [ 146.224895][ T7119] EXT4-fs error (device loop2): ext4_readdir:264: inode #2: block 20: comm syz.2.383: path (unknown): bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=2048 fake=0 [ 146.296112][ T7143] netlink: 36 bytes leftover after parsing attributes in process `syz.6.390'. [ 146.344504][ T7141] loop0: detected capacity change from 0 to 1764 [ 146.389913][ T7141] Bluetooth: MGMT ver 1.23 [ 146.706070][ T7156] netlink: 68 bytes leftover after parsing attributes in process `syz.1.397'. [ 146.936530][ T5840] EXT4-fs warning (device loop2): ext4_update_dynamic_rev:1137: updating to rev 1 because of new feature flag, running e2fsck is recommended [ 147.024151][ T5840] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 147.075975][ T7167] netlink: 'syz.6.402': attribute type 1 has an invalid length. [ 147.160746][ T5956] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 147.192065][ T7172] loop5: detected capacity change from 0 to 1024 [ 147.344155][ T5956] usb 1-1: Using ep0 maxpacket: 32 [ 147.355979][ T5956] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 147.372900][ T7172] hfsplus: xattr searching failed [ 147.381322][ T5956] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 147.420557][ T5956] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 147.454444][ T5956] usb 1-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 147.493233][ T5956] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 147.500383][ T1144] hfsplus: bad catalog file entry [ 147.523374][ T5956] usb 1-1: config 0 descriptor?? [ 147.528407][ T1144] hfsplus: b-tree write err: -5, ino 3 [ 147.529040][ T7162] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 147.552850][ T5956] hub 1-1:0.0: USB hub found [ 147.713002][ T30] kauditd_printk_skb: 307 callbacks suppressed [ 147.713022][ T30] audit: type=1326 audit(1763519140.024:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7185 comm="syz.5.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 147.843601][ T5956] hub 1-1:0.0: 2 ports detected [ 147.879759][ T30] audit: type=1326 audit(1763519140.064:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7185 comm="syz.5.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 147.933524][ T30] audit: type=1326 audit(1763519140.064:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7185 comm="syz.5.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 147.959121][ T30] audit: type=1326 audit(1763519140.064:326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7185 comm="syz.5.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 148.028768][ T7193] loop5: detected capacity change from 0 to 512 [ 148.037778][ T30] audit: type=1326 audit(1763519140.064:327): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7185 comm="syz.5.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 148.097154][ T7193] EXT4-fs (loop5): Test dummy encryption mode enabled [ 148.149265][ T7193] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 148.191784][ T30] audit: type=1326 audit(1763519140.064:328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7185 comm="syz.5.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 148.219967][ T7193] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 148.247383][ T5956] hub 1-1:0.0: set hub depth failed [ 148.257235][ T5956] usb 1-1: USB disconnect, device number 6 [ 148.492375][ T7196] loop6: detected capacity change from 0 to 32768 [ 148.532949][ T7196] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.414 (7196) [ 148.543814][ T7193] EXT4-fs (loop5): 1 truncate cleaned up [ 148.558752][ T7196] BTRFS info (device loop6): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 148.569025][ T7196] BTRFS info (device loop6): using sha256 (sha256-lib) checksum algorithm [ 148.570584][ T5906] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 148.606318][ T30] audit: type=1326 audit(1763519140.064:329): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7185 comm="syz.5.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 148.662817][ T7193] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 148.745673][ T30] audit: type=1326 audit(1763519140.064:330): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7185 comm="syz.5.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 148.817786][ T30] audit: type=1326 audit(1763519140.074:331): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7185 comm="syz.5.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 148.818451][ T1144] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 148.854408][ T7196] BTRFS info (device loop6): enabling ssd optimizations [ 148.862214][ T7196] BTRFS info (device loop6): turning on async discard [ 148.868983][ T7196] BTRFS info (device loop6): enabling free space tree [ 148.870646][ T5906] usb 5-1: Using ep0 maxpacket: 16 [ 148.946761][ T5906] usb 5-1: config 0 has no interfaces? [ 149.003883][ T5906] usb 5-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice=7d.f9 [ 149.028471][ T30] audit: type=1326 audit(1763519140.074:332): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7185 comm="syz.5.408" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9b39f8f6c9 code=0x7ffc0000 [ 149.053141][ T5906] usb 5-1: New USB device strings: Mfr=11, Product=2, SerialNumber=3 [ 149.091546][ T5906] usb 5-1: Product: syz [ 149.095749][ T5906] usb 5-1: Manufacturer: syz [ 149.100339][ T5906] usb 5-1: SerialNumber: syz [ 149.107800][ T5843] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 149.217725][ T6585] BTRFS info (device loop6): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 149.221675][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 149.252710][ T5906] usb 5-1: config 0 descriptor?? [ 149.264690][ T1144] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 149.581959][ T1144] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 149.753042][ T43] usb 5-1: USB disconnect, device number 8 [ 149.918931][ T1144] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.227472][ T5838] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 150.237385][ T5838] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 150.246462][ T5838] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 150.255057][ T5838] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 150.263597][ T5838] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 150.310044][ T1144] bridge_slave_1: left allmulticast mode [ 150.328721][ T1144] bridge_slave_1: left promiscuous mode [ 150.359143][ T1144] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.394418][ T1144] bridge_slave_0: left allmulticast mode [ 150.406816][ T7236] loop6: detected capacity change from 0 to 8192 [ 150.413306][ T1144] bridge_slave_0: left promiscuous mode [ 150.426471][ T1144] bridge0: port 1(bridge_slave_0) entered disabled state [ 150.531402][ T7236] FAT-fs (loop6): error, clusters badly computed (2 != 1) [ 150.538895][ T7236] FAT-fs (loop6): Filesystem has been set read-only [ 150.669272][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 150.953438][ T7253] netlink: 'syz.6.430': attribute type 1 has an invalid length. [ 150.961324][ T7253] netlink: 16150 bytes leftover after parsing attributes in process `syz.6.430'. [ 151.288964][ T7262] loop1: detected capacity change from 0 to 164 [ 151.370612][ T7262] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 151.405304][ T7262] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 151.704965][ T7281] netlink: 'syz.1.440': attribute type 27 has an invalid length. [ 151.719958][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 151.766815][ T1144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 151.778655][ T1144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 151.795252][ T1144] bond0 (unregistering): Released all slaves [ 151.917376][ T7281] bridge0: port 2(bridge_slave_1) entered disabled state [ 151.925945][ T7281] bridge0: port 1(bridge_slave_0) entered disabled state [ 151.943007][ T5887] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 152.032788][ T7281] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 152.048571][ T7281] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 152.343333][ T5838] Bluetooth: hci4: command tx timeout [ 152.464877][ T3025] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.484228][ T3025] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.511092][ T3025] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.547008][ T3025] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 152.778537][ T5914] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 152.864501][ T7283] loop4: detected capacity change from 0 to 32768 [ 152.978028][ T1144] hsr_slave_0: left promiscuous mode [ 153.007509][ T1144] hsr_slave_1: left promiscuous mode [ 153.018832][ T1144] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 153.039372][ T1144] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 153.060896][ T5887] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 153.074012][ T1144] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 153.105093][ T1144] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 153.189645][ T1144] veth1_macvtap: left promiscuous mode [ 153.205813][ T7305] netlink: 'syz.5.452': attribute type 10 has an invalid length. [ 153.218236][ T1144] veth0_macvtap: left promiscuous mode [ 153.234473][ T1144] veth1_vlan: left promiscuous mode [ 153.247487][ T1144] veth0_vlan: left promiscuous mode [ 153.363384][ T7291] loop6: detected capacity change from 0 to 32768 [ 153.446601][ T7291] XFS (loop6): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 153.511094][ T7318] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 153.583839][ T7291] XFS (loop6): Ending clean mount [ 153.604517][ T7291] XFS (loop6): Quotacheck needed: Please wait. [ 153.685038][ T7291] XFS (loop6): Quotacheck: Done. [ 153.787007][ T5914] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 153.818870][ T5927] IPVS: starting estimator thread 0... [ 153.832639][ T6585] XFS (loop6): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 153.912095][ T7326] IPVS: using max 24 ests per chain, 57600 per kthread [ 154.303314][ T5914] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 154.422084][ T5838] Bluetooth: hci4: command tx timeout [ 154.433205][ T1144] team0 (unregistering): Port device team_slave_1 removed [ 154.472485][ T5914] usb 2-1: config 0 has too many interfaces: 204, using maximum allowed: 32 [ 154.496018][ T5914] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 204 [ 154.518783][ T5914] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 154.532572][ T1144] team0 (unregistering): Port device team_slave_0 removed [ 154.542453][ T5914] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 154.564186][ T5914] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 154.570632][ T5927] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 154.581341][ T5914] usb 2-1: New USB device found, idVendor=28bd, idProduct=0909, bcdDevice= 0.00 [ 154.605727][ T5914] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 154.655106][ T5914] usb 2-1: config 0 descriptor?? [ 154.740309][ T7343] loop0: detected capacity change from 0 to 32768 [ 154.748645][ T5927] usb 7-1: Using ep0 maxpacket: 16 [ 154.755529][ T5927] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 154.765161][ T5927] usb 7-1: config 0 has no interface number 0 [ 154.776065][ T5927] usb 7-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 154.787141][ T5927] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 154.795242][ T5927] usb 7-1: Product: syz [ 154.800096][ T5927] usb 7-1: Manufacturer: syz [ 154.804800][ T5927] usb 7-1: SerialNumber: syz [ 154.827061][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 154.830723][ T5927] usb 7-1: config 0 descriptor?? [ 154.852658][ T5927] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 154.863008][ T7343] XFS (loop0): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 154.894678][ T7343] XFS (loop0): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51. [ 154.916409][ T7343] XFS (loop0): Starting recovery (logdev: internal) [ 154.954318][ T7343] XFS (loop0): Ending recovery (logdev: internal) [ 155.014821][ T7343] XFS (loop0): Metadata corruption detected at xfs_btree_lookup_get_block+0x3c5/0x500, xfs_bnobt block 0x8 [ 155.029109][ T7343] XFS (loop0): Unmount and run xfs_repair [ 155.059329][ T7343] XFS (loop0): Internal error ltbno + ltlen > bno at line 2104 of file fs/xfs/libxfs/xfs_alloc.c. Caller xfs_free_ag_extent+0x1098/0x1760 [ 155.074580][ T7343] CPU: 1 UID: 0 PID: 7343 Comm: syz.0.463 Not tainted syzkaller #0 PREEMPT(full) [ 155.074613][ T7343] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 155.074628][ T7343] Call Trace: [ 155.074637][ T7343] [ 155.074647][ T7343] dump_stack_lvl+0x189/0x250 [ 155.074691][ T7343] ? __pfx__xfs_alert_tag+0x10/0x10 [ 155.074717][ T7343] ? __pfx_dump_stack_lvl+0x10/0x10 [ 155.074753][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.074781][ T7343] ? xfs_alloc_get_rec+0x2df/0x410 [ 155.074818][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.074856][ T7343] xfs_corruption_error+0x122/0x170 [ 155.074884][ T7343] ? xfs_free_ag_extent+0x1098/0x1760 [ 155.074921][ T7343] xfs_free_ag_extent+0x1260/0x1760 [ 155.074950][ T7343] ? xfs_free_ag_extent+0x1098/0x1760 [ 155.075000][ T7343] ? __pfx_xfs_free_ag_extent+0x10/0x10 [ 155.075034][ T7343] ? kasan_save_track+0x4f/0x80 [ 155.075067][ T7343] ? kasan_save_track+0x3e/0x80 [ 155.075100][ T7343] ? __kasan_slab_alloc+0x6c/0x80 [ 155.075146][ T7343] __xfs_free_extent+0x2f1/0x470 [ 155.075187][ T7343] ? __pfx___xfs_free_extent+0x10/0x10 [ 155.075248][ T7343] ? rcu_is_watching+0x15/0xb0 [ 155.075283][ T7343] xfs_extent_free_finish_item+0x28b/0x670 [ 155.075319][ T7343] ? __pfx_xfs_extent_free_finish_item+0x10/0x10 [ 155.075348][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.075376][ T7343] ? rcu_is_watching+0x15/0xb0 [ 155.075410][ T7343] ? __pfx_xfs_extent_free_finish_item+0x10/0x10 [ 155.075435][ T7343] xfs_defer_finish_one+0x5c8/0xcf0 [ 155.075490][ T7343] ? __pfx_xfs_defer_finish_one+0x10/0x10 [ 155.075528][ T7343] xfs_defer_finish_noroll+0x910/0x12d0 [ 155.075558][ T7343] ? xfs_trans_commit+0x10b/0x1c0 [ 155.075594][ T7343] ? __pfx_xfs_defer_finish_noroll+0x10/0x10 [ 155.075617][ T7343] ? down_write_nested+0x169/0x200 [ 155.075650][ T7343] ? __pfx_down_write_nested+0x10/0x10 [ 155.075685][ T7343] ? xfs_trans_reserve_quota_nblks+0x18a/0x2e0 [ 155.075737][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.075771][ T7343] xfs_trans_commit+0x10b/0x1c0 [ 155.075810][ T7343] ? __pfx_xfs_trans_commit+0x10/0x10 [ 155.075846][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.075884][ T7343] xfs_free_file_space+0x5ce/0xce0 [ 155.075933][ T7343] ? __pfx_xfs_free_file_space+0x10/0x10 [ 155.075983][ T7343] xfs_collapse_file_space+0x22c/0x690 [ 155.076024][ T7343] ? __pfx_xfs_collapse_file_space+0x10/0x10 [ 155.076056][ T7343] ? xfs_break_layouts+0x248/0x2f0 [ 155.076084][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.076112][ T7343] ? mnt_put_write_access_file+0xc0/0x100 [ 155.076144][ T7343] ? __pfx_xfs_vn_update_time+0x10/0x10 [ 155.076173][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.076204][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.076238][ T7343] __xfs_file_fallocate+0xcda/0x1610 [ 155.076289][ T7343] ? __pfx___xfs_file_fallocate+0x10/0x10 [ 155.076347][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.076377][ T7343] ? aa_file_perm+0x13a/0x1550 [ 155.076405][ T7343] ? aa_file_perm+0x13a/0x1550 [ 155.076427][ T7343] ? aa_file_perm+0x44d/0x1550 [ 155.076453][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.076491][ T7343] ? ktime_get+0x45/0x200 [ 155.076519][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.076555][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.076583][ T7343] ? __lock_acquire+0xab9/0xd20 [ 155.076619][ T7343] xfs_file_fallocate+0x27b/0x340 [ 155.076663][ T7343] ? __pfx_xfs_file_fallocate+0x10/0x10 [ 155.076701][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.076737][ T7343] vfs_fallocate+0x669/0x7e0 [ 155.076775][ T7343] ? __fget_files+0x2a/0x420 [ 155.076810][ T7343] ? __pfx_vfs_fallocate+0x10/0x10 [ 155.076844][ T7343] ? __fget_files+0x3a0/0x420 [ 155.076865][ T7343] ? __fget_files+0x2a/0x420 [ 155.076895][ T7343] ? srso_alias_return_thunk+0x5/0xfbef5 [ 155.076928][ T7343] __x64_sys_fallocate+0xc0/0x110 [ 155.076970][ T7343] do_syscall_64+0xfa/0xfa0 [ 155.077007][ T7343] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.077026][ T7343] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 155.077058][ T7343] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.077082][ T7343] RIP: 0033:0x7f461238f6c9 [ 155.077103][ T7343] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 155.077124][ T7343] RSP: 002b:00007f4613144038 EFLAGS: 00000246 ORIG_RAX: 000000000000011d [ 155.077149][ T7343] RAX: ffffffffffffffda RBX: 00007f46125e5fa0 RCX: 00007f461238f6c9 [ 155.077167][ T7343] RDX: 0000000000004000 RSI: 0000000000000008 RDI: 0000000000000005 [ 155.077182][ T7343] RBP: 00007f4612411f91 R08: 0000000000000000 R09: 0000000000000000 [ 155.077197][ T7343] R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000000 [ 155.077212][ T7343] R13: 00007f46125e6038 R14: 00007f46125e5fa0 R15: 00007fff6b9d16d8 [ 155.077253][ T7343] [ 155.078063][ T7343] XFS (loop0): Corruption detected. Unmount and run xfs_repair [ 155.568265][ T7343] XFS (loop0): Corruption of in-memory data (0x8) detected at xfs_defer_finish_noroll+0xcc0/0x12d0 (fs/xfs/libxfs/xfs_defer.c:721). Shutting down filesystem. [ 155.578079][ T5914] input: HID 28bd:0909 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:28BD:0909.0009/input/input10 [ 155.604369][ T7343] XFS (loop0): Please unmount the filesystem and rectify the problem(s) [ 155.656595][ T5824] XFS (loop0): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 155.680454][ T5914] uclogic 0003:28BD:0909.0009: input,hidraw0: USB HID v0.00 Mouse [HID 28bd:0909] on usb-dummy_hcd.1-1/input0 [ 155.712684][ T5914] usb 2-1: USB disconnect, device number 7 [ 155.867386][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 155.952613][ T7305] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 156.071695][ T5914] IPVS: starting estimator thread 0... [ 156.081436][ T7356] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 156.097884][ T5927] gspca_spca1528: reg_w err -71 [ 156.110920][ T5906] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 156.124585][ T5927] spca1528 7-1:0.1: probe with driver spca1528 failed with error -71 [ 156.134968][ T5927] usb 7-1: USB disconnect, device number 2 [ 156.210614][ T7358] IPVS: using max 24 ests per chain, 57600 per kthread [ 156.308379][ T7365] loop5: detected capacity change from 0 to 256 [ 156.483921][ T7237] chnl_net:caif_netlink_parms(): no params data found [ 156.500721][ T5838] Bluetooth: hci4: command tx timeout [ 156.631567][ T7376] block nbd0: Unsupported socket: should be TCP or UNIX. [ 156.823057][ T7377] loop0: detected capacity change from 0 to 8192 [ 156.907778][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 156.977072][ T7237] bridge0: port 1(bridge_slave_0) entered blocking state [ 157.010800][ T7237] bridge0: port 1(bridge_slave_0) entered disabled state [ 157.045326][ T7237] bridge_slave_0: entered allmulticast mode [ 157.072353][ T7237] bridge_slave_0: entered promiscuous mode [ 157.104874][ T7237] bridge0: port 2(bridge_slave_1) entered blocking state [ 157.152196][ T7390] loop6: detected capacity change from 0 to 32768 [ 157.154565][ T7237] bridge0: port 2(bridge_slave_1) entered disabled state [ 157.160936][ T5927] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 157.174030][ T7390] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.477 (7390) [ 157.187745][ T7237] bridge_slave_1: entered allmulticast mode [ 157.196342][ T7390] BTRFS info (device loop6): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 157.206532][ T7390] BTRFS info (device loop6): using crc32c (crc32c-lib) checksum algorithm [ 157.219914][ T7237] bridge_slave_1: entered promiscuous mode [ 157.280637][ T5914] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 157.324748][ T7237] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 157.369024][ T7390] BTRFS info (device loop6): setting nodatasum [ 157.375472][ T7390] BTRFS info (device loop6): setting nodatacow [ 157.381709][ T7390] BTRFS info (device loop6): turning on async discard [ 157.388472][ T7390] BTRFS info (device loop6): enabling free space tree [ 157.395313][ T7390] BTRFS info (device loop6): enabling auto defrag [ 157.401782][ T7390] BTRFS info (device loop6): max_inline set to 0 [ 157.430684][ T5914] usb 5-1: Using ep0 maxpacket: 16 [ 157.441192][ T30] kauditd_printk_skb: 18 callbacks suppressed [ 157.441210][ T30] audit: type=1800 audit(1763519149.764:351): pid=7390 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.477" name="bus" dev="loop6" ino=263 res=0 errno=0 [ 157.452803][ T5914] usb 5-1: config 0 has an invalid interface number: 41 but max is 0 [ 157.481565][ T7237] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 157.560140][ T5914] usb 5-1: config 0 has no interface number 0 [ 157.604773][ T5914] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 157.624100][ T6585] BTRFS info (device loop6): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf [ 157.640661][ T5914] usb 5-1: config 0 interface 41 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 157.680641][ T5914] usb 5-1: config 0 interface 41 has no altsetting 0 [ 157.715743][ T7237] team0: Port device team_slave_0 added [ 157.716410][ T5914] usb 5-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 157.752136][ T5914] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 157.770374][ T5914] usb 5-1: Product: syz [ 157.771267][ T7237] team0: Port device team_slave_1 added [ 157.775040][ T5914] usb 5-1: Manufacturer: syz [ 157.800747][ T5914] usb 5-1: SerialNumber: syz [ 157.812967][ T5914] usb 5-1: config 0 descriptor?? [ 157.847551][ T7392] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 157.867369][ T7392] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 157.948210][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 157.967671][ T7419] loop5: detected capacity change from 0 to 4096 [ 158.023568][ T7237] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 158.042909][ T7237] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 158.102281][ T7237] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 158.136003][ T7392] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 158.143564][ T7392] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 158.153190][ T7237] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 158.181841][ T7237] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 158.234320][ T7423] loop0: detected capacity change from 0 to 16 [ 158.242391][ T7237] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 158.253664][ T7423] erofs (device loop0): mounted with root inode @ nid 36. [ 158.433690][ T7237] hsr_slave_0: entered promiscuous mode [ 158.445127][ T7237] hsr_slave_1: entered promiscuous mode [ 158.463183][ T7237] debugfs: 'hsr0' already exists in 'hsr' [ 158.476337][ T7237] Cannot create hsr debugfs directory [ 158.520612][ T43] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 158.538691][ T7430] loop0: detected capacity change from 0 to 64 [ 158.592067][ T5838] Bluetooth: hci4: command tx timeout [ 158.613324][ T30] audit: type=1800 audit(1763519150.924:352): pid=7430 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.490" name="file1" dev="loop0" ino=22 res=0 errno=0 [ 158.691417][ T43] usb 7-1: Using ep0 maxpacket: 16 [ 158.709256][ T43] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 158.718018][ T30] audit: type=1800 audit(1763519150.924:353): pid=7430 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.490" name="file1" dev="loop0" ino=22 res=0 errno=0 [ 158.732782][ T43] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 158.803959][ T43] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 158.835959][ T5914] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): sr_get_phy_addr : Error reading PHYID register:ffffffe0 [ 158.853261][ T43] usb 7-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 158.873486][ T43] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 158.907206][ T43] usb 7-1: config 0 descriptor?? [ 158.990323][ T5913] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 159.065526][ T7438] loop0: detected capacity change from 0 to 256 [ 159.101992][ T5914] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): Failed to send software reset:ffffffb9 [ 159.115476][ T5914] CoreChips 5-1:0.41 (unnamed net_device) (uninitialized): Failed to power down PHY : -71 [ 159.141359][ T63] wlan1: Trigger new scan to find an IBSS to join [ 159.148643][ T5914] CoreChips 5-1:0.41: probe with driver CoreChips failed with error -71 [ 159.178922][ T5914] usb 5-1: USB disconnect, device number 9 [ 159.181711][ T7237] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 159.202944][ T7438] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0x987a2e96, utbl_chksum : 0xe619d30d) [ 159.228937][ T7237] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 159.262512][ T7237] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 159.262935][ T7438] exFAT-fs (loop0): start_clu is invalid cluster(0x0) [ 159.298755][ T7237] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 159.338301][ T43] microsoft 0003:045E:07DA.000A: ignoring exceeding usage max [ 159.355149][ T43] microsoft 0003:045E:07DA.000A: unsupported Resolution Multiplier 0 [ 159.382004][ T43] microsoft 0003:045E:07DA.000A: implement() called with n (152) > 32! (kworker/1:1) [ 159.542606][ T7237] 8021q: adding VLAN 0 to HW filter on device bond0 [ 159.554406][ T43] microsoft 0003:045E:07DA.000A: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.6-1/input0 [ 159.580589][ T43] microsoft 0003:045E:07DA.000A: no inputs found [ 159.598304][ T43] microsoft 0003:045E:07DA.000A: could not initialize ff, continuing anyway [ 159.609777][ T7237] 8021q: adding VLAN 0 to HW filter on device team0 [ 159.621004][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 159.629926][ T43] usb 7-1: USB disconnect, device number 3 [ 159.669616][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 159.676870][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 159.756514][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 159.763756][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 159.830123][ T7436] loop5: detected capacity change from 0 to 32768 [ 159.864181][ T7436] JBD2: Ignoring recovery information on journal [ 159.921682][ T7436] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 159.996592][ T7237] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 160.026907][ T5914] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 160.187784][ T5906] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 160.278900][ T5843] ocfs2: Unmounting device (7,5) on (node local) [ 160.484850][ T7467] loop4: detected capacity change from 0 to 7 [ 160.574226][ T7467] Dev loop4: unable to read RDB block 7 [ 160.580154][ T7467] loop4: unable to read partition table [ 160.647100][ T7467] loop4: partition table beyond EOD, truncated [ 160.689323][ T7467] loop_reread_partitions: partition scan of loop4 (þ被xü—ŸÑà– ) failed (rc=-5) [ 160.726909][ T7237] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 160.745955][ T7464] loop6: detected capacity change from 0 to 32768 [ 160.808938][ T7464] gfs2: fsid=syz:syz: Trying to join cluster "lock_nolock", "syz:syz" [ 160.818787][ T7464] gfs2: fsid=syz:syz: Now mounting FS (format 1801)... [ 160.858247][ T7464] gfs2: fsid=syz:syz.0: journal 0 mapped with 5 extents in 0ms [ 160.873015][ T6000] gfs2: fsid=syz:syz.0: jid=0, already locked for use [ 160.880428][ T6000] gfs2: fsid=syz:syz.0: jid=0: Looking at journal... [ 160.916549][ T5887] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 161.030987][ T6000] gfs2: fsid=syz:syz.0: jid=0: Journal head lookup took 150ms [ 161.038667][ T6000] gfs2: fsid=syz:syz.0: jid=0: Done [ 161.066906][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 161.083070][ T7464] gfs2: fsid=syz:syz.0: first mount done, others may mount [ 161.686257][ T7237] veth0_vlan: entered promiscuous mode [ 161.786413][ T7237] veth1_vlan: entered promiscuous mode [ 161.973382][ T7237] veth0_macvtap: entered promiscuous mode [ 162.060723][ T7237] veth1_macvtap: entered promiscuous mode [ 162.150722][ T6000] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 162.184918][ T51] wlan1: Trigger new scan to find an IBSS to join [ 162.246227][ T7237] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 162.308182][ T7237] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 162.320690][ T7479] loop5: detected capacity change from 0 to 131072 [ 162.332053][ T7479] F2FS-fs (loop5): Test dummy encryption mode enabled [ 162.343734][ T7479] F2FS-fs (loop5): invalid crc value [ 162.465159][ T7479] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 162.502584][ T7479] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 162.549356][ T7479] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-aesni" [ 162.644222][ T1163] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 162.689179][ T1163] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 162.744786][ T1163] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 162.795474][ T1163] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 163.182348][ T3025] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 163.190209][ T3025] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 163.223377][ T5887] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 163.231533][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 163.311376][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 163.323026][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 163.330872][ T30] audit: type=1326 audit(1763519155.634:354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7498 comm="syz.0.509" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f461238f6c9 code=0x0 [ 163.575061][ T7507] loop7: detected capacity change from 0 to 512 [ 163.640373][ T7507] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 163.661427][ T7507] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 163.751430][ T7496] loop4: detected capacity change from 0 to 40427 [ 163.762137][ T7496] F2FS-fs (loop4): build fault injection rate: 174 [ 163.770758][ T7496] F2FS-fs (loop4): build fault injection type: 0x3bfe8c [ 163.785932][ T7496] F2FS-fs (loop4): invalid crc value [ 163.888256][ T7237] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 163.982602][ T7496] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 [ 164.005189][ T7496] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 164.096518][ T7496] syz.4.506: attempt to access beyond end of device [ 164.096518][ T7496] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 164.151199][ T7496] CPU: 0 UID: 0 PID: 7496 Comm: syz.4.506 Not tainted syzkaller #0 PREEMPT(full) [ 164.151234][ T7496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 164.151251][ T7496] Call Trace: [ 164.151260][ T7496] [ 164.151271][ T7496] dump_stack_lvl+0x189/0x250 [ 164.151315][ T7496] ? __pfx_dump_stack_lvl+0x10/0x10 [ 164.151349][ T7496] ? __pfx_queue_work_on+0x10/0x10 [ 164.151376][ T7496] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 164.151411][ T7496] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 164.151458][ T7496] f2fs_handle_critical_error+0x37c/0x540 [ 164.151505][ T7496] f2fs_write_end_io+0x886/0xb60 [ 164.151551][ T7496] __submit_merged_bio+0x27a/0x6a0 [ 164.151596][ T7496] __submit_merged_write_cond+0x255/0x530 [ 164.151642][ T7496] f2fs_write_data_pages+0x261d/0x3000 [ 164.151707][ T7496] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 164.151751][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.151825][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.151881][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.151908][ T7496] ? __lock_acquire+0xab9/0xd20 [ 164.151943][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.151971][ T7496] ? do_raw_spin_lock+0x121/0x290 [ 164.152011][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.152044][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.152071][ T7496] ? do_raw_spin_unlock+0x122/0x240 [ 164.152106][ T7496] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 164.152133][ T7496] do_writepages+0x32e/0x550 [ 164.152172][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.152205][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.152236][ T7496] ? do_raw_spin_unlock+0x122/0x240 [ 164.152276][ T7496] filemap_fdatawrite+0x199/0x240 [ 164.152312][ T7496] ? __pfx_filemap_fdatawrite+0x10/0x10 [ 164.152394][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.152428][ T7496] ? do_raw_spin_unlock+0x122/0x240 [ 164.152468][ T7496] f2fs_sync_dirty_inodes+0x31f/0x830 [ 164.152514][ T7496] f2fs_write_checkpoint+0x93e/0x2440 [ 164.152540][ T7496] ? check_noncircular+0xe0/0x160 [ 164.152605][ T7496] ? __pfx_f2fs_write_checkpoint+0x10/0x10 [ 164.152683][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.152711][ T7496] ? down_write+0x162/0x1f0 [ 164.152736][ T7496] ? __pfx_down_write+0x10/0x10 [ 164.152774][ T7496] f2fs_issue_checkpoint+0x3b8/0x610 [ 164.152807][ T7496] ? __pfx_f2fs_issue_checkpoint+0x10/0x10 [ 164.152860][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.152887][ T7496] ? __lock_acquire+0xab9/0xd20 [ 164.152952][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.152979][ T7496] ? f2fs_sync_fs+0x200/0x3d0 [ 164.153017][ T7496] f2fs_do_sync_file+0x869/0x1860 [ 164.153056][ T7496] ? __pfx_f2fs_do_sync_file+0x10/0x10 [ 164.153130][ T7496] ? __pfx_down_write+0x10/0x10 [ 164.153156][ T7496] ? sb_start_write+0x114/0x1c0 [ 164.153186][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.153213][ T7496] ? mnt_want_write_file+0x164/0x200 [ 164.153246][ T7496] __f2fs_ioctl+0x485a/0xb5b0 [ 164.153294][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.153321][ T7496] ? file_ioctl+0x22d/0x780 [ 164.153356][ T7496] ? __pfx_file_ioctl+0x10/0x10 [ 164.153406][ T7496] ? kasan_quarantine_put+0xdd/0x220 [ 164.153440][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.153466][ T7496] ? lockdep_hardirqs_on+0x9c/0x150 [ 164.153502][ T7496] ? __pfx___f2fs_ioctl+0x10/0x10 [ 164.153533][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.153565][ T7496] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 164.153602][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.153629][ T7496] ? do_vfs_ioctl+0xb33/0x1430 [ 164.153659][ T7496] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 164.153693][ T7496] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 164.153774][ T7496] ? __fget_files+0x2a/0x420 [ 164.153802][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.153834][ T7496] ? __fget_files+0x3a0/0x420 [ 164.153856][ T7496] ? __fget_files+0x2a/0x420 [ 164.153882][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.153910][ T7496] ? f2fs_ioctl+0x135/0x250 [ 164.153937][ T7496] ? __pfx_f2fs_ioctl+0x10/0x10 [ 164.153965][ T7496] __se_sys_ioctl+0xfc/0x170 [ 164.154001][ T7496] do_syscall_64+0xfa/0xfa0 [ 164.154036][ T7496] ? lockdep_hardirqs_on+0x9c/0x150 [ 164.154071][ T7496] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.154095][ T7496] ? srso_alias_return_thunk+0x5/0xfbef5 [ 164.154122][ T7496] ? exc_page_fault+0xab/0x100 [ 164.154160][ T7496] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 164.154184][ T7496] RIP: 0033:0x7f9f0e18f6c9 [ 164.154206][ T7496] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 164.154227][ T7496] RSP: 002b:00007f9f0ef64038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 164.154252][ T7496] RAX: ffffffffffffffda RBX: 00007f9f0e3e5fa0 RCX: 00007f9f0e18f6c9 [ 164.154271][ T7496] RDX: 0000000000000000 RSI: 000000000000f502 RDI: 0000000000000005 [ 164.154287][ T7496] RBP: 00007f9f0e211f91 R08: 0000000000000000 R09: 0000000000000000 [ 164.154303][ T7496] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 164.154318][ T7496] R13: 00007f9f0e3e6038 R14: 00007f9f0e3e5fa0 R15: 00007ffd68263008 [ 164.154359][ T7496] [ 164.670292][ T6000] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 164.670422][ T7496] F2FS-fs (loop4): Stopped filesystem due to reason: 3 [ 165.019238][ T7525] loop7: detected capacity change from 0 to 512 [ 165.142782][ T63] wlan1: Creating new IBSS network, BSSID 0e:54:7c:74:60:9b [ 165.164559][ T7525] EXT4-fs error (device loop7): ext4_iget_extra_inode:5075: inode #15: comm syz.7.516: corrupted in-inode xattr: invalid ea_ino [ 165.276577][ T7525] EXT4-fs error (device loop7): ext4_orphan_get:1397: comm syz.7.516: couldn't read orphan inode 15 (err -117) [ 165.365720][ T7525] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 165.442422][ T7528] input: syz1 as /devices/virtual/input/input11 [ 165.666039][ T7237] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 165.701651][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 166.188891][ T7542] netlink: 28 bytes leftover after parsing attributes in process `syz.7.522'. [ 166.201690][ T43] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 166.261244][ T5887] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 166.410447][ T43] usb 6-1: Using ep0 maxpacket: 16 [ 166.419403][ T43] usb 6-1: config 0 interface 0 has no altsetting 0 [ 166.437309][ T43] usb 6-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 166.458423][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 166.482433][ T43] usb 6-1: config 0 descriptor?? [ 166.712897][ T7538] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 166.721845][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 166.749326][ T6000] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 167.188081][ T7558] loop7: detected capacity change from 0 to 40427 [ 167.199555][ T7558] F2FS-fs (loop7): invalid crc value [ 167.206937][ T43] hid (null): bogus close delimiter [ 167.292019][ T5887] usb 6-1: USB disconnect, device number 4 [ 167.296870][ T7558] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 1 [ 167.309926][ T7558] F2FS-fs (loop7): Start checkpoint disabled! [ 167.323325][ T7558] F2FS-fs (loop7): f2fs_disable_checkpoint() finish, err:0 [ 167.340634][ T7558] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e6 [ 167.369865][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 167.378309][ T975] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 167.473314][ T36] kworker/u8:2: attempt to access beyond end of device [ 167.473314][ T36] loop7: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 167.503859][ T36] CPU: 0 UID: 0 PID: 36 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(full) [ 167.503890][ T36] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 167.503906][ T36] Workqueue: writeback wb_workfn (flush-7:7) [ 167.503944][ T36] Call Trace: [ 167.503953][ T36] [ 167.503963][ T36] dump_stack_lvl+0x189/0x250 [ 167.504003][ T36] ? __pfx_dump_stack_lvl+0x10/0x10 [ 167.504037][ T36] ? __pfx_queue_work_on+0x10/0x10 [ 167.504064][ T36] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 167.504097][ T36] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 167.504145][ T36] f2fs_handle_critical_error+0x37c/0x540 [ 167.504190][ T36] f2fs_write_end_io+0x886/0xb60 [ 167.504236][ T36] __submit_merged_bio+0x27a/0x6a0 [ 167.504280][ T36] __submit_merged_write_cond+0x255/0x530 [ 167.504324][ T36] f2fs_write_data_pages+0x261d/0x3000 [ 167.504388][ T36] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 167.504428][ T36] ? __pfx_f2fs_available_free_memory+0x10/0x10 [ 167.504502][ T36] ? __pfx_f2fs_balance_fs_bg+0x10/0x10 [ 167.504538][ T36] ? srso_alias_return_thunk+0x5/0xfbef5 [ 167.504566][ T36] ? look_up_lock_class+0x74/0x170 [ 167.504612][ T36] ? trace_f2fs_writepages+0x7f/0x200 [ 167.504650][ T36] ? f2fs_write_node_pages+0x478/0x6e0 [ 167.504691][ T36] ? __pfx_f2fs_write_node_pages+0x10/0x10 [ 167.504731][ T36] ? __lock_acquire+0xab9/0xd20 [ 167.504763][ T36] ? __pfx_f2fs_write_data_pages+0x10/0x10 [ 167.504789][ T36] do_writepages+0x32e/0x550 [ 167.504832][ T36] ? srso_alias_return_thunk+0x5/0xfbef5 [ 167.504859][ T36] ? reacquire_held_locks+0x127/0x1d0 [ 167.504890][ T36] ? writeback_sb_inodes+0x384/0x1010 [ 167.504934][ T36] __writeback_single_inode+0x145/0xff0 [ 167.504970][ T36] ? srso_alias_return_thunk+0x5/0xfbef5 [ 167.504996][ T36] ? do_raw_spin_unlock+0x122/0x240 [ 167.505035][ T36] writeback_sb_inodes+0x6c7/0x1010 [ 167.505101][ T36] ? __pfx_writeback_sb_inodes+0x10/0x10 [ 167.505183][ T36] ? srso_alias_return_thunk+0x5/0xfbef5 [ 167.505210][ T36] ? rcu_is_watching+0x15/0xb0 [ 167.505239][ T36] ? srso_alias_return_thunk+0x5/0xfbef5 [ 167.505277][ T36] wb_writeback+0x43b/0xaf0 [ 167.505320][ T36] ? queue_io+0x311/0x590 [ 167.505358][ T36] ? __pfx_wb_writeback+0x10/0x10 [ 167.505402][ T36] ? _raw_spin_unlock_irq+0x23/0x50 [ 167.505441][ T36] wb_workfn+0x409/0xef0 [ 167.505488][ T36] ? __pfx_wb_workfn+0x10/0x10 [ 167.505521][ T36] ? srso_alias_return_thunk+0x5/0xfbef5 [ 167.505548][ T36] ? __lock_acquire+0xab9/0xd20 [ 167.505584][ T36] ? srso_alias_return_thunk+0x5/0xfbef5 [ 167.505615][ T36] ? srso_alias_return_thunk+0x5/0xfbef5 [ 167.505647][ T36] ? _raw_spin_unlock_irq+0x23/0x50 [ 167.505678][ T36] ? process_scheduled_works+0x9ef/0x17b0 [ 167.505703][ T36] ? process_scheduled_works+0x9ef/0x17b0 [ 167.505732][ T36] process_scheduled_works+0xae1/0x17b0 [ 167.505793][ T36] ? __pfx_process_scheduled_works+0x10/0x10 [ 167.505836][ T36] ? srso_alias_return_thunk+0x5/0xfbef5 [ 167.505873][ T36] worker_thread+0x8a0/0xda0 [ 167.505932][ T36] kthread+0x711/0x8a0 [ 167.505968][ T36] ? __pfx_worker_thread+0x10/0x10 [ 167.505995][ T36] ? __pfx_kthread+0x10/0x10 [ 167.506024][ T36] ? srso_alias_return_thunk+0x5/0xfbef5 [ 167.506056][ T36] ? _raw_spin_unlock_irq+0x23/0x50 [ 167.506087][ T36] ? srso_alias_return_thunk+0x5/0xfbef5 [ 167.506113][ T36] ? lockdep_hardirqs_on+0x9c/0x150 [ 167.506146][ T36] ? __pfx_kthread+0x10/0x10 [ 167.506180][ T36] ret_from_fork+0x4bc/0x870 [ 167.506209][ T36] ? __pfx_ret_from_fork+0x10/0x10 [ 167.506243][ T36] ? __switch_to_asm+0x39/0x70 [ 167.506263][ T36] ? __switch_to_asm+0x33/0x70 [ 167.506282][ T36] ? __pfx_kthread+0x10/0x10 [ 167.506316][ T36] ret_from_fork_asm+0x1a/0x30 [ 167.506358][ T36] [ 167.508641][ T36] F2FS-fs (loop7): Stopped filesystem due to reason: 3 [ 167.788599][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 168.006857][ T7566] loop0: detected capacity change from 0 to 32768 [ 168.017682][ T7566] BTRFS: device fsid 14d642db-7b15-43e4-81e6-4b8fac6a25f8 devid 1 transid 8 /dev/loop0 (7:0) scanned by syz.0.532 (7566) [ 168.086201][ T7566] BTRFS info (device loop0): first mount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 168.130719][ T7566] BTRFS info (device loop0): using blake2b (blake2b-256-generic) checksum algorithm [ 168.481132][ T7566] BTRFS info (device loop0): enabling ssd optimizations [ 168.527473][ T7566] BTRFS info (device loop0): turning on async discard [ 168.560617][ T7566] BTRFS info (device loop0): enabling free space tree [ 168.594813][ T7566] BTRFS info (device loop0): use zstd compression, level 3 [ 168.834062][ T43] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 169.026318][ T5824] BTRFS info (device loop0): last unmount of filesystem 14d642db-7b15-43e4-81e6-4b8fac6a25f8 [ 169.867985][ T6000] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 170.212697][ T7622] loop0: detected capacity change from 0 to 64 [ 170.289216][ T7604] loop5: detected capacity change from 0 to 32768 [ 170.431627][ T975] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 170.719477][ T7612] loop6: detected capacity change from 0 to 32768 [ 170.950574][ T111] ================================================================== [ 170.958673][ T111] BUG: KASAN: slab-use-after-free in jfs_lazycommit+0x74b/0xa90 [ 170.966319][ T111] Read of size 4 at addr ffff888077f52c94 by task jfsCommit/111 [ 170.973947][ T111] [ 170.976268][ T111] CPU: 0 UID: 0 PID: 111 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT(full) [ 170.976297][ T111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 170.976313][ T111] Call Trace: [ 170.976322][ T111] [ 170.976331][ T111] dump_stack_lvl+0x189/0x250 [ 170.976368][ T111] ? __kasan_check_byte+0x12/0x40 [ 170.976394][ T111] ? __pfx_dump_stack_lvl+0x10/0x10 [ 170.976427][ T111] ? srso_alias_return_thunk+0x5/0xfbef5 [ 170.976456][ T111] ? lock_release+0x4b/0x3e0 [ 170.976484][ T111] ? srso_alias_return_thunk+0x5/0xfbef5 [ 170.976513][ T111] ? __virt_addr_valid+0x4a5/0x5c0 [ 170.976550][ T111] print_report+0xca/0x240 [ 170.976580][ T111] ? jfs_lazycommit+0x74b/0xa90 [ 170.976607][ T111] kasan_report+0x118/0x150 [ 170.976628][ T111] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 170.976664][ T111] ? jfs_lazycommit+0x74b/0xa90 [ 170.976696][ T111] jfs_lazycommit+0x74b/0xa90 [ 170.976727][ T111] ? __pfx_jfs_lazycommit+0x10/0x10 [ 170.976754][ T111] ? __pfx_default_wake_function+0x10/0x10 [ 170.976795][ T111] ? __kthread_parkme+0x7b/0x200 [ 170.976824][ T111] ? srso_alias_return_thunk+0x5/0xfbef5 [ 170.976849][ T111] ? __kthread_parkme+0x1a1/0x200 [ 170.976878][ T111] kthread+0x711/0x8a0 [ 170.976912][ T111] ? __pfx_jfs_lazycommit+0x10/0x10 [ 170.976940][ T111] ? __pfx_kthread+0x10/0x10 [ 170.976971][ T111] ? srso_alias_return_thunk+0x5/0xfbef5 [ 170.977002][ T111] ? _raw_spin_unlock_irq+0x23/0x50 [ 170.977033][ T111] ? srso_alias_return_thunk+0x5/0xfbef5 [ 170.977061][ T111] ? lockdep_hardirqs_on+0x9c/0x150 [ 170.977102][ T111] ? __pfx_kthread+0x10/0x10 [ 170.977136][ T111] ret_from_fork+0x4bc/0x870 [ 170.977163][ T111] ? __pfx_ret_from_fork+0x10/0x10 [ 170.977192][ T111] ? __switch_to_asm+0x39/0x70 [ 170.977213][ T111] ? __switch_to_asm+0x33/0x70 [ 170.977232][ T111] ? __pfx_kthread+0x10/0x10 [ 170.977266][ T111] ret_from_fork_asm+0x1a/0x30 [ 170.977298][ T111] [ 170.977307][ T111] [ 171.166706][ T111] Allocated by task 7604: [ 171.171024][ T111] kasan_save_track+0x3e/0x80 [ 171.175711][ T111] __kasan_kmalloc+0x93/0xb0 [ 171.180320][ T111] __kmalloc_cache_noprof+0x3d5/0x6f0 [ 171.185690][ T111] jfs_fill_super+0xc2/0xd80 [ 171.190272][ T111] get_tree_bdev_flags+0x40e/0x4d0 [ 171.195380][ T111] vfs_get_tree+0x92/0x2b0 [ 171.199792][ T111] do_new_mount+0x302/0xa10 [ 171.204289][ T111] __se_sys_mount+0x313/0x410 [ 171.208947][ T111] do_syscall_64+0xfa/0xfa0 [ 171.213445][ T111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.219320][ T111] [ 171.221624][ T111] Freed by task 5843: [ 171.225580][ T111] kasan_save_track+0x3e/0x80 [ 171.230250][ T111] __kasan_save_free_info+0x46/0x50 [ 171.235434][ T111] __kasan_slab_free+0x5c/0x80 [ 171.240191][ T111] kfree+0x19a/0x6d0 [ 171.244076][ T111] generic_shutdown_super+0x135/0x2c0 [ 171.249442][ T111] kill_block_super+0x44/0x90 [ 171.254111][ T111] deactivate_locked_super+0xbc/0x130 [ 171.259470][ T111] cleanup_mnt+0x425/0x4c0 [ 171.263874][ T111] task_work_run+0x1d4/0x260 [ 171.268462][ T111] exit_to_user_mode_loop+0xe9/0x130 [ 171.273731][ T111] do_syscall_64+0x2bd/0xfa0 [ 171.278314][ T111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.284190][ T111] [ 171.286492][ T111] The buggy address belongs to the object at ffff888077f52c00 [ 171.286492][ T111] which belongs to the cache kmalloc-256 of size 256 [ 171.300525][ T111] The buggy address is located 148 bytes inside of [ 171.300525][ T111] freed 256-byte region [ffff888077f52c00, ffff888077f52d00) [ 171.314307][ T111] [ 171.316609][ T111] The buggy address belongs to the physical page: [ 171.322996][ T111] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77f52 [ 171.331737][ T111] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 171.340215][ T111] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 171.348173][ T111] page_type: f5(slab) [ 171.352139][ T111] raw: 00fff00000000040 ffff88801a026b40 0000000000000000 0000000000000001 [ 171.360706][ T111] raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 171.369276][ T111] head: 00fff00000000040 ffff88801a026b40 0000000000000000 0000000000000001 [ 171.377934][ T111] head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 [ 171.386588][ T111] head: 00fff00000000001 ffffea0001dfd481 00000000ffffffff 00000000ffffffff [ 171.395244][ T111] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 171.403892][ T111] page dumped because: kasan: bad access detected [ 171.410283][ T111] page_owner tracks the page as allocated [ 171.416062][ T111] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 7516, tgid 7515 (syz.6.513), ts 164790051704, free_ts 98661503150 [ 171.437241][ T111] post_alloc_hook+0x234/0x290 [ 171.442004][ T111] get_page_from_freelist+0x2365/0x2440 [ 171.447533][ T111] __alloc_frozen_pages_noprof+0x181/0x370 [ 171.453324][ T111] alloc_pages_mpol+0x232/0x4a0 [ 171.458158][ T111] allocate_slab+0x96/0x350 [ 171.462649][ T111] ___slab_alloc+0xf56/0x1990 [ 171.467309][ T111] __slab_alloc+0x65/0x100 [ 171.471710][ T111] __kmalloc_cache_noprof+0x411/0x6f0 [ 171.477089][ T111] io_fgetxattr_prep+0x18f/0x290 [ 171.482018][ T111] io_submit_sqes+0x935/0x1e60 [ 171.486773][ T111] __se_sys_io_uring_enter+0x2df/0x2b20 [ 171.492308][ T111] do_syscall_64+0xfa/0xfa0 [ 171.496804][ T111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.502680][ T111] page last free pid 5193 tgid 5193 stack trace: [ 171.508985][ T111] __free_frozen_pages+0xbc4/0xd30 [ 171.514095][ T111] __put_partials+0x146/0x170 [ 171.518842][ T111] put_cpu_partial+0x1f2/0x2e0 [ 171.523592][ T111] __slab_free+0x2b9/0x390 [ 171.527994][ T111] qlist_free_all+0x97/0x140 [ 171.532573][ T111] kasan_quarantine_reduce+0x148/0x160 [ 171.538024][ T111] __kasan_slab_alloc+0x22/0x80 [ 171.542867][ T111] kmem_cache_alloc_noprof+0x367/0x6e0 [ 171.548314][ T111] getname_flags+0xb8/0x540 [ 171.552800][ T111] do_sys_openat2+0xbc/0x1c0 [ 171.557376][ T111] __x64_sys_openat+0x138/0x170 [ 171.562212][ T111] do_syscall_64+0xfa/0xfa0 [ 171.566709][ T111] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 171.572586][ T111] [ 171.574895][ T111] Memory state around the buggy address: [ 171.580511][ T111] ffff888077f52b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 171.588562][ T111] ffff888077f52c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 171.596606][ T111] >ffff888077f52c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 171.604644][ T111] ^ [ 171.609208][ T111] ffff888077f52d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 171.617250][ T111] ffff888077f52d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 171.625380][ T111] ================================================================== [ 171.633424][ T111] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 171.640600][ T111] CPU: 0 UID: 0 PID: 111 Comm: jfsCommit Not tainted syzkaller #0 PREEMPT(full) [ 171.649693][ T111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 171.659728][ T111] Call Trace: [ 171.662993][ T111] [ 171.665909][ T111] dump_stack_lvl+0x99/0x250 [ 171.670502][ T111] ? __asan_memcpy+0x40/0x70 [ 171.675091][ T111] ? __pfx_dump_stack_lvl+0x10/0x10 [ 171.680283][ T111] ? __pfx__printk+0x10/0x10 [ 171.684867][ T111] ? srso_alias_return_thunk+0x5/0xfbef5 [ 171.690494][ T111] vpanic+0x237/0x6d0 [ 171.694475][ T111] ? __pfx_vpanic+0x10/0x10 [ 171.698979][ T111] panic+0xb9/0xc0 [ 171.702704][ T111] ? __pfx_panic+0x10/0x10 [ 171.707113][ T111] ? srso_alias_return_thunk+0x5/0xfbef5 [ 171.712736][ T111] ? srso_alias_return_thunk+0x5/0xfbef5 [ 171.718355][ T111] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 171.724246][ T111] ? jfs_lazycommit+0x74b/0xa90 [ 171.729089][ T111] check_panic_on_warn+0x89/0xb0 [ 171.734022][ T111] ? jfs_lazycommit+0x74b/0xa90 [ 171.738860][ T111] end_report+0x78/0x160 [ 171.743098][ T111] kasan_report+0x129/0x150 [ 171.747585][ T111] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 171.752953][ T111] ? jfs_lazycommit+0x74b/0xa90 [ 171.757796][ T111] jfs_lazycommit+0x74b/0xa90 [ 171.762464][ T111] ? __pfx_jfs_lazycommit+0x10/0x10 [ 171.767650][ T111] ? __pfx_default_wake_function+0x10/0x10 [ 171.773455][ T111] ? __kthread_parkme+0x7b/0x200 [ 171.778381][ T111] ? srso_alias_return_thunk+0x5/0xfbef5 [ 171.784002][ T111] ? __kthread_parkme+0x1a1/0x200 [ 171.789025][ T111] kthread+0x711/0x8a0 [ 171.793174][ T111] ? __pfx_jfs_lazycommit+0x10/0x10 [ 171.798368][ T111] ? __pfx_kthread+0x10/0x10 [ 171.802956][ T111] ? srso_alias_return_thunk+0x5/0xfbef5 [ 171.808579][ T111] ? _raw_spin_unlock_irq+0x23/0x50 [ 171.813772][ T111] ? srso_alias_return_thunk+0x5/0xfbef5 [ 171.819391][ T111] ? lockdep_hardirqs_on+0x9c/0x150 [ 171.824582][ T111] ? __pfx_kthread+0x10/0x10 [ 171.829166][ T111] ret_from_fork+0x4bc/0x870 [ 171.833744][ T111] ? __pfx_ret_from_fork+0x10/0x10 [ 171.838849][ T111] ? __switch_to_asm+0x39/0x70 [ 171.843598][ T111] ? __switch_to_asm+0x33/0x70 [ 171.848342][ T111] ? __pfx_kthread+0x10/0x10 [ 171.852927][ T111] ret_from_fork_asm+0x1a/0x30 [ 171.857685][ T111] [ 171.861011][ T111] Kernel Offset: disabled [ 171.865320][ T111] Rebooting in 86400 seconds..