kern.securelevel: 0 -> 1 creating runtime link editor directory cache. preserving editor files. starting network daemons: sshd. starting local daemons:. Wed Feb 19 18:59:05 PST 2020 OpenBSD/amd64 (ci-openbsd-main-8.c.syzkaller.internal) (tty00) Warning: Permanently added '10.128.0.194' (ECDSA) to the list of known hosts. 2020/02/19 18:59:18 fuzzer started 2020/02/19 18:59:25 dialing manager at 10.128.15.235:16300 2020/02/19 18:59:25 syscalls: 337 2020/02/19 18:59:25 code coverage: enabled 2020/02/19 18:59:25 comparison tracing: enabled 2020/02/19 18:59:25 extra coverage: support is not implemented in syzkaller 2020/02/19 18:59:25 setuid sandbox: enabled 2020/02/19 18:59:25 namespace sandbox: support is not implemented in syzkaller 2020/02/19 18:59:25 Android sandbox: support is not implemented in syzkaller 2020/02/19 18:59:25 fault injection: support is not implemented in syzkaller 2020/02/19 18:59:25 leak checking: support is not implemented in syzkaller 2020/02/19 18:59:25 net packet injection: enabled 2020/02/19 18:59:25 net device setup: support is not implemented in syzkaller 2020/02/19 18:59:25 concurrency sanitizer: support is not implemented in syzkaller 2020/02/19 18:59:25 devlink PCI setup: support is not implemented in syzkaller 18:59:29 executing program 0: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x80, 0x1e4) ioctl$TIOCMBIS(r0, 0x8004746c, &(0x7f0000000040)=0x5) r1 = openat$tty(0xffffffffffffff9c, &(0x7f0000000080)='/dev/tty\x00', 0x80, 0x0) ioctl$TIOCGWINSZ(r1, 0x40087468, &(0x7f00000000c0)) ioctl$TIOCDRAIN(r0, 0x2000745e) ioctl$TIOCFLUSH(r0, 0x80047410, &(0x7f0000000100)=0x4) recvfrom$inet6(r0, &(0x7f0000000140)=""/102, 0x66, 0x20, 0x0, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x100, 0x20) ioctl$TIOCNXCL(r2, 0x2000740e) ioctl$FIONREAD(r1, 0x4004667f, &(0x7f0000000200)) r3 = openat$wsdisplay(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ttyCcfg\x00', 0x10000, 0x0) ioctl$WSDISPLAYIO_GETSCREENTYPE(r3, 0xc028575d, &(0x7f0000000280)={0x9, 0x9, './file0\x00', 0x2, 0x7e, 0x6, 0x3}) ioctl$TIOCOUTQ(r0, 0x40047473, &(0x7f00000002c0)=0x2400000) ioctl$TIOCOUTQ(r2, 0x40047473, &(0x7f0000000300)=0x8001) ioctl$WSDISPLAYIO_ADDSCREEN(0xffffffffffffff9c, 0x80245753, &(0x7f0000000340)={0x2, './file0\x00', './file0\x00'}) chdir(&(0x7f0000000380)='./file0\x00') chroot(&(0x7f00000003c0)='./file1\x00') r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000400)='/dev/null\x00', 0x80, 0x0) ioctl$WSDISPLAYIO_SVIDEO(r4, 0x80045745, &(0x7f0000000440)) setsockopt$inet6_MRT6_DEL_MFC(r2, 0x29, 0x69, &(0x7f0000000480)={{0x18, 0x1, 0x9, 0x8000}, {0x18, 0x2, 0x98e7, 0x5}, 0x200, [0x100000, 0x81, 0xdafb, 0x100, 0x0, 0x2, 0x400, 0xffffffff]}, 0x3c) ioctl$TIOCSCTTY(r2, 0x20007461) munlock(&(0x7f0000ffa000/0x3000)=nil, 0x3000) r5 = dup(0xffffffffffffff9c) ioctl$BIOCGRTIMEOUT(r5, 0x4010426e, &(0x7f00000004c0)) getsockopt$SO_PEERCRED(0xffffffffffffff9c, 0xffff, 0x1022, &(0x7f0000000540)={0x0, 0x0}, 0xc) getsockopt$SO_PEERCRED(r4, 0xffff, 0x1022, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0xc) fchownat(0xffffffffffffffff, &(0x7f0000000500)='./file0\x00', r6, r7, 0x4) write(r4, &(0x7f00000005c0)="d25942ae1c8ff2645d9ddaaab226fafe", 0x10) r8 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) getgroups(0x1, &(0x7f0000000640)=[0x0]) fchownat(r8, &(0x7f0000000600)='./file1\x00', 0xffffffffffffffff, r9, 0x4) 18:59:30 executing program 1: r0 = shmat(0x0, &(0x7f0000ff9000/0x4000)=nil, 0x2000) shmdt(r0) r1 = socket$inet6(0x18, 0x4000, 0x0) r2 = shmget$private(0x0, 0x2000, 0x1, &(0x7f0000ffc000/0x2000)=nil) shmat(r2, &(0x7f0000ffc000/0x4000)=nil, 0x2000) r3 = msgget(0x1, 0x12) msgsnd(r3, &(0x7f0000000000)={0x1, "1e1a60bca99dffb1cda35c83e596a59e80ab280430a94c164a941e337bbafe7c0af575a611aa19941f4b64a405c9662f608bb51eb49c8adb32356c3f022d3d75238ad874a8ead4be1d9980399921bfb3a03e48aad82f97fb131afc5f1e36edc1930874bcc5745d14838f96addd3506ca8ce275ea70f2d74d31769992549f1b55649138a75968e011"}, 0x90, 0x0) shmdt(r0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSTSTAMP(r4, 0x8008745a, &(0x7f0000000100)={0x20, 0x727}) link(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00') pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$VMM_IOC_INTR(r5, 0x800c5606, &(0x7f0000000200)={0x5, 0x7355, 0x1ff}) rename(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='./file0\x00') chdir(&(0x7f00000002c0)='./file0\x00') r6 = socket$inet(0x2, 0x8000, 0x40) getsockopt$SO_PEERCRED(r6, 0xffff, 0x1022, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0xc) bind(r5, &(0x7f0000000340)=@in6={0x18, 0x1, 0xffff}, 0xc) mkdir(&(0x7f0000000380)='./file0\x00', 0x80) getsockopt$sock_cred(r1, 0xffff, 0x1022, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f0000000400)=0xc) getsockopt$sock_cred(0xffffffffffffff9c, 0xffff, 0x1022, &(0x7f0000000440)={0x0, 0x0, 0x0}, &(0x7f0000000480)=0xc) shmctl$IPC_SET(r2, 0x1, &(0x7f00000004c0)={{0x40, r8, r9, r10, r11, 0x111, 0x3fe0}, 0x3ddb, 0x7, r7, r7, 0xd56, 0x40, 0x8}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)) r12 = accept$inet6(0xffffffffffffff9c, 0x0, &(0x7f0000000580)) getpeername(r12, &(0x7f00000005c0)=@un=@file={0x0, ""/108}, &(0x7f0000000640)=0x6e) r13 = open(&(0x7f0000000680)='./file0\x00', 0x80, 0xa1) ioctl$TIOCSBRK(r13, 0x2000747b) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_MRT6_ADD_MIF(r14, 0x29, 0x66, &(0x7f0000000700)={0x2, 0x1, 0xd9, 0x1dc, 0xfffffff8}, 0xc) open(&(0x7f0000000740)='./file0\x00', 0x40, 0x8) 18:59:30 executing program 0: munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) munlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) minherit(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) shmget$private(0x0, 0x3000, 0x200, &(0x7f0000ffd000/0x3000)=nil) socket$inet(0x2, 0x1, 0x2) getpgrp() 18:59:30 executing program 0: ioctl$VMM_IOC_WRITEREGS(0xffffffffffffffff, 0x82485608, &(0x7f0000000240)={0x0, 0x0, 0x0, {[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1fe], [0x0, 0x0, 0x9, 0x9, 0xffffffffffffffff, 0xffbffffffefffbff], [0x0, 0x0, 0x401], [{}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x6}]}}) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f0000000300)={'tap', 0x0}) r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000200)='/dev/bpf\x00', 0x0, 0x0) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000080)={0x3, &(0x7f00000004c0)=[{0x25}, {0x3d}, {0x6}]}) r1 = socket(0x18, 0x1, 0x0) close(r1) connect$unix(r1, &(0x7f00000000c0)=@abs={0x0, 0x7}, 0x1c) connect$unix(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="122a28e6b75d6d03cba161c1889932df6ce23c43e9e71ec2dc32ef5a"], 0xa) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000000)={'tap', 0x0}) ioctl$BIOCSDIRFILT(r0, 0x8004427d, &(0x7f0000000040)=0x1000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r2 = socket(0x18, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) r4 = socket(0x18, 0x2, 0x0) close(r4) setsockopt(r4, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) write(r4, &(0x7f0000000040)="100a2956b9223776", 0x21d) connect$unix(r4, &(0x7f0000000180)=@abs={0x1, 0x0, 0x0}, 0x8) r5 = socket(0x18, 0x2, 0x0) close(r5) setsockopt(r5, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) write(r5, &(0x7f0000000040)="100a2956b9223776", 0x21d) connect(r5, &(0x7f00000001c0)=@in6={0x18, 0x0, 0x1, 0x9}, 0xc) r6 = socket(0x18, 0x1, 0x0) setsockopt(r6, 0x29, 0xc, &(0x7f0000000140)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) getsockopt$SO_PEERCRED(r6, 0xffff, 0x1022, &(0x7f0000000000), 0xc) ioctl$TIOCFLUSH(r3, 0x8080691a, &(0x7f0000000300)) 18:59:30 executing program 1: chown(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000140)}], 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) mkdir(&(0x7f0000000000)='./file1\x00', 0x0) unveil(&(0x7f0000000000)='./file1\x00', &(0x7f0000000080)='c\x00') r0 = msgget$private(0x0, 0xfffffffffffffffd) msgrcv(r0, &(0x7f0000000f80)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000831f51f1f32fd93d3b5fc9c5ddf800000000000000000000000000000000000000000000000000000000020000009aeab5beef00010027001c000000000000000000000000000000000006000000000000000000000000a86cf4410000000000000073060000000000000000000000fe000000000000000000000000000000b25d8ad62856dec8dbdb05fd2d6c5da5d9aacf0688258af5c5f7a1c1215526d997cadc5720f13248985c5c89117daa00fbcea2481795dc129c8b73dfd45409dea1010048c680e0f62c43576c06736304c3312a624ea751eb00000000000000000000001b00002000"/301], 0xfffffffffffffe9f, 0x1, 0x1000) msgsnd(r0, &(0x7f0000001280)={0x2, "7f0ffb8f47c36f9d5b6645ce6e24546b0963f797a46be5177a80f137cade1791fa22d3697cdfd21260e438f037c504bdaff28d4242d63e1d62cc4ba12b67ee0786b07ab78a67f89cca4ba1f9b097848d5127dc76732214c6f92cfea51cba2d1917412f5b798a76f71c35ccf9352eb68687b0002223c978fb83fb3742647ec9e61755c12110316734b21533dcebb4554b96f7c609e6b71c23b81145a24d57db98d819"}, 0xaa, 0x1000) r1 = socket(0x18, 0x400000001002, 0x0) setsockopt$sock_int(r1, 0xffff, 0x800, 0x0, 0x0) msgsnd(r0, &(0x7f0000001240)=ANY=[@ANYRES16=r1], 0x1, 0x800) msgrcv(r0, &(0x7f00000010c0)={0x0, ""/63}, 0x47, 0x3, 0x800) r2 = msgget$private(0x0, 0xfffffffffffffffd) msgrcv(r2, &(0x7f0000000f80)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000831f51f1f32fd93d3b5fc9c5ddf800000000000000000000000000000000000000000000000000000000020000009aeab5beef00010027001c000000000000000000000000000000000006000000000000000000000000a86cf4410000000000000073060000000000000000000000fe000000000000000000000000000000b25d8ad62856dec8dbdb05fd2d6c5da5d9aacf0688258af5c5f7a1c1215526d997cadc5720f13248985c5c89117daa00fbcea2481795dc129c8b73dfd45409dea1010048c680e0f62c43576c06736304c3312a624ea751eb00000000000000000000001b00002000"/301], 0xfffffffffffffe9f, 0x1, 0x1000) msgsnd(r2, &(0x7f0000001280)=ANY=[@ANYBLOB="02000000000000007f0ffb8f47c36f9d5b6645ce6e24546b0963f797a46be5177a80f137cade1791fa22d3697cdfd21260e438f037c504bdaff28d4242d63e1d62cc0f142b67ee0786b07ab78a67f89cca4ba1f9b097846b14bdf4053f5c59c6f92cfea51cba2d1917412f5b798a76f71c35ccf9352eb68687b0002223c978fb83fb3742647ec9e61755c12110316734b21533dcebb4554b96f7c609e6b71c23b81145a24d57db98d819"], 0xaa, 0x1000) r3 = socket(0x18, 0x400000001002, 0x0) setsockopt$sock_int(r3, 0xffff, 0x800, 0x0, 0x0) msgsnd(r2, &(0x7f0000001240)=ANY=[@ANYRES16=r3], 0x1, 0x800) msgrcv(r2, &(0x7f00000010c0)=ANY=[@ANYBLOB="0000000000000000f068731450230000000000000000000000000000000000000000000000000000000000000000000000000000ff0f00"/71], 0x47, 0x3, 0x800) msgget$private(0x0, 0x200) r4 = msgget$private(0x0, 0xfffffffffffffffd) msgrcv(r4, &(0x7f0000000f80)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000831f51f1f32fd93d3b5fc9c5ddf800000000000000000000000000000000000000000000000000000000020000009aeab5beef00010027001c000000000000000000000000000000000006000000000000000000000000a86cf4410000000000000073060000000000000000000000fe000000000000000000000000000000b25d8ad62856dec8dbdb05fd2d6c5da5d9aacf0688258af5c5f7a1c1215526d997cadc5720f13248985c5c89117daa00fbcea2481795dc129c8b73dfd45409dea1010048c680e0f62c43576c06736304c3312a624ea751eb00000000000000000000001b00002000"/301], 0xfffffffffffffe9f, 0x1, 0x1000) msgsnd(r4, &(0x7f0000001280)={0x2, "7f0ffb8f47c36f9d5b6645ce6e24546b0963f797a46be5177a80f137cade1791fa22d3697cdfd21260e438f037c504bdaff28d4242d63e1d62cc4ba12b67ee0786b07ab78a67f89cca4ba1f9b097848d5127dc76732214c6f92cfea51cba2d1917412f5b798a76f71c35ccf9352eb68687b0002223c978fb83fb3742647ec9e61755c12110316734b21533dcebb4554b96f7c609e6b71c23b81145a24d57db98d819"}, 0xaa, 0x1000) r5 = socket(0x18, 0x400000001002, 0x0) setsockopt$sock_int(r5, 0xffff, 0x800, 0x0, 0x20) msgsnd(r4, &(0x7f00000001c0)=ANY=[@ANYRESHEX], 0x1, 0x800) msgrcv(r4, &(0x7f00000010c0)=ANY=[@ANYBLOB="0000000000000017420041c0c0a14c4192385c5178a8b000"/71], 0x47, 0x3, 0x800) r6 = msgget$private(0x0, 0xfffffffffffffffd) msgrcv(r6, &(0x7f0000000f80)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000831f51f1f32fd93d3b5fc9c5ddf800000000000000000000000000000000000000000000000000000000020000009aeab5beef00010027001c000000000000000000000000000000000006000000000000000000000000a86cf4410000000000000073060000000000000000000000fe000000000000000000000000000000b25d8ad62856dec8dbdb05fd2d6c5da5d9aacf0688258af5c5f7a1c1215526d997cadc5720f13248985c5c89117daa00fbcea2481795dc129c8b73dfd45409dea1010048c680e0f62c43576c06736304c3312a624ea751eb00000000000000000000001b00002000"/301], 0xfffffffffffffe9f, 0x1, 0x1000) msgsnd(r6, &(0x7f0000001280)={0x2, "7f0ffb8f47c36f9d5b6645ce6e24546b0963f797a46be5177a80f137cade1791fa22d3697cdfd21260e438f037c504bdaff28d4242d63e1d62cc4ba12b67ee0786b07ab78a67f89cca4ba1f9b097848d5127dc76732214c6f92cfea51cba2d1917412f5b798a76f71c35ccf9352eb68687b0002223c978fb83fb3742647ec9e61755c12110316734b21533dcebb4554b96f7c609e6b71c23b81145a24d57db98d819"}, 0xaa, 0x1000) r7 = socket(0x18, 0x400000001002, 0x0) setsockopt$sock_int(r7, 0xffff, 0x800, 0x0, 0x0) msgsnd(r6, &(0x7f0000001240)=ANY=[@ANYRES16=r7], 0x1, 0x800) msgrcv(r6, &(0x7f00000010c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000002cfb842e000000000000000000000000000000000033388500000000000000000057588a5719136800"/71], 0x47, 0x3, 0x800) r8 = msgget$private(0x0, 0xfffffffffffffffd) r9 = socket(0x18, 0x2, 0x0) close(r9) setsockopt(r9, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) write(r9, &(0x7f0000000040)="100a2956b9223776", 0x21d) msgrcv(r8, &(0x7f0000000f80)=ANY=[@ANYPTR64=&(0x7f0000000100)=ANY=[@ANYRESDEC=0x0, @ANYRES16=r9, @ANYBLOB="fab1d2db6c828dedef0b24f87b70b391e5be639a212eddb1aef2105044f2ca248d1f1c67a49ac98aa473716168ac3bf0eb6fb7b8d50807737758df2f1cd3f7776a537fc6d42c31f89f773adbcc8e456704f38237557d96b8f591b0244ac0d1ed2d20bdf12666"]], 0x1, 0x1, 0x1000) msgsnd(r8, &(0x7f0000001280)=ANY=[@ANYBLOB="02000000000000007f0ffb8f47c36f9d5b6645ce6e24546b0963f797a483e5177a80f137cade1790f037c504bdafef8d4242d63e1d62cc4ba12b67ee0786b07ab78a67f89cca4ba1f9b09784805127dc76732214c6f92cfea51cba2d1917412f5b798a76f71c35ccf9352e368687b0003f23c978fb83fb3742647ec9e61755c12110316734b21533dcebb45596d9f7c609e6b71c23b81145a24d57db98d81900"/170], 0xaa, 0x1000) r10 = socket(0x18, 0x400000001002, 0x0) setsockopt$sock_int(r10, 0xffff, 0x800, 0x0, 0x0) msgsnd(r8, &(0x7f0000001240)=ANY=[@ANYRES16=r10], 0x1, 0x800) msgrcv(r8, &(0x7f00000010c0)={0x0, ""/63}, 0x47, 0x3, 0x800) r11 = getuid() r12 = geteuid() setreuid(r11, r12) getsockopt$sock_cred(0xffffffffffffff9c, 0xffff, 0x1022, &(0x7f00000000c0), &(0x7f00000002c0)=0xc) 18:59:30 executing program 0: r0 = socket(0x18, 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$TIOCFLUSH(r1, 0x8080691a, &(0x7f0000000300)) ioctl$WSDISPLAYIO_GMODE(r1, 0x4004574b, &(0x7f00000000c0)) r2 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000080)='/dev/bpf\x00', 0x4000000001, 0x0) ioctl$BIOCSETIF(r2, 0x8020426c, &(0x7f0000000040)={'tap', 0x0}) ioctl$BIOCSETWF(r2, 0x80104277, &(0x7f0000000000)={0x6, &(0x7f0000000100)=[{0x24}, {0x40, 0x9, 0x1}, {0x86f, 0x0, 0x0, 0x80}, {0xc9, 0x7, 0x67}, {0xff7f, 0x1f, 0x14, 0xffffff0e}, {0x4, 0x80, 0x6, 0x7}]}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x80, 0x42) ioctl$BIOCSETIF(r3, 0x8020426c, &(0x7f0000000180)={'tap', 0x0}) pwrite(r2, &(0x7f0000000240)="fbaf8a8d1a029be96914f6357e3a", 0xe, 0x0, 0x0) 18:59:30 executing program 0: ioctl$TIOCSETA(0xffffffffffffffff, 0x802c7414, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, "0000000000000001003e1d8c4aaaffac9100"}) r0 = socket(0x18, 0x4003, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="2000000000000000ffff000000000000f87c8a5b67041b542a538706000000b810000000290000003100000003000000a533c5cc2c9744a117acf6b1f084fb89d1729e258b30330180997e8319f16383f96d79727d88340d4d064fe03da49b97c9d701cc71e0ecd25f59c390b52b4067bc5da3ee16a1b1b32653e294b9f90244d4c57ed8116d49bf864554035a49679e2f8347ed3aa1ed2c74bddf95bd06ecf21bd2b41e0f5f26d06ef860329a25fb20849f53f9c94029f11f4c0ae01ec91dd707cc130600000000000000fb60a5e7d2e90ac4d6f21a62322d40c75911fbe88f7f8a909be6ed4438720a97b6cdeff985ead6cb904dff9defecce19084b6736184f66e2bc3d407b46bde0a41d396f255a8ff9d202203f37acddc9b2c8c8cace9ae5275c0aa0f6654df3246b54a43bef13789da871098aa2b0063f482cfba2cafb50bb8218172066e4a0848c53be4ead4db2c0095571e8a0eb0a36aec69ede1961a16f09c928d98be1ac53339004f56cbaa3b5416cdbeadecc091b765a77e88868be7168f0096948b3db1a8d67c9536ec988d8a303204a06105a688c12d3f3f59420e55205cf5ef6cad87a9051e2a9a7cc50f51435fdf643a9632d0692b2d722d465fc982728e0ef7a6f9b8c9849db822ea431a299c839f4000000000000"], 0x30}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x1, 0x7, 0x3}, 0x8) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) connect$unix(r0, &(0x7f00000000c0)=@abs={0x0, 0x7}, 0x1c) bind$inet6(r0, &(0x7f0000000000)={0x18, 0x1, 0x9, 0xff}, 0xc) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x40, 0x148) lstat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)) ioctl$VT_GETSTATE(r1, 0x40067664, &(0x7f0000000080)) 18:59:30 executing program 0: r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100)='/dev/bpf\x00', 0x0, 0x0) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000200)={0x3, &(0x7f0000000180)=[{0x5c}, {0x7c}, {0x7ffffffe}]}) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) syz_emit_ethernet(0x61, &(0x7f0000000000)="b6") syz_emit_ethernet(0x63, &(0x7f0000000040)="c68793da5880683d70e291eab1015e50184959a914b0a1737ece402287554857d3f29fe5b4f1d4ae2593adbbb8faedb907fa264143c332c6c510928ec7d3a99df48a09edf50887ab842e457cd34205a0545024720b67c62736dbdf67984d66538eecbd") 18:59:31 executing program 1: mknod(&(0x7f0000000140)='./bus\x00', 0x80002005, 0x8000000000005200) r0 = open$dir(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mkdir(&(0x7f0000000200)='./bus\x00', 0x8) chflags(&(0x7f0000000000)='./bus\x00', 0x1) r1 = kqueue() kevent(r1, &(0x7f0000000100)=[{{r0}, 0xfffffffffffffffc, 0x1}], 0x81, 0x0, 0x40000, 0x0) r2 = socket(0x18, 0x2, 0x0) r3 = socket(0x18, 0x2, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$TIOCFLUSH(r4, 0x8080691a, &(0x7f0000000300)) openat(r4, &(0x7f0000000040)='./bus\x00', 0x8, 0xa) r5 = socket(0x18, 0x1, 0x0) close(r5) connect$unix(r5, &(0x7f00000000c0)=@abs={0x0, 0x7}, 0x1c) r6 = open$dir(&(0x7f00000000c0)='./bus\x00', 0x2, 0x26) r7 = fcntl$dupfd(r2, 0xa, r6) ioctl$TIOCFLUSH(r7, 0x8080691a, &(0x7f0000000300)) ioctl$WSDISPLAYIO_USEFONT(r7, 0x80585750, &(0x7f0000000180)={'./bus\x00', 0x9cf, 0x3ff, 0x600000, 0x1, 0x1, 0x1, 0x6, 0x4daf83f695ed6c07, 0x0, 0x9, 0xd55b}) 18:59:31 executing program 0: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) kevent(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)={0x3, 0xffffffffffffffff}) r2 = kqueue() kevent(r2, &(0x7f0000000040), 0xa9, 0x0, 0xfffff801, 0x0) r3 = socket(0x18, 0x2, 0x0) close(r3) setsockopt(r3, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) write(r3, &(0x7f0000000040)="100a2956b9223776", 0x21d) r4 = socket(0x18, 0x1, 0x0) setsockopt(r4, 0x29, 0xc, &(0x7f0000000140)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) r5 = socket(0x18, 0x1, 0x0) setsockopt(r5, 0x29, 0xc, &(0x7f0000000140)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) r6 = socket(0x18, 0x1, 0x0) close(r6) connect$unix(r6, &(0x7f0000000300)=ANY=[@ANYBLOB="01002e2f66696c45310096181a26a5185b231ffa3bdd6fd4addfe3ae4e595b0b957ad84d7f3f2f806c1ee62a897761cbfd6f3269134bbb43cf58df23fe9473bc427c2e"], 0xa) r7 = socket(0x18, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r8, &(0x7f0000000240)=@file={0x1, './file0\x00'}, 0xa) r9 = socket(0x18, 0x1, 0x0) setsockopt(r9, 0x29, 0xc, &(0x7f0000000140)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) setsockopt(r9, 0x29, 0xc, &(0x7f0000000140)="ebff66e7a708a83867f64e713048e69931b29648", 0x14) r10 = socket(0x18, 0x2, 0x0) close(r10) setsockopt(r10, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) write(r10, &(0x7f0000000040)="100a2956b9223776", 0x21d) kevent(0xffffffffffffffff, &(0x7f0000000100)=[{{r3}, 0xffffffffffffffff, 0x38, 0x20000000, 0x86d7, 0x49a}, {{r4}, 0xfffffffffffffffa, 0x85, 0x1, 0x5e4, 0x685}, {{r5}, 0xfffffffffffffffa, 0x1c, 0x80, 0x10000}, {{r6}, 0xfffffffffffffffd, 0x4, 0x20000000, 0x12, 0x10000}, {{r0}, 0x0, 0x2a, 0x1, 0x2, 0xffffffff}, {{r7}, 0xfffffffffffffffd, 0x4, 0x80, 0x800, 0x3}], 0x46c, &(0x7f0000000080)=[{{r0}, 0xfffffffffffffffa, 0x8, 0x2, 0x100000001, 0x61}, {{r10}, 0xfffffffffffffffd, 0x80, 0x1, 0x1, 0x100}], 0x728, &(0x7f00000001c0)={0x2, 0x8}) fsync(r2) kevent(r2, 0x0, 0x0, 0x0, 0x2, 0x0) select(0x40, &(0x7f0000000040)={0xfffffffffffffffd}, 0x0, 0x0, 0x0) r11 = kqueue() dup2(r11, r1) 18:59:31 executing program 0: open(&(0x7f00000003c0)='./file0\x00', 0x610, 0x0) mknod(&(0x7f0000000100)='./bus\x00', 0x3a0934c44f7b202b, 0x1b00) ktrace(&(0x7f0000000080)='./file0\x00', 0x4, 0x20, 0x0) r0 = open(&(0x7f00000000c0)='./bus\x00', 0x11, 0x0) r1 = open(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x5, 0x10, r1, 0x0, 0x0) ioctl$WSMUXIO_LIST_DEVICES(r0, 0x20005302, &(0x7f0000000140)={0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0xfffffffb}, {}, {}, {}, {}, {}, {}, {0x1}, {}, {}, {}, {0x0, 0xfffffffd}, {}, {0x2}, {}, {}, {}, {0x0, 0xffffffff}]}) execve(0x0, 0x0, 0x0) r2 = semget(0xffffffffffffffff, 0x1, 0x0) semop(r2, &(0x7f0000000140)=[{0x0, 0xfffffffffffffffa, 0x1002}, {0x1, 0x15, 0x1000}, {0x0, 0x7de6, 0x40000001000}, {0xfffffffffffffffe, 0x4, 0x1800}, {0x2, 0x3}, {0x2, 0x6, 0x1000}, {0x4, 0x1d49, 0x1000}, {0x3, 0x4000000000000, 0x1800}, {0x7, 0x9, 0x1000}], 0x9) r3 = socket(0x18, 0x2, 0x0) close(r3) setsockopt(r3, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) write(r3, &(0x7f0000000040)="100a2956b9223776", 0x21d) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r4, 0xffff, 0x1022, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000000100)=0x1) setuid(r5) r6 = socket(0x18, 0x2, 0x0) close(r6) setsockopt(r6, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) write(r6, &(0x7f0000000040)="100a2956b9223776", 0x21d) getsockopt$SO_PEERCRED(r6, 0xffff, 0x1022, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0xc) lchown(&(0x7f0000000600)='./bus\x00', r5, r7) sendto$unix(r3, &(0x7f0000000500)="3e920513f4182044044ec3b2c9d178faf16aceb2a8529b02e3a78b49739a5c5db07aca8680b9541eeb09df68b92347f259024c8b6c1d8fc3842976d34af0a7057becbfc851bf3dab9fbdd79f763bac79f04d4c03cad0864c6f79b232b8cf7382dca7b849ac4cdc2e9530721a4597f6b8d0bb0b59d3ac115613b88bbe13c788467f605d618699a57658b3ba373d425bbf8bdba3d7896ef71cf846700d64a77ff6a9b0a2a41a77490a065800bef01841707134b20d2150b6335021809a0527d3a6314bc34b12a1547a8df5cf8f1bf935819dc038239d699acbe987ac346cd688758869bf83bcc0341c4f9bef91", 0xec, 0x1, 0x0, 0x0) semop(r2, &(0x7f0000000000), 0x0) getsockopt$SO_PEERCRED(r0, 0xffff, 0x1022, &(0x7f0000000040)={0x0, 0x0}, 0xc) r9 = socket(0x18, 0x1, 0x0) setsockopt(r9, 0x29, 0xc, &(0x7f0000000140)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) getsockopt$sock_cred(r9, 0xffff, 0x1022, &(0x7f0000000380)={0x0, 0x0, 0x0}, &(0x7f0000000400)=0xc) semctl$IPC_SET(r2, 0x0, 0x1, &(0x7f0000000440)={{0x1, r8, r10, 0x0, 0xffffffffffffffff, 0x0, 0x1f}, 0x6, 0x81, 0x7f}) sendto$unix(0xffffffffffffffff, &(0x7f0000000280)="ae366adc81af8ca82cc37a26cfeed89bd49658c31da63cb6a4a1d6cc0aa7436cb3f36e09e3fad5d03aac8215f9cd178ea8086215da71f85a80aca68e5c48e245df50b2c2917fca65890ed0ea2fe90291538573737cfe5e029f6fa447a868d9c94766d11afcd4627dd9ee01a9eaf8ed14524bebc4e46cf2b79af200beea8048ee2ce3b509dc3b4c6ca3b55331c3db4929a5c13508e199942d686ae53671714071c701868e0518491ad8e9680b52a9d54aabc17c4efbb855dd49316bf7e08043f0c6e7124ff5155b367c65f560f145f14cd4", 0xd1, 0x402, &(0x7f00000004c0)=ANY=[@ANYBLOB="00002e2f66696c653000d8b404a40cd1c9045fa5e49b0a4c1cb2d402838e1259663e8e7c12b00a960933f06ac45e063cd7c22681d32ab9a82f564aa0dd"], 0xa) 18:59:31 executing program 1: r0 = socket(0x18, 0x1, 0x0) close(r0) r1 = socket(0x800000018, 0x2, 0x0) setsockopt$sock_int(r0, 0xffff, 0x1000, &(0x7f0000000000)=0x8, 0x4) r2 = socket(0x18, 0x1, 0x0) close(r2) connect$unix(0xffffffffffffff9c, &(0x7f0000000040)=@abs={0x0, 0x7}, 0x8) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$TIOCSETAF(r3, 0x802c7416, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffffe, 0x0, "090000f38900f4ffe64dc22a30adca60b38800"}) bind$unix(r1, &(0x7f0000000080)=@abs={0x1f95d27d48731892}, 0x1c) r4 = socket(0x18, 0x1, 0x0) ioctl$TIOCSETA(0xffffffffffffffff, 0x802c7414, &(0x7f00000000c0)={0x0, 0x0, 0xffff, 0x0, "00370700000000000000df00000000000000e600"}) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x0, {0x0, 0x1}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) socket(0x20, 0xe001, 0xb1) close(r4) r5 = socket(0x18, 0x3, 0x0) r6 = socket(0x18, 0x1, 0x0) close(r6) connect$unix(r6, &(0x7f00000000c0)=@abs={0x0, 0x7}, 0x1c) dup2(0xffffffffffffffff, r6) setsockopt(r5, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13f9fd812eaa4e713040e69931929648", 0x14) connect$unix(r4, &(0x7f00000000c0)=@abs={0x0, 0x7}, 0x1c) sendto$unix(r4, 0x0, 0x0, 0x0, 0x0, 0x0) 18:59:31 executing program 1: select(0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x0, 0x8006}, 0x0, 0x0) ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x0, {0x0, 0x10000000000001}}) ioctl$TIOCSETA(0xffffffffffffffff, 0x802c7414, &(0x7f00000000c0)={0x0, 0x0, 0xffffffffffffffff, 0x0, "00000000000000000000f2ffffffffffffff4000"}) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x2, &(0x7f0000000300)=[{}, {}]}) r0 = semget(0x2, 0x3, 0x22) semctl$GETNCNT(r0, 0x3, 0x3, &(0x7f0000000340)=""/4096) ioctl$TIOCSETAF(0xffffffffffffffff, 0x802c7416, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x0, 0x0, "010000000000000000ffffff7f00"}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = socket(0x18, 0x1, 0x0) setsockopt(r1, 0x29, 0xc, &(0x7f0000000140)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) r2 = socket(0x18, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$TIOCFLUSH(r3, 0x8080691a, &(0x7f0000000300)) ioctl$VT_GETMODE(r3, 0x40087603, &(0x7f0000000080)) r4 = socket(0x18, 0x1, 0x0) close(r4) r5 = socket(0x18, 0x2, 0x0) close(r5) socket(0x400000000018, 0x3, 0x3a) setsockopt(r5, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) connect$unix(r4, &(0x7f00000000c0)=@abs={0x0, 0x7}, 0x1c) write(r5, &(0x7f0000000040)="100a2956b9223776", 0x21d) 18:59:31 executing program 0: setrlimit(0x8, &(0x7f0000000000)={0x9, 0x1}) r0 = syz_open_pts() close(r0) syz_open_pts() ioctl$TIOCSETAW(r0, 0x80047469, &(0x7f0000001780)={0x34, 0x0, 0x0, 0x0, "1ffbffa6163cb90277925f1be62c36ae61dba648"}) writev(r0, &(0x7f0000000840)=[{&(0x7f0000000280)="11a97f469ebdb3e71f1a593627cb7434fc82ff43ed092a839578e335ae386ecc19405afcb5695038bb30c4db6e5e37b8db8da2b0aeb4c95637", 0x39}, {&(0x7f0000000900)="d1ae4096c7f91909ec3d381096b4cc2ccc75f35f0902f9c7fff6353c9dd2df3a6a16", 0x22}, {&(0x7f0000000580)="558566786fbf6683a54097e67c", 0xd}], 0x3) 18:59:31 executing program 0: ioctl$VMM_IOC_WRITEREGS(0xffffffffffffff9c, 0x82485608, &(0x7f0000000240)={0x0, 0x0, 0x0, {[], [], [0x0, 0x0, 0x0, 0x9, 0xffffffffffffffff, 0xfff7f7fffffeffff], [0x0, 0x0, 0x401]}}) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f0000000300)={'tap', 0x0}) ioctl$TIOCFLUSH(0xffffffffffffff9c, 0x80047410, &(0x7f0000000040)=0xfffffffe) r0 = open$dir(&(0x7f0000000280)='./bus\x00', 0x0, 0x0) r1 = fcntl$getown(r0, 0x5) ktrace(0x0, 0x5, 0x8, r1) fcntl$lock(0xffffffffffffff9c, 0x7, &(0x7f0000000000)={0xd66189dbfe36f05d, 0x0, 0xb5c, 0x0, r1}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r2 = socket(0x18, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$TIOCFLUSH(r3, 0x8080691a, &(0x7f0000000300)) 18:59:31 executing program 0: r0 = getgid() getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x1022, 0x0, 0x0) setregid(0x0, 0x0) getgroups(0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x1022, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r1, 0xffff, 0x1022, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xfffffffffffffd13) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r3, 0xffff, 0x1022, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xfd72) setregid(0x0, r4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r5, 0xffff, 0x1022, &(0x7f0000000100)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xfd72) setregid(0x0, r6) r7 = getgid() setregid(r2, r7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r8, 0xffff, 0x1022, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xfffffffffffffd13) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r10, 0xffff, 0x1022, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xfffffffffffffd13) setregid(0xffffffffffffffff, r11) setregid(r2, r11) setregid(r0, r9) socketpair$unix(0x1, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x1022, 0x0, 0x0) setregid(0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0xffff, 0x1022, 0x0, &(0x7f00000000c0)) setregid(0x0, 0x0) getgroups(0x0, &(0x7f0000000040)) socket(0x11, 0x3, 0x0) r12 = socket(0x11, 0x4003, 0x0) setsockopt$sock_int(r12, 0xffff, 0x10, 0x0, 0x0) sendto$unix(r12, &(0x7f0000000240)="b100050260000000000087000101000000000000cea0fea7fef9730541ded3357ae26caa0416fa4f374a36acf00b7804be781e4991f788df5f882b297be1aa5b0100000001000000bbc257699a1f132e27acb5d602000d7d026ba8af63ff37282902e4fd89720fd3872babfbb770c1f5a872c881ff7cc53c894303b22f310b404f36a00f90006ee01be657aea8a3f800040000000000000700"/177, 0xb1, 0x2, 0x0, 0x44) r13 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bpf\x00', 0x0, 0x0) ioctl$BIOCSETWF(r13, 0x80104277, &(0x7f00000000c0)={0x20000000000000b6, &(0x7f0000000140)=[{}]}) r14 = shmget$private(0x0, 0x1000, 0x0, &(0x7f0000ffe000/0x1000)=nil) shmctl$IPC_STAT(r14, 0x2, 0x0) shmctl$SHM_LOCK(r14, 0x3) geteuid() 18:59:32 executing program 1: r0 = syz_open_pts() ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f00000000c0)={0x0, 0x0, 0x90d6, 0x0, "d700060000000000005b00000000000000e74de4"}) write(r0, &(0x7f0000000180)="582720efabd16ebae63225259560f8e5815f73f2a044fd33055552fbd7e41789632dfc94ff334a5619515a4c8ab06198824b3da025bbd47b3bf579456fc7d4096e8c8b6b87cb2d72b8bcdb9ad8a4f5f728193ef16ab93f12fc4d5f16b136a5d00d1628b53a", 0x65) write(r0, &(0x7f0000000380)="9dfc17934c5e0d3b30aa192322c085e4635dadd1e3f80890a8cdf37d0d98d547053bef9f140a7afc90c1468a40bd422a5bebc5e1940b1a351b3df7ffc6f7bb3e06c224bd7d4d91894ae3c8775a9440223482cb0fba0e1d3f2a64fb903e219c784cfe37d1a5415925481d31ff502dfc072002dd39b9a4168bd5612a0b8bc2897d0a2c2ffff5c4866590a35f749b3f1fb77a549d7d5718bd268009f65aaaa7f573359d06980e331cc55ce28e57e936", 0xae) r1 = syz_open_pts() r2 = socket(0x18, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$TIOCFLUSH(r3, 0x8080691a, &(0x7f0000000300)) ioctl$TIOCFLUSH(r1, 0x80047410, &(0x7f0000000100)=0x1) ioctl$TIOCMGET(r3, 0x4004746a, &(0x7f0000000000)) close(r0) dup(r1) r4 = socket(0x18, 0x2, 0x0) r5 = fcntl$dupfd(r4, 0x0, r4) ioctl$TIOCFLUSH(r5, 0x8080691a, &(0x7f0000000300)) ioctl$WSDISPLAYIO_GBURNER(r5, 0x400c5752, &(0x7f0000000140)) socket$unix(0x1, 0x5, 0x0) open$dir(&(0x7f0000000340)='./file0\x00', 0x400000002c5, 0x0) syz_open_pts() r6 = socket$unix(0x1, 0x2, 0x0) sendmsg$unix(r6, &(0x7f0000000080)={&(0x7f0000000040)=@file={0x170, './file0\x00'}, 0x9, 0x0}, 0x0) socket(0x10, 0x3, 0x81) r7 = socket(0x10000000002, 0x2, 0x0) setsockopt$sock_int(r7, 0xffff, 0x100, &(0x7f00000000c0)=0x10000, 0x4) 18:59:32 executing program 0: ioctl$TIOCSETAF(0xffffffffffffffff, 0x802c7416, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x4000000, "d73000000000a54da35c00"}) ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x0, {0x0, 0x1}}) r0 = socket(0x18, 0x1, 0x0) close(r0) r1 = socket(0x18, 0x400000002, 0x0) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) socket(0x0, 0x0, 0x0) setsockopt(r1, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) connect$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0xa) 18:59:32 executing program 0: mknod(&(0x7f0000000100)='./bus\x00', 0x2000, 0x86138) stat(&(0x7f0000000000)='./bus\x00', &(0x7f0000000080)) r0 = open(&(0x7f0000000040)='./bus\x00', 0x2, 0x0) unveil(&(0x7f0000000200)='./bus\x00', &(0x7f0000000240)='x\x00') write(r0, &(0x7f0000000140)="220e22", 0x3) r1 = semget(0xffffffffffffffff, 0x1, 0x0) semop(r1, &(0x7f0000000140)=[{0x0, 0xfffffffffffffffa, 0x1002}, {0x1, 0x15, 0x1000}, {0x0, 0x7de6, 0x40000001000}, {0xfffffffffffffffe, 0x4, 0x1800}, {0x2, 0x3}, {0x2, 0x6, 0x1000}, {0x4, 0x1d49, 0x1000}, {0x3, 0x4000000000000, 0x1800}, {0x7, 0x9, 0x1000}], 0x9) semop(r1, &(0x7f0000000000)=[{0x3, 0x8, 0x1000}], 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r2, 0xffff, 0x1022, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000000100)=0x1) setuid(r3) r4 = socket(0x18, 0x2, 0x0) close(r4) setsockopt(r4, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) write(r4, &(0x7f0000000040)="100a2956b9223776", 0x21d) getsockopt$SO_PEERCRED(r4, 0xffff, 0x1022, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r6, 0xffff, 0x1022, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000000100)=0x1) setuid(r7) semctl$IPC_SET(r1, 0x0, 0x1, &(0x7f0000000300)={{0x6, r3, r5, r7, 0xffffffffffffffff, 0x3f, 0x4}, 0x8, 0xfffffffffffffffd, 0x9}) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000180)={{}, 0x1000000000004, 0x5}) pwritev(r0, &(0x7f00000002c0)=[{&(0x7f0000000180), 0xff20}], 0x100000000000005e, 0x0, 0x0) login: panic: receive 3: so 0xfffffd805e56d4b0, so_type 3, m 0xfffffd805baa5c00, m_type 0 Stopped at db_enter+0x18: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND *144452 87577 0 0 0 0 dhclient db_enter() at db_enter+0x18 panic(ffffffff821abe2f) at panic+0x15c soreceive(fffffd805e56d4b0,0,ffff80001d372468,0,0,ffff80001d372374) at soreceive+0x16e7 soo_read(fffffd80611f2618,ffff80001d372468,0) at soo_read+0x53 dofilereadv(ffff80001d339008,6,ffff80001d372468,0,ffff80001d372550) at dofilereadv+0x1a1 sys_read(ffff80001d339008,ffff80001d372500,ffff80001d372550) at sys_read+0x83 syscall(ffff80001d3725d0) at syscall+0x507 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffe7e20, count: 7 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic receive 3: so 0xfffffd805e56d4b0, so_type 3, m 0xfffffd805baa5c00, m_type 0 ddb> trace db_enter() at db_enter+0x18 panic(ffffffff821abe2f) at panic+0x15c soreceive(fffffd805e56d4b0,0,ffff80001d372468,0,0,ffff80001d372374) at soreceive+0x16e7 soo_read(fffffd80611f2618,ffff80001d372468,0) at soo_read+0x53 dofilereadv(ffff80001d339008,6,ffff80001d372468,0,ffff80001d372550) at dofilereadv+0x1a1 sys_read(ffff80001d339008,ffff80001d372500,ffff80001d372550) at sys_read+0x83 syscall(ffff80001d3725d0) at syscall+0x507 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7f7ffffe7e20, count: -8 ddb> show registers rdi 0 rsi 0x1 rbp 0xffff80001d3721b0 rbx 0xffff80001d372260 rdx 0x2 rcx 0 rax 0 r8 0xffff80001d372170 r9 0x1 r10 0 r11 0xc04f0fe77f58bf9c r12 0x3000000008 r13 0xffff80001d3721c0 r14 0x100 r15 0x1 rip 0xffffffff819e0b28 db_enter+0x18 cs 0x8 rflags 0x246 rsp 0xffff80001d3721a0 ss 0x10 db_enter+0x18: addq $0x8,%rsp ddb> show proc PROC (dhclient) pid=144452 stat=onproc flags process=0 proc=0 pri=24, usrpri=50, nice=20 forw=0xffffffffffffffff, list=0xffff80001d33a118,0xffff80001d339768 process=0xffff8000ffffae10 user=0xffff80001d36d000, vmspace=0xfffffd806bc09440 estcpu=0, cpticks=1, pctcpu=0.0 user=0, sys=1, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 96491 182179 74712 0 2 0 syz-executor.0 96491 406892 74712 0 2 0x4000000 syz-executor.0 60354 477232 45754 0 2 0 syz-executor.1 60354 302788 45754 0 3 0x4000080 ttyout syz-executor.1 45754 37493 25843 0 3 0x82 nanosleep syz-executor.1 74712 405831 25843 0 2 0x482 syz-executor.0 25843 437534 81394 0 3 0x82 thrsleep syz-fuzzer 25843 480592 81394 0 3 0x4000082 thrsleep syz-fuzzer 25843 134342 81394 0 3 0x4000082 thrsleep syz-fuzzer 25843 410622 81394 0 3 0x4000082 thrsleep syz-fuzzer 25843 261723 81394 0 3 0x4000082 thrsleep syz-fuzzer 25843 432972 81394 0 3 0x4000082 kqread syz-fuzzer 25843 376021 81394 0 3 0x4000082 thrsleep syz-fuzzer 25843 522163 81394 0 3 0x4000082 thrsleep syz-fuzzer 81394 284299 88372 0 3 0x10008a pause ksh 88372 490180 77722 0 3 0x92 select sshd 24528 236643 1 0 3 0x100083 ttyin getty 77722 66268 1 0 3 0x80 select sshd 24644 499644 58561 73 3 0x100090 kqread syslogd 58561 160231 1 0 3 0x100082 netio syslogd 47010 103887 1 77 2 0x100010 dhclient *87577 144452 1 0 7 0 dhclient 41461 507061 0 0 2 0x14200 zerothread 1431 105485 0 0 3 0x14200 aiodoned aiodoned 89775 264206 0 0 3 0x14200 syncer update 4101 388705 0 0 3 0x14200 cleaner cleaner 65053 346421 0 0 3 0x14200 reaper reaper 48911 99575 0 0 3 0x14200 pgdaemon pagedaemon 75804 512873 0 0 3 0x14200 bored crynlk 34233 154273 0 0 3 0x14200 bored crypto 68962 394213 0 0 3 0x40014200 acpi0 acpi0 19166 349269 0 0 3 0x14200 bored softnet 31833 429118 0 0 3 0x14200 bored systqmp 74971 254994 0 0 3 0x14200 bored systq 80210 6614 0 0 3 0x40014200 bored softclock 4849 435517 0 0 3 0x40014200 idle0 4109 212350 0 0 3 0x14200 bored smr 1 237891 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 9457 6326K 6581K 78643K 10587 0 pcb 13 8K 8K 78643K 21 0 rtable 105 3K 3K 78643K 193 0 ifaddr 44 10K 10K 78643K 48 0 counters 21 16K 16K 78643K 21 0 ioctlops 0 0K 2K 78643K 15 0 mount 1 1K 1K 78643K 1 0 vnodes 1216 76K 77K 78643K 1232 0 UFS quota 1 32K 32K 78643K 1 0 UFS mount 5 36K 36K 78643K 5 0 shm 2 1K 5K 78643K 3 0 VM map 2 0K 0K 78643K 2 0 sem 4 0K 0K 78643K 6 0 dirhash 12 2K 2K 78643K 12 0 ACPI 1794 195K 288K 78643K 12646 0 file desc 6 17K 25K 78643K 53 0 proc 47 38K 54K 78643K 361 0 subproc 32 2K 2K 78643K 34 0 NFS srvsock 1 0K 0K 78643K 1 0 NFS daemon 1 16K 16K 78643K 1 0 ip_moptions 0 0K 0K 78643K 13 0 in_multi 33 2K 2K 78643K 39 0 ether_multi 1 0K 0K 78643K 2 0 ISOFS mount 1 32K 32K 78643K 1 0 MSDOSFS mount 1 16K 16K 78643K 1 0 ttys 31 148K 148K 78643K 31 0 exec 0 0K 1K 78643K 183 0 pagedep 1 8K 8K 78643K 1 0 inodedep 1 32K 32K 78643K 1 0 newblk 1 0K 0K 78643K 1 0 VM swap 7 26K 26K 78643K 7 0 UVM amap 97 21K 21K 78643K 950 0 UVM aobj 8 2K 2K 78643K 8 0 memdesc 1 4K 4K 78643K 1 0 crypto data 1 1K 1K 78643K 1 0 ip6_options 0 0K 0K 78643K 16 0 NDP 6 0K 0K 78643K 10 0 temp 75 3010K 3073K 78643K 1869 0 kqueue 3 4K 10K 78643K 8 0 SYN cache 2 16K 16K 78643K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle arp 64 6 0 0 1 0 1 1 0 8 0 rtpcb 80 23 0 21 1 0 1 1 0 8 0 rtentry 112 45 0 1 2 0 2 2 0 8 0 unpcb 120 55 0 47 1 0 1 1 0 8 0 syncache 264 4 0 4 1 1 0 1 0 8 0 tcpqe 32 25 0 25 1 0 1 1 0 8 1 tcpcb 544 42 0 38 2 0 2 2 0 8 1 inpcb 280 108 0 101 2 0 2 2 0 8 1 nd6 48 6 0 0 1 0 1 1 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 188 0 0 12 0 12 12 0 8 0 art_table 32 189 0 0 2 0 2 2 0 8 0 art_node 16 44 0 4 1 0 1 1 0 8 0 sysvmsgpl 40 14 0 14 1 0 1 1 0 8 1 semapl 112 2 0 0 1 0 1 1 0 8 0 shmpl 112 6 0 0 1 0 1 1 0 8 0 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino1pl 128 1446 0 47 46 0 46 46 0 8 0 ffsino 240 1446 0 47 83 0 83 83 0 8 0 nchpl 144 1705 0 94 60 0 60 60 0 8 0 uvmvnodes 72 1497 0 0 28 0 28 28 0 8 0 vnodes 208 1497 0 0 79 0 79 79 0 8 0 namei 1024 4089 0 4089 1 0 1 1 0 8 1 scxspl 192 4835 0 4835 1 0 1 1 0 8 1 plimitpl 152 14 0 7 1 0 1 1 0 8 0 sigapl 432 224 0 210 2 0 2 2 0 8 0 futexpl 56 711 0 711 1 0 1 1 0 8 1 knotepl 112 58 0 39 1 0 1 1 0 8 0 kqueuepl 144 8 0 6 1 0 1 1 0 8 0 pipelkpl 16 73 0 63 1 0 1 1 0 8 0 pipepl 120 146 0 127 1 0 1 1 0 8 0 fdescpl 432 225 0 210 2 0 2 2 0 8 0 filepl 120 1190 0 1092 4 0 4 4 0 8 1 lockfpl 104 11 0 10 1 0 1 1 0 8 0 lockfspl 48 6 0 5 1 0 1 1 0 8 0 sessionpl 112 17 0 7 1 0 1 1 0 8 0 pgrppl 48 17 0 7 1 0 1 1 0 8 0 ucredpl 96 67 0 60 1 0 1 1 0 8 0 zombiepl 144 210 0 210 1 0 1 1 0 8 1 processpl 896 239 0 210 4 0 4 4 0 8 0 procpl 624 278 0 240 4 0 4 4 0 8 1 sockpl 400 186 0 169 5 0 5 5 0 8 3 mcl8k 8192 1 0 1 1 0 1 1 0 8 1 mcl4k 4096 13 0 13 2 1 1 1 0 8 1 mcl2k 2048 64072 0 64029 17 3 14 14 0 8 8 mtagpl 80 4 0 2 2 1 1 1 0 8 0 mbufpl 256 101311 0 101208 11 1 10 10 0 8 0 bufpl 280 3990 0 162 274 0 274 274 0 8 0 anonpl 16 37251 0 21543 65 1 64 64 0 107 0 amapchunkpl 152 1030 0 894 8 0 8 8 0 158 2 amappl16 192 1039 0 178 44 0 44 44 0 8 0 amappl15 184 3 0 1 1 0 1 1 0 8 0 amappl14 176 2 0 2 2 2 0 1 0 8 0 amappl13 168 23 0 22 1 0 1 1 0 8 0 amappl12 160 25 0 23 2 1 1 1 0 8 0 amappl11 152 69 0 56 1 0 1 1 0 8 0 amappl10 144 21 0 14 1 0 1 1 0 8 0 amappl9 136 367 0 364 1 0 1 1 0 8 0 amappl8 128 270 0 252 1 0 1 1 0 8 0 amappl7 120 114 0 102 1 0 1 1 0 8 0 amappl6 112 20 0 16 1 0 1 1 0 8 0 amappl5 104 195 0 183 1 0 1 1 0 8 0 amappl4 96 434 0 404 1 0 1 1 0 8 0 amappl3 88 103 0 98 1 0 1 1 0 8 0 amappl2 80 1001 0 926 3 0 3 3 0 8 1 amappl1 72 13632 0 13205 27 11 16 20 0 8 7 amappl 80 504 0 460 2 0 2 2 0 84 1 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 64 7 0 0 1 0 1 1 0 8 0 uaddrrnd 24 225 0 210 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 225 0 210 1 0 1 1 0 8 0 vmmpekpl 168 5707 0 5681 2 0 2 2 0 8 0 vmmpepl 168 34563 0 32546 123 7 116 116 0 357 28 vmsppl 272 224 0 210 2 0 2 2 0 8 1 pdppl 4096 456 0 420 6 0 6 6 0 8 1 pvpl 32 126895 0 108180 151 0 151 151 0 265 0 pmappl 200 224 0 210 1 0 1 1 0 8 0 extentpl 40 46 0 29 1 0 1 1 0 8 0 phpool 112 152 0 7 5 0 5 5 0 8 0