last executing test programs:

10.9093935s ago: executing program 0 (id=1842):
r0 = syz_open_dev$I2C(&(0x7f00000007c0), 0x0, 0x2)
syz_usb_connect(0x0, 0x52, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x1, 0x3c, 0x4c, 0x20, 0x15c2, 0xffdc, 0xa41b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x40, 0x1, 0x2, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x9d, 0x0, 0x0, 0x1f, 0x98, 0x8e, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x2, 0x1}, [@mixer_unit={0x7, 0x24, 0x4, 0x0, 0x5, "8e91"}, @output_terminal={0x9, 0x24, 0x3, 0x6, 0x306, 0x5, 0x4, 0x5}, @selector_unit={0x7, 0x24, 0x5, 0x6, 0x57, "c7cc"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x302, 0x5, 0x1, 0x2}, @mixer_unit={0x5, 0x24, 0x4, 0x4, 0xd9}]}]}}]}}]}}, 0x0)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x228)
r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000005c0)=@generic={&(0x7f0000000580)='./bus\x00', 0x0, 0x8}, 0x18)
r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2c0c2, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xf, 0x4, &(0x7f0000000440)=ANY=[@ANYRESHEX=r2], 0x0, 0x6, 0x21, &(0x7f0000000200)=""/33, 0x41000, 0x8, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r1, 0x1, &(0x7f00000002c0)=[0xffffffffffffffff], &(0x7f0000000340)=[{0x1, 0x8000001, 0x7, 0x2}], 0x10, 0xab}, 0x94)
readlinkat(r2, &(0x7f0000000100)='./mnt\x00', 0x0, 0x0)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xe)
r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0)
write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000800)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0xe, 0x40, 0x1, 0x3, 0x3, 0x8, "9e8eef2c4b3d4fcef5c15b09ef3b"}}, 0x126)
write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r3, 0x0)
ioctl$BLKRAGET(r3, 0x1263, &(0x7f0000000080))
syz_emit_ethernet(0x5a, &(0x7f0000000000)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x24, 0x6, 0x0, @dev={0xfe, 0x80, '\x00', 0x20}, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, {[@generic={0xfe, 0x2}, @generic={0xfe, 0xe, "149674ca44bd880314dea5a1"}]}}}}}}}}, 0x0)
syz_open_dev$I2C(&(0x7f00000007c0), 0x0, 0x2) (async)
syz_usb_connect(0x0, 0x52, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x1, 0x3c, 0x4c, 0x20, 0x15c2, 0xffdc, 0xa41b, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x40, 0x1, 0x2, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x9d, 0x0, 0x0, 0x1f, 0x98, 0x8e, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x2, 0x1}, [@mixer_unit={0x7, 0x24, 0x4, 0x0, 0x5, "8e91"}, @output_terminal={0x9, 0x24, 0x3, 0x6, 0x306, 0x5, 0x4, 0x5}, @selector_unit={0x7, 0x24, 0x5, 0x6, 0x57, "c7cc"}, @output_terminal={0x9, 0x24, 0x3, 0x2, 0x302, 0x5, 0x1, 0x2}, @mixer_unit={0x5, 0x24, 0x4, 0x4, 0xd9}]}]}}]}}]}}, 0x0) (async)
ioctl$I2C_SLAVE_FORCE(r0, 0x706, 0x228) (async)
bpf$OBJ_GET_PROG(0x7, &(0x7f00000005c0)=@generic={&(0x7f0000000580)='./bus\x00', 0x0, 0x8}, 0x18) (async)
openat$vsock(0xffffffffffffff9c, &(0x7f0000000600), 0x2c0c2, 0x0) (async)
bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xf, 0x4, &(0x7f0000000440)=ANY=[@ANYRESHEX=r2], 0x0, 0x6, 0x21, &(0x7f0000000200)=""/33, 0x41000, 0x8, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r1, 0x1, &(0x7f00000002c0)=[0xffffffffffffffff], &(0x7f0000000340)=[{0x1, 0x8000001, 0x7, 0x2}], 0x10, 0xab}, 0x94) (async)
readlinkat(r2, &(0x7f0000000100)='./mnt\x00', 0x0, 0x0) (async)
ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xe) (async)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) (async)
write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000800)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0xe, 0x40, 0x1, 0x3, 0x3, 0x8, "9e8eef2c4b3d4fcef5c15b09ef3b"}}, 0x126) (async)
write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b) (async)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r3, 0x0) (async)
ioctl$BLKRAGET(r3, 0x1263, &(0x7f0000000080)) (async)
syz_emit_ethernet(0x5a, &(0x7f0000000000)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x24, 0x6, 0x0, @dev={0xfe, 0x80, '\x00', 0x20}, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, {[@generic={0xfe, 0x2}, @generic={0xfe, 0xe, "149674ca44bd880314dea5a1"}]}}}}}}}}, 0x0) (async)

9.369171111s ago: executing program 0 (id=1845):
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
add_key(&(0x7f0000000280)='rxrpc\x00', 0x0, &(0x7f0000000100)="01000000060000000000006bb55a2a630bf7c045f94cd977", 0x18, 0xffffffffffffffff)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x4, 0xfa0d, 0xfffffffb}, 0x0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
getsockopt$inet_mreqn(r2, 0x0, 0x53, 0x0, &(0x7f0000000000)=0x4)
mremap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f00005c0000/0x4000)=nil)
setxattr$security_capability(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180), &(0x7f0000000200)=@v2={0x2000000, [{0x6, 0x80000001}, {0x0, 0xff}]}, 0x14, 0x3)
r3 = socket(0x28, 0x1, 0x0)
r4 = syz_io_uring_setup(0x512, &(0x7f0000000280)={0x0, 0xc65d, 0x100, 0x8, 0x40}, &(0x7f0000000240)=<r5=>0x0, &(0x7f0000000040)=<r6=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4)
r7 = socket$inet_udp(0x2, 0x2, 0x0)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_route(0x10, 0x3, 0x0)
r9 = syz_io_uring_setup(0x239, &(0x7f00000003c0)={0x0, 0x0, 0x10100}, &(0x7f00000002c0), &(0x7f0000000280))
io_uring_register$IORING_REGISTER_PBUF_RING(r9, 0x16, 0xfffffffffffffffe, 0x1)
io_uring_enter(r9, 0xe08, 0xcb57, 0x20, 0x0, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000300)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x40048c5}, 0x4000)
sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x14, 0x3, 0x8, 0x101, 0x0, 0x0, {0x3}}, 0x14}}, 0x0)
socketpair(0x23, 0x1, 0xffffffff, &(0x7f0000000080)={<r10=>0xffffffffffffffff})
ioctl$sock_kcm_SIOCKCMCLONE(r10, 0x89e2, &(0x7f00000000c0)={r8})
unshare(0x24000400)
setsockopt$inet_MCAST_MSFILTER(r7, 0x11, 0x30, 0x0, 0x1a533)
syz_io_uring_submit(r5, r6, &(0x7f00000000c0)=@IORING_OP_RECVMSG={0xa, 0x0, 0x0, r3, 0x0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0, 0x2121, 0x0, {0x3}})
io_uring_enter(r4, 0x47f6, 0xb277, 0x0, 0x0, 0x0)
r11 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r11, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000000e14010028bd"], 0x20}, 0x1, 0x0, 0x0, 0x40010}, 0x0)

7.653312097s ago: executing program 2 (id=1852):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x161942, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$can_j1939(0x1d, 0x2, 0x7)
r2 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r2, 0x0, 0x0)
syz_open_procfs(0x0, 0x0)
bind$inet(r2, 0x0, 0x0)
r3 = dup(r2)
sendmsg$nl_route_sched(r3, 0x0, 0x0)
ioctl$TIOCGRS485(r3, 0x542e, 0x0)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', <r4=>0x0})
bind$can_j1939(r1, &(0x7f00000000c0)={0x1d, r4, 0x3, {0x0, 0xff}, 0xff}, 0x18)
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket$can_j1939(0x1d, 0x2, 0x7)
ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f00000000c0)={'vcan0\x00', <r7=>0x0})
bind$can_j1939(r6, &(0x7f0000000340)={0x1d, r7, 0x0, {0x1, 0xff, 0x4}, 0xfe}, 0x18)
setsockopt$sock_int(r6, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4)
sendmsg$inet(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000540)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081)
sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=@newtfilter={0x24, 0x11, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x74, r7, {0xfff1, 0x10}, {0xfff1, 0x9}, {0x2, 0x10}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x48040}, 0x20000050)
r8 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x30, 0x2, 0x3, 0x201, 0x0, 0x0, {0x5, 0x0, 0x3}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x25}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x7ff}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x1000004, 0x2}}]}, 0x30}, 0x1, 0x0, 0x0, 0x4058881}, 0x0)
r9 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60)
r10 = eventfd(0x0)
ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000280)={r10, 0x2, 0x2, r10})
dup2(r10, r9)

7.248513394s ago: executing program 1 (id=1853):
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0)
r3 = dup(r2)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000a, 0x13, r3, 0x2000)
r4 = dup(r3)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17)
write$binfmt_aout(r4, 0x0, 0xffffffdb)
ioctl$BTRFS_IOC_SPACE_INFO(r3, 0xc0109414, &(0x7f00000000c0)={0x0, 0x8})
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x400, 0x1)
r5 = openat$fuse(0xffffffffffffff9c, &(0x7f00000003c0), 0x42, 0x0)
r6 = syz_open_procfs(0xffffffffffffffff, 0x0)
mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
rename(&(0x7f0000000180)='./file0\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00')
r7 = socket$nl_route(0x10, 0x3, 0x0)
r8 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$NFT_MSG_GETRULE(r6, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000600)={0x1394, 0x7, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x2}, @NFTA_RULE_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_RULE_EXPRESSIONS={0x12cc, 0x4, 0x0, 0x1, [{0x40, 0x1, 0x0, 0x1, @lookup={{0xb}, @val={0x30, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_LOOKUP_SET_ID={0x8}, @NFTA_LOOKUP_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_LOOKUP_SET={0x9, 0x1, 'syz0\x00'}, @NFTA_LOOKUP_FLAGS={0x8, 0x5, 0x1, 0x0, 0x72d11f0068a583ef}]}}}, {0x10, 0x1, 0x0, 0x1, @meta={{0x9}, @void}}, {0x10, 0x1, 0x0, 0x1, @match={{0xa}, @void}}, {0xb0, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x9c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x88, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x84, 0x1, "a23fcad60612020f78cd0d9266727b6353222d4e88ad140d7cf9ebe4424a7a924622f09e7c6fd8a84cdf861f44f66aa5dc60b753b38c6392fa15f256e76aff3c19c18749821ed73e3c5aaede3351b3675f99d65832ab22f9055ec5e7de39d9b22aa6f058e3845ad233cc8bcacf815deade713cd81f43674431a1684ddcb3ffcf"}]}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_IMMEDIATE_DREG={0x8, 0x1, 0x1, 0x0, 0xa}]}}}, {0x1158, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x114c, 0x2, 0x0, 0x1, [@NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x5}, @NFTA_CMP_DATA={0x1140, 0x3, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0x1004, 0x1, "2c2e57e048412c7466a5dc9604c4aceded785fed23dba30663c5dd4c4188534314520cfee9ac7b54b8e261715354f816300bb53186495f7ced8478c23e768b0977d94098d19c92e2242abc7c9b12fcb6764e7a5c332a744f7e3626ac4ff4522c2dfc4203e89f0a9da11610ea37f3d39d86170e9225372389ac2e4fb55278a1aec58d432010e3d9a3719c4d31c78f56b855a9980abc87282b008a848a960618749c21a50a25c898d1223a395814b4146bffc0c7baa0caf0dbde7a3a3918e23a2543e4836b03b0ae62fb1428db1a757a7a7e2c2d3efc1e41828578c6c4d5707d36904798ae77794034b84354547f36d5026e01ead098edb40c662257f353e56bc7fd9be491d24ada3a5b20867f171ca2ae1ab2e2642cadcb2077bca3ad64ddf575ddda2757f1678df14c284c43d3fb8ac9ed9052a58b21c23439a053e54d8887c2ed57f764cccc1ffa1572a5c854dfbcd40f66c88ac3488245a9b7b388fa870c7b36188d4533393c775ef703343eb666cd8f801f6f51704c1eaa1e10fcce793d4e2fcc39ff31a2a6fc32f80dd6d4966f0c53a2edfb74c3703d356bb14088aefa56f56f6b1f533ea6ff6a3de53269c957cbdcfbba7c635874baca2799fe3ff3eeed1e2967b712834f4bae1146c503e864970f2255c04322f315a62db69128f629794a1eccdc6b93fe2617f41d6e57bb3a235145d722e4418f5473065c264a4c136650a83fbfc6aa30480feded4dd00ef8da44941950e77ae194275d899ef9d6033049373ca778f9cd60f2891f25eb0f1fa7bbf0c3be2d695bfb8ee1264026f412bab525b40e1f84e3260465c3c1ec385bc08fd37dd3459a5f054054ad91df2cf1e803674710cbefbde9ea854eb74ca675faf49605b021d640a03c3c4445bc92fa7a1f9c7e091ccdc405010c906450c78f6e59e5fec048901e9380abbb4c4c5fa0e7e5943bbe9706a69467f1e84c53856570a470cc9f4ac88e253691e93426bbf684c81effa31b6ef515d1da12d0f2139074052dbb8def360cfb79fdc6983da5962a24534366a31dc665b2f45e7d217faf7f23e228886494bfffb19b7eb4746f30d645f650fceb7c12b28fac5f71db5fb712271862df89b6860ec24a26062f0a333cbec8001d0096dcdda85038a4147351825d767638c5ba7c52d8b94ef5966845b0ee549f3a386e9d133ee236a676fcf681bb9ff64dfcd49149495b5816a65700585b7365501d20d4bb25c6d3c5ad82da0b9ae5cc73be971034a68d33b395421c53d51bedf718afc88dc8897f1741475be70b72410a2bde01fea654f2ddecd7897dc6514acb8d688b340626730f2c0834b04ead1efe071a4c4f4c1a7ae2d460009c8831b6ffd8863fec1c3ac528eb8d898504e78e5113688da034e1d6e0493062c0413f2cec2f95323ff487d49b2fadb1eacc114eb72a145afcd16334e62b1bd5a5ee8f027cc70a94293c96cde87dcc3a0cd2ff72b3545f37dcd928aa9f64c94dd63c8ed07563d801341f080f29ee94a2425f14884340f4ac830a5ee1619b3ded9ca12953e1cbc4e19346f527a5b0d08c97f5c676837cc8c3111a9b0880f28a624729fb5fbcf72c1ca03637a829259f3244ed75c34ccaffb4fc18af64cd9cb1b22443d78d446d8bf702bec5b31fc2b4e9d84498d91b6073aa566eefc9a60c5302110dbf81618f0e0505636915de164898185143258f65ed6dcb88b3b8533b1df1371795beeaeec40336d59ad2c7894a5bf4328ee2d7d619267c28607f82bae608a92283f0aa1ed86d8eadc44526a8d99ebba63fff757d4e29b3eab0d421fbcf94967e07d0e6bed0a9c2edb9b0876c918c7a16ba2e4c45552fcaba25cbf4a37351032bd1a28e224a7508b7ebf89cb2f53e5203f71cbfab70d47b32e6a14dce84bec796a37b2c6106595e7769db03e04bbc107fcab2b7768ac3922fc5a99b14e0a6d18d46c361008e7a52bd790ce3e0aa9c89608cdbe9737d3adfea5c3dd83358dcf00ced92c3e3a7dd5c4c51547841ed340f9bb90f53ffeaddcfbb0cba49880864d82ce3d31289fe87e838a4953fa202d5bdb0040d7d3520574e61bc80bc3616a1f48cb69442af3aa893925b7865d516298c1de3097c81fef8a9c3094e6709a69d30101f85fa879ea6ef05a878c1c916cd131b648e1b8820d613e3a0a132fe3157640df00b8ddd09822fd95ebf00292f7fe2449c06d7000a20f5dc689c84e76c2d15acccba07d385424c047f4eb7812cf956eab922b6f6afeba9e98dcc41cd14b57f9130e44c55deafc9030682d0fa7f6e8ad8e45ba640bb022bc2ab50071eb6f1aba082467ac20ab40029fcad27684fed78d100f917c1376b537a681871ad2d80d91830013ec174b25ae8fa852b6cd69a3c059531d2b88f2ae8ba2eb2f0b62e89d539ee9bdb17e07e23c5e2b16b19159f5a9ea3674fda4d0fa183412588c9044afeb90fc004aa51c18e850ae5a55b685a8e694f035e426336c143f7281417883a6c63aa2776077901b76e7629101cf37ee1c9ea3be56e31f515decf4e8415cb27dbd39dc51e2a8e253a7df87fb87a964aa9a8327f717a4bd50ae392b1fb1d1b6796770387f59b0340f690af2f26cf42615fa38ea49120f9016bad8402089d89d51bdadb64418f643d986d2fb4741b6cd05bbf91a5629a7e919979d7277da08e16ec92a8cb1977ea7df0e47233bc98ab300766cecf8cd0f2d46e26f5f1509bb952194a748f1c62363f223f7205cb66eb7f84d134f0adaf96f0e441894754b02b9d31df80c192d911eea1519631933b733f099feba61166db73ade86e7ec64cbfe72da0610567de549fcd1a90240532668eab8b94f83382e431aceac3e319fd3859677bfc13e6051fc0821297706a024b97d52673fe2761e548bcc329bfb11981cbabc49dfcc5e3f5192eb9740ef187ea89d8dfe01bfa3e81dc87f6fdb4b5ce1c8bd65f3c742fab22df67665bf7871247a7847a817f09f394ac0400de1638cc6c73727e28892b30c7e907142645cb1f6b9df18068f7ed61657720390f61b3a673d0de4bca1e836b1cae6bf739d851ad1f715b89987fcb2497df5a5881f71a29c5c0dcd421d6a211123fd9ee74ac727d94103dd36d2b85cb4de029b00bb4d2df1c6a11b5b580458c5e5ff4ebc35a41d41fb576153a27024edb3cb04ca29e50492c1fdf8be665691c1bdb9daa9596e7153a38b82e9a79c69e4aa819353201d233b33fa6dc8cd3baa8353f19a670ef50ef98745ffcadcfcb7630087bb1c58726988c21d1c4c14f1507df080d9f7595d9c6b9dc694f2bedd712f3969d6fdffcd8f6d2e942e89fe5c54c00106291dba3101e29aaf426629bb793e1e3225e8f700f0f4cb40b2fa2f78782f54b1b7a29ef332b4a4d3d5cba0ef75c25dcc7d663ab5a974746708f4586217b87a0f419b8c7dc4af11c7910cb3b99cf402791fda934f66d14b6e85e118d1bce658e700987a7c65d8b25636b78b2f69c137dec5df17d4afc53b0ea1837aebae908e64d586580d03eb07729a35a171bc41df8d8cb1340fad0eb0c471ee0549eeccccc2122805e37fb793485ae5a72355bf08a01929be631a16853822dbdb6dbfcde6de78c3bfd67bdb23811dbcc3a8251981a80a2eec49f7b8dc954e0be3fa8dd64d15a12e358c39ad895c0bc6ad3b6f17b8df17c1d3ce199aee67dcb5493cc2bb1c0b02d94e52f3f847e74d7e0d368a97dacfa2574f4a149789026f13a49a1d75364f6bacef9735aa722da7f2ec9596ccbb10f453ada08b4f7f612da587ff2ed7653963be5543344201f2551aa3fc5a3570e96f2ce6e96f8d5c87bb685fbe7bbaea78dedf530463d1599306ade1a81af7b698e4e20c07333d1fda38cf4a3e2be851a9113a2bd9cb5994430530f250f2061291f5db91826430f8ec3f4c1de82387389ef11a365ee1a414696e09eac7935cc2624a21a9a88fdbc5508a684fc83489bc979753f0e64c5b1a526ef58428229dd071ef3400ddd8427c4edc65c12c6e0b08c0543fc3099bf3003df8e07c18d841a151efcb033a1f0b9b821a622d3efd1cc1837871205521cd1661518441a3216d4cbf6e32f6618e27f2b5a01aa9b7b9de996536b14c5e43abdd78dd3c006bfd1dfcf16bb42f591007c78e79cce44d13975d95084da14a1c19161453ec72f91e58314c37538bd4a052d6307c5366f8cc5b3b9a07296de8dbfa3caeede513c8ec99fd0061c5e043f93f120c9d361669d76fb97e4b73e54ecbe800e595e9aec00089a4cf0f4befc54e3fb0ad376d931a096c05642d7259562175f889f8f305aadc35f048698469ad203d12aa5a76eba7bdec43d30ac49e0f8132220c080597b9996c687276af3890bb7769bbe5e9d132c8a0f2a5f8373104c8efb516748de77d7e4d989581984f70084cb7822c0e3a5ae5a503c389e5be82f1a243e667b19582fe05bceaad36e43a6ba6f5494d2cf20171084bc5831e09723cb1b9007273b2ced14b769394230b440710311b84c1368e324a239e1f913068f6a953c34516f84354cc666566ec0bcad4fa80e2c9ad1935b43a63442585a67fdcf83a13ae8989e190a72aedf156737280550c9bb2828f213e22e958bd515d15fe6b6cc9ff79cbbd268280add1f924608e3b493e8b2dd8cd9775c3088d649f1417503215b7eb59fd4f8a456491045bb8e38dfdb3e248b17165b6aecf27cc98dd7e79d029484c2ef6af748528c516dbd13c910c6acb5243b391eb1589bc9278f3ea4fca7efcd84ad338db42f88199c99545b1dbf45292661b04a6ec89bfc7e721142cb6158c16c5cdb7b8075de5239e3e5eb702ce5eb789da1caa9d443e9e1d20957609644ed15514af418a2af983ebe1b4b900957633a020d9da1bdac3672c9737074e3a0bf0da1edfe39c035912db5f64822b7e357255e560264feed687312d87eb6bd2671b403aa300f9c1771be734a7cfadea3e484143c02a0c619f3da4b71e5ddde9d7b2fe7c3f3b24451cdcba7d1db5e9d686e3b6df44842798eb83334079944fad1b0e26e715d8b1fa5c09493f76ed90ae691ed426487b244c8dfefd27b3102ceba90601ae0b62c710950800821c90867d5f6ea6066658e2d0acaa5597b94d8692446a22544d46ba24d59c57b733aaed01dc8fe2543f3e3f606adaffeb1b3e4bc4f7584d3240f4ff561e2965176e36c7009c67be83b9fb8b122283331f6070b31ad3e6711346752d03f3773ec8a80f31ef5e20041db591f782522a98a4c179cf75235db11e7e627f9d6312d734d3ee997a48464bbfb3e3a715f91795ccf1b878832fdb0553eb1d00ed25bac19cd48d34b8ff592cc142eec67cdf808e23e660c0105de117128f36bda0849a71abd75f7952ab1e4120c652c933d64d35a11671893efd8f371b9bbae98e74f74e183b0a87194a3433eb21892cd77002891637b1013f37f30064cd73692592f1717d8ccfabef7e28274fc0f4bb7461e22e0eed896a85f71b1bdc98e706c4d9c10ae3d3028c11c01d37c9ca004f378964b07f1775c094ed368d31ee7492c074c693d37918f23e0da8d9a2f8ffc41712b706e3913e501f4cbb6e5df84f144038fe647fb07ceb7e6d17aa030e5bfed9a66c6b1918727e2eb798f33cf8f88a891c1bcfee669d7e12078968b5c55afc3f655a33fb6199f415810e140367cb319c498745f4740476c74ab9a511fe88614f8b42eb6712ddf1738a546dcc12cd09b000cb7242dcf6f63653fe11e0fcab018107b121a8b325998553852d111462662256b1acaa3341ffceb153649731eb99c015b624d603a6dcee349a6ee6ec1b4aa3f3673720d5d59b3f8"}, @NFTA_DATA_VALUE={0xa1, 0x1, "4f85347b88fdb6aa983926ca4567af539d8512c6f4bc4d76fe169adfa6050b08fe2481d11848822af971fe7045d928c0aab40c2a4376ca81429b3c15cd5ad12c120cf71fe56e396049b341f46e505b000592f2339137417abaf7df2b1d4b6eb2fc0fa9e861dbd471f2fe89f7be749b870c4760e23aec405745abea9fd227b3868f5640c06eb2ca252657a54cbb9bab4a11a58ca619222389a808d3f81d"}, @NFTA_DATA_VERDICT={0x34, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}]}]}}}, {0x18, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}]}}}, {0x48, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_SREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_BYTEORDER_SIZE={0x8, 0x5, 0x1, 0x0, 0x54}, @NFTA_BYTEORDER_OP={0x8}, @NFTA_BYTEORDER_SIZE={0x8, 0x5, 0x1, 0x0, 0xda}, @NFTA_BYTEORDER_SREG={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_BYTEORDER_OP={0x8, 0x3, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x5c, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @range={{0xa}, @void}}, {0x20, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0xb}]}}}, {0x28, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz2\x00'}]}}}]}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x3}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x4}]}, 0x1394}, 0x1, 0x0, 0x0, 0x4000}, 0x4011)
r9 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000000c0)={'bridge0\x00', <r10=>0x0})
syz_emit_ethernet(0x4a, &(0x7f00000004c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd308", 0x14, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x42}}}}}}}, 0x0)
sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@bridge_delvlan={0x24, 0x70, 0x1, 0x0, 0x0, {0x7, 0x0, 0x0, r10}, [@BRIDGE_VLANDB_ENTRY={0xc, 0x1, 0x0, 0x1, @BRIDGE_VLANDB_ENTRY_INFO={0x8, 0x1, {0x42, 0x2}}}]}, 0x24}}, 0x0)
sendmsg$nl_route(r7, 0x0, 0x0)
r11 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r11, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x3, {0x2}}, 0x10)
pwritev2(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x7000, 0x0, 0x3)

7.210234783s ago: executing program 2 (id=1854):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='nv', 0x2)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x0, @loopback}, 0x1c)
connect$inet6(r0, 0x0, 0x0)
sendmmsg$inet6(r0, 0x0, 0x0, 0x10)

7.04317098s ago: executing program 2 (id=1855):
sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)=[{0x0}, {0x0}], 0x2}}], 0x1, 0x0)
sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000010c0)=ANY=[@ANYBLOB="e0010000000000002900000004000000043800000000000007100000000102099f000800000000000000fe72f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4f01be8f5836d417874540898619050b14420ab124b11de36afb16ef4fc1cf3f4e4fa0e647cd1b07b068d3894180b6aa7527a4a8252f6836a0d67a7782c675a838ea989e567e4774de1f52d188e0b0888c5070800000001007a018000010005020bf49328e80ee304ecb742ec46556f5e38785bb58341044cb1533c38d0a64a03f726b4d38b8e3e756883484af16dfc7e050455898d747efeed14450c7d92e1230d6f60e45dd6d85e0d8ca8d7658305a5ee0c1525a9995718d3c04072bfd81df99b0baba6a4670ef019f53f62effb8e73e08da75862de6a08938e3ecc0dc061a7d7e93f824fb75daa513a65d675742eef2ca970c1ebf27f24b7103a72e5a6a547990e86cdb59a00ccb4b4b444b11294b7db73ea45e998710e650d7660ea4f57fede8d6f70bdb4c4b3886a83c5119df03d6dcc5669f19960cb2e4de453e37f92306dec13e9de54017881a6e8490569d77d83b704cfa54fde1c982473f9b4001994fd60f6692b6e7ac84e00ed6594fd9022bec78ff59bd02e5928dc33708aa26ed7d95a9528d7cb71785801512c00000000000000140000000000000029000000340000000000000000000000f80000000000000029000000360000005e1c000000000000000100000100c204000000070730000000030a00ff0f02000000000000006609000000000000f7ffffffffffffff0100000000000000010000000000000007100000000002070600ff7f00000000000008770d7c9d342d653967c93d583e9eb625de61ada482164947c057258abcf1f8b91edf0300148a971f5500fc1ea49f961d98d881f02e0b5fc18cf2de33df1a81925fc3f9090bab00000000000000fb990834994dac107c44a3964fb9c9155241f3bcb8caca3539185ae3b88ff475bdc34f6f48b655e0d8914007100000000302030700008000000000000001032bdb862000000000000000290000003700000073000000000000000001000000000000140000000000000029000000340000000300000000000000148814548a187d8d22de80"], 0x328}}], 0x1, 0x810)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x3a)
r2 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6)
r3 = accept4(r2, 0x0, 0x0, 0x800)
sendmmsg$alg(r3, &(0x7f0000000040), 0x0, 0x40800)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil})
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000eafa7240936901b0293df400100109021b000124a80080090400000103000000090503"], 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000000)={'veth0_to_team\x00', 0x400})
socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r5, &(0x7f0000000140), 0x0, 0x10002, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sendmsg(r6, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x80)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x4, 0x8001, 0x0, 0xb49, 0x200000000002, 0x7, 0x8}, 0x0)
r7 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r7, 0xc0285700, &(0x7f0000000b00)={0x409, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", <r8=>0xffffffffffffffff})
ioctl$SYNC_IOC_FILE_INFO(r8, 0xc0383e04, &(0x7f0000000140)={""/32, 0x0, 0x0, 0xa, 0x0, &(0x7f0000000b40)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}]})
r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
socket(0x400000000010, 0x3, 0x0)
r10 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})

7.041513188s ago: executing program 0 (id=1856):
bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="220000000400000010010009008dfe67c1847a4204c273ca47a112ae7f85da2214bd8dd46fa3cde3dfe128c08bb42ad23e5fc03d672a19725075242dbeb0f6ac"], 0x48)

6.733454763s ago: executing program 0 (id=1857):
madvise(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x16)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040))
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x1ff, 0x1501)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x80, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0})
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r1, &(0x7f0000000240), 0x0, 0x0)
recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x60, 0x0, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
syz_usb_connect(0x0, 0x0, 0x0, 0x0)
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0x3})
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000007b6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc23982876"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340), 0x10}, 0x94)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'bridge0\x00', <r4=>0x0})
r5 = socket(0x10, 0x80002, 0x0)
connect$inet6(r5, 0x0, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a00000000000000", @ANYRES32=r4, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0)

4.943531519s ago: executing program 3 (id=1863):
r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00')
lseek(r0, 0x100000e00000, 0x1)
statx(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x800, 0x80, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
getgroups(0x3, &(0x7f00000001c0)=[0xffffffffffffffff, <r2=>0xee00, 0xffffffffffffffff])
mount$fuseblk(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', &(0x7f0000000140), 0x3020000, &(0x7f00000003c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@allow_other}, {@default_permissions}], [{@subj_user}, {@fsuuid={'fsuuid', 0x3d, {[0x39, 0x36, 0x63, 0x65, 0x30, 0x33, 0x66, 0x37], 0x2d, [0x34, 0x30, 0x36, 0x38], 0x2d, [0x65, 0x34, 0x39, 0x32], 0x2d, [0x37, 0x64, 0x33, 0x31], 0x2d, [0x55, 0x64, 0x39, 0x37, 0x35, 0x30, 0x3c, 0x64]}}}, {@fscontext={'fscontext', 0x3d, 'unconfined_u'}}, {@appraise}, {@appraise_type}]}})
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="500000001000010029bd81000000000000000000", @ANYRES32=0x0, @ANYBLOB="802100000000000014000300776c616e300000000000000000000000080004000e04000014001680100001800c00090080000080"], 0x50}}, 0x0)

4.781332741s ago: executing program 3 (id=1864):
r0 = socket$inet6(0xa, 0x2, 0x0)
getsockopt$MRT6(r0, 0x29, 0xd0, &(0x7f0000000340), &(0x7f0000000100)=0x4)
sendto$inet6(r0, 0x0, 0x36, 0x4084004, &(0x7f0000000500)={0xa, 0x4e24, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x88, 0x1, &(0x7f0000000080)=0xfffffff2, 0x4)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000), &(0x7f0000000080)=0x4)
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
connect$can_bcm(0xffffffffffffffff, &(0x7f0000000480), 0x10)
sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x4040)
sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
landlock_create_ruleset(0x0, 0x0, 0x0)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = syz_io_uring_setup(0x1238, &(0x7f0000000380)={0x0, 0x880fd, 0x80, 0x3, 0x356}, &(0x7f0000000040)=<r4=>0x0, &(0x7f0000000200)=<r5=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffff4, 0x0, 0x4)
prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f0000000280)={0x1, &(0x7f0000000300)=[{0x200000000006, 0x1, 0x6, 0x7ffc1ff6}]})
r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x400000011bc82, 0x0)
dup(r6)
read(r6, 0x0, 0x0)
syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r2, 0x80, &(0x7f0000000080)=@l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x16}, 0x1}})
io_uring_enter(r3, 0x3532, 0x32c9, 0x45, 0x0, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x10031, 0xffffffffffffffff, 0x65be1000)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0)

4.384974713s ago: executing program 4 (id=1866):
r0 = socket(0x10, 0x2, 0x0)
write(r0, &(0x7f00000000c0)="24a600001e005f0214fffffffffffff8070000001d00000000000000080009000d000000", 0x24)

4.141645367s ago: executing program 4 (id=1867):
r0 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff)
r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
mkdirat$cgroup(r4, &(0x7f0000000080)='syz0\x00', 0x1ff)
r5 = openat$cgroup(r4, &(0x7f0000000280)='syz0\x00', 0x200002, 0x0)
r6 = openat$cgroup_type(r5, &(0x7f0000000040), 0x2, 0x0)
write$cgroup_type(r6, &(0x7f00000000c0), 0x9)
r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002})
r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0)
ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
dup3(r8, r7, 0x0)
ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x400c6314, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0})
sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r3, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0)
r9 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
ioctl$vim2m_VIDIOC_S_CTRL(r9, 0xc008561c, &(0x7f0000000100)={0xf0f014, 0x6})
r10 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r10, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=ANY=[@ANYBLOB="200000001000030400000000fcffffff00000000", @ANYRES32=r3, @ANYBLOB="44679df400000000"], 0x20}}, 0x0)
r11 = socket(0x1, 0x803, 0x0)
getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, <r12=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14)
sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000b05a44000013000062726964a7ae7951da1defdbc1730000", @ANYRES32=r12, @ANYBLOB], 0x3c}}, 0x0)
r13 = fsmount(r0, 0x0, 0x0)
syz_clone3(&(0x7f0000000340)={0x200000000, 0x0, 0x0, 0x0, {0x3a}, 0x0, 0x0, 0x0, 0x0, 0x0, {r13}}, 0x58)
io_uring_setup(0x21dd, &(0x7f00000001c0)={0x0, 0x1fffff, 0x1000, 0x2, 0x26a, 0x0, r13})
sendmmsg$inet(r1, &(0x7f0000002080)=[{{&(0x7f0000000080)={0x2, 0x4e22, @local}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000400)="0a32d0e01fd7402302ea53adce10042ebf8c69153fa0de27f18b090c4d3382970c368fe9157c95ad64fc54a2b68166fbec7d7b83fc569c7de45f0d844f16827155a54f09b12a7cfec03c510b7235442549d4a547727a627628f1b75509fa14c034", 0x61}, {&(0x7f0000000980)="5e751bfc004aee229b72de69dae6172d7fc949938127cec549c24ba40ba29a45de16c7816ba4a8a4d0ed9aa6818891b5374fabb4bfb10e77f352f2b0f70eb96f37f70dd13c1f6edfaf63666d4b079d259fb199cb5ca7ffd51e3feb2feb3a434bb21107cd6483c6a595027cdbb08eaf8345658633a02fec5e8692315d99cf9c27436671a6fb5b3e38a0f24e5c51fa0385f1b75a009c6e117c88f1e1e7422e36abd61ab7672cc7c473fa3ec5c5d6463e2032875085aa3d8cd9470fa52c0999b11a15376422efffcbfd47e08e87f645e53275e42e9e42a92f4db40c92cfc63c2ddc187118dc76bbe5faa382d4f83cdac7fba062e89d4d8de200fd4b9effe1dbc8514051abb02999b4a03722be833fac4b09a0ff1aa8b1e88cdae227884dc92d45e3c5f8deb1a57a9252994510d05d0e7631a268eb18e6fecb21e360f372f75c43700c3696ab8f6aeb51af3d7b435a7a8af1208539915c32cd4af1b51911554ee9c3df0ee99347f9f27f92fdaee1cef7fdd38604e60013d6d01a8ce065452751f909b6f1555f85581cfd9a8e6db08ba639d594d8093e527554ef08b26b888a55774f9d1bcf66832a676034909df8c18520aaf1def13dc6e11b8b0898efe40e5560f6aa187b2c65c8fad6033737eff75a07f10e06598f4afdc3e6acca67d4e321cc748453a7546f70e02d171b4ca6b177009795cad4fde3ea1579d68fe4df2b0cbae6d3e086eb88a13bb01002795d8b4bf108f21e789c3c32a501d4bab9cabacf96608636ad7fa4058b435c492374cb45b142396175c310b2ffe1691bb76575ad17285b1f66ac54370a3e5727853d479da4b5ea6fadbf9c47c0f44bc3fdaf177fe5e9673c813adb4a5468bcd01ff4f86c7b688d28a16bba15be3c42dea2b984683cdbea4d8652a4bb7aa1072687e6ceb806315862a6141094d00f508d3f64be451570cca1aa465dc05403536f20b78f287b170136e62b0e83ff869f1fc0893304d0d2bbf8ab56c08c86b18d85739f73bed8a65c314c1c5b522680683494d0be94814a577fad54ea893663d9fb27b8cfe6a6bd2bdf5344c381ec691ef9028ed4e722d7b24c3100c5a75e0fb79c54ba25692ded6e23653029147a82c0b52f82f73d6607405741689c0730ede16242b0109f010c45b4d4ef28d4533f4fef19e9b1f922cab4513eec7ff6ada3643d14f33f3ca9b88b44bdb43937380889f526671910efe4069520d75851e7f8160a473d5c638885e881e5332368253790441de9213d4f41606cda47e64d67578152ae00c8fa9adf44d5666d5170dd5e01fb997e4312291368ef0e357ffbe5804dcbd19adf493636f6063206782a0b46b86c80750579ec5a25ebc92d25000392844e008e8030d857d7a1f8bf2d91a61291f2ca9bf16dc78f97b190d175774fc10fd5e52077f769152260bd00c93e783f164483b20e463643d8fa46d76e2be121fabcf2c314f49114b5a48af8e1e03267a7a681630f8660d706ea50cbf823ea7eb9f7a426ddfe2e740e99e68c6660eedcb8493725d1dc13855fed09435f08026b5b9c95ca61b191b794884f21d6946f8433491d3ffffa237c99112f455574e7480b0253b1b30a19e1037f325c09fd53bcb2d0d5010cf3c40ebc95008938aeab8280b3b9e82ed38089a2d62febfae62fd07338b823addf23f6feab81baa55bae34868738e11ce7c7138216afab7d3ff031434b7be819c4339e7378410d51cd93c716d86078e281e17983c7568443e33c4570270885f7bd0cc3a45ef49d7aa833ae3919d99953f79e20f13ec6a1664587a04e4e3aa3658d6836b6cca61ac11e41cbae36fc12db895e377abf26545b6eb28140ba4525c8e5c74d0d61fb4b846892c0ec1b46f422e82cbc095207ab1d1fa353b24ec763ba5e4885f3bbeed0159cc3c7d8df01070c789a3e65b332ccc54c7120645d2a6ab284884304c58814c835a32721870342a92ce792a0ff42585ad0f6a7fe3a854bee1911593845e8ce6439eb351ff480e6a10dff0ac39085285e8beefb719a9d6be1509d34dae0c3afe1a789930e882cf7605698ae3abb5fbaf1dd64382aacef52f10ccccea9a2ed07fc6437073c8b88d84ca14a1c1f58ab64757705240c34c182b631c242e55d0e3dd1ab3bbe981e28d080919c50980acb450d580735aad3971cab7c0b0610ff74459d4bc5d56c1fe819ed9cc35f3de9d31f45cc65fa382eab018cc7e4832243ed4b545e0137cf4149c656a13c9fef062029dd2b7b24b3b6b63761e977c46e9a247c236de1b328976e3e5a24746be6b0bbb80f8edbda0c5b920f4e42bb7339ab8ba1f8a76d6bdd56213f5f44983ee78fbe6af5fb9c4bcea2eb13c90a04ed7cf0ca3b7c454eb09fa36162491d8e20f21fd14e2e5216a37e561a52c3b4935ff7cdd4e53060f649970764fe1c720831bc2a029943512cbcdc2cc82bf283d331bf6a01b42fd9256f3a7e5ea25d0aeed04edbfff6054f20ead7128d94cb11b006b220e1e41321f985d7c61cef5536ba651915480823007caff65042d5b0a3879afc1ac571a1bb8d8dbde3b4b40473908d1dbfabf1858d7d0920e70801de203a36d77ef625edd8947bd299a78e826d40674b79c8302f91a3725ed7c640836264e1fde3a39bd210dab43d8c500a2f000a6902343b8ac2aa0d2f02633bd3ccc35a2b388dcb7dd6515a8910086e6d99ac7a36335f00e60faa28ae26237cea242691a59fe3da42d287bc886714960dfbf5c70e40849ce85a209800fe66061cc192a281dbe1f0e7eaf21aee83805d26ca5df3f8132a9a9931a2815ba7c2711683a5b60df7443ecbcee7784d44e06f7158d915743101c35c85268124aac0c94dbc6f64261536aa6430f0843fdf58f92ea2ca1b749737484070021c6b1f7531fe40f26b9545dcc42ab0ad938b372348a22c4851c2565bd5b74e05f4b739ac35a5c0d14139300ac6a755bc94ba95a8bf55a3293c5a8e83e36c9cf2fda1af941c5ebf45b025c459b799db6b4f3b9086a746d21fb3fdebc929b0f3d9468487d5a9fb873a061a69767ad9d6887f7a4fea7c296f8f2297140cac11493b4b93b8bc09fa357d309d7a20ab554411e1f8ef6fe9d38b60c581abbf0cb76e4eab6f3f1d4cf8f772b935a96400bf553bd3c1986da5614035fd88329799ff75c5cc26491590ac6986d12da49ecb92419f0e5fb2c901d15b1be39e9cb5af33c66b3247ef30f3387c5dc79265fb3c3fa1d3d720c70b22126a4a8f5646e685d8b646930396f9abbce3352a13416b1c79a1674cb47284744e71492427c04876077bdd6970b7ff4e3a25007a112d5810049074742f36984f92b0aea190143001cbf776a66ccd223d8b665430ee7a7068f78d9578d567cc8472947aaac93b0d62da99571b468cd35c58ea5abaaf17b13aca6c806603683c89ad6f17c823d91467ff6654919f6158ec5b4aaac6fa160a319ae9deb71e2c5f4a8c6875e47b174250dbe6e88340d0b6b06d35f041c3654f5adec84803e8fb8f277bf802dcbc6ae5efc269636bd524d44172249b603615fe147050d04fdd2eb8832958e3bc048da485db3c6a4d35822eb426f7edc0828176f882bb83f3995c863eef2e436c071601e497603ad4d687ce27e3a50ccb6a3736ce70cbd0351683f420751ad62e3d3ddb054e1c22c2f376e49bf7f328561b6cfe1345eff32aae502671a7133b74ab12f0b4952b11981eefffe50b0114d5b6c7bf9431bc7cb686c5c650df5581c8c726c3b1d8f9aa00984a99cbc465ff10efa6ff3713872de25269d47589a03b1d110bec6888cf6038a0af9de24a7eb150f82ea0bbbdbcfb0e274821ad90848604557efa77cd8de67f67b249bd0ad1189ba9d5cedb2c47352414c777fc838de9ed2d8c8eff4db80ecd8abea58baeb5ff1c4532e4bec54ae9ddbbc0a1fdb10247337542c20f5eac9c63079a38b2b8a78881362438f9c9ec1e623ca46c013f87bd6e6c428e2e66d066f232b7a87e3562e878156c17c03ad333fb6d432d2f6819a395fe02d135443597f77f2c14a089fceb04d2db086d46ee2b8274bd78b5f612d7c6f2d01b32dab0213a1adf445fed05dbcddaa74f3056690232602a12125056916b1c9d4c974b784f7f4d7f7082341580950932433d523f465e731cbfe73d0e8927d0381c07b2f0f19e9a52b80f9b891b4c4a691cf1f9fc44906f39ff3092f9204165292f6cb3346368dc4986ad14e5b4757fc6e6f1046305bce73336bb52857ce2d7b638a87584627cb0e723cfe7dd479904dfc6586cce1f1135c74752fac67d23f65999e4251adc893f13adfc475bc8414980735df93c63ba9066e5c51b2e8c0398787514e0b26f5f32f355da372fc980d4bb9c6df6afd34feec2df2477373ea4e2fb5cd92a9d3e092041849f54037ad9abfc1741861485752537af3ef86db8f0917760e4aab03b6004a3719eade3d35a4869c89ded5da3bb96a11d338d3171e3e4db8ce691903ed8b92e52f6b85d21fca3526cbc631cad660341a0e69d0b43bdd3e538915a74013ad458b8b6db6564a493cf4b61f6a61ba0eec0c46022d7fec75f3b1eb11d0a95627f6f1f0a32a7cfd60824bd60282febe92da29a660396ad7b9c4277beebaf649d0680fefb2052956b88d6ed4b30a267b5e6855dac7022fb59a5f1474e28cd06c0c1d3a992d1ab177651971557a0202903d261c13d80ce601ec043f741eae0bccb6cda24f09634c935d96654a25b16d78326aaefd867211df70d62bbea26057d5e0d934e8eda765483d6c7b92123147bfacac13e36a19b37ef1b6e0c76ee22788c105dea67e581eeef15c9712ad0c913780571a5b1266b52409cd6972f6e544fd6733f20539575a9874ffb9cc6b9c48bab1ce65eba0f5bf220fe7488b0f2fb132d9217e22ae2880f1599dc527e8085f776f74d0daec9b32c5775af01251218e1367f321fb265fea5d86eae6c741b1f3df58d91816f60c313eb7455bc08d978af38699d25ce7b832bb7aedf80c9fe310dd8bac5683b09a97966a4a4dea03c224001079e94f8368b6f45c3c1e2404b6c5d76f9c0033c8bf1ed7d9f8003c88b0388054d580ed6223543dfe4a635fca4f09ca3fea39576751216a1eb110fc926be92876b497ad6b6afbb21d6d3bb28b84516b22555e64854589a4bdc70acde3b009dba0d77be85916add80708fcc05b252dc09f3f5220696718486688bde51dd3f28466b5a4cdde1efec26fc39448ede42a43e995263978bd3198c82abd5c663f8ceaceca186b2be8a349e1d16b60fc5777038644156db989b78a08df9c0fd2fbbe6fc1a69ecbb929d0e74c03e4def82b6d478d89d66ade3d6e189b4fb95fd0459f8f624df873acc82bfb63ee011202586dfb37a0984c2d9be40fe9ce771da3e006be230727c44a16e4e0d36ef06d54658c32fc2ccfeb7cf3553cf81e173ff4be1cfdde518cb36e35bc8f6a25de12cf876ecb6a7e7be116cd0b1e0225b6520ab088ea224fd9eb6c90b7e9f77d95c406c8e73780dc8f6ebf9b10860131e22e3f6bf05d885cee8b7f46cceebe3f1c84cff65036f1ccfb53e53f1889ec467d0b6e56f1d49e318e6b93a60a75dedbd2d3967b4c34ef05b33b3fffee6f989b7246a935ba0b2d1e7e13d0ee057f0543bcdf8dbdef2986d2bd7274ef57a500d298ca4313d0481964fa93b5c868b8e6afe2490c64234eb6dbf1a1226e5deab4b586dbb43d28c47b7f8f0fc228d5d308550c14fc2900514dd82999795bfa3be2bc690041b38b371cb5c33664be8d4d9dbef66f1603576632f3e2146f8cdc5c3bc371418ed278f4262e27e63b5750ec27e", 0x1000}], 0x2, &(0x7f0000000280)}}, {{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000480)="882cf9f7463c4b5f66baa5a7af5554cdb63994988860bfa2256352b8e148688d39a8604372224456799962ad8f7b17a1c12d7769f7cb21f65f6e505335ff99890a74a8e2e96e6ce7b95350886a51c72aa5d87497d06c44f96474a681121bed788f5bcc500193", 0x66}, {&(0x7f0000000500)="54f7fa3c2e976b32e962ba20bccc44e0dcb0aa0ec608b8303595a82b3360001a09f97899000f2cb169922c76eadfd92e3ff60e46f876b9553fade10df319484f01d0ee89a046b99dfb01120bdae490e74cfee81026991b907bd03c1ae0dc5a172448903cf2b664355821c95dc0d5e2d5557c8b7118b32138cb02c48861d39bed95ad463191cc1c", 0x87}, {&(0x7f00000005c0)="064186010a2797cec19f67e0c98f623a96fec2bd13ec5ae8187ffb3bf6a154afb9ae841d5c7f8b41845a295fd88f8ff7d5972547317d6464bd9b11bbe5d2da17ae50a8124a2bc0f125dd514715599162ca3879ac94f6aa4f20311a1864bfeecf71d88bcb4e13b1ca3c3e1238863c12a82577f3c8aa1a0f7d342436198c2f58674bef786ccb3cf3e26b7349f68e562c9b6b1a33daef28d69cb5839495f06f25a264940f25284d1a6efde8b5d0c46b045a1aca3a52af8f13ae135829105d738f9f543ffbb14682b6b6933d79fb796d9cfae80c949209fa7ba89f9ae20e7b599f5b272c6e1b", 0xe4}, {&(0x7f00000006c0)="033b28aa1e8d8b844d9b196be961860793800d08685d5c95528d52f25ff82bb3d8e1329f51e62e2099c2b28ddf6fc66b6a5b09575fd0c5b2ef98c783137e63aeeaee2c5d7ed58d36135278da4bae619ac4f5f62586933fdb78ccaf7215ad23de99db20cb4fdd2ccaa8dc720de0276319e780683f33c6790e06718cb66702231533267c9f81a091b9e615ad23ea3209b9597a9292dfeebfd1ab31853795ee0e6cc85e7d8dc452348f9bda6e33cfe6659fa172e68aebb7bbcd9593373c2a395d7929d2b51c1da06418078bd301f6de7c9da2d84eafe0769ddf9c2b870f34b6233695c12f45a29fb93fe0a0e7aef8389b7ab1f2", 0xf2}, {&(0x7f0000001980)}], 0x5, &(0x7f0000001a80)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0xa5}}, @ip_ttl={{0x14, 0x0, 0x2, 0x4}}, @ip_tos_u8={{0x11}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @remote, @dev={0xac, 0x14, 0x14, 0x15}}}}, @ip_retopts={{0x5c, 0x0, 0x7, {[@generic={0x82, 0x3, 'N'}, @ssrr={0x89, 0x1f, 0xb1, [@rand_addr=0x64010100, @multicast2, @multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x39}, @loopback]}, @rr={0x7, 0x27, 0x36, [@remote, @loopback, @loopback, @dev={0xac, 0x14, 0x14, 0x2e}, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @dev={0xac, 0x14, 0x14, 0xf}, @local]}]}}}], 0xc8}}, {{&(0x7f0000000800)={0x2, 0x4, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000900)=[{&(0x7f0000001b80)="7a39b61bb1576abdd316692bd2837743e3dd72288de4de4719cd75184c6d8847c82e0246fa5a10a18d23590892ea6ee679e103824133da2a85aa4af68355b46b7a8cf1ec4d4b2fbf169f60d528b1f962a8e1138ed72dbdf7f51a534f8f248474e6f43618d315fa6e6d12967549370201d159c3eac16d73cb76f5ed33778a4cb43ec8bb8f00e847bc9c066193fa", 0x8d}], 0x1, &(0x7f0000001c40)=[@ip_tos_int={{0x14, 0x0, 0x1, 0xeeab}}], 0x18}}, {{&(0x7f0000001c80)={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000001e80)=[{&(0x7f0000001cc0)="f7226bde26dd8d5e325af3fb970334829a20707dbf8c338fcb0ac111c1b3a6289a752edd4664546b4d3717a252b5c0ab5697e2f7bd1813a185c2671ac990f8cecfbad72f17a7e7ca027d884523a0a7cd676beb3fd112211550c03e71d6b7ff35a3aecb12515d2f3c7435597d33d0c4acb5469dd06f1a940a9fa1c6a40f87503865636321c41266716bda426dda3ed256bbd2587aa5382b077cbe29", 0x9b}, {&(0x7f0000001d80)="21e9e3eceaf7b1d8c26dbd5c17b7ba371609a8af31bf8c25106a6613ee15bf75c6ba1dcef953c36d4fc8430064ccf6ce90916252080ae402836a8fa4019e655fdf3af4ad9476cd57b5c8903be5f37021ba52c9519f7f7d7b82e3e135984bb3fa4f6cba3ea0be9f577f999ed215cd41e246452b2bac4bf5c52d97ef7a34d4e61f38510be025859c0f4682556d757b090a857820bb00fef79bdf8997cb1c3bde0c19fb0656d354463ddf16e908221165c4240332220eb3c6975ea41b24c6db982f9ee8a1b9a3673daabaf541a051ad745f983583e00d816e840feca224c6", 0xdd}], 0x2}}, {{0x0, 0x0, &(0x7f0000001fc0)=[{&(0x7f0000001ec0)="5fdc0a9ebaac4c0305b4029fa51cc70d207e9a5860978f12c2aa3ed9af1f8f361e7257a2e76e30141b5df5c6e3c53e95bcdbeb3e53fc24d80e6e22780b2d73d482b536cf09eedc8fa1d3f3078f942f351a67dc0a357dcb8afabfdd975cb4ea6ae4f379ca7b646e11e5357990e48a85eb30ea2b39d142ba7d883023303859b39f7a5078e02364f76f0dc609abef69c009cdc4", 0x92}, {&(0x7f0000001f80)="74cfb7a52bc8b05058dba174e34ef697865bda3ba248b1952e3f3f57b0d1504e0e3de56e5ec3c6a68bd9b3b5fa02e0d6be5d64bbe9ea057d3803f6e846", 0x3d}], 0x2, &(0x7f0000002000)=[@ip_retopts={{0x34, 0x0, 0x7, {[@ssrr={0x89, 0x23, 0x95, [@private=0xa010100, @multicast1, @broadcast, @multicast1, @empty, @local, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x30}]}, @end]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x40}}], 0x50}}], 0x5, 0x800)

4.139618031s ago: executing program 1 (id=1868):
r0 = syz_io_uring_setup(0x18d7, &(0x7f0000000040)={0x0, 0x0, 0x2, 0x0, 0x25b}, &(0x7f0000ffe000), &(0x7f0000ffe000))
io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r0, 0x2, &(0x7f0000000180), 0x100000)
r1 = socket$netlink(0x10, 0x3, 0x0)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40)
r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0)
r3 = eventfd(0xffffffff)
ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3)
ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3})
ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74})
ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680))
ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1)
sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=@newlink={0x40, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00, 0x0, 0x157f}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @batadv={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x40}}, 0x20000840)

3.952941125s ago: executing program 2 (id=1869):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)={0x3c, r2, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x7}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x8}, @ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000800}, 0x0)
r3 = socket(0x2b, 0x1, 0x0)
setsockopt(r3, 0x1, 0x7, &(0x7f0000001180)="e57ad09c", 0x4)
getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000000c0)={0x8, 0x1, 0x9, 0xff, <r4=>0x0}, &(0x7f0000000100)=0x10)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={r4, 0x94, &(0x7f0000000280)=[@in6={0xa, 0x4e21, 0x6, @empty, 0x6}, @in={0x2, 0x4e24, @empty}, @in6={0xa, 0x4e20, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x400}, @in6={0xa, 0x4e21, 0x9, @dev={0xfe, 0x80, '\x00', 0xa}}, @in={0x2, 0x4e23, @loopback}, @in={0x2, 0x4e23, @multicast2}, @in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x25}}]}, &(0x7f0000000340)=0x10)
r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r6 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000380)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x2c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x4044050}, 0x40)
ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0)
getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240))
bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28)
ioctl$KVM_CAP_X86_USER_SPACE_MSR(r5, 0x4068aea3, &(0x7f0000000180)={0xbc, 0x0, 0x1})
ioctl$KVM_RUN(r7, 0xae80, 0x0)
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5})
r8 = socket$igmp6(0xa, 0x3, 0x2)
setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528)
syz_emit_ethernet(0x4a, &(0x7f0000000000)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0x10, 0x7, 0x0, 0x3}}}}}}}, 0x0)
syz_emit_ethernet(0x4e, &(0x7f0000000080)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, "9e00", 0x18, 0x6, 0xfde3996dcd16970f, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x6, 0xc2, 0xfffd, 0x0, 0x3, {[@window={0x3, 0x3, 0x40}]}}}}}}}}, 0x0)

3.745111801s ago: executing program 1 (id=1870):
unshare(0x28040680)
r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50)
r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000055090100000000009500000000000000b7020000000000007baaf8ff00000000b5090800000000007baaf0ff00000000bf8700000000000007070000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018280000", @ANYRES32=r0, @ANYBLOB], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={r2, 0x0, 0x0}, 0x10)

3.674936369s ago: executing program 4 (id=1871):
getsockopt$inet_mptcp_buf(0xffffffffffffffff, 0x11c, 0x2, &(0x7f0000000180)=""/145, &(0x7f0000000000)=0x91)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newneigh={0x30, 0x1c, 0x1, 0x0, 0xfffffffd, {0xa, 0x0, 0x0, 0x0, 0x0, 0x8}, [@NDA_DST_IPV6={0x14, 0x1, @local}]}, 0x30}}, 0x0)
r0 = syz_open_dev$evdev(&(0x7f0000000400), 0xfffffffffffffffc, 0x800)
readv(r0, &(0x7f0000000300)=[{&(0x7f0000000440)=""/134, 0x86}], 0x1)
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000240)={0x1, 0x0, [{}]})
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x10, 0x2, 0xb6, '\x00', 0x2})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f00000004c0)={0x1, 0x0, [{0x40000070, 0x0, 0x6}]})
socket(0x10, 0x3, 0x0)

3.652889473s ago: executing program 0 (id=1872):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000140)={0x0, &(0x7f0000000500)=[@nested_vmlaunch={0x12f, 0x18, 0x1}, @uexit={0x0, 0x18, 0x200}, @cpuid={0x64, 0x18, {0x0, 0x80000000}}, @wr_crn={0x67, 0x20, {0x3, 0x3}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x3, @save_area=0x41b, 0x8000000000000001, 0x4d, 0x100079c}}, @wr_crn={0x67, 0x20, {0x2, 0x2}}, @enable_nested={0x12c, 0x18}, @wr_crn={0x67, 0x20, {0x4, 0x10000}}, @wrmsr={0x65, 0x20, {0xc0011036, 0xa}}, @uexit={0x0, 0x18, 0x7}, @uexit={0x0, 0x18, 0xffffffffffffffff}, @nested_vmresume={0x130, 0x18, 0x2}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @control64=0x2029, 0x7ff, 0x9d8b, 0x3}}], 0x198})
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680))
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
dup3(r1, r2, 0x0)
r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0)
write$binfmt_script(r4, &(0x7f0000000100), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0)
preadv(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f326635004000000f300f20e06635800000000f22e0f30fa6c8", 0x50}], 0x1, 0x0, 0x0, 0x0)
r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r5, 0x4068aea3, &(0x7f0000000240)={0xbe, 0x0, 0x1})
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1f, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0)
openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)

3.521150429s ago: executing program 1 (id=1873):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x200, 0x0)
close(r1)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'})
openat$vcsu(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
connect$unix(r3, &(0x7f00000003c0)=@file={0x0, './file1\x00'}, 0x6e)
sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x0, 0x806, 0x5, 0xffffffff}, 0x0)
ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, <r5=>0x0})
ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r5, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000})
r6 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x142ba3)
r7 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x8aa83, 0x175)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143041, 0x0)
ioctl$LOOP_CHANGE_FD(r6, 0x4c06, r7)
ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r5, 0x0, <r8=>0xffffffffffffffff, 0x1})
ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(0xffffffffffffffff, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r8, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x334e8b})
bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x94)
ioctl$IOMMU_IOAS_UNMAP$ALL(0xffffffffffffffff, 0x3b86, &(0x7f0000000240)={0x18, r5})
r9 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r9, 0x0, 0x20048000)

3.245383849s ago: executing program 3 (id=1874):
r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0x4}, 0x0)
r3 = socket$inet6(0xa, 0x80003, 0x6)
connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @loopback}, 0x1c)
sendmmsg(r3, &(0x7f0000000480), 0x2e9, 0x1f4)
socket$inet6_sctp(0xa, 0x1, 0x84)
ioctl$IOMMU_DESTROY$hwpt(0xffffffffffffffff, 0x3b80, 0x0)
syz_open_dev$dri(0x0, 0x1, 0x0)
r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='maps\x00')
r5 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
ioctl$IMADDTIMER(r5, 0x80044940, &(0x7f00000002c0))
ppoll(&(0x7f0000000480)=[{r5, 0xa000}, {r4, 0x64}], 0x2, 0x0, 0x0, 0x0)
syz_open_dev$dri(0x0, 0x1, 0x0)
syz_open_procfs(0x0, 0x0)
socket$packet(0x11, 0x3, 0x300)
r6 = openat$dir(0xffffffffffffff9c, 0x0, 0x800, 0x45)
openat$incfs(r6, 0x0, 0x8000, 0x8)
openat$ptp0(0xffffffffffffff9c, 0x0, 0x8002, 0x0)
r7 = memfd_secret(0x0)
ioctl$PTP_EXTTS_REQUEST2(r7, 0x40103d0b, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
flock(0xffffffffffffffff, 0x1)

3.190876413s ago: executing program 4 (id=1875):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0)
r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f00000000c0)=0xb0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000000)={@my=0x1})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r3, 0x7a8, &(0x7f0000000080)={{@local, 0x2}, @local, 0x0, 0x0, 0x5e, 0x200000000000, 0x100000000000006})
ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(r3, 0x7a4, &(0x7f0000000540)={{@local, 0x1986eb}, 0x0, 0x9, 0xffffffff, 0x40})
writev(0xffffffffffffffff, 0x0, 0x0)
ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, 0x0)
r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0)
r5 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$DMA_HEAP_IOCTL_ALLOC(r5, 0xc0184800, &(0x7f0000000100)={0x20004, <r6=>r4, 0x80000})
r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='numa_maps\x00')
sendmsg$NFNL_MSG_ACCT_GET(0xffffffffffffffff, 0x0, 0xc080)
r8 = syz_open_dev$dri(&(0x7f0000000040), 0x1ff, 0x80000)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r8, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r6})
bind$inet(r0, 0x0, 0x0)
listen(r0, 0x0)
ioctl$VIDIOC_TRY_DECODER_CMD(r7, 0xc0485661, &(0x7f0000001180)={0x2, 0x2, @raw_data=[0x0, 0x0, 0x7, 0x8, 0x5, 0x8830, 0x3, 0x7, 0x21c, 0x3, 0x102f8a47, 0x101, 0xeab, 0x6, 0x9, 0x5]})
syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010100, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0)

1.708050295s ago: executing program 2 (id=1876):
socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @multicast2}, 0x10)
memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, 0x0, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="400000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="a7ffa88800000000200012800900010069706970000000fa0f000280040013000500090000000008f33a5798cb485f3a9776f093ab3e544599d87862ad961fa67f7215b55c42d37b9a100eb2ec063287898534c013c8f11d376156badd398f094e0e3b"], 0x40}}, 0x0)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000680)={'bridge0\x00', <r5=>0x0})
syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00')
sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r5, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e000300000003000000050007"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0)

1.633948701s ago: executing program 1 (id=1877):
syz_usb_connect(0x0, 0x3f, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000d5b6c108701801007fe60102030109022d00010000000009040000030a00000009058d0000000000000905f3ff000000000009050b"], 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
r1 = socket$inet6(0xa, 0x1, 0x0)
getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, 0x0, &(0x7f00000004c0))
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = syz_open_procfs(0x0, &(0x7f0000000280)='io\x00')
preadv(r3, &(0x7f00000001c0)=[{&(0x7f0000000340)=""/230, 0xe6}], 0x1, 0x401, 0x9)
sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01080000000000000000070000000900010073797a300000000054000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000340000000080800fa3f000000310800064000000000440000000c0801010000000000000000070000f40c00020073797a31000000000900010073797a3000000000180003801400008008000340000000020800028004000100140000001000010000000000000000000084000a"], 0xe0}}, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x0, 0x6, 0x2, 0x6}, 0x14)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4)
sendto$inet6(r0, &(0x7f0000001b00)="a6", 0x1, 0x20000045, &(0x7f0000000140)={0xa, 0x4e21, 0xc, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xfff}, 0x1c)

1.49323279s ago: executing program 3 (id=1878):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)={0x14, 0x3, 0x1, 0x401}, 0x14}, 0x1, 0x0, 0x0, 0x20000004}, 0x24004084)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@delnexthop={0x30, 0x69, 0x8, 0x70bd27, 0x25dfdbfd, {}, [{0x8, 0x1, 0x2}, {0x8, 0x1, 0x1}, {0x8, 0x1, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x4044081}, 0x4000880)

1.357127155s ago: executing program 3 (id=1879):
recvmsg$unix(0xffffffffffffffff, 0x0, 0x100)
gettid()
syz_clone(0xb44040, 0x0, 0x0, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, 0x0, 0x0)
r2 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r2, 0x0, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x30, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x63}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x3}]}], {0x14}}, 0x58}}, 0x0)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0)
r4 = accept4(r2, 0x0, 0x0, 0x800)
sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x19}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x1, 0x40800)
recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0)
syz_open_dev$mouse(&(0x7f0000000140), 0xbda, 0x1)
write$char_usb(0xffffffffffffffff, &(0x7f0000000040)="e2", 0x918)
pselect6(0x40, &(0x7f0000000100)={0xffffffffffffffa0, 0x0, 0xbfa5, 0x0, 0xe, 0x0, 0x100000}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x802, 0x100000000, 0x0, 0x0, 0x6a9}, &(0x7f0000000280)={0x0, 0x989680}, 0x0)
timer_settime(0x0, 0x1, &(0x7f00000000c0)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)

1.204608873s ago: executing program 4 (id=1880):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="40000000090603000000000000000000050000400900020073797a31007b936bd7bee991e22aae000000050001000700000018000780060004404e2100000c00"], 0x40}, 0x1, 0x0, 0x0, 0x10004893}, 0x80)

863.986788ms ago: executing program 2 (id=1881):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]})
mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x81c0, 0x0)
truncate(&(0x7f0000000280)='./file1\x00', 0x1)
r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000680)=ANY=[@ANYBLOB="12010000cf8bed20d90f21004029000000010902120001000000000904"], 0x0)
syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000580)={0x44, &(0x7f0000000380)=ANY=[@ANYBLOB="201105"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402)
ioctl$I2C_RDWR(r2, 0x707, &(0x7f0000000040)={&(0x7f0000000600)=[{0xff00, 0xc000, 0x0, 0x0}], 0x1})
syz_usb_control_io$lan78xx(r1, 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(r3, r4, &(0x7f00000c6000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0)
socket$inet_smc(0x2b, 0x1, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_NESTED_STATE(r4, 0x4080aebf, &(0x7f0000003680)={{0x0, 0x0, 0xfffffea8, {0xf000}}, "cb31455c9ea4288a70a2a6bb8068fd95dd041cf5b177a3bffe992dfbbdf959487337b92336ce1de32e7695c411c0bf9f852d2d71192f33001fd51f5b396a55cb98699a09d21648c4cb30d9d7e3e397c7a3c041c76c72385a46c48c5302848c3696facce956952c2a85822ddf20434ccee5806294ed563ff3a972cddf6ef16ddace933d8a5adea40cd3ad40c9873c29368838e815ff59723519154856b2d5cd9cd79a97dc2fa08dada1175817886e5f9e7aa3dca783a44c667a4806826570ec6acb57d65efc313a384e11fb633dee17ee600145f2cb3103384606140021be766fcb7fa029f0513bbb466177ca1068192550bbf4e6f5694aec747a16e27688a988fa595bca1761b8e88a7dbcaeaf97a8b7b53058b1faf880dd6f1b6eb4c7beb0582b4007f1a67db1352407adbe1456bf762c94fd825b9419d74f63cdeb6c6976de1890d773f0c8088d2bd48a838cf5b87f5ddf926352960fb978874b0f175acfa55ddfe84de3fc9f75b58bf7a35f33d3c43ed5e3224e92751fa1b43f94f64b681163ef1360a3f3bb7403afc67a188b2104b45c5814aaa9e218552498bf85f4b221d9acc32a331f5f8c109cc9f335ff4e418ab30b54b99d5376cd92ac431fc8211fcbaf64716afdc4b6d0417e04d5723e4675d282b36bef3a3a19e855029ec7c33830a6df19332b63e9d8a0f22d96ac230c67657a4e7f7afab91dc0ce751b68980e5a4f6d9d6d9b98802ba9d8576640eea61b8c308a1745df61560e56108bececa3016d93246fdc8b768634e8319b1ffde103c07378f8f4927baba05e992a4b5af0958a7e495e7ce53f7917451d15a963ca14f5cdc4563775688b6533a4b97e0f84b0a33c30077b20805c1f42cc7815efada97ad59ac486bc9e0ee386b49cb97b47fbf8f919f06c75a49636795054b5ebee3e91602c90d7f4db49220affe56d56b96e4f662b2bf36dae482ffc7ba21cbc55e21b73309d6b7aa5509defcb77c236e43b579c61eae5c8d8f8fa71ad876b96069f2e4352c8aaf16e299d21edf5434c0cd9b25cdc9210fb0de759b1dd3fc7fe4c7118bbde72a5617dff21f7a5036448fba7fe41aaee0c289cd076d757e47b0713b236f6f141ba0112c9312b3ec853aabafdf1eb2cbb517d2d7352725f557214d27d9a340af0128fc960a4ea64c933b0d8dd226b6e024471aaac8a7074b2a8695ab990fae33b6235c5b4095437298858909bcbd40a8a286d1bedb06b7b3775bce0a5bca19b0a5c2fa8dbf87b55ae0a43c5086422e5bacb94047e150451f599b9c13aade536933e14d672c21a35cb68572c3de02f3147414eff4b8674b91f7aebf35f056a8d388f67f8ef7cfaf6b28fe745831ef41def1839791647016932c70685752851327f1837d2f1e9d8f93443eefed2317119c8152ca451a5d3aeb253fb484283f52e5db9f61f059ad3c217a860ee0571d254483501b00699208c7fa5571cf58b9715c954115bc2db0af28361938bb95ced7370c8cbb6141ef62fdbf369dfc4eccd98ab9886d79a52cbf91a27dd0f4b29940492e860fb94654dea54fad6290570760e3b59a0cf28053732472dc313b5fedfc583fc702a880971dc61286370aaf167810455cce7654dc4325a41d9d1944abcdc4d81378f1e96a8f94cd95b886a01f086e379601504219d57d531ba34e1ba0905785fb629c61f6b940a652cdee9dbef12b7fcde087b92816db3386a5769049ba00788e31de4ddbb8b56de1fbe3a5e671728effda7cfd0b650cf5df2faf22470812efbbb548e47cbf36c64e05a7877820f08948ceedb35e12a4a143ee0101a7bf0a00a4062b50c39020669700adf739a6f75352a45fd1373d3e85c3867170373f0c7a794d8590f4c22ae62d438ec365b0f6a15cb2ffe0fc6f57185e1760761bd4370027c01dfad0502f00b6898115df3c530d0b0b4a64e623fd580b528a733e4c881cf5843a975a97f92a7833527887c79fa8eec82b9526a15c6c5f2972083ce8aec735810580ffa4ea2cef4823aee044dd70927f7c07bba18b930006aa86ae7399ac6b4c24bc9d6a6ab0c5b428d7255d4d983eadf97e10c1b00867da29ac981acb453073a37236e7ae808e7759b2e0cffc3ec43afb1e95cd090a7d4b9225a0e3cbebfe49b93846ab603891e2da7d85a04bf42d12d16a97c965bc4911d3ba7a9ca505794d8744fef00a436089de67aa8b480070230dfb002eb91edaff428d4908a87afae418dff7ca59aefe1ad8f6935f309fe7985c2310881659c60a66a5e50242497ba1cd5d2bd79496ccd23f9fd901afc6622829cb3701caa50f96e09e3b23bfa3181b74ec7dae2e42c9caab43e49ae1d922a1a1eb3682de026323d9215fcec42c54401a1af81450830a4b784ed1c7922734bf3632409147680dd3fabcef296353705bb5c0e650e12905a05db1e7923923a96ddc783fc1ed46e2010416c37d9d149ad73e808bd6e4464f62893024a8501803b6c88fc55c8bbc1da7cbf580b5a81fb7c61455ae3a8aaec303fba12e0f2b51ed5e8bd31db40e8bdbd00e7b1ddd317069083a5632b5cfc88a27bf82bba60c62e5f0f6af6bda3390f8e72a2811baf3d6325e70d9a3b59cab1abe95290ecb87985567e1243504c038de9d4d100ea64eec45208cd8d2474e646f7d81eed6d59b8b0859552b6fc088d874cde3e75ee30243dc9d88ed5b577851a5bd9e2a453287025777fcac19ac33e1c94b4ad272f1055b16b842a6bd6168fb45f1f74ed2467020df5431068a5f2cbeaa6ac1841308c7c9f752aa06927f91fdf18ef9d9e942367e5ecac0abf4d3b8fc7b80238c0e7faf2ea7d3f5271028fc558a44799bde63168becc67c5531e843336fb16ab618d37f95a91937b824bf896b044146bc3a5e264a8f23ddd00729cd9aa56d9a9a24b7ab96ae021b193d8874d43ff4b723d86b7564e550378599c3e0c7a2b3d447ad76eb4cd699733d970a5ab218429a1af81df9c8013d6d16a6bcb019f6ace4461cdaa785d20ea027cfa53d521bb91ad2c04aaa6c0f268b14924803977633280c7b7beb14c88fae542b7a13e96253259e7296e37276da88891c14664340e84ae732edbd71e67047e476735b220ca231de31a380ece372db632ec3cb3ef5ac97ec41148febd2acb15cde1ee5e990ea0aaa95c2df39e2111dd1185d14a194e22d34fda8f54e99d3a73e5a231682c726d40816e048c1d059bf3bb9ee2b5f895365d95aa28f6adbf6e16469926b4d8ee7f04c7dbafaa444df5b88596c17874f0efe35e5ada1a69634f4b430f852d33b032f823c5deb54f47a7a4adb1adf56d5440b7a917580004c13e0b36c8e0a203a2be3f8fffd9efef3af19389a12c67859d4381ac0a02da18e25931b41216b731de25e1245482c84d45de1cddbce2109322a3428bff692012573fe9efd02109dbf35c5d3a287dec105cf3f1a2e5f0b1cc08c7b4759766d25d0f7b42c3ea8bf8101e61159a2ba7602e9c7947cf936ac39bf59b24084709fd61d704bbdba7d282aac778b7ec1dcaf984527c8112d56e75ab774d1598d9816abc77b0e693880beca5f330c626774ab5cb6967fb0ea8e14efce120947092c3b6f8a22f07cad22e971418092481fcad36ecf0cfd6bc3864115b8507c13554584f1f6fee5ee07eb6a091638d8e7781c1c006166e0f987f9f4de535e9f3df1db8c9328e9a19a73c76059ab4edfe9eda7f16cc6b869229bafb179d194e20ccc6f9338183b673de8138ddab9a0907278f6eaacc55bf59a450ebc10e0b88c82d9f0deca86ff771f46509250fde94e0c94256b77616d099862ddc9b341838d634a9dc4b55a88fcc6248901135f6aa76365433e7e534e0e5ae8eec2a63df62c3e244a40481189ff54122698c7e2da2c829b2eec9efc9894ee05be04ae6dd48406eaace17827e38bf38b414059aded0343e0711a8d864ff41a8d9ed40fb2aa1a3f4014f691cd0e8af62445a021820ff03afa8a192ee255862f306851df1de96ce36cafb6a60b7069db7aa96fd1ffb2fb01e6247f770304dffe4b1c8d0eeb336dd6806d6ab5d418953b1cae7cbbf53766b61e4aad5cfce8255b78af26f9bd11283a9c7d12cd63b82cd2b506fd4061d1e16fc7c713d80763c3b0aa0faadcd9b7d676101aad80e1ca00369297e1f714003ab8d0b545c335014a522a25a767950963ef821425b79b521076166d0df3ef358c7d60d99cc85463c186e8faf16af79785680382e4cc93f6594f8c4461e0988c08717640df24a5f357db22432fcae21702dc792d201212fb3791e0164bb3d433a8268ec96df73766fdba42965e00e619246cba5d96eb853a7c22c34d2fe5e5d3f3ccf9c627d069517b743cd07f6f7b444074bb9a50269f2e03309c58930e56a9583eb00c37fbcdd391972261f41756c10c8899fcd036e2017e088ef9e6ec31f795d55b3bba214c53c98fc9318e4ade0e7e6fd259aa277fed54c27e5210787a5f6937f56fdbe1da5113f059061ca590ddf536a55da91ac6ed41cb9c0418b115b29f5e823c1b0ee7c2b3982087763545b34e2c945d587ebce69bbe299a7f52b674f351977370fc700474bc15d7e6ef98c14258ecf401a4f3bba1a9aa76c5ab0b8819fe6efe3fba1899909e5e48554299150ee272451b56142d12ae2bb4942db430239701d494917f2c939a6fb9d98d4751a6f2c4537ec870342d223343a9bd7b8d8c99aff8cbfa298395551185f35dec120228073a1e496a58b59d9ac5986249a7c6db9398395cbf341c08ee910700e2daa042dba1846fef59c72ce872bba2046a14fcf9a6da5686d62bfba76309a9865c26e5fa41dd872fc749fdc57953105ace4978f9eb788c8d061c853ad0313e51e732c5d7bc05e752443c8e99b8e81c688befdb5b14c3cc2f96eb8ce8290303e483992fcbece1ff278d0dc036ad437b6cbc695c7741ba4556e242146d40843c73deaf8fceba40e4a4acd739b3031848b17a210a1ff0dc1908b77c4bb94543af52e1fe2a090c8f217428d02336303f7952c3ddefa7c81850676e7f4cc3d32c3937281fa5ab279c3fe39f92ba077dadb8c2c3df17cc511bd33c41cb161d24aea154f0f5902c94b56fe072d321a983668bd9f4838878e66ec44cb233d7d0ca908a794c844ff8b3ba4c57f6c5fc2f3a54db448b013f0c4998bbc6ed0409b3368391cb28c6df4a909fff90f308ff38c758ff7d8a2920bc221236d89b3b76de44e8ce649b32f5135a0217ba9036a8edddee97d7ba15f2c21fb7d3cae3eb6ef09dd03eed650489c83b5ba5dd9daf7a86cf0544fb8a58e46b860e3e42e10cd6f1c4f81179eb2c3ba611793a32abb4c0768db90e8bdd1694efaa9c2b45c89d203fdfb8b926b6a0d666d91b93065a83184fc2065961f2308056241b66f427c0f0aabc75852c90f0624cf036d537032ca8d73325d2ae2a79a7292c240c34584bb881fe5d468a051cbc0bde061f9eddfb758cd2dfba296eef549e5c4ede097111216a0ec60f90e8d6f5dd843c82e15f505f8c74e854ba9cd386249d552978eb8135a5f8c79c3ceb8dd5828b0218ffe40f375d6cf3ff2f47c276c8169ab98336582a852c1535018fb2306aca6b8c9f9e38d64c66a722762b76c69d4ca6c14bd6992549e4eec17287fce194467f972d9200c3d1ac4fd4a8f2620e2e4281d28c099946ed90789ba122705326390d3e058ceed24044e542efb36416272eadf6304f30efa0b7bc1ae5be92fe50e591ee6f725726e917ec113506920beb2aa53b39f1d76b31500", "cfb220c7d481332f3f1f8079dfe27e23185fd67a407358db7892789f96b7fa9b14daa48617a10d8a91b820ecbaa470ec0bb1f3cbce7f70ec70b19a4cad082229c2788f8611d7dc306d9a45761a97828c36ed87ebde5d4a3e1609c1422a8ae2f7cca428ebdb0dd38b90b9598a353b18a600bf35a369e6e3e5abb0a1c5c0c0e48e014e7ef1b7d768b3c5657f1adfbb7ff2985082b16c99eb83ec3660990dcf1106efa6b7f8a4798fec811c2c85faec0235c83b7093b3d02367421abc40a554e0b0d7fc1bcaece4222c594f8d20e368fe625ca433c75486fe5c94103cd17291349ee12b877602936688666f82ecd8f4f83d50bb1650e08b96cd25ad147c4c956c98649806a3736d072c8d97c6e3a46a7c18535df8d828b86662400d8e9cc861fa1dd5dc193892d3168396c499e07b279fb76c7e289f2fd955691363bc1de74536dc571817615c88b0d594a136966c129e424ccb7ef1c7c7461eac7ca5f03d72ea4c9c3d1156ee4cb1bb70e097357588b5c49f6716bbae1bd118104b42786f09a3b9f7cb80f383cadfd0c462096ff2bb637b7cf79764b6a4b7ffc5d87c1f063fb48e7f08ad5af534c70079f12f28e8921abbd4280801cdf6101ea494768b1274afd0eea5939843d56022a83590920fe446d52dfe699c33977d5592dbf7e0e236b8175d7faae06e0c50f7402174023ce4b996564e945c416fa823f2f9c3213ac50b20bd1fd55bb8d9fe70ee31ea2f404ae0fcbf857bebcc9196c8c622059fea2e248e4058905b69fb98be312d3193ea1d8ff653173e8c2371371b77a5bea45b3cd6fba19b6336f94ec04c8f86d24e9ca959874577d7ca0baf3c4ff30b554bc3ccc06df46d925373fbf7863e2cf684d3bc9603ab72b851ca4728294de87f2dec6f23ca9e43ed2e5cbba662d13137fc1ce0f6ae6aeb974f72f4b750825fafb67715e425f40c7da83b92d4249a0a4e96b789cceb7b07f38cb83f72dd093a345ab3cb8ae760fc14e40ea182a0d7fe1facc62a1ab0902349fd7e27bb0cd349fb5053f4734823abf020739b4b43bb11f5d69b61295068df31177959903c2ea1bb82d24eeaa93d0d4738d5d15b2a401e7ebe0d3cfbd45b2db2882cdb41408aaa718f8320fbb7f9da4f68d0eebeef175442e807e9908132731fe5e268582dcf6dffa4251ebb7121db8e412089fa9d8af9919799547a26b6b8eb44c28f1ce5f9a3021fe30841be204c1b4b3813dccae6baeef9b53fe413cbec46bb0cd95d3793cdc9bfe6cdd96ce0c4aa4a25e1cbbeeee6c9fa558b279048c7e31d07b125bac68d4e1f4253bd4dc7824cf3d722c94cf2b8f61bc8155731f072fd447082b181a13ffb8c08a1d568298c5de2d969fae2bea070a9e2688f294e76b8c200dfb993ec19778eb56ae3127c1116ccc85ef8806fdcb9ee0cb66ff03fbb0fa6c52b9b101b3830fc1650efa859163a264b4059092e5dc9a415ec09bfd1460f142fe5ef00beb6aa9032bd0de97aefc6f65e8cfeea761b3d8174caf528b6627682ff4d4450cb0f34251fc000ed01dd538ef13260984f44703b89dfb511bfb538d0b1c8aded964e1bcc5ca57437468b14a31ec0000a17e4d24369c40500449c37e7dccedba3eceb59d827dace246b5c48afb6a5988e64c560b3dc76c32d831f51cdbc5cfc4364ac8b25372b87c92bacfedc6bc8feb44098dbebc89cda03c59e4c58a31372bd574704b9e788834b9f83c6703f6709efad97c4ce499ea580dae1de282a019247cb3dce5c1906322e6d3ca5157ea6428bc42416936fac194efe136089c07faf7adf1e923003f1dc63fcbc634b389a4f351a6a4ee785e23c6bb04ca2f265be1e634362b87c6f9fd369bbe62a1db6b286c7ffde6370bb4d6e9e0cc3ec451e1a99d134726c9075e71319d3a6fffffffffffffe3be6d086481069cd32f4cde7816f8e3a0ac6428a7488f31f06ee0da10df3ed0c150d29085879d064f914407f60018bb588735663647bfeda930407d69abef3f72fd461c2b85b00988b412a180fd267fc646a86d297e7e40912607157b6fa873df6442579b1523d8117f0c06c87adf75843b8bff30a5bfb4fe1e9846b7fdd58774641baf9cc9c4e38e53ed24a9d9e9dbc7657aa9b220a8545852b0409f5c0812e953823e841967bf55059acc7a4600818134359e72cfae0d04a0738ac8acca133d6395a455b22cdd6f901d4cdea1cf17415f7d7895a4b65f80d2f7c5c60a0dc04b40c9ae5ffc922e074a82afd704673e1766d19db9f60eab0238fb4a3169a08aded607847e5d752d4e24c4914b95bac3892bcfc2076f16a7f07583f0d418b9dec03afdb2e93335a392e1b1ef2910eb2a4b6a63fe61641f3c02bef73cd7e4a77a6f30ae821598c3160511603541bea89022b54f321c2a55cdeeb19335d78a821ab6ca0f36588a9a79a41e2123905a491d658c2a1caeee998c995bb0f816c92c5dc2b862183f80b9f9786c9c5524723c944d11f6894c7f008ab8194f577e22c03631d2a33205f508ea49653e7600639242dbaba704f700ac227f32dc575c559a0a1f4fe0cf6c22fbf7e1ca2ab4b1e4724e8379021e3c9a7c1509c6a413bd7d9c98938ec40762eda2546d636597defa86c1ad31126a1182d365f858927d140fb0a97f80adcc5f4ed5efe11ac503453917a263f1d64692348d30f382e85e464ef7616067a42df5de1a1b622fabefe2ca4ceffa4801f7a02fdef40644cd1d079590d900727628d54b44db7ac700d8d664f7eea12837fcf347360d8e43a354fe51b4c49e8fcda3c322b738ed2b800b5cc06e22c72af2a67ee7bc8ae894e841f2cf2b0a7e381caf944bf4e91ded63b6f82f7474e4f81e986fff7e5339b8e9f60103a1af81833e120f0c88893ecabac044a4a2867cda4fdcb084459a00507aa9e5a8e761a72df3322a1ae8cd918b4994c23bdb1e459b4f21651bd7fa067a00e2a2877bf6b29f289ed8018e0a78f6fb4ded9749640e0e37f6381b320ab72da404f3d70d60152f6fa6738932387b83250cb3148141edb52f109bfd4bda8054959db01f4c550609a63c08cf01ecd110cfc6f0055638c0dde039d2ac2daafe59e561f9f08a8830c3f661e4325de63e98f4a4216ec3b83fd200201ed3f646ffc6c4a8aca64a6874743242d4feeaa9153de06e51c512d9cab7ae712c6424069f3e5db4ddebe9b48b5f6caa741162edf97674d2368e03a387f798151a4b9b9fa9e3a5838a343133158364a9fe3bb3f9a3c464c0c54a4c64ca774ad200925ac6bf59508c10a8574afde9b821741af43ec64cedc13aa220b39772195283506dfe899dd6a7b37eb21f154056a2df3564ef2bb918a928651de88c3613b84e7960bddd7b46b1304deb30f57b6fe5a3b4788629e91bcc2456a72fabb16b47da71624d2e9081de748b3387f52da4bb094782326dcfde0827e2d674e41bb375247d349cade9c704e5431785009b0e53f1b45c70b237c9432e07e4c7a8464ed11608a3d2184338dd9e6f6ef4b3d751e979667b6a3953c89aff4eead7a978071a912b3de21a85a5849c57933cf53cd74a610f3e60f699766fbc7e0bb8a891a429c77bb6f3b6f9f8eb0b1bd9588ef2ce98fdf0a0838e4b0bed807d8b673093c717feec8d697e32542274887d039db7a2daed5d52c8e9767443229f8003c5d67e907376ea2f393484fa70deee159cb56f8d097b8fe2736e95f540137e20725f0940a8d049068ead4c46bb3771a671bb00de88931e03445a55868de0c220db05cbda9f996d5fe7c1070efe5e718fed4d4cb4ecacad3d6b643bc0ffe9a71b720ba7b5adbbdefe29106ef6a6ffe4547f5d02bec312147df0abe80efb2d5e598fc7c8b268e58b59e0d75728e9a18126f013c963ddc92d251405f857fe3a5cbacf443be7772975b7bf4f6d7ed6f80dfcc47a88c6d19120942adb5385be6ef3c0d7e396bcac5affc8f9276d6cd1a0b069aed72a98cde8ea7aabe6cc091b19efcfaf9368dfeb3087a05a42e3b893dae5ffeb72e6ac06e995a2a75ea0b5f7876247bb4c38cf3f0153f1f7473b522f1c440b632270e2b1d654d3a5ae16cb788482760d34ca79c8951b29c628e21029715683a3e6f8f77c5d89ecdae37e0190f79c4c1dbc9d0160e359cd6c94d6662ed53bb01a83374ff593c823acc59241b11f020902069fc0054a9b26cb320bef4fb1f8cc5bd8ae76eb029afab731b9876bc4e8708a8315512823cff1f9375d284ce66e53d4efad6c76d17bb532fc938b8f80c13ce86b5ba3e540164bc5a5d47cd321c241d8740f453ef95bd3878d578561ad6ce20877ffbd44062dce8df1d048d8d5e4045be647886108cbb1f0b26a8b74b66858afedb830a161bb02bde4c46a688a0ea3a7018ce24666aab0f422ede2f78ea29f77e28d87c744cba0285ce33d0d9ac45774829699de6d725a9b6db6e7d03ad4ec9d075c386e68ca0bcd9e9911d741ed0168cbddb87a7918a964d206629da4e887277b0ef7d3f9c7082f3f15f29a0dfb39f3b0877a5ec3ac4343e0d808f5aee8f1869923aab6dfc3016821c013109f34aece6183994b853d0e9561375c02cdd26b1b55194757341929a8038864cedd6b5a3b8b51ade44637044c4ebddb190f173969a0ca4cf5d42153763a0b91da0110ae7a25204850927d81b00176d4568a3d444d8029bd010df784e3f673fe855601ec4f1b26b2df58841e6a65f0db66373f63cc14a8b07dfc52ac9957eb542d05ed687c79519609de96df18b63cb294b534ddf7d2e8f41bcc1e5a006191c4db057b6709f0a96f18e7e8f67b8be2a19c015b9c4b0b3f42e4de366b71f8da8888809473c3c7a02a1158e375f29997a43bc7118ca4d1abb8f8f21972fc589aaa3d73a4d40a1e1705e169ac6e56cff50d89fc45b6863c8fc67bb2b5939a7f33072539ba4c24077be5711ba368bf7efd4897931531d388eb5c2e56bef337777150dd59518652145c9594e110e41d2615196c6b197916c88cc2814e13a3a922b4ecb044bf31cc90e0bfe0ce07de29188bbcb0ec1a12b509f52582fbb948c3cbe0c6964f46991cec0704bfac08aec6ad8ddfc36dc68c7f547c5ee6af4a8d55c79e3dc1c49b045379811f81e9a185a92cd37ae4ee32c5d3c82d36d6202a6c84fd231fe467071d42072827fd77afa5d757e6f37247f783ef09bdfd7536b666e84bc4bb878005b7829293a04ba090272dec844f4ef0e934617c08518bdc6b915ac6f3f03e4a6ab88e21c3f21f93b31d95ea3b9228e0031cb69795de5abd19c4cb4a0cf2984e53ca391cc66e33ee0d510151670331fa264753704fea5e4b1760f74890c49a74a47e0da13155c5470013d53dea0f05b5e088f1511c209f5be940232318af2757951d399e32eb862d915784713baa8ba93645caf04ba78fa3cf600ff92b9c5be58ad87438a340bac00a5ea9fb17e39478ba61fe36335e48d8c5a0b25f024cbd2ec7f217d0f260951da396dc13a2a74cd90df4b52db686e3b34d27cfa4cebd7bf59cbcfaf4007dc943a1da6e0bd1799a21ab449d7bb42935e50c839c5b567c59742436af15bc8d46095520dcd9273ae2b6f3c1cc2b4311ac9e5d297f0940b1552c5955adb302022022bb7457978998b56328629b7725dfbe3dedb37f37af0697a4471d1d6ff6bec633a38540adeba903f3eaaec5785fbb3c6a598f49dbd9ff93c67dea1ef39a614331b119fa8efccc8bac01595fb95a2a57eec9fc6c6fe82782aa89ea971866fd9a3bca4010182099b964be9e3bb13bd6b77850e435f55a5d46e5bcb3330c7edefd31c33f61275e51600"})
syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="65660fc736b9230200000f320fc5b0040000000f0f10970fe8fa640f01cfc4e21d4501c744240000000000c74424021c320000c744240600000000c4e17de69222ad2eec0fc76e04b8200fae82ef66bafc0c66b8004066ef66b8296c", 0x5c}], 0x1, 0x0, 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2})
ioctl$KVM_RUN(r4, 0xae80, 0x0)

863.286804ms ago: executing program 4 (id=1882):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000780)=ANY=[@ANYBLOB="120100005fb8e520cd0c8000834a0102030109021b00020000000009046f0000aad823000904"], 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
r3 = socket$inet6_mptcp(0xa, 0x1, 0x106)
sendto$inet6(r3, 0x0, 0x0, 0xc080, 0x0, 0x0)
connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x2, @dev={0xfe, 0x80, '\x00', 0x13}, 0x7}, 0x1c)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
unshare(0x20040600)
r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0)
mq_timedsend(r5, 0x0, 0x0, 0x7, 0x0)
r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), 0xffffffffffffffff)
ioctl$int_in(r3, 0x5421, &(0x7f0000000200)=0xf34)
r7 = syz_usbip_server_init(0x1)
write$usbip_server(r7, &(0x7f0000000280)=ANY=[@ANYRESDEC=r1, @ANYRESDEC=0x0, @ANYRES64=r5], 0x60)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000000c0)=ANY=[@ANYRESHEX=r0, @ANYRES16=r6, @ANYRES64=r2], 0x28}}, 0x800)
close(r2)
socket$nl_generic(0x10, 0x3, 0x10)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
syz_usb_connect(0x2, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000011620140480b05101e8c00000001090212000100000000090401"], 0x0)
r8 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x440c02, 0x0)
ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, 0x0)
r9 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x82083)
ioctl$I2C_RDWR(r9, 0x707, &(0x7f0000000080)={&(0x7f0000000740)=[{0x6, 0x10, 0x0, 0x0}, {0x9, 0x11, 0x0, 0x0}], 0x2})
r10 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'veth1\x00', <r11=>0x0})
sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x7}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x8000, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
socket$inet_sctp(0x2, 0x1, 0x84)
sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@deltclass={0x38, 0x29, 0x200, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0x2, 0xf}, {0xffe0, 0xfff3}, {0xffff, 0x2}}, [@tclass_kind_options=@c_mqprio={0xb}, @TCA_RATE={0x6, 0x5, {0x0, 0xfe}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4004890)
socket$packet(0x11, 0x3, 0x300)

504.289051ms ago: executing program 0 (id=1883):
madvise(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x16)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040))
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x1ff, 0x1501)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x80, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0})
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r1, &(0x7f0000000240), 0x0, 0x0)
recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x60, 0x0, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
syz_usb_connect(0x0, 0x0, 0x0, 0x0)
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000040)={0xffffffffffffffff, 0x1, 0x3})
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000080)=0x8)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000007b6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc23982876"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340), 0x10}, 0x94)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'bridge0\x00', <r4=>0x0})
r5 = socket(0x10, 0x80002, 0x0)
connect$inet6(r5, 0x0, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a00000000000000000700", @ANYRES32=r4, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0)

84.240106ms ago: executing program 3 (id=1884):
mkdirat(0xffffffffffffff9c, 0x0, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={0xffffffffffffffff, 0x0, 0x0}, 0x20)
syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', <r3=>0x0})
r4 = socket(0x10, 0x80002, 0x0)
r5 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0)
ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x12)
ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x11)
ioctl$UI_DEV_SETUP(r5, 0x405c5503, &(0x7f0000000100)={{0x1}, 'syz1\x00'})
ioctl$UI_DEV_CREATE(r5, 0x5501)
sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0xffa1, &(0x7f0000000380)={&(0x7f0000000140)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r3, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYBLOB="35874207"], 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x0)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'wlan0\x00'})
sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[@ANYRES16=r6, @ANYBLOB="010000000000000000003b00000008000300", @ANYBLOB="30003300d0000800ffffffffffff08021100000050505050505000400f03720603030303030375080100fbff0f00100008002600710900000800270002000000"], 0x5c}, 0x1, 0x0, 0x0, 0x4008050}, 0x40000)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff)
r8 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_SET_TID_CONFIG(r8, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002ec0)={0x28, r7, 0x10ada85e65c25359, 0xfffffffd, 0x25dfdbfd, {{0x6b}, {@val={0x8}, @val={0xc, 0x99, {0x2, 0x72}}}}}, 0x28}}, 0x0)
r9 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001517ee40f00a057a00f6000203010902120001000000000904000000ff"], 0x0)
syz_usb_control_io$uac1(r9, 0x0, &(0x7f0000000540)={0x44, &(0x7f0000000240)=ANY=[@ANYBLOB="000a110000000b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100})
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)

0s ago: executing program 1 (id=1885):
r0 = socket$inet6(0xa, 0x2, 0x0)
getsockopt$MRT6(r0, 0x29, 0xd0, &(0x7f0000000340), &(0x7f0000000100)=0x4)
sendto$inet6(r0, 0x0, 0x36, 0x4084004, &(0x7f0000000500)={0xa, 0x4e24, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c)
setsockopt$inet6_udp_int(r0, 0x88, 0x1, &(0x7f0000000080)=0xfffffff2, 0x4)
r1 = socket$inet6_sctp(0xa, 0x1, 0x84)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000), &(0x7f0000000080)=0x4)
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
connect$can_bcm(0xffffffffffffffff, &(0x7f0000000480), 0x10)
sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x4040)
sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
landlock_create_ruleset(0x0, 0x0, 0x0)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
r3 = syz_io_uring_setup(0x1238, &(0x7f0000000380)={0x0, 0x880fd, 0x80, 0x3, 0x356}, &(0x7f0000000040)=<r4=>0x0, &(0x7f0000000200)=<r5=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffff4, 0x0, 0x4)
prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f0000000280)={0x1, &(0x7f0000000300)=[{0x200000000006, 0x1, 0x6, 0x7ffc1ff6}]})
r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x400000011bc82, 0x0)
dup(r6)
read(r6, 0x0, 0x0)
syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r2, 0x80, &(0x7f0000000080)=@l2tp={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x16}, 0x1}})
io_uring_enter(r3, 0x3532, 0x32c9, 0x45, 0x0, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x10031, 0xffffffffffffffff, 0x65be1000)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r7=>0xffffffffffffffff, <r8=>0xffffffffffffffff})
sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0)

kernel console output (not intermixed with test programs):

x10
[  486.576321][T11726]  rpm_resume+0x8b1/0x15f0
[  486.576353][T11726]  ? __pfx_rpm_resume+0x10/0x10
[  486.576368][T11726]  ? do_raw_spin_lock+0x121/0x290
[  486.576386][T11726]  ? rpm_resume+0x849/0x15f0
[  486.576404][T11726]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  486.576435][T11726]  rpm_resume+0x8b1/0x15f0
[  486.576468][T11726]  ? __pfx_rpm_resume+0x10/0x10
[  486.576487][T11726]  ? _raw_spin_lock_irqsave+0xb3/0xf0
[  486.576508][T11726]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[  486.576536][T11726]  ? __pm_runtime_resume+0x9d/0x180
[  486.576557][T11726]  __pm_runtime_resume+0x11c/0x180
[  486.576577][T11726]  usb_autopm_get_interface+0x20/0xf0
[  486.576599][T11726]  wdm_write+0x25f/0xcf0
[  486.576632][T11726]  ? __pfx_wdm_write+0x10/0x10
[  486.576651][T11726]  ? common_file_perm+0x1b5/0x220
[  486.576673][T11726]  ? bpf_lsm_file_permission+0x9/0x20
[  486.576688][T11726]  ? security_file_permission+0x75/0x290
[  486.576712][T11726]  ? rw_verify_area+0x255/0x4d0
[  486.576732][T11726]  ? __pfx_wdm_write+0x10/0x10
[  486.576754][T11726]  vfs_write+0x27e/0xb30
[  486.576782][T11726]  ? __pfx_vfs_write+0x10/0x10
[  486.576803][T11726]  ? __fget_files+0x2a/0x420
[  486.576822][T11726]  ? __fget_files+0x2a/0x420
[  486.576836][T11726]  ? __fget_files+0x3a0/0x420
[  486.576850][T11726]  ? __fget_files+0x2a/0x420
[  486.576880][T11726]  ksys_write+0x145/0x250
[  486.576904][T11726]  ? __pfx_ksys_write+0x10/0x10
[  486.576929][T11726]  ? do_syscall_64+0xbe/0xf80
[  486.576949][T11726]  do_syscall_64+0xfa/0xf80
[  486.576966][T11726]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  486.576982][T11726]  ? clear_bhb_loop+0x60/0xb0
[  486.577002][T11726]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  486.577018][T11726] RIP: 0033:0x7f378b98f749
[  486.577034][T11726] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  486.577049][T11726] RSP: 002b:00007f378c8ba038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  486.577068][T11726] RAX: ffffffffffffffda RBX: 00007f378bbe5fa0 RCX: 00007f378b98f749
[  486.577080][T11726] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
[  486.577090][T11726] RBP: 00007f378c8ba090 R08: 0000000000000000 R09: 0000000000000000
[  486.577100][T11726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  486.577110][T11726] R13: 00007f378bbe6038 R14: 00007f378bbe5fa0 R15: 00007f378bd0fa28
[  486.577139][T11726]  </TASK>
[  486.581450][T11726] hub 5-0:1.0: hub_ext_port_status failed (err = -12)
[  487.258856][T11752] batadv0: entered promiscuous mode
[  487.267233][T11752] vlan3: entered promiscuous mode
[  487.373636][    C1] cdc_wdm 5-1:1.0: nonzero urb status received: -71
[  487.380272][    C1] cdc_wdm 5-1:1.0: wdm_int_callback - 0 bytes
[  488.137989][T11758] syzkaller0: entered promiscuous mode
[  488.169776][T11758] syzkaller0: entered allmulticast mode
[  488.447450][   T10] usb 3-1: new full-speed USB device number 66 using dummy_hcd
[  488.456774][    C1] cdc_wdm 5-1:1.0: wdm_int_callback - usb_submit_urb failed with result -1
[  488.480703][T11769] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1474'.
[  488.555202][    T9] usb 2-1: new high-speed USB device number 89 using dummy_hcd
[  488.585268][   T10] usb 3-1: device descriptor read/64, error -71
[  488.635618][ T5947] usb 5-1: USB disconnect, device number 58
[  488.705252][    T9] usb 2-1: Using ep0 maxpacket: 8
[  488.713611][    T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 15
[  488.730106][    T9] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x76, changing to 0x6
[  488.742730][    T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x6 has an invalid bInterval 0, changing to 7
[  488.755285][    T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x6 has invalid wMaxPacketSize 0
[  488.762845][ T5929] vhci_hcd: vhci_device speed not set
[  488.768520][    T9] usb 2-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8
[  488.779763][    T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  488.787871][    T9] usb 2-1: Product: syz
[  488.792319][    T9] usb 2-1: Manufacturer: syz
[  488.797143][    T9] usb 2-1: SerialNumber: syz
[  488.804700][    T9] usb 2-1: config 0 descriptor??
[  488.815226][ T5947] usb 1-1: new full-speed USB device number 65 using dummy_hcd
[  488.826485][    T9] powermate 2-1:0.0: probe with driver powermate failed with error -5
[  488.834918][   T10] usb 3-1: new full-speed USB device number 67 using dummy_hcd
[  488.969840][ T5947] usb 1-1: device descriptor read/64, error -71
[  488.976330][   T10] usb 3-1: device descriptor read/64, error -71
[  489.087113][   T10] usb usb3-port1: attempt power cycle
[  489.215198][ T5947] usb 1-1: new full-speed USB device number 66 using dummy_hcd
[  489.345232][ T5947] usb 1-1: device descriptor read/64, error -71
[  489.425189][   T10] usb 3-1: new full-speed USB device number 68 using dummy_hcd
[  489.446192][   T10] usb 3-1: device descriptor read/8, error -71
[  489.456666][ T5947] usb usb1-port1: attempt power cycle
[  489.688172][   T10] usb 3-1: new full-speed USB device number 69 using dummy_hcd
[  489.722159][   T10] usb 3-1: device descriptor read/8, error -71
[  489.800130][ T5947] usb 1-1: new full-speed USB device number 67 using dummy_hcd
[  489.826700][ T5947] usb 1-1: device descriptor read/8, error -71
[  489.845440][   T10] usb usb3-port1: unable to enumerate USB device
[  490.065322][ T5947] usb 1-1: new full-speed USB device number 68 using dummy_hcd
[  490.085805][ T5947] usb 1-1: device descriptor read/8, error -71
[  490.138893][   T49] usb 2-1: USB disconnect, device number 89
[  490.215494][ T5947] usb usb1-port1: unable to enumerate USB device
[  490.702179][T11784] syzkaller1: entered promiscuous mode
[  490.709301][T11784] syzkaller1: entered allmulticast mode
[  490.720517][T11784] fuse: Bad value for 'group_id'
[  490.726257][T11784] fuse: Bad value for 'group_id'
[  491.082435][T11789] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6)
[  491.089001][T11789] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus)
[  491.116690][T11789] vhci_hcd vhci_hcd.0: Device attached
[  491.395209][    T9] usb 36-1: SetAddress Request (2) to port 0
[  491.408936][    T9] usb 36-1: new SuperSpeed USB device number 2 using vhci_hcd
[  491.605985][   T30] audit: type=1326 audit(1764857179.783:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11809 comm="syz.4.1485" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f378b98f749 code=0x0
[  491.683519][T11790] vhci_hcd: connection reset by peer
[  491.689286][   T13] vhci_hcd: stop threads
[  491.693571][   T13] vhci_hcd: release socket
[  491.711917][   T13] vhci_hcd: disconnect device
[  492.868953][T11823] fuse: Bad value for 'group_id'
[  492.875295][T11823] fuse: Bad value for 'group_id'
[  493.385191][   T10] usb 4-1: new high-speed USB device number 56 using dummy_hcd
[  493.545209][ T5870] usb 1-1: new high-speed USB device number 69 using dummy_hcd
[  493.565664][   T10] usb 4-1: Using ep0 maxpacket: 32
[  493.587359][   T10] usb 4-1: New USB device found, idVendor=1a0a, idProduct=0108, bcdDevice=4d.52
[  493.652336][   T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  493.687817][   T10] usb 4-1: Product: syz
[  493.700983][   T10] usb 4-1: Manufacturer: syz
[  493.706792][ T5870] usb 1-1: Using ep0 maxpacket: 16
[  493.713627][ T5870] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[  493.755907][ T5870] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  493.771644][   T10] usb 4-1: SerialNumber: syz
[  493.843443][ T5870] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  493.860546][ T5870] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  493.889945][ T5947] usb 3-1: new high-speed USB device number 70 using dummy_hcd
[  493.908554][ T5870] usb 1-1: Product: syz
[  493.915772][ T5870] usb 1-1: Manufacturer: syz
[  493.920484][ T5870] usb 1-1: SerialNumber: syz
[  493.927170][ T5870] usb 1-1: config 0 descriptor??
[  493.935667][ T5870] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  493.945489][ T5870] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class)
[  494.055143][ T5947] usb 3-1: Using ep0 maxpacket: 16
[  494.062214][ T5947] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0
[  494.088002][ T5947] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  494.098105][ T5947] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  494.107797][ T5947] usb 3-1: Product: syz
[  494.112168][ T5947] usb 3-1: Manufacturer: syz
[  494.117211][ T5947] usb 3-1: SerialNumber: syz
[  494.150161][ T5947] usb 3-1: config 0 descriptor??
[  494.205922][ T5947] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  494.225880][ T5947] em28xx 3-1:0.0: DVB interface 0 found: bulk
[  494.232168][ T5870] em28xx 1-1:0.0: unknown em28xx chip ID (0)
[  494.238966][ T5870] em28xx 1-1:0.0: Config register raw data: 0xfffffffb
[  494.259193][ T5870] em28xx 1-1:0.0: AC97 chip type couldn't be determined
[  494.268077][ T5870] em28xx 1-1:0.0: No AC97 audio processor
[  494.329017][ T5870] usb 1-1: USB disconnect, device number 69
[  494.342526][ T5870] em28xx 1-1:0.0: Disconnecting em28xx
[  494.401183][ T5870] em28xx 1-1:0.0: Freeing device
[  494.436558][ T5947] em28xx 3-1:0.0: unknown em28xx chip ID (0)
[  494.515574][ T5947] em28xx 3-1:0.0: reading from i2c device at 0xa0 failed (error=-5)
[  494.550715][ T5947] em28xx 3-1:0.0: board has no eeprom
[  494.625212][ T5947] em28xx 3-1:0.0: Identified as PCTV tripleStick (292e) (card=94)
[  494.645234][ T5947] em28xx 3-1:0.0: dvb set to bulk mode.
[  494.657309][ T6000] em28xx 3-1:0.0: Binding DVB extension
[  494.674972][ T5947] usb 3-1: USB disconnect, device number 70
[  494.700614][ T5947] em28xx 3-1:0.0: Disconnecting em28xx
[  494.751209][ T6000] em28xx 3-1:0.0: Registering input extension
[  494.766135][ T5947] em28xx 3-1:0.0: Closing input extension
[  494.804665][ T5947] em28xx 3-1:0.0: Freeing device
[  494.814307][ T5870] usb 1-1: new high-speed USB device number 70 using dummy_hcd
[  494.862938][T11849] netlink: 'syz.4.1494': attribute type 10 has an invalid length.
[  494.872104][T11849] bond0: (slave wlan1): Opening slave failed
[  494.975280][ T5870] usb 1-1: Using ep0 maxpacket: 8
[  494.991700][ T5870] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  495.097685][ T5870] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3
[  495.167113][ T5870] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a3, bcdDevice= 0.40
[  495.178593][ T5870] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  495.196052][ T5870] usb 1-1: Product: syz
[  495.205364][ T5870] usb 1-1: Manufacturer: syz
[  495.217089][ T5870] usb 1-1: SerialNumber: syz
[  495.248454][ T5870] usb 1-1: bad CDC descriptors
[  495.254271][ T5870] usbtest 1-1:1.0: couldn't get endpoints, -22
[  495.271401][ T5870] usbtest 1-1:1.0: probe with driver usbtest failed with error -22
[  495.456747][   T49] usb 1-1: USB disconnect, device number 70
[  495.675337][   T10] usb_ehset_test 4-1:84.0: probe with driver usb_ehset_test failed with error -32
[  495.698675][   T10] usb 4-1: USB disconnect, device number 56
[  495.751685][T11867] bridge0: port 2(bridge_slave_1) entered disabled state
[  495.759193][T11867] bridge0: port 1(bridge_slave_0) entered disabled state
[  496.065266][ T6050] usb 2-1: new high-speed USB device number 90 using dummy_hcd
[  496.275156][   T10] usb 5-1: new high-speed USB device number 59 using dummy_hcd
[  496.315168][ T6050] usb 2-1: Using ep0 maxpacket: 8
[  496.346533][ T6050] usb 2-1: config 127 has an invalid interface number: 171 but max is 1
[  496.372812][ T6050] usb 2-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config
[  496.401538][ T6050] usb 2-1: config 127 has no interface number 1
[  496.432857][ T6050] usb 2-1: config 127 interface 171 has no altsetting 0
[  496.457496][   T10] usb 5-1: config 0 has no interfaces?
[  496.462965][ T6050] usb 2-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9
[  496.463413][ T6050] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  496.463433][ T6050] usb 2-1: Product: syz
[  496.463447][ T6050] usb 2-1: Manufacturer: syz
[  496.463462][ T6050] usb 2-1: SerialNumber: syz
[  496.463702][   T10] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  496.463725][   T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=67
[  496.463743][   T10] usb 5-1: SerialNumber: syz
[  496.467488][   T10] usb 5-1: config 0 descriptor??
[  496.525527][    T9] usb 36-1: device descriptor read/8, error -110
[  496.545858][T11879] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(6)
[  496.545897][T11879] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus)
[  496.546034][T11879] vhci_hcd vhci_hcd.0: Device attached
[  496.700458][T11880] vhci_hcd: connection closed
[  496.700651][ T6062] vhci_hcd: stop threads
[  496.700668][ T6062] vhci_hcd: release socket
[  496.700814][ T6062] vhci_hcd: disconnect device
[  496.759020][T11868] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1497'.
[  496.818287][ T5929] usb 5-1: USB disconnect, device number 59
[  496.927655][    T9] usb usb36-port1: attempt power cycle
[  497.486192][    T9] usb usb36-port1: unable to enumerate USB device
[  499.042560][ T6050] xr_serial 2-1:127.171: xr_serial converter detected
[  499.050668][ T6050] xr_serial ttyUSB0: Failed to set reg 0x1a: -71
[  499.059523][ T6050] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71
[  499.200066][ T6050] usb 2-1: USB disconnect, device number 90
[  499.350299][ T6050] xr_serial 2-1:127.171: device disconnected
[  500.201817][T11899] netlink: 'syz.4.1507': attribute type 10 has an invalid length.
[  500.281723][T11899] bond0: (slave wlan1): Opening slave failed
[  501.386338][T11939] syzkaller0: entered promiscuous mode
[  501.392110][T11939] syzkaller0: entered allmulticast mode
[  501.479471][ T1302] ieee802154 phy0 wpan0: encryption failed: -22
[  501.486154][ T1302] ieee802154 phy1 wpan1: encryption failed: -22
[  501.641932][T11948] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6)
[  501.648493][T11948] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus)
[  501.680058][T11948] vhci_hcd vhci_hcd.0: Device attached
[  501.814228][T11956] netlink: 64 bytes leftover after parsing attributes in process `syz.0.1519'.
[  502.021717][ T5870] usb 42-1: SetAddress Request (19) to port 0
[  502.035543][T11949] vhci_hcd: connection closed
[  502.036995][ T3969] vhci_hcd: stop threads
[  502.054661][ T5870] usb 42-1: new SuperSpeed USB device number 19 using vhci_hcd
[  502.081311][ T3969] vhci_hcd: release socket
[  502.093139][ T3969] vhci_hcd: disconnect device
[  502.205527][ T6000] usb 2-1: new high-speed USB device number 91 using dummy_hcd
[  502.234639][T11956] bridge0: port 2(bridge_slave_1) entered blocking state
[  502.241856][T11956] bridge0: port 2(bridge_slave_1) entered forwarding state
[  502.249264][T11956] bridge0: port 1(bridge_slave_0) entered blocking state
[  502.256433][T11956] bridge0: port 1(bridge_slave_0) entered forwarding state
[  502.375175][ T6000] usb 2-1: Using ep0 maxpacket: 8
[  502.384305][ T6000] usb 2-1: config 127 has an invalid interface number: 171 but max is 1
[  502.404840][ T6000] usb 2-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config
[  502.443374][ T6000] usb 2-1: config 127 has no interface number 1
[  502.479393][T11968] vim2m vim2m.0: vidioc_s_fmt queue busy
[  502.495539][ T6000] usb 2-1: config 127 interface 171 has no altsetting 0
[  502.528402][T11956] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  502.578050][ T6000] usb 2-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9
[  502.612849][ T6000] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  502.647592][ T6000] usb 2-1: Product: syz
[  502.664699][ T6000] usb 2-1: Manufacturer: syz
[  502.700189][ T6000] usb 2-1: SerialNumber: syz
[  504.467214][T11983] netlink: 'syz.4.1527': attribute type 13 has an invalid length.
[  504.521751][T11983] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  504.555386][   T49] usb 1-1: new full-speed USB device number 71 using dummy_hcd
[  504.745454][   T49] usb 1-1: config 0 has an invalid interface number: 105 but max is 0
[  504.753932][   T49] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  504.765478][   T49] usb 1-1: config 0 has no interface number 0
[  504.815394][   T49] usb 1-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28
[  504.824821][   T49] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  504.855128][   T49] usb 1-1: Product: syz
[  504.879734][   T49] usb 1-1: Manufacturer: syz
[  504.905229][   T49] usb 1-1: SerialNumber: syz
[  504.927129][   T49] usb 1-1: config 0 descriptor??
[  504.981939][   T49] uvcvideo 1-1:0.105: Found UVC 0.00 device syz (046d:08f3)
[  505.007038][   T49] uvcvideo 1-1:0.105: No valid video chain found.
[  505.106206][ T6000] xr_serial 2-1:127.171: xr_serial converter detected
[  505.130168][ T6000] xr_serial ttyUSB0: Failed to set reg 0x1a: -71
[  505.269315][ T6000] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71
[  505.300481][ T6000] usb 2-1: USB disconnect, device number 91
[  505.318635][ T6000] xr_serial 2-1:127.171: device disconnected
[  505.442772][T11990] FAULT_INJECTION: forcing a failure.
[  505.442772][T11990] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  505.463863][T11990] CPU: 0 UID: 0 PID: 11990 Comm: syz.1.1531 Not tainted syzkaller #0 PREEMPT(full) 
[  505.463890][T11990] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  505.463901][T11990] Call Trace:
[  505.463908][T11990]  <TASK>
[  505.463917][T11990]  dump_stack_lvl+0x189/0x250
[  505.463941][T11990]  ? __pfx____ratelimit+0x10/0x10
[  505.463964][T11990]  ? __pfx_dump_stack_lvl+0x10/0x10
[  505.463981][T11990]  ? __pfx__printk+0x10/0x10
[  505.464013][T11990]  should_fail_ex+0x414/0x560
[  505.464039][T11990]  _copy_to_user+0x31/0xb0
[  505.464058][T11990]  simple_read_from_buffer+0xe1/0x170
[  505.464086][T11990]  proc_fail_nth_read+0x1b3/0x220
[  505.464106][T11990]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  505.464128][T11990]  ? rw_verify_area+0x2a6/0x4d0
[  505.464147][T11990]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  505.464167][T11990]  vfs_read+0x200/0xa30
[  505.464184][T11990]  ? fdget_pos+0x247/0x320
[  505.464203][T11990]  ? __pfx___mutex_lock+0x10/0x10
[  505.464220][T11990]  ? __pfx_vfs_read+0x10/0x10
[  505.464242][T11990]  ? __fget_files+0x2a/0x420
[  505.464260][T11990]  ? __fget_files+0x3a0/0x420
[  505.464275][T11990]  ? __fget_files+0x2a/0x420
[  505.464299][T11990]  ksys_read+0x145/0x250
[  505.464329][T11990]  ? __pfx_ksys_read+0x10/0x10
[  505.464353][T11990]  ? do_syscall_64+0xbe/0xf80
[  505.464373][T11990]  do_syscall_64+0xfa/0xf80
[  505.464389][T11990]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  505.464406][T11990]  ? clear_bhb_loop+0x60/0xb0
[  505.464426][T11990]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  505.464442][T11990] RIP: 0033:0x7fc63898e15c
[  505.464457][T11990] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48
[  505.464472][T11990] RSP: 002b:00007fc6398a1030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  505.464490][T11990] RAX: ffffffffffffffda RBX: 00007fc638be5fa0 RCX: 00007fc63898e15c
[  505.464503][T11990] RDX: 000000000000000f RSI: 00007fc6398a10a0 RDI: 0000000000000004
[  505.464514][T11990] RBP: 00007fc6398a1090 R08: 0000000000000000 R09: 0000000000000000
[  505.464524][T11990] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  505.464534][T11990] R13: 00007fc638be6038 R14: 00007fc638be5fa0 R15: 00007fc638d0fa28
[  505.464563][T11990]  </TASK>
[  505.545164][   T49] usb 4-1: new high-speed USB device number 57 using dummy_hcd
[  505.811577][T11981] netlink: 'syz.2.1528': attribute type 10 has an invalid length.
[  506.162180][   T49] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[  506.185156][T12004] program syz.1.1534 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  506.224232][   T49] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7
[  506.248704][   T49] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0
[  506.271500][   T49] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  506.305679][   T49] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  506.328864][   T49] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  506.351927][   T49] usb 4-1: config 0 descriptor??
[  506.400070][T11977] netlink: 'syz.0.1526': attribute type 10 has an invalid length.
[  506.574519][ T6000] usb 1-1: USB disconnect, device number 71
[  506.690928][T12008] mmap: syz.2.1537 (12008): VmData 37404672 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data.
[  506.768738][T12009] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6)
[  506.775291][T12009] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus)
[  506.783752][T12009] vhci_hcd vhci_hcd.0: Device attached
[  506.798116][T12009] netlink: 'syz.4.1535': attribute type 2 has an invalid length.
[  506.838663][   T49] plantronics 0003:047F:FFFF.000E: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0
[  507.033445][T12010] vhci_hcd: connection reset by peer
[  507.045467][ T6035] vhci_hcd: stop threads
[  507.050298][   T49] usb 4-1: USB disconnect, device number 57
[  507.056511][ T6035] vhci_hcd: release socket
[  507.064221][ T6035] vhci_hcd: disconnect device
[  507.155308][ T5870] usb 42-1: device descriptor read/8, error -110
[  507.182510][T12013] fido_id[12013]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory
[  507.606304][ T5870] usb usb42-port1: attempt power cycle
[  507.786302][T12018] netlink: 'syz.2.1538': attribute type 10 has an invalid length.
[  507.812009][T12018] netlink: 'syz.2.1538': attribute type 10 has an invalid length.
[  508.004198][T12029] bridge0: vlan filtering disabled, automatically disabling multicast vlan snooping
[  508.286594][ T5870] usb usb42-port1: unable to enumerate USB device
[  508.317729][T12032] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1542'.
[  508.326942][T12032] openvswitch: netlink: Flow actions attr not present in new flow.
[  508.691111][T12034] FAULT_INJECTION: forcing a failure.
[  508.691111][T12034] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  508.708821][T12034] CPU: 0 UID: 0 PID: 12034 Comm: syz.4.1543 Not tainted syzkaller #0 PREEMPT(full) 
[  508.708848][T12034] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  508.708860][T12034] Call Trace:
[  508.708867][T12034]  <TASK>
[  508.708875][T12034]  dump_stack_lvl+0x189/0x250
[  508.708899][T12034]  ? __pfx____ratelimit+0x10/0x10
[  508.708922][T12034]  ? __pfx_dump_stack_lvl+0x10/0x10
[  508.708941][T12034]  ? __pfx__printk+0x10/0x10
[  508.708962][T12034]  ? __might_fault+0xb0/0x130
[  508.708994][T12034]  should_fail_ex+0x414/0x560
[  508.709021][T12034]  _copy_from_user+0x2d/0xb0
[  508.709039][T12034]  ___sys_sendmsg+0x158/0x2a0
[  508.709062][T12034]  ? __pfx____sys_sendmsg+0x10/0x10
[  508.709079][T12034]  ? __lock_acquire+0x6b6/0x2cf0
[  508.709135][T12034]  ? __might_fault+0xb0/0x130
[  508.709159][T12034]  __sys_sendmmsg+0x227/0x430
[  508.709184][T12034]  ? __pfx___sys_sendmmsg+0x10/0x10
[  508.709213][T12034]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  508.709246][T12034]  ? ksys_write+0x22a/0x250
[  508.709269][T12034]  ? __pfx_ksys_write+0x10/0x10
[  508.709294][T12034]  __x64_sys_sendmmsg+0xa0/0xc0
[  508.709315][T12034]  do_syscall_64+0xfa/0xf80
[  508.709333][T12034]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  508.709357][T12034]  ? clear_bhb_loop+0x60/0xb0
[  508.709378][T12034]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  508.709394][T12034] RIP: 0033:0x7f378b98f749
[  508.709411][T12034] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  508.709425][T12034] RSP: 002b:00007f378c8ba038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[  508.709444][T12034] RAX: ffffffffffffffda RBX: 00007f378bbe5fa0 RCX: 00007f378b98f749
[  508.709457][T12034] RDX: 0400000000000292 RSI: 0000200000002c40 RDI: 0000000000000003
[  508.709469][T12034] RBP: 00007f378c8ba090 R08: 0000000000000000 R09: 0000000000000000
[  508.709480][T12034] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  508.709490][T12034] R13: 00007f378bbe6038 R14: 00007f378bbe5fa0 R15: 00007f378bd0fa28
[  508.709519][T12034]  </TASK>
[  509.413293][T12063] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1551'.
[  509.429021][T12063] ip6gretap0: entered promiscuous mode
[  509.441254][T12063] macvtap1: entered promiscuous mode
[  509.460987][T12063] macvtap1: entered allmulticast mode
[  509.468078][T12063] ip6gretap0: entered allmulticast mode
[  509.502842][T12070] ip6gretap0: left allmulticast mode
[  509.508706][T12070] ip6gretap0: left promiscuous mode
[  509.937363][T12075] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6)
[  509.943922][T12075] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus)
[  510.125119][T12080] bridge0: vlan filtering disabled, automatically disabling multicast vlan snooping
[  510.172826][T12081] netlink: 'syz.0.1553': attribute type 2 has an invalid length.
[  510.172864][T12075] vhci_hcd vhci_hcd.0: Device attached
[  510.385203][T12076] vhci_hcd: connection closed
[  510.388531][ T6062] vhci_hcd: stop threads
[  510.428081][ T6062] vhci_hcd: release socket
[  510.455782][ T6062] vhci_hcd: disconnect device
[  510.495428][ T5870] usb 34-1: enqueue for inactive port 0
[  511.196461][ T5870] usb usb34-port1: attempt power cycle
[  511.341422][T12100] program syz.2.1561 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  511.796586][ T5870] usb usb34-port1: unable to enumerate USB device
[  512.735178][ T5870] usb 4-1: new high-speed USB device number 58 using dummy_hcd
[  512.925534][ T5870] usb 4-1: device descriptor read/64, error -71
[  513.028837][T12132] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  513.091204][T12134] vim2m vim2m.0: vidioc_s_fmt queue busy
[  513.419319][ T5870] usb 4-1: new high-speed USB device number 59 using dummy_hcd
[  513.619958][ T5870] usb 4-1: device descriptor read/64, error -71
[  513.775702][ T5870] usb usb4-port1: attempt power cycle
[  514.135366][ T5870] usb 4-1: new high-speed USB device number 60 using dummy_hcd
[  514.169966][ T5870] usb 4-1: device descriptor read/8, error -71
[  514.505183][ T5870] usb 4-1: new high-speed USB device number 61 using dummy_hcd
[  514.547855][ T5870] usb 4-1: device descriptor read/8, error -71
[  514.595035][T12157] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6)
[  514.601604][T12157] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus)
[  514.752671][T12161] netlink: 'syz.0.1578': attribute type 2 has an invalid length.
[  514.759767][ T5870] usb usb4-port1: unable to enumerate USB device
[  514.776720][T12157] vhci_hcd vhci_hcd.0: Device attached
[  514.932764][T12166] binder: 12165:12166 ioctl c0306201 2000000001c0 returned -22
[  514.945240][T12166] netlink: 'syz.2.1580': attribute type 1 has an invalid length.
[  515.002829][T12166] bond4: entered promiscuous mode
[  515.022796][T12158] vhci_hcd: connection closed
[  515.024650][T12166] bond4: entered allmulticast mode
[  515.034560][ T3969] vhci_hcd: stop threads
[  515.039658][ T3969] vhci_hcd: release socket
[  515.044620][ T3969] vhci_hcd: disconnect device
[  515.049521][ T5929] usb 34-1: SetAddress Request (15) to port 0
[  515.055692][ T5929] usb 34-1: new SuperSpeed USB device number 15 using vhci_hcd
[  515.088130][T12166] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1580'.
[  515.177958][ T5929] usb 34-1: enqueue for inactive port 0
[  515.597509][ T5929] usb usb34-port1: attempt power cycle
[  516.156223][ T5929] usb usb34-port1: unable to enumerate USB device
[  516.232838][T12188] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1584'.
[  516.255400][T12188] ip6gretap0: entered promiscuous mode
[  516.296753][T12188] macvtap3: entered promiscuous mode
[  516.317762][T12188] macvtap3: entered allmulticast mode
[  516.323161][T12188] ip6gretap0: entered allmulticast mode
[  516.355338][T12193] netlink: 'syz.3.1585': attribute type 10 has an invalid length.
[  516.407318][T12189] netlink: 'syz.3.1585': attribute type 10 has an invalid length.
[  516.446715][T12191] ip6gretap0: left allmulticast mode
[  516.457612][T12191] ip6gretap0: left promiscuous mode
[  516.626997][T12193] team0: Port device netdevsim0 added
[  516.754308][ T5929] usb 3-1: new high-speed USB device number 71 using dummy_hcd
[  516.953756][T12209] binder: 12208:12209 ioctl c0306201 2000000001c0 returned -22
[  516.979589][T12209] netlink: 'syz.0.1591': attribute type 1 has an invalid length.
[  516.988220][ T5929] usb 3-1: Using ep0 maxpacket: 32
[  517.002798][T12189] team0: Port device netdevsim0 removed
[  517.017090][ T5929] usb 3-1: unable to get BOS descriptor or descriptor too short
[  517.038864][ T5929] usb 3-1: config 40 has an invalid interface number: 160 but max is 0
[  517.049082][T12189] bond0: (slave netdevsim0): Enslaving as an active interface with an up link
[  517.062068][ T5929] usb 3-1: config 40 has an invalid descriptor of length 0, skipping remainder of the config
[  517.077932][ T5929] usb 3-1: config 40 has no interface number 0
[  517.087183][T12212] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1591'.
[  517.096850][ T5929] usb 3-1: config 40 interface 160 altsetting 47 endpoint 0xC has invalid maxpacket 1023, setting to 64
[  517.111209][ T5929] usb 3-1: config 40 interface 160 altsetting 47 endpoint 0x3 has invalid maxpacket 52346, setting to 64
[  517.128764][ T5929] usb 3-1: config 40 interface 160 altsetting 47 has 2 endpoint descriptors, different from the interface descriptor's value: 7
[  517.218757][ T5929] usb 3-1: config 40 interface 160 has no altsetting 0
[  517.281151][ T5929] usb 3-1: New USB device found, idVendor=0763, idProduct=1021, bcdDevice=74.b7
[  517.293266][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  517.303642][T12211] bond2: entered promiscuous mode
[  517.331990][T12211] bond2: entered allmulticast mode
[  517.338970][ T5929] usb 3-1: Product: syz
[  517.376104][ T5929] usb 3-1: Manufacturer: syz
[  517.385762][ T5929] usb 3-1: SerialNumber: syz
[  517.623859][ T5929] usb 3-1: Quirk or no altset; falling back to MIDI 1.0
[  517.802555][ T5929] snd-usb-audio 3-1:40.160: probe with driver snd-usb-audio failed with error -2
[  517.842539][ T8659] udevd[8659]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:40.160/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  517.858923][ T5929] usb 3-1: USB disconnect, device number 71
[  518.185845][ T5929] usb 4-1: new high-speed USB device number 62 using dummy_hcd
[  518.350818][ T5929] usb 4-1: Using ep0 maxpacket: 32
[  518.363518][ T5929] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  518.394331][ T5929] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  518.422726][ T5929] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[  518.453562][ T5929] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  518.481170][ T5929] usb 4-1: config 0 descriptor??
[  518.508145][ T5929] hub 4-1:0.0: USB hub found
[  518.641740][T12242] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6)
[  518.648303][T12242] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus)
[  518.657358][T12242] vhci_hcd vhci_hcd.0: Device attached
[  518.697262][T12242] : entered promiscuous mode
[  518.707458][ T5929] hub 4-1:0.0: config failed, hub doesn't have any ports! (err -19)
[  518.887053][   T24] usb 1-1: new high-speed USB device number 72 using dummy_hcd
[  519.015209][ T5870] usb 38-1: SetAddress Request (8) to port 0
[  519.027668][ T5870] usb 38-1: new SuperSpeed USB device number 8 using vhci_hcd
[  519.046962][   T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  519.069109][   T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  519.143486][T12243] vhci_hcd: connection reset by peer
[  519.150245][   T12] vhci_hcd: stop threads
[  519.154520][   T12] vhci_hcd: release socket
[  519.176698][   T12] vhci_hcd: disconnect device
[  519.258336][   T24] usb 1-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00
[  519.268518][   T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  519.280113][   T24] usb 1-1: config 0 descriptor??
[  519.701938][   T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0
[  519.731057][   T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0
[  519.745155][   T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0
[  519.755462][   T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0
[  519.783847][   T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0
[  519.813165][   T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0
[  519.835328][   T24] cp2112 0003:10C4:EA90.000F: unknown main item tag 0x0
[  519.874315][   T24] cp2112 0003:10C4:EA90.000F: hidraw0: USB HID v0.00 Device [HID 10c4:ea90] on usb-dummy_hcd.0-1/input0
[  519.987155][   T24] cp2112 0003:10C4:EA90.000F: Part Number: 0x82 Device Version: 0xFE
[  520.518851][T12251] binder: 12250:12251 ioctl c0306201 2000000001c0 returned -22
[  520.546444][T12251] netlink: 'syz.2.1602': attribute type 1 has an invalid length.
[  520.566908][ T5929] usbhid 4-1:0.0: can't add hid device: -71
[  520.572973][ T5929] usbhid 4-1:0.0: probe with driver usbhid failed with error -71
[  520.600175][T12240] cp2112 0003:10C4:EA90.000F: Error starting transaction: -38
[  520.648960][   T24] cp2112 0003:10C4:EA90.000F: error reading lock byte: -71
[  520.665966][ T5929] usb 4-1: USB disconnect, device number 62
[  520.707769][T12253] bond5: entered promiscuous mode
[  520.723134][T12253] bond5: entered allmulticast mode
[  520.750171][   T24] usb 1-1: USB disconnect, device number 72
[  520.766249][T12253] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1602'.
[  520.869856][T12259] netlink: 'syz.3.1604': attribute type 29 has an invalid length.
[  520.880365][T12259] netlink: 'syz.3.1604': attribute type 29 has an invalid length.
[  520.981781][T12263] loop2: detected capacity change from 0 to 7
[  520.991070][ T8659] Dev loop2: unable to read RDB block 7
[  521.003386][ T8659]  loop2: AHDI p1 p2 p3
[  521.009114][ T8659] loop2: partition table partially beyond EOD, truncated
[  521.017125][ T8659] loop2: p1 start 1601398130 is beyond EOD, truncated
[  521.024005][ T8659] loop2: p2 start 1702059890 is beyond EOD, truncated
[  521.036709][T12263] Dev loop2: unable to read RDB block 7
[  521.056797][T12263]  loop2: AHDI p1 p2 p3
[  521.067845][T12263] loop2: partition table partially beyond EOD, truncated
[  521.079300][T12263] loop2: p1 start 1601398130 is beyond EOD, truncated
[  521.087730][T12263] loop2: p2 start 1702059890 is beyond EOD, truncated
[  521.455708][   T24] usb 2-1: new full-speed USB device number 92 using dummy_hcd
[  521.585147][   T24] usb 2-1: device descriptor read/64, error -71
[  521.955261][   T24] usb 2-1: new full-speed USB device number 93 using dummy_hcd
[  522.115761][   T24] usb 2-1: device descriptor read/64, error -71
[  522.227983][   T24] usb usb2-port1: attempt power cycle
[  522.605182][   T24] usb 2-1: new full-speed USB device number 94 using dummy_hcd
[  522.686089][   T24] usb 2-1: device descriptor read/8, error -71
[  522.753956][T12278] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6)
[  522.760557][T12278] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus)
[  522.878160][T12278] vhci_hcd vhci_hcd.0: Device attached
[  523.115124][T12286] vhci_hcd: connection closed
[  523.116432][   T50] vhci_hcd: stop threads
[  523.134540][   T24] usb 2-1: new full-speed USB device number 95 using dummy_hcd
[  523.144410][   T50] vhci_hcd: release socket
[  523.165924][   T50] vhci_hcd: disconnect device
[  523.187456][T12290] : entered promiscuous mode
[  523.213067][   T24] usb 2-1: device descriptor read/8, error -71
[  523.225198][   T49] usb 34-1: enqueue for inactive port 0
[  523.257176][T12295] can: request_module (can-proto-3) failed.
[  523.378888][   T24] usb usb2-port1: unable to enumerate USB device
[  523.758162][   T49] usb usb34-port1: attempt power cycle
[  523.925307][T12306] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1617'.
[  524.001276][T12306] bridge0: port 2(bridge_slave_1) entered disabled state
[  524.008907][T12306] bridge0: port 1(bridge_slave_0) entered disabled state
[  524.115705][ T5870] usb 38-1: device descriptor read/8, error -110
[  524.407020][   T49] usb usb34-port1: unable to enumerate USB device
[  524.506313][ T5870] usb usb38-port1: attempt power cycle
[  524.535261][    T9] usb 2-1: new high-speed USB device number 96 using dummy_hcd
[  524.651543][T12319] netlink: 'syz.2.1621': attribute type 10 has an invalid length.
[  524.668909][T12319] netlink: 'syz.2.1621': attribute type 10 has an invalid length.
[  524.695641][    T9] usb 2-1: Using ep0 maxpacket: 8
[  524.704602][    T9] usb 2-1: config index 0 descriptor too short (expected 5924, got 36)
[  524.723274][    T9] usb 2-1: config 250 has an invalid interface number: 228 but max is -1
[  524.735172][ T6000] usb 1-1: new high-speed USB device number 73 using dummy_hcd
[  524.753292][    T9] usb 2-1: config 250 has 1 interface, different from the descriptor's value: 0
[  524.763820][    T9] usb 2-1: config 250 has no interface number 0
[  524.781705][    T9] usb 2-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024
[  524.812828][T12232] warn_alloc: 1 callbacks suppressed
[  524.812841][T12232] syz.4.1597: vmalloc error: size 536870912, failed to allocated page array size 1048576, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null)
[  524.820673][    T9] usb 2-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024
[  524.847781][T12232] ,cpuset=syz4,mems_allowed=0-1
[  524.967058][T12232] CPU: 1 UID: 0 PID: 12232 Comm: syz.4.1597 Not tainted syzkaller #0 PREEMPT(full) 
[  524.967081][T12232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  524.967094][T12232] Call Trace:
[  524.967102][T12232]  <TASK>
[  524.967111][T12232]  dump_stack_lvl+0x189/0x250
[  524.967136][T12232]  ? __pfx_rcu_read_unlock_special+0x10/0x10
[  524.967164][T12232]  ? __pfx_dump_stack_lvl+0x10/0x10
[  524.967182][T12232]  ? __pfx__printk+0x10/0x10
[  524.967205][T12232]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  524.967232][T12232]  ? cpuset_print_current_mems_allowed+0x1f/0x360
[  524.967261][T12232]  warn_alloc+0x214/0x310
[  524.967291][T12232]  ? __pfx_warn_alloc+0x10/0x10
[  524.967322][T12232]  ? __get_vm_area_node+0x28f/0x300
[  524.967344][T12232]  ? translate_table+0x198/0x2000
[  524.967364][T12232]  __vmalloc_node_range_noprof+0x690/0x12d0
[  524.967414][T12232]  ? __pfx___vmalloc_node_range_noprof+0x10/0x10
[  524.967437][T12232]  ? translate_table+0x198/0x2000
[  524.967455][T12232]  ? rcu_is_watching+0x15/0xb0
[  524.967473][T12232]  ? translate_table+0x198/0x2000
[  524.967489][T12232]  __kvmalloc_node_noprof+0x670/0x910
[  524.967512][T12232]  ? translate_table+0x198/0x2000
[  524.967526][T12232]  ? do_ipt_set_ctl+0x881/0xcd0
[  524.967544][T12232]  ? nf_setsockopt+0x26f/0x290
[  524.967561][T12232]  ? __x64_sys_setsockopt+0x13f/0x1b0
[  524.967579][T12232]  ? do_syscall_64+0xfa/0xf80
[  524.967602][T12232]  translate_table+0x198/0x2000
[  524.967639][T12232]  ? __pfx_translate_table+0x10/0x10
[  524.967658][T12232]  ? __might_fault+0xb0/0x130
[  524.967698][T12232]  ? _copy_from_user+0x94/0xb0
[  524.967718][T12232]  do_ipt_set_ctl+0x967/0xcd0
[  524.967740][T12232]  ? rcu_is_watching+0x15/0xb0
[  524.967760][T12232]  ? trace_contention_end+0x39/0x100
[  524.967781][T12232]  ? __pfx_do_ipt_set_ctl+0x10/0x10
[  524.967819][T12232]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  524.967848][T12232]  ? __pfx_aa_sk_perm+0x10/0x10
[  524.967871][T12232]  nf_setsockopt+0x26f/0x290
[  524.967897][T12232]  ? __pfx_sock_common_setsockopt+0x10/0x10
[  524.967924][T12232]  do_sock_setsockopt+0x17c/0x1b0
[  524.967948][T12232]  __x64_sys_setsockopt+0x13f/0x1b0
[  524.967971][T12232]  do_syscall_64+0xfa/0xf80
[  524.967990][T12232]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  524.968007][T12232]  ? clear_bhb_loop+0x60/0xb0
[  524.968028][T12232]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  524.968046][T12232] RIP: 0033:0x7f378b98f749
[  524.968063][T12232] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  524.968080][T12232] RSP: 002b:00007f378c8ba038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  524.968100][T12232] RAX: ffffffffffffffda RBX: 00007f378bbe5fa0 RCX: 00007f378b98f749
[  524.968113][T12232] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003
[  524.968124][T12232] RBP: 00007f378ba13f91 R08: 0000000000000478 R09: 0000000000000000
[  524.968135][T12232] R10: 0000200000001800 R11: 0000000000000246 R12: 0000000000000000
[  524.968146][T12232] R13: 00007f378bbe6038 R14: 00007f378bbe5fa0 R15: 00007f378bd0fa28
[  524.968175][T12232]  </TASK>
[  524.968261][T12232] Mem-Info:
[  524.977908][    T9] usb 2-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid wMaxPacketSize 0
[  525.314917][ T5870] usb usb38-port1: unable to enumerate USB device
[  525.360011][T12232] active_anon:25014 inactive_anon:3 isolated_anon:0
[  525.360011][T12232]  active_file:22057 inactive_file:40107 isolated_file:0
[  525.360011][T12232]  unevictable:2800 dirty:225 writeback:0
[  525.360011][T12232]  slab_reclaimable:8146 slab_unreclaimable:179322
[  525.360011][T12232]  mapped:31716 shmem:19294 pagetables:1693
[  525.360011][T12232]  sec_pagetables:0 bounce:0
[  525.360011][T12232]  kernel_misc_reclaimable:0
[  525.360011][T12232]  free:1179306 free_pcp:14310 free_cma:0
[  525.405590][    C0] vkms_vblank_simulate: vblank timer overrun
[  525.547409][ T6000] usb 1-1: New USB device found, idVendor=2c42, idProduct=1709, bcdDevice=ca.b7
[  525.566904][T12232] Node 0 active_anon:101456kB inactive_anon:12kB active_file:88228kB inactive_file:160228kB unevictable:9664kB isolated(anon):0kB isolated(file):0kB mapped:130864kB dirty:908kB writeback:0kB shmem:75640kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:6144kB kernel_stack:12892kB pagetables:6620kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  525.575198][ T6000] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  525.618423][    T9] usb 2-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 0
[  525.628897][    T9] usb 2-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17
[  525.644410][ T6000] usb 1-1: Product: syz
[  525.652575][ T6000] usb 1-1: Manufacturer: syz
[  525.657426][ T6000] usb 1-1: SerialNumber: syz
[  525.665253][    T9] usb 2-1: config 250 interface 228 has no altsetting 0
[  525.674403][ T6000] usb 1-1: config 0 descriptor??
[  525.689636][    T9] usb 2-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07
[  525.700495][    T9] usb 2-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59
[  525.708962][    T9] usb 2-1: Product: syz
[  525.713167][    T9] usb 2-1: SerialNumber: syz
[  525.721979][    T9] hub 2-1:250.228: bad descriptor, ignoring hub
[  525.737570][    T9] hub 2-1:250.228: probe with driver hub failed with error -5
[  525.752183][T12232] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:152kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB
[  525.812986][T12232] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  525.842950][    C0] vkms_vblank_simulate: vblank timer overrun
[  525.925983][    T9] usblp 2-1:250.228: usblp0: USB Bidirectional printer dev 96 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292
[  525.945156][T12232] lowmem_reserve[]: 0 2504 2504 2504 2504
[  525.967902][T12232] Node 0 DMA32 free:809000kB boost:0kB min:34308kB low:42884kB high:51460kB reserved_highatomic:0KB free_highatomic:0KB active_anon:102272kB inactive_anon:12kB active_file:88228kB inactive_file:160228kB unevictable:9724kB writepending:928kB zspages:0kB present:3129332kB managed:2564460kB mlocked:8192kB bounce:0kB free_pcp:40200kB local_pcp:7912kB free_cma:0kB
[  526.001547][    C0] vkms_vblank_simulate: vblank timer overrun
[  526.073685][T12232] lowmem_reserve[]: 0 0 0 0 0
[  526.085891][T12232] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:108kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB
[  526.134405][    C0] vkms_vblank_simulate: vblank timer overrun
[  526.167183][T12232] lowmem_reserve[]: 0 0 0 0 0
[  526.176400][T12232] Node 1 Normal free:3891040kB boost:0kB min:55592kB low:69488kB high:83384kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:17280kB local_pcp:14304kB free_cma:0kB
[  526.208707][    C0] vkms_vblank_simulate: vblank timer overrun
[  526.223772][    T9] usb 2-1: reset high-speed USB device number 96 using dummy_hcd
[  526.245846][T12232] lowmem_reserve[]: 0 0 0 0 0
[  526.252022][T12232] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB
[  526.277304][T12232] Node 0 DMA32: 11*4kB (ME) 385*8kB (UME) 917*16kB (UME) 739*32kB (UME) 415*64kB (UME) 188*128kB (UME) 129*256kB (UME) 84*512kB (UME) 59*1024kB (UM) 27*2048kB (UM) 128*4096kB (UM) = 808100kB
[  526.351687][T12232] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB
[  526.352899][T12316] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  526.385232][T12232] Node 1 Normal: 218*4kB (UM) 57*8kB (UME) 37*16kB (UME) 217*32kB (UME) 75*64kB (UME) 14*128kB (UME) 7*256kB (UME) 4*512kB (UME) 1*1024kB (M) 2*2048kB (UE) 944*4096kB (M) = 3891040kB
[  526.400032][T12316] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  526.407733][T12232] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  526.421365][T12232] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB
[  526.447876][T12232] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB
[  526.448823][T12328] loop2: detected capacity change from 0 to 7
[  526.457858][T12232] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
[  526.477037][T12232] 81457 total pagecache pages
[  526.482012][ T6000] usb 1-1: f81604_read: reg: 105 failed: -EPIPE
[  526.488747][ T6000] f81604 1-1:0.0: Setting termination of CH#1 failed: -EPIPE
[  526.496526][ T6000] f81604 1-1:0.0: probe with driver f81604 failed with error -32
[  526.504540][T12232] 3 pages in swap cache
[  526.511233][T12232] Free swap  = 124984kB
[  526.518419][ T8772] Dev loop2: unable to read RDB block 7
[  526.534420][ T8772]  loop2: AHDI p1 p2 p3
[  526.541660][T12232] Total swap = 124996kB
[  526.549609][ T8772] loop2: partition table partially beyond EOD, truncated
[  526.560311][T12232] 2097051 pages RAM
[  526.564192][T12232] 0 pages HighMem/MovableOnly
[  526.569168][ T8772] loop2: p1 start 1601398130 is beyond EOD, truncated
[  526.576528][T12232] 424294 pages reserved
[  526.580745][T12232] 0 pages cma reserved
[  526.584899][ T8772] loop2: p2 start 1702059890 is beyond EOD, truncated
[  526.597445][T12328] Dev loop2: unable to read RDB block 7
[  526.609250][T12328]  loop2: AHDI p1 p2 p3
[  526.613479][T12328] loop2: partition table partially beyond EOD, truncated
[  526.636103][T12328] loop2: p1 start 1601398130 is beyond EOD, truncated
[  526.657554][    T9] usb 2-1: failed to restore interface 228 altsetting 255 (error=-71)
[  526.678440][    T9] usb 2-1: USB disconnect, device number 96
[  526.698865][T12328] loop2: p2 start 1702059890 is beyond EOD, truncated
[  526.707434][    T9] usblp0: removed
[  527.175700][  T986] usb 4-1: new high-speed USB device number 63 using dummy_hcd
[  527.301821][T12348] xt_CT: No such helper "netbios-ns"
[  527.307249][  T986] usb 4-1: device descriptor read/64, error -71
[  527.461669][T12355] can: request_module (can-proto-3) failed.
[  527.639741][  T986] usb 4-1: new high-speed USB device number 64 using dummy_hcd
[  527.794436][  T986] usb 4-1: device descriptor read/64, error -71
[  527.905555][  T986] usb usb4-port1: attempt power cycle
[  528.255164][  T986] usb 4-1: new high-speed USB device number 65 using dummy_hcd
[  528.386095][  T986] usb 4-1: device descriptor read/8, error -71
[  528.815176][  T986] usb 4-1: new high-speed USB device number 66 using dummy_hcd
[  528.838336][  T986] usb 4-1: device descriptor read/8, error -71
[  528.877933][ T5929] usb 1-1: USB disconnect, device number 73
[  528.937634][T12375] program syz.1.1635 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  528.955584][  T986] usb usb4-port1: unable to enumerate USB device
[  528.982054][T12378] FAULT_INJECTION: forcing a failure.
[  528.982054][T12378] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  529.005842][T12378] CPU: 1 UID: 0 PID: 12378 Comm: syz.0.1638 Not tainted syzkaller #0 PREEMPT(full) 
[  529.005875][T12378] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  529.005885][T12378] Call Trace:
[  529.005893][T12378]  <TASK>
[  529.005901][T12378]  dump_stack_lvl+0x189/0x250
[  529.005924][T12378]  ? __pfx____ratelimit+0x10/0x10
[  529.005946][T12378]  ? __pfx_dump_stack_lvl+0x10/0x10
[  529.005962][T12378]  ? __pfx__printk+0x10/0x10
[  529.005993][T12378]  should_fail_ex+0x414/0x560
[  529.006017][T12378]  _copy_from_user+0x2d/0xb0
[  529.006034][T12378]  __copy_msghdr+0x3c5/0x5b0
[  529.006056][T12378]  ___sys_sendmsg+0x1a5/0x2a0
[  529.006077][T12378]  ? __pfx____sys_sendmsg+0x10/0x10
[  529.006123][T12378]  ? __fget_files+0x2a/0x420
[  529.006137][T12378]  ? __fget_files+0x3a0/0x420
[  529.006163][T12378]  __sys_sendmmsg+0x227/0x430
[  529.006185][T12378]  ? __pfx___sys_sendmmsg+0x10/0x10
[  529.006210][T12378]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  529.006242][T12378]  ? ksys_write+0x22a/0x250
[  529.006262][T12378]  ? __pfx_ksys_write+0x10/0x10
[  529.006283][T12378]  __x64_sys_sendmmsg+0xa0/0xc0
[  529.006304][T12378]  do_syscall_64+0xfa/0xf80
[  529.006320][T12378]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  529.006335][T12378]  ? clear_bhb_loop+0x60/0xb0
[  529.006353][T12378]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  529.006370][T12378] RIP: 0033:0x7f380b38f749
[  529.006385][T12378] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  529.006399][T12378] RSP: 002b:00007f38095f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
[  529.006416][T12378] RAX: ffffffffffffffda RBX: 00007f380b5e5fa0 RCX: 00007f380b38f749
[  529.006427][T12378] RDX: 0000000000000001 RSI: 0000200000001500 RDI: 0000000000000003
[  529.006438][T12378] RBP: 00007f38095f6090 R08: 0000000000000000 R09: 0000000000000000
[  529.006449][T12378] R10: 0000000000000818 R11: 0000000000000246 R12: 0000000000000001
[  529.006458][T12378] R13: 00007f380b5e6038 R14: 00007f380b5e5fa0 R15: 00007f380b70fa28
[  529.006487][T12378]  </TASK>
[  529.219021][    C1] vkms_vblank_simulate: vblank timer overrun
[  530.605184][    T9] usb 4-1: new full-speed USB device number 67 using dummy_hcd
[  530.778417][    T9] usb 4-1: unable to get BOS descriptor or descriptor too short
[  530.796354][    T9] usb 4-1: not running at top speed; connect to a high speed hub
[  530.826818][    T9] usb 4-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config
[  530.852454][    T9] usb 4-1: config 7 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  530.869414][    T9] usb 4-1: New USB device found, idVendor=0489, idProduct=e0b5, bcdDevice=ae.2a
[  530.880470][    T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  530.915763][    T9] usb 4-1: Product: syz
[  530.920995][    T9] usb 4-1: Manufacturer: syz
[  530.969812][    T9] usb 4-1: SerialNumber: syz
[  531.455174][ T6000] usb 2-1: new high-speed USB device number 97 using dummy_hcd
[  531.655425][ T6000] usb 2-1: Using ep0 maxpacket: 16
[  531.698312][ T6000] usb 2-1: config 0 has no interfaces?
[  531.708489][ T6000] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  531.717596][ T6000] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  531.725632][ T6000] usb 2-1: Manufacturer: syz
[  531.732841][ T6000] usb 2-1: config 0 descriptor??
[  532.568959][T12428] raw_sendmsg: syz.4.1652 forgot to set AF_INET. Fix it!
[  532.965382][  T986] usb 3-1: new high-speed USB device number 72 using dummy_hcd
[  533.155342][  T986] usb 3-1: Using ep0 maxpacket: 8
[  533.167981][  T986] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  533.178048][  T986] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  533.191253][  T986] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 30768, setting to 1024
[  533.218238][  T986] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024
[  533.243398][  T986] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  533.288795][  T986] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23
[  533.316813][  T986] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  533.560758][  T986] usb 3-1: GET_CAPABILITIES returned 0
[  533.577003][  T986] usbtmc 3-1:16.0: can't read capabilities
[  533.688592][ T5870] usb 5-1: new full-speed USB device number 60 using dummy_hcd
[  533.784110][T12427] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  533.797032][T12427] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  533.819207][  T986] usb 3-1: USB disconnect, device number 72
[  533.906682][ T5870] usb 5-1: config 0 has an invalid interface number: 105 but max is 0
[  533.931017][ T5870] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  533.965146][ T5870] usb 5-1: config 0 has no interface number 0
[  533.990846][ T5870] usb 5-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28
[  534.015362][ T5870] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  534.037565][ T5870] usb 5-1: Product: syz
[  534.045165][ T5870] usb 5-1: Manufacturer: syz
[  534.055753][ T5870] usb 5-1: SerialNumber: syz
[  534.070596][ T5870] usb 5-1: config 0 descriptor??
[  534.103183][ T5870] uvcvideo 5-1:0.105: Found UVC 0.00 device syz (046d:08f3)
[  534.118523][ T5870] uvcvideo 5-1:0.105: No valid video chain found.
[  534.234596][ T5870] usb 2-1: USB disconnect, device number 97
[  534.946523][ T5870] usb 1-1: new high-speed USB device number 74 using dummy_hcd
[  535.147771][ T5870] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32
[  535.175148][ T5870] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config
[  535.214474][ T5870] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66
[  535.256578][ T5870] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9
[  535.281746][ T5870] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024
[  535.302063][T12437] netlink: 'syz.4.1657': attribute type 10 has an invalid length.
[  535.310847][T12437] bond0: (slave wlan1): Opening slave failed
[  535.488417][T11847] usb 5-1: USB disconnect, device number 60
[  535.506939][ T5870] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40
[  535.544012][ T5870] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0
[  535.555772][ T5870] usb 1-1: Product: syz
[  535.563225][ T5870] usb 1-1: Manufacturer: syz
[  535.627897][ T5870] cdc_wdm 1-1:1.0: skipping garbage
[  535.634342][ T5870] cdc_wdm 1-1:1.0: skipping garbage
[  535.654640][ T5870] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device
[  535.665480][ T5870] cdc_wdm 1-1:1.0: Unknown control protocol
[  536.207381][    C0] cdc_wdm 1-1:1.0: Unexpected error -71
[  536.208648][  T986] usb 1-1: USB disconnect, device number 74
[  536.215081][    C0] wdm_int_callback: 5689 callbacks suppressed
[  536.215103][    C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71
[  536.231952][    C0] wdm_int_callback: 5689 callbacks suppressed
[  536.231974][    C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes
[  536.244076][    C0] cdc_wdm 1-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19
[  536.625364][    T9] usb 5-1: new high-speed USB device number 61 using dummy_hcd
[  536.655979][ T5870] usb 4-1: USB disconnect, device number 67
[  536.712358][T12460] loop2: detected capacity change from 0 to 7
[  536.720708][ T8659] Dev loop2: unable to read RDB block 7
[  536.726558][ T8659]  loop2: AHDI p1 p2 p3
[  536.730890][ T8659] loop2: partition table partially beyond EOD, truncated
[  536.739279][ T8659] loop2: p1 start 1601398130 is beyond EOD, truncated
[  536.746233][  T986] usb 1-1: new high-speed USB device number 75 using dummy_hcd
[  536.746731][ T8659] loop2: p2 start 1702059890 is beyond EOD, truncated
[  536.762164][T12460] Dev loop2: unable to read RDB block 7
[  536.767947][   T49] usb 2-1: new high-speed USB device number 98 using dummy_hcd
[  536.776959][T12460]  loop2: AHDI p1 p2 p3
[  536.781166][T12460] loop2: partition table partially beyond EOD, truncated
[  536.788864][T12460] loop2: p1 start 1601398130 is beyond EOD, truncated
[  536.796105][T12460] loop2: p2 start 1702059890 is beyond EOD, truncated
[  536.797484][    T9] usb 5-1: config 0 has an invalid interface number: 51 but max is 0
[  536.823768][    T9] usb 5-1: config 0 has an invalid interface number: 4 but max is 0
[  536.846902][    T9] usb 5-1: config 0 has 2 interfaces, different from the descriptor's value: 1
[  536.861365][    T9] usb 5-1: config 0 has no interface number 0
[  536.877858][    T9] usb 5-1: config 0 has no interface number 1
[  536.886599][    T9] usb 5-1: New USB device found, idVendor=cc35, idProduct=693f, bcdDevice=e7.0f
[  536.896700][    T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  536.904712][    T9] usb 5-1: Product: syz
[  536.907791][  T986] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32
[  536.909889][    T9] usb 5-1: Manufacturer: syz
[  536.929478][    T9] usb 5-1: SerialNumber: syz
[  536.932942][  T986] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config
[  536.939226][    T9] usb 5-1: config 0 descriptor??
[  536.950124][   T49] usb 2-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3
[  536.955746][    T9] cdc_acm 5-1:0.51: probe with driver cdc_acm failed with error -22
[  536.967944][   T49] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  536.979803][  T986] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66
[  536.993175][  T986] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9
[  537.010255][  T986] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024
[  537.024924][   T49] usb 2-1: config 0 descriptor??
[  537.027939][T12467] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE
[  537.032884][   T49] cp210x 2-1:0.0: cp210x converter detected
[  537.037594][T12467] IPv6: NLM_F_CREATE should be set when creating new route
[  537.037650][T12467] IPv6: NLM_F_CREATE should be set when creating new route
[  537.062910][  T986] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40
[  537.072251][  T986] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0
[  537.080731][  T986] usb 1-1: Product: syz
[  537.085162][  T986] usb 1-1: Manufacturer: syz
[  537.106401][  T986] cdc_wdm 1-1:1.0: skipping garbage
[  537.111682][  T986] cdc_wdm 1-1:1.0: skipping garbage
[  537.119566][  T986] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device
[  537.126096][  T986] cdc_wdm 1-1:1.0: Unknown control protocol
[  537.165762][  T986] usb 5-1: USB disconnect, device number 61
[  537.449023][   T49] cp210x 2-1:0.0: failed to get vendor val 0x0010 size 3: -32
[  537.467066][   T49] usb 2-1: cp210x converter now attached to ttyUSB0
[  537.625183][    T9] usb 3-1: new full-speed USB device number 73 using dummy_hcd
[  537.666763][ T6000] usb 2-1: USB disconnect, device number 98
[  537.676940][ T6000] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0
[  537.709730][ T6000] cp210x 2-1:0.0: device disconnected
[  537.773228][T12474] FAULT_INJECTION: forcing a failure.
[  537.773228][T12474] name failslab, interval 1, probability 0, space 0, times 0
[  537.787039][T12474] CPU: 0 UID: 0 PID: 12474 Comm: syz.4.1670 Not tainted syzkaller #0 PREEMPT(full) 
[  537.787068][T12474] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  537.787079][T12474] Call Trace:
[  537.787087][T12474]  <TASK>
[  537.787095][T12474]  dump_stack_lvl+0x189/0x250
[  537.787120][T12474]  ? __pfx____ratelimit+0x10/0x10
[  537.787144][T12474]  ? __pfx_dump_stack_lvl+0x10/0x10
[  537.787162][T12474]  ? __pfx__printk+0x10/0x10
[  537.787182][T12474]  ? kmalloc_reserve+0xbd/0x290
[  537.787204][T12474]  ? __lock_acquire+0x6b6/0x2cf0
[  537.787229][T12474]  should_fail_ex+0x414/0x560
[  537.787257][T12474]  should_failslab+0xa8/0x100
[  537.787290][T12474]  kmem_cache_alloc_noprof+0x74/0x6f0
[  537.787312][T12474]  ? skb_clone+0x212/0x3a0
[  537.787338][T12474]  skb_clone+0x212/0x3a0
[  537.787361][T12474]  __netlink_deliver_tap+0x404/0x850
[  537.787394][T12474]  ? netlink_deliver_tap+0x2e/0x1b0
[  537.787416][T12474]  netlink_deliver_tap+0x19c/0x1b0
[  537.787438][T12474]  netlink_unicast+0x7fa/0x9e0
[  537.787466][T12474]  ? __pfx_netlink_unicast+0x10/0x10
[  537.787487][T12474]  ? netlink_sendmsg+0x642/0xb30
[  537.787506][T12474]  ? skb_put+0x11b/0x210
[  537.787527][T12474]  netlink_sendmsg+0x805/0xb30
[  537.787557][T12474]  ? __pfx_netlink_sendmsg+0x10/0x10
[  537.787582][T12474]  ? aa_sock_msg_perm+0xf1/0x1b0
[  537.787602][T12474]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  537.787624][T12474]  ? __pfx_netlink_sendmsg+0x10/0x10
[  537.787647][T12474]  __sock_sendmsg+0x21c/0x270
[  537.787674][T12474]  ____sys_sendmsg+0x505/0x820
[  537.787699][T12474]  ? __pfx_____sys_sendmsg+0x10/0x10
[  537.787728][T12474]  ? import_iovec+0x74/0xa0
[  537.787749][T12474]  ___sys_sendmsg+0x21f/0x2a0
[  537.787772][T12474]  ? __pfx____sys_sendmsg+0x10/0x10
[  537.787798][T12474]  ? rcu_read_lock_any_held+0xb3/0x120
[  537.787843][T12474]  ? __fget_files+0x2a/0x420
[  537.787859][T12474]  ? __fget_files+0x3a0/0x420
[  537.787886][T12474]  __x64_sys_sendmsg+0x19b/0x260
[  537.787909][T12474]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  537.787938][T12474]  ? __pfx_ksys_write+0x10/0x10
[  537.787963][T12474]  ? do_syscall_64+0xbe/0xf80
[  537.787983][T12474]  do_syscall_64+0xfa/0xf80
[  537.788000][T12474]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  537.788017][T12474]  ? clear_bhb_loop+0x60/0xb0
[  537.788037][T12474]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  537.788053][T12474] RIP: 0033:0x7f378b98f749
[  537.788069][T12474] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  537.788084][T12474] RSP: 002b:00007f378c8ba038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  537.788103][T12474] RAX: ffffffffffffffda RBX: 00007f378bbe5fa0 RCX: 00007f378b98f749
[  537.788114][T12474] RDX: 0000000020000000 RSI: 0000200000006040 RDI: 0000000000000006
[  537.788132][T12474] RBP: 00007f378c8ba090 R08: 0000000000000000 R09: 0000000000000000
[  537.788142][T12474] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  537.788151][T12474] R13: 00007f378bbe6038 R14: 00007f378bbe5fa0 R15: 00007f378bd0fa28
[  537.788187][T12474]  </TASK>
[  537.791152][    T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64
[  538.109449][    T9] usb 3-1: New USB device found, idVendor=8380, idProduct=1850, bcdDevice= 0.00
[  538.118861][    T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  538.130384][    T9] usb 3-1: config 0 descriptor??
[  538.136192][T12471] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22
[  538.368193][ T6000] usb 1-1: USB disconnect, device number 75
[  538.694263][T12490] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1676'.
[  538.775755][T12492] program syz.1.1674 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  538.969092][    T9] betop 0003:8380:1850.0010: report_id 1146923772 is invalid
[  538.987861][    T9] betop 0003:8380:1850.0010: item 0 4 1 8 parsing failed
[  539.011968][    T9] betop 0003:8380:1850.0010: parse failed
[  539.029257][    T9] betop 0003:8380:1850.0010: probe with driver betop failed with error -22
[  539.573448][    T9] usb 3-1: USB disconnect, device number 73
[  540.142811][T12512] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(6)
[  540.149381][T12512] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus)
[  540.184401][T12515] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1681'.
[  540.329141][T12512] vhci_hcd vhci_hcd.0: Device attached
[  540.657465][T12525] netlink: 'syz.4.1683': attribute type 10 has an invalid length.
[  540.678637][T12525] netlink: 'syz.4.1683': attribute type 10 has an invalid length.
[  540.697454][   T49] usb 34-1: SetAddress Request (23) to port 0
[  540.745236][   T49] usb 34-1: new SuperSpeed USB device number 23 using vhci_hcd
[  540.810567][T12513] vhci_hcd: connection closed
[  540.814865][ T3526] vhci_hcd: stop threads
[  540.823992][ T3526] vhci_hcd: release socket
[  540.837142][ T3526] vhci_hcd: disconnect device
[  540.905009][   T49] usb 34-1: enqueue for inactive port 0
[  541.366254][   T49] usb usb34-port1: attempt power cycle
[  541.517077][T12536] netlink: 'syz.3.1687': attribute type 13 has an invalid length.
[  541.553572][T12537] netlink: 'syz.2.1686': attribute type 13 has an invalid length.
[  541.828575][T12536] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  541.896719][T12537] bridge0: port 2(bridge_slave_1) entered blocking state
[  541.903889][T12537] bridge0: port 2(bridge_slave_1) entered listening state
[  541.911204][T12537] bridge0: port 1(bridge_slave_0) entered blocking state
[  541.918382][T12537] bridge0: port 1(bridge_slave_0) entered listening state
[  542.007764][   T49] usb usb34-port1: unable to enumerate USB device
[  542.025832][T12537] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  542.070867][T12546] netlink: 'syz.1.1689': attribute type 10 has an invalid length.
[  542.192303][T12546] team0: Port device netdevsim0 added
[  543.075407][ T5929] usb 1-1: new full-speed USB device number 76 using dummy_hcd
[  543.236411][ T5929] usb 1-1: device descriptor read/64, error -71
[  543.285012][T12559] syzkaller0: entered promiscuous mode
[  543.291635][T12559] syzkaller0: entered allmulticast mode
[  543.505169][ T5929] usb 1-1: new full-speed USB device number 77 using dummy_hcd
[  543.741088][ T5929] usb 1-1: device descriptor read/64, error -71
[  543.886343][ T5929] usb usb1-port1: attempt power cycle
[  544.265421][ T5929] usb 1-1: new full-speed USB device number 78 using dummy_hcd
[  544.320873][ T5929] usb 1-1: device descriptor read/8, error -71
[  544.545381][   T24] usb 5-1: new full-speed USB device number 62 using dummy_hcd
[  544.575314][ T5929] usb 1-1: new full-speed USB device number 79 using dummy_hcd
[  544.734470][ T5929] usb 1-1: device descriptor read/8, error -71
[  544.822866][   T24] usb 5-1: config 4 has an invalid interface number: 7 but max is 0
[  544.849775][T12587] loop2: detected capacity change from 0 to 7
[  544.868879][ T5929] usb usb1-port1: unable to enumerate USB device
[  544.896556][   T24] usb 5-1: config 4 has no interface number 0
[  544.921198][ T8659] Dev loop2: unable to read RDB block 7
[  544.944655][ T8659]  loop2: AHDI p1 p2 p3
[  544.955916][ T8659] loop2: partition table partially beyond EOD, truncated
[  544.971017][   T24] usb 5-1: config 4 interface 7 altsetting 119 has a duplicate endpoint with address 0xB, skipping
[  545.012797][ T8659] loop2: p1 start 1601398130 is beyond EOD, truncated
[  545.020805][   T24] usb 5-1: config 4 interface 7 has no altsetting 0
[  545.028842][ T8659] loop2: p2 start 1702059890 is beyond EOD, truncated
[  545.084008][T12587] Dev loop2: unable to read RDB block 7
[  545.129374][   T24] usb 5-1: New USB device found, idVendor=05c6, idProduct=9079, bcdDevice=1e.58
[  545.144459][T12587]  loop2: AHDI p1 p2 p3
[  545.175314][T12587] loop2: partition table partially beyond EOD, truncated
[  545.211777][   T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  545.220135][T12587] loop2: p1 start 1601398130 is beyond EOD, truncated
[  545.263553][T12587] loop2: p2 start 1702059890 is beyond EOD, truncated
[  545.272199][   T24] usb 5-1: Product: syz
[  545.331579][   T24] usb 5-1: Manufacturer: syz
[  545.347248][   T24] usb 5-1: SerialNumber: syz
[  545.372987][T12577] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  545.445655][T12577] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  545.861579][T12577] ipip0: left promiscuous mode
[  545.875486][T12577] ipip0: left allmulticast mode
[  545.888824][T12577] bond1: left promiscuous mode
[  545.901040][T12577] bond1: left allmulticast mode
[  545.914391][T12577] macvtap1: left promiscuous mode
[  545.927888][T12577] macvtap1: left allmulticast mode
[  545.960231][ T5967] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  545.994744][ T5967] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  546.031265][ T5967] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  546.042063][ T5912] usb 5-1: USB disconnect, device number 62
[  546.155164][ T5913] usb 4-1: new high-speed USB device number 68 using dummy_hcd
[  546.325420][ T5913] usb 4-1: Using ep0 maxpacket: 32
[  546.348806][ T5913] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024
[  546.367126][ T5913] usb 4-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79
[  546.425897][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2
[  546.441602][ T5913] usb 4-1: Product: syz
[  546.486983][ T5913] usb 4-1: Manufacturer: syz
[  546.491631][ T5913] usb 4-1: SerialNumber: syz
[  546.498377][ T5913] usb 4-1: config 0 descriptor??
[  546.504340][T12603] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  546.922019][    T9] usb 4-1: USB disconnect, device number 68
[  547.881652][T12631] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1711'.
[  547.896020][T12631] ip6gretap0: entered promiscuous mode
[  547.904472][T12631] macvtap4: entered promiscuous mode
[  547.946064][T12631] macvtap4: entered allmulticast mode
[  547.951594][T12631] ip6gretap0: entered allmulticast mode
[  547.976107][T12635] netlink: 'syz.3.1712': attribute type 1 has an invalid length.
[  547.995232][    T9] usb 3-1: new high-speed USB device number 74 using dummy_hcd
[  548.066391][T12633] ip6gretap0: left allmulticast mode
[  548.071821][T12633] ip6gretap0: left promiscuous mode
[  548.185157][    T9] usb 3-1: Using ep0 maxpacket: 16
[  548.216460][    T9] usb 3-1: config 0 has no interfaces?
[  548.234145][T12637] bond4: (slave ip6gretap1): Enslaving as a backup interface with an up link
[  548.254375][    T9] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  548.313654][T12639] veth5: entered promiscuous mode
[  548.318783][    T9] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  548.321922][T12639] bond4: (slave veth5): Enslaving as a backup interface with a down link
[  548.354874][    T9] usb 3-1: Manufacturer: syz
[  548.396776][    T9] usb 3-1: config 0 descriptor??
[  548.535181][ T5838] usb 4-1: new high-speed USB device number 69 using dummy_hcd
[  548.546987][T12647] loop2: detected capacity change from 0 to 7
[  548.566991][T12647] Dev loop2: unable to read RDB block 7
[  548.573659][T12647]  loop2: AHDI p1 p2 p3
[  548.578116][T12647] loop2: partition table partially beyond EOD, truncated
[  548.590334][T12647] loop2: p1 start 1601398130 is beyond EOD, truncated
[  548.597794][T12647] loop2: p2 start 1702059890 is beyond EOD, truncated
[  548.733653][ T5838] usb 4-1: Using ep0 maxpacket: 8
[  548.788456][ T5838] usb 4-1: unable to get BOS descriptor or descriptor too short
[  548.797677][ T5838] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xEE, changing to 0x8E
[  548.996618][ T5838] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7
[  549.181427][ T5838] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  549.215140][ T5838] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1
[  549.225245][ T5838] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xF has invalid wMaxPacketSize 0
[  549.239182][ T5838] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 4
[  549.258132][ T5838] usb 4-1: New USB device found, idVendor=0763, idProduct=1002, bcdDevice=5f.84
[  549.268150][ T5838] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  549.278649][ T5838] usb 4-1: Product: syz
[  549.283714][ T5838] usb 4-1: Manufacturer: syz
[  549.295410][ T5838] usb 4-1: SerialNumber: syz
[  549.454025][ T5838] usb 4-1: config 0 descriptor??
[  549.513181][T12637] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22
[  549.522140][T12637] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22
[  549.539055][ T5838] usb 4-1: Quirk or no altset; falling back to MIDI 1.0
[  549.694077][T12663] netlink: 'syz.4.1719': attribute type 10 has an invalid length.
[  549.722239][T12663] netlink: 'syz.4.1719': attribute type 10 has an invalid length.
[  549.782262][    T9] usb 4-1: USB disconnect, device number 69
[  550.656070][ T5838] usb 3-1: USB disconnect, device number 74
[  551.960721][T12677] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  551.986516][T12677] Bluetooth: hci0: Opcode 0x0406 failed: -4
[  552.087100][T12677] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  552.094218][T12677] Bluetooth: hci3: Opcode 0x0406 failed: -4
[  552.157296][T12677] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  552.163326][T12677] Bluetooth: hci1: Opcode 0x0406 failed: -4
[  552.201855][T12677] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  552.225319][T12677] Bluetooth: hci4: Opcode 0x0406 failed: -4
[  552.267505][T12677] Bluetooth: hci2: Opcode 0x0c1a failed: -4
[  552.285485][T12677] Bluetooth: hci2: Opcode 0x0406 failed: -4
[  552.879228][T12703] loop2: detected capacity change from 0 to 7
[  552.957421][ T8659] Dev loop2: unable to read RDB block 7
[  552.984624][ T8659]  loop2: AHDI p1 p2 p3
[  553.019871][ T8659] loop2: partition table partially beyond EOD, truncated
[  553.039227][T12707] netlink: 'syz.4.1732': attribute type 10 has an invalid length.
[  553.039796][ T8659] loop2: p1 start 1601398130 is beyond EOD, truncated
[  553.093542][ T8659] loop2: p2 start 1702059890 is beyond EOD, truncated
[  553.108235][T12703] Dev loop2: unable to read RDB block 7
[  553.124148][T12703]  loop2: AHDI p1 p2 p3
[  553.125367][T12707] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1732'.
[  553.138643][T12703] loop2: partition table partially beyond EOD, truncated
[  553.172666][T12707] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check.
[  553.189186][T12703] loop2: p1 start 1601398130 is beyond EOD, truncated
[  553.210188][T12703] loop2: p2 start 1702059890 is beyond EOD, truncated
[  553.235200][ T5847] Bluetooth: hci0: command 0x0406 tx timeout
[  553.285198][T12597] usb 4-1: new high-speed USB device number 70 using dummy_hcd
[  553.445328][T12597] usb 4-1: Using ep0 maxpacket: 16
[  553.452527][T12597] usb 4-1: config 0 has an invalid interface number: 69 but max is 0
[  553.461720][T12597] usb 4-1: config 0 has no interface number 0
[  553.473380][T12597] usb 4-1: New USB device found, idVendor=05ac, idProduct=0274, bcdDevice=f9.c2
[  553.548829][T12725] netlink: 'syz.4.1736': attribute type 13 has an invalid length.
[  553.718059][T12725] 8021q: adding VLAN 0 to HW filter on device bond0
[  553.726663][T12725] 8021q: adding VLAN 0 to HW filter on device team0
[  553.773134][T12597] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  553.781526][T12725] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  553.812319][ T5913] usb 1-1: new high-speed USB device number 80 using dummy_hcd
[  553.836515][T12597] usb 4-1: Product: syz
[  553.852457][T12597] usb 4-1: Manufacturer: syz
[  553.859383][T12597] usb 4-1: SerialNumber: syz
[  553.872123][T12597] usb 4-1: config 0 descriptor??
[  553.890499][T12597] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.69/input/input64
[  553.925190][ T5838] usb 3-1: new high-speed USB device number 75 using dummy_hcd
[  553.985144][ T5913] usb 1-1: Using ep0 maxpacket: 16
[  553.996394][ T5913] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0
[  554.024900][ T5913] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  554.089070][ T5913] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  554.115304][ T5847] Bluetooth: hci3: command 0x0406 tx timeout
[  554.122695][ T5913] usb 1-1: Product: syz
[  554.130273][T12708] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  554.135274][ T5913] usb 1-1: Manufacturer: syz
[  554.145428][ T5838] usb 3-1: Using ep0 maxpacket: 8
[  554.152318][ T5913] usb 1-1: SerialNumber: syz
[  554.172929][ T5913] usb 1-1: config 0 descriptor??
[  554.178381][T12708] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  554.196088][ T5847] Bluetooth: hci1: command 0x0406 tx timeout
[  554.204348][ T5838] usb 3-1: config 0 has an invalid interface number: 88 but max is 3
[  554.234721][ T5913] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0)
[  554.256423][ T5838] usb 3-1: config 0 has an invalid interface number: 250 but max is 3
[  554.271807][ T5913] em28xx 1-1:0.0: DVB interface 0 found: bulk
[  554.275550][ T5847] Bluetooth: hci2: command 0x0406 tx timeout
[  554.284325][ T5847] Bluetooth: hci4: command 0x0406 tx timeout
[  554.285115][ T5838] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  554.303058][ T5189] bcm5974 4-1:0.69: could not read from device
[  554.325300][ T5189] bcm5974 4-1:0.69: could not read from device
[  554.369024][ T5189] bcm5974 4-1:0.69: could not read from device
[  554.387546][T12597] usb 4-1: USB disconnect, device number 70
[  554.459927][ T5838] usb 3-1: config 0 has 2 interfaces, different from the descriptor's value: 4
[  554.483379][ T5838] usb 3-1: config 0 has no interface number 0
[  554.493298][ T5838] usb 3-1: config 0 has no interface number 1
[  554.503068][ T5838] usb 3-1: config 0 interface 88 has no altsetting 0
[  554.517330][ T5838] usb 3-1: config 0 interface 250 has no altsetting 0
[  554.940421][ T5838] usb 3-1: New USB device found, idVendor=03f0, idProduct=581d, bcdDevice=12.b3
[  554.949547][ T5838] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  554.966724][ T5838] usb 3-1: config 0 descriptor??
[  554.997993][ T5913] em28xx 1-1:0.0: unknown em28xx chip ID (0)
[  555.348833][ T5837] Bluetooth: hci0: command 0x0406 tx timeout
[  555.413380][ T5913] em28xx 1-1:0.0: reading from i2c device at 0xa0 failed (error=-5)
[  555.421504][ T5913] em28xx 1-1:0.0: board has no eeprom
[  555.476695][T12746] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1740'.
[  555.750442][ T5913] em28xx 1-1:0.0: Identified as PCTV tripleStick (292e) (card=94)
[  555.768642][ T5913] em28xx 1-1:0.0: dvb set to bulk mode.
[  555.780714][ T5912] em28xx 1-1:0.0: Binding DVB extension
[  556.161595][ T5912] em28xx 1-1:0.0: Registering input extension
[  556.193226][T12597] usb 1-1: USB disconnect, device number 80
[  556.211027][T12597] em28xx 1-1:0.0: Disconnecting em28xx
[  556.212573][ T5837] Bluetooth: hci3: command 0x0406 tx timeout
[  556.227589][T12597] em28xx 1-1:0.0: Closing input extension
[  556.285381][ T5837] Bluetooth: hci1: command 0x0406 tx timeout
[  556.307737][T12597] em28xx 1-1:0.0: Freeing device
[  556.365200][ T5837] Bluetooth: hci4: command 0x0406 tx timeout
[  556.366786][T12733] Bluetooth: hci2: command 0x0406 tx timeout
[  556.666368][ T5912] usb 5-1: new high-speed USB device number 63 using dummy_hcd
[  556.682111][ T5838] usb 3-1: string descriptor 0 read error: -71
[  556.735362][ T5838] usb 3-1: USB disconnect, device number 75
[  556.868827][ T5912] usb 5-1: Using ep0 maxpacket: 8
[  556.893135][T12764] FAULT_INJECTION: forcing a failure.
[  556.893135][T12764] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  556.906325][ T5912] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b
[  556.921390][ T5912] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  556.942598][T12764] CPU: 1 UID: 0 PID: 12764 Comm: syz.0.1747 Not tainted syzkaller #0 PREEMPT(full) 
[  556.942626][T12764] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  556.942636][T12764] Call Trace:
[  556.942643][T12764]  <TASK>
[  556.942650][T12764]  dump_stack_lvl+0x189/0x250
[  556.942672][T12764]  ? __pfx____ratelimit+0x10/0x10
[  556.942693][T12764]  ? __pfx_dump_stack_lvl+0x10/0x10
[  556.942710][T12764]  ? __pfx__printk+0x10/0x10
[  556.942729][T12764]  ? __might_fault+0xb0/0x130
[  556.942766][T12764]  should_fail_ex+0x414/0x560
[  556.942792][T12764]  _copy_from_iter+0x1cd/0x1630
[  556.942816][T12764]  ? __build_skb_around+0x22d/0x3c0
[  556.942837][T12764]  ? __pfx__copy_from_iter+0x10/0x10
[  556.942856][T12764]  ? __alloc_skb+0x2f1/0x430
[  556.942877][T12764]  ? __pfx___alloc_skb+0x10/0x10
[  556.942895][T12764]  ? netlink_sendmsg+0x642/0xb30
[  556.942911][T12764]  ? skb_put+0x11b/0x210
[  556.942927][T12764]  netlink_sendmsg+0x6b2/0xb30
[  556.942952][T12764]  ? __pfx_netlink_sendmsg+0x10/0x10
[  556.942973][T12764]  ? aa_sock_msg_perm+0xf1/0x1b0
[  556.942988][T12764]  ? bpf_lsm_socket_sendmsg+0x9/0x20
[  556.943006][T12764]  ? __pfx_netlink_sendmsg+0x10/0x10
[  556.943022][T12764]  __sock_sendmsg+0x21c/0x270
[  556.943043][T12764]  ____sys_sendmsg+0x505/0x820
[  556.943062][T12764]  ? __pfx_____sys_sendmsg+0x10/0x10
[  556.943084][T12764]  ? import_iovec+0x74/0xa0
[  556.943099][T12764]  ___sys_sendmsg+0x21f/0x2a0
[  556.943116][T12764]  ? __pfx____sys_sendmsg+0x10/0x10
[  556.943135][T12764]  ? rcu_read_lock_any_held+0xb3/0x120
[  556.943172][T12764]  ? __fget_files+0x2a/0x420
[  556.943183][T12764]  ? __fget_files+0x3a0/0x420
[  556.943203][T12764]  __x64_sys_sendmsg+0x19b/0x260
[  556.943220][T12764]  ? __pfx___x64_sys_sendmsg+0x10/0x10
[  556.943242][T12764]  ? __pfx_ksys_write+0x10/0x10
[  556.943261][T12764]  ? do_syscall_64+0xbe/0xf80
[  556.943276][T12764]  do_syscall_64+0xfa/0xf80
[  556.943290][T12764]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  556.943304][T12764]  ? clear_bhb_loop+0x60/0xb0
[  556.943321][T12764]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  556.943333][T12764] RIP: 0033:0x7f380b38f749
[  556.943346][T12764] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  556.943358][T12764] RSP: 002b:00007f38095f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  556.943374][T12764] RAX: ffffffffffffffda RBX: 00007f380b5e5fa0 RCX: 00007f380b38f749
[  556.943383][T12764] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004
[  556.943391][T12764] RBP: 00007f38095f6090 R08: 0000000000000000 R09: 0000000000000000
[  556.943399][T12764] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  556.943407][T12764] R13: 00007f380b5e6038 R14: 00007f380b5e5fa0 R15: 00007f380b70fa28
[  556.943429][T12764]  </TASK>
[  557.219731][    C1] bridge0: port 1(bridge_slave_0) entered learning state
[  557.228918][    C1] bridge0: port 2(bridge_slave_1) entered learning state
[  557.252601][ T5912] pvrusb2: Hardware description: Terratec Grabster AV400
[  557.287810][ T5912] pvrusb2: **********
[  557.292173][ T5912] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental.
[  557.302419][ T5912] pvrusb2: Important functionality might not be entirely working.
[  557.310850][ T5912] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver.
[  557.329946][ T5912] pvrusb2: **********
[  557.522314][ T2346] pvrusb2: Invalid write control endpoint
[  557.571763][T12776] loop5: detected capacity change from 0 to 7
[  557.601074][    C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  557.610303][    C1] buffer_io_error: 313 callbacks suppressed
[  557.610315][    C1] Buffer I/O error on dev loop5, logical block 0, async page read
[  557.635518][    C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  557.644683][    C1] Buffer I/O error on dev loop5, logical block 0, async page read
[  557.654337][    C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  557.663504][    C1] Buffer I/O error on dev loop5, logical block 0, async page read
[  557.671639][    C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  557.680779][    C1] Buffer I/O error on dev loop5, logical block 0, async page read
[  557.688934][    C1] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  557.698087][    C1] Buffer I/O error on dev loop5, logical block 0, async page read
[  557.708078][    C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  557.717283][    C0] Buffer I/O error on dev loop5, logical block 0, async page read
[  557.727669][    C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  557.736828][    C0] Buffer I/O error on dev loop5, logical block 0, async page read
[  557.744674][T12776] ldm_validate_partition_table(): Disk read failed.
[  557.752989][T12754] pvrusb2: Invalid write control endpoint
[  557.810342][    C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  557.819650][    C0] Buffer I/O error on dev loop5, logical block 0, async page read
[  557.831152][ T2346] pvrusb2: Invalid write control endpoint
[  557.835158][    C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  557.846272][    C0] Buffer I/O error on dev loop5, logical block 0, async page read
[  557.853081][ T2346] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work.
[  557.870529][T12775] netlink: 'syz.2.1746': attribute type 10 has an invalid length.
[  557.884059][T12775] netlink: 'syz.2.1746': attribute type 10 has an invalid length.
[  557.947593][    C0] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2
[  557.956825][    C0] Buffer I/O error on dev loop5, logical block 0, async page read
[  557.965151][T12776] Dev loop5: unable to read RDB block 0
[  557.982237][T12776]  loop5: unable to read partition table
[  557.992161][ T2346] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device.
[  558.004182][T12776] loop5: partition table beyond EOD, truncated
[  558.025162][T12776] loop_reread_partitions: partition scan of loop5 (���������C�j̖�P=ý?�}X���	���%��`��ր���{��֐�ȵ4FLQk݊) failed (rc=-5)
[  558.171513][ T5927] usb 1-1: new high-speed USB device number 81 using dummy_hcd
[  558.179397][ T2346] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups.
[  558.211506][ T2346] pvrusb2: Device being rendered inoperable
[  558.221201][ T2346] cx25840 1-0044: Unable to detect h/w, assuming cx23887
[  558.235265][ T2346] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a)
[  558.304216][T12784] FAULT_INJECTION: forcing a failure.
[  558.304216][T12784] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  558.325809][  T986] usb 5-1: USB disconnect, device number 63
[  558.352100][T12784] CPU: 1 UID: 0 PID: 12784 Comm: syz.3.1749 Not tainted syzkaller #0 PREEMPT(full) 
[  558.352117][T12784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  558.352124][T12784] Call Trace:
[  558.352129][T12784]  <TASK>
[  558.352134][T12784]  dump_stack_lvl+0x189/0x250
[  558.352151][T12784]  ? __pfx____ratelimit+0x10/0x10
[  558.352166][T12784]  ? __pfx_dump_stack_lvl+0x10/0x10
[  558.352177][T12784]  ? __pfx__printk+0x10/0x10
[  558.352190][T12784]  ? __might_fault+0xb0/0x130
[  558.352208][T12784]  should_fail_ex+0x414/0x560
[  558.352224][T12784]  _copy_from_user+0x2d/0xb0
[  558.352235][T12784]  do_ipv6_setsockopt+0x23e/0x2eb0
[  558.352252][T12784]  ? get_pid_task+0x20/0x1f0
[  558.352264][T12784]  ? __pfx_do_ipv6_setsockopt+0x10/0x10
[  558.352279][T12784]  ? __pfx_aa_label_sk_perm+0x10/0x10
[  558.352294][T12784]  ? __lock_acquire+0x6b6/0x2cf0
[  558.352307][T12784]  ? __pfx___might_resched+0x10/0x10
[  558.352331][T12784]  ? ksys_write+0x1cb/0x250
[  558.352347][T12784]  ? __mutex_unlock_slowpath+0x1a1/0x730
[  558.352356][T12784]  ? aa_sk_perm+0x15f/0x920
[  558.352366][T12784]  ? aa_sk_perm+0x7ee/0x920
[  558.352378][T12784]  ? __pfx_aa_sk_perm+0x10/0x10
[  558.352388][T12784]  ? aa_sock_opt_perm+0xff/0x1a0
[  558.352400][T12784]  ipv6_setsockopt+0x59/0x170
[  558.352413][T12784]  ? __pfx_sock_common_setsockopt+0x10/0x10
[  558.352429][T12784]  do_sock_setsockopt+0x17c/0x1b0
[  558.352442][T12784]  __x64_sys_setsockopt+0x13f/0x1b0
[  558.352456][T12784]  do_syscall_64+0xfa/0xf80
[  558.352466][T12784]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  558.352476][T12784]  ? clear_bhb_loop+0x60/0xb0
[  558.352487][T12784]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  558.352496][T12784] RIP: 0033:0x7f8091d8f749
[  558.352507][T12784] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  558.352515][T12784] RSP: 002b:00007f8092b5e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  558.352527][T12784] RAX: ffffffffffffffda RBX: 00007f8091fe5fa0 RCX: 00007f8091d8f749
[  558.352535][T12784] RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000005
[  558.352541][T12784] RBP: 00007f8092b5e090 R08: 00000000000003d0 R09: 0000000000000000
[  558.352547][T12784] R10: 0000200000000400 R11: 0000000000000246 R12: 0000000000000001
[  558.352554][T12784] R13: 00007f8091fe6038 R14: 00007f8091fe5fa0 R15: 00007f809210fa28
[  558.352569][T12784]  </TASK>
[  558.626830][ T2346] pvrusb2: Attached sub-driver cx25840
[  558.632438][ T2346] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[  558.642533][ T2346] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[  558.842424][ T5927] usb 1-1: config 1 has an invalid interface number: 10 but max is 2
[  558.851916][ T5927] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config
[  558.871511][ T5927] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3
[  558.887456][   T30] audit: type=1326 audit(1764857247.063:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12789 comm="syz.2.1752" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f09d038f749 code=0x0
[  558.889190][ T5927] usb 1-1: config 1 has no interface number 0
[  558.917852][ T5927] usb 1-1: config 1 interface 10 altsetting 36 has 0 endpoint descriptors, different from the interface descriptor's value: 1
[  558.931686][ T5927] usb 1-1: config 1 interface 10 has no altsetting 0
[  558.935301][ T5838] usb 4-1: new high-speed USB device number 71 using dummy_hcd
[  558.943559][ T5927] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00
[  558.956343][ T5927] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  558.964717][ T5927] usb 1-1: SerialNumber: syz
[  558.972582][T12796] netlink: 'syz.1.1751': attribute type 13 has an invalid length.
[  558.998991][T12796] bridge0: port 2(bridge_slave_1) entered blocking state
[  559.006285][T12796] bridge0: port 2(bridge_slave_1) entered forwarding state
[  559.013841][T12796] bridge0: port 1(bridge_slave_0) entered blocking state
[  559.021059][T12796] bridge0: port 1(bridge_slave_0) entered forwarding state
[  559.105163][ T5838] usb 4-1: Using ep0 maxpacket: 16
[  559.117316][ T5838] usb 4-1: too many configurations: 123, using maximum allowed: 8
[  559.136927][ T5838] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  559.148616][ T5838] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  559.159985][T12796] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  559.195748][ T5838] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  559.216332][ T5838] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  559.235588][ T5838] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  559.254331][ T5927] usb 1-1: USB disconnect, device number 81
[  559.279780][ T5838] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  559.309497][ T5838] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  559.516078][ T5838] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  559.560989][ T5838] usb 4-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00
[  559.579202][ T5838] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=45
[  559.665166][ T5838] usb 4-1: SerialNumber: syz
[  559.724472][ T5838] usb 4-1: config 0 descriptor??
[  559.736473][ T5838] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input67
[  561.349167][ T5189] bcm5974 4-1:0.0: could not read from device
[  561.349608][ T5838] usb 4-1: USB disconnect, device number 71
[  561.394639][ T8484] bcm5974 4-1:0.0: could not read from device
[  561.522395][T12817] input: syz0 as /devices/virtual/input/input69
[  561.592527][   T30] audit: type=1326 audit(1764857249.753:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12819 comm="syz.3.1760" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8091d8f749 code=0x0
[  562.541935][T12856] netlink: 'syz.3.1769': attribute type 13 has an invalid length.
[  562.595766][T12856] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  562.620049][T12858] xt_time: invalid argument - start or stop time greater than 23:59:59
[  562.685755][T12860] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1772'.
[  562.694850][T12860] netem: change failed
[  562.919524][ T1302] ieee802154 phy0 wpan0: encryption failed: -22
[  562.941690][ T1302] ieee802154 phy1 wpan1: encryption failed: -22
[  563.785194][ T5838] usb 2-1: new high-speed USB device number 99 using dummy_hcd
[  563.824668][T12876] ip6_tunnel: non-ECT from fc02:0000:0000:0000:0000:0000:0000:0000 with DS=0x6
[  563.967596][ T5838] usb 2-1: config 1 has an invalid interface number: 24 but max is 2
[  563.975896][ T5838] usb 2-1: config 1 has an invalid interface number: 43 but max is 2
[  563.987980][ T5838] usb 2-1: config 1 has an invalid interface number: 142 but max is 2
[  564.004869][ T5838] usb 2-1: config 1 has an invalid interface number: 33 but max is 2
[  564.036967][ T5838] usb 2-1: config 1 has an invalid descriptor of length 250, skipping remainder of the config
[  564.050760][ T5838] usb 2-1: config 1 has 4 interfaces, different from the descriptor's value: 3
[  564.062701][ T5838] usb 2-1: config 1 has no interface number 0
[  564.071444][ T5838] usb 2-1: config 1 has no interface number 1
[  564.080313][ T5838] usb 2-1: config 1 has no interface number 2
[  564.086910][ T5838] usb 2-1: config 1 has no interface number 3
[  564.096837][ T5838] usb 2-1: config 1 interface 24 altsetting 64 endpoint 0x5 has invalid maxpacket 487, setting to 64
[  564.112255][ T5838] usb 2-1: config 1 interface 24 altsetting 64 bulk endpoint 0x1 has invalid maxpacket 64
[  564.115343][ T6000] usb 3-1: new high-speed USB device number 76 using dummy_hcd
[  564.123045][ T5838] usb 2-1: config 1 interface 43 altsetting 6 has a duplicate endpoint with address 0xD, skipping
[  564.148770][ T5838] usb 2-1: config 1 interface 43 altsetting 6 has a duplicate endpoint with address 0xB, skipping
[  564.171931][ T5838] usb 2-1: config 1 interface 43 altsetting 6 has 5 endpoint descriptors, different from the interface descriptor's value: 7
[  564.189438][ T5838] usb 2-1: too many endpoints for config 1 interface 142 altsetting 174: 111, using maximum allowed: 30
[  564.201548][ T5838] usb 2-1: config 1 interface 142 altsetting 174 endpoint 0xF has invalid maxpacket 1023, setting to 64
[  564.213506][ T5838] usb 2-1: config 1 interface 142 altsetting 174 has 2 endpoint descriptors, different from the interface descriptor's value: 111
[  564.227749][ T5838] usb 2-1: config 1 interface 33 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 14
[  564.242570][ T5838] usb 2-1: config 1 interface 24 has no altsetting 0
[  564.250293][ T5838] usb 2-1: config 1 interface 43 has no altsetting 0
[  564.257950][ T5838] usb 2-1: config 1 interface 142 has no altsetting 0
[  564.266195][ T5838] usb 2-1: config 1 interface 33 has no altsetting 0
[  564.392428][ T5838] usb 2-1: New USB device found, idVendor=2040, idProduct=826d, bcdDevice=b3.ae
[  564.395314][ T6000] usb 3-1: Using ep0 maxpacket: 16
[  564.402404][ T5838] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  564.419656][ T6000] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  564.435866][ T6000] usb 3-1: config 0 interface 0 has no altsetting 0
[  564.438921][ T5838] usb 2-1: Product: 鬁巉현託㺳뻜擰踍趌鬄Ҕ砃먧柦儋ꐋ합벓侁㟼파Ⳝ⒆浪聦蘝蠵烈끏뛧ȭ曄휳꾤䅜䊎쓃뀞ゅ찫ੑ譞᫴塥
[  564.460795][ T5838] usb 2-1: Manufacturer: п
[  564.465831][ T5838] usb 2-1: SerialNumber: 筛異〔⬿⾮왫蒄쑬茚枽후⿽图栖淑឵㵀揩ᗝⶖ齈ꑲ惘鬿ꎑ㠖ὤ㳻ꆕ톄㉻ꈈ쑷꧲䠝䴼賵䈖謬鉶盦ᒎ퇳곊挽뿌蕴ᾼ噿沋率왈鹼왝蕰ᗉᕙ촶㑃ꭆ䇜敤毟♡샫ブ㪘ࣉ惥杷曱߮
[  564.494762][ T6000] usb 3-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20
[  564.505243][ T6000] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  564.513339][ T6000] usb 3-1: Product: syz
[  564.517827][ T6000] usb 3-1: Manufacturer: syz
[  564.522518][ T6000] usb 3-1: SerialNumber: syz
[  564.529849][ T6000] usb 3-1: config 0 descriptor??
[  564.542990][T12870] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  564.719954][T12892] can: request_module (can-proto-0) failed.
[  564.754533][    C0] imon 3-1:0.0: imon usb_rx_callback_intf0: status(-71)
[  564.795948][ T6000] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input71
[  564.826647][ T6000] imon:send_packet: packet tx failed (-71)
[  564.834220][ T5838] cdc_ether 2-1:1.33: skipping garbage
[  564.844624][ T5838] cdc_ether 2-1:1.33: skipping garbage
[  564.855512][ T6000] imon 3-1:0.0: panel buttons/knobs setup failed
[  564.862077][ T5838] cdc_ether 2-1:1.33: skipping garbage
[  564.872075][ T5838] cdc_ether 2-1:1.33: skipping garbage
[  564.882101][ T5838] cdc_ether 2-1:1.33: skipping garbage
[  564.893276][ T5838] cdc_ether 2-1:1.33: skipping garbage
[  564.905180][ T5838] cdc_ether 2-1:1.33: skipping garbage
[  564.910877][ T5838] usb 2-1: bad CDC descriptors
[  564.924574][ T5838] usb 2-1: USB disconnect, device number 99
[  565.004516][ T6000] rc_core: IR keymap rc-imon-pad not found
[  565.020287][ T6000] Registered IR keymap rc-empty
[  565.025453][ T6000] imon 3-1:0.0: Looks like you're trying to use an IR protocol this device does not support
[  565.042033][ T6000] imon 3-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol
[  565.061428][ T6000] imon:send_packet: packet tx failed (-71)
[  565.085460][ T6000] imon 3-1:0.0: remote input dev register failed
[  565.091952][ T6000] imon 3-1:0.0: imon_init_intf0: rc device setup failed
[  565.141695][ T6000] imon 3-1:0.0: unable to initialize intf0, err 0
[  565.156738][ T6000] imon:imon_probe: failed to initialize context!
[  565.163110][ T6000] imon 3-1:0.0: unable to register, err -19
[  565.196185][ T6000] usb 3-1: USB disconnect, device number 76
[  565.505172][ T6000] usb 3-1: new high-speed USB device number 77 using dummy_hcd
[  566.175212][ T6000] usb 3-1: Using ep0 maxpacket: 16
[  566.188654][ T6000] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  566.206457][ T6000] usb 3-1: config 0 interface 0 has no altsetting 0
[  566.215696][ T6000] usb 3-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20
[  566.224984][ T6000] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  566.240123][ T6000] usb 3-1: Product: syz
[  566.244325][ T6000] usb 3-1: Manufacturer: syz
[  566.249137][ T6000] usb 3-1: SerialNumber: syz
[  566.266381][ T6000] usb 3-1: config 0 descriptor??
[  566.471629][T12925] trusted_key: encrypted_key: hex blob is missing
[  566.557643][ T6000] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input74
[  566.606961][T12930] netlink: 'syz.4.1791': attribute type 5 has an invalid length.
[  566.635180][T12930] netlink: 3657 bytes leftover after parsing attributes in process `syz.4.1791'.
[  566.935230][ T6000] rc_core: IR keymap rc-imon-pad not found
[  566.941147][ T6000] Registered IR keymap rc-empty
[  567.095293][ T6000] imon 3-1:0.0: Looks like you're trying to use an IR protocol this device does not support
[  567.107992][ T6000] imon 3-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol
[  567.177245][T12878] netlink: 3672 bytes leftover after parsing attributes in process `syz.2.1776'.
[  567.226130][ T6000] rc rc0: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0
[  567.261088][ T6000] input: iMON Remote (15c2:0041) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input75
[  567.467052][ T6000] imon 3-1:0.0: iMON device (15c2:0041, intf0) on usb<3:77> initialized
[  567.719364][    C0] imon 3-1:0.0: imon usb_rx_callback_intf0: status(-71)
[  567.726998][ T6000] usb 3-1: USB disconnect, device number 77
[  568.094587][T12939] IPVS: sync thread started: state = BACKUP, mcast_ifn = hsr0, syncid = 3, id = 0
[  568.205728][T12943] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1798'.
[  568.465228][ T6000] usb 1-1: new high-speed USB device number 82 using dummy_hcd
[  568.566527][T12956] netlink: 'syz.2.1802': attribute type 7 has an invalid length.
[  568.625218][ T6000] usb 1-1: Using ep0 maxpacket: 16
[  568.642287][ T6000] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  568.662389][ T6000] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  568.673112][ T6000] usb 1-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00
[  568.682509][ T6000] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  568.695739][ T6000] usb 1-1: config 0 descriptor??
[  568.725522][T12597] usb 5-1: new high-speed USB device number 64 using dummy_hcd
[  568.855275][T12597] usb 5-1: device descriptor read/64, error -71
[  569.060244][T12968] program syz.2.1805 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  569.105334][T12597] usb 5-1: new high-speed USB device number 65 using dummy_hcd
[  569.135780][ T6000] usbhid 1-1:0.0: can't add hid device: -71
[  569.153638][ T6000] usbhid 1-1:0.0: probe with driver usbhid failed with error -71
[  569.196642][ T6000] usb 1-1: USB disconnect, device number 82
[  569.245192][T12597] usb 5-1: device descriptor read/64, error -71
[  569.355762][T12597] usb usb5-port1: attempt power cycle
[  569.745227][T12597] usb 5-1: new high-speed USB device number 66 using dummy_hcd
[  569.766595][T12597] usb 5-1: device descriptor read/8, error -71
[  569.797332][T12976] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1808'.
[  570.005173][T12597] usb 5-1: new high-speed USB device number 67 using dummy_hcd
[  570.025790][T12597] usb 5-1: device descriptor read/8, error -71
[  570.045194][    T9] usb 1-1: new high-speed USB device number 83 using dummy_hcd
[  570.145550][T12597] usb usb5-port1: unable to enumerate USB device
[  570.195899][    T9] usb 1-1: too many configurations: 9, using maximum allowed: 8
[  570.214698][    T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9
[  570.227973][    T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  570.265374][    T9] usb 1-1: config 0 interface 0 has no altsetting 0
[  570.276052][    T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9
[  570.284955][    T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  570.309662][    T9] usb 1-1: config 0 interface 0 has no altsetting 0
[  570.326848][    T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9
[  570.387712][    T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  570.407037][    T9] usb 1-1: config 0 interface 0 has no altsetting 0
[  570.420264][    T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9
[  570.438328][    T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  570.457897][    T9] usb 1-1: config 0 interface 0 has no altsetting 0
[  570.472398][    T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9
[  570.488034][    T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  570.508555][    T9] usb 1-1: config 0 interface 0 has no altsetting 0
[  570.523096][    T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9
[  570.541176][    T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  570.562372][    T9] usb 1-1: config 0 interface 0 has no altsetting 0
[  570.577236][    T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9
[  570.593864][    T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  570.614806][    T9] usb 1-1: config 0 interface 0 has no altsetting 0
[  570.629224][    T9] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 9
[  570.646402][    T9] usb 1-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  570.666251][    T9] usb 1-1: config 0 interface 0 has no altsetting 0
[  570.682637][    T9] usb 1-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e
[  570.702008][    T9] usb 1-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168
[  570.718927][    T9] usb 1-1: Product: syz
[  570.726618][    T9] usb 1-1: Manufacturer: syz
[  570.736349][    T9] usb 1-1: SerialNumber: syz
[  570.752091][    T9] usb 1-1: config 0 descriptor??
[  570.771751][    T9] yurex 1-1:0.0: USB YUREX device now attached to Yurex #0
[  570.982835][    T9] usb 1-1: USB disconnect, device number 83
[  570.995926][    T9] yurex 1-1:0.0: USB YUREX #0 now disconnected
[  571.387263][T12987] netlink: 'syz.2.1811': attribute type 10 has an invalid length.
[  571.460029][T12988] netlink: 'syz.2.1811': attribute type 10 has an invalid length.
[  571.527262][   T30] audit: type=1326 audit(1764857259.703:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12989 comm="syz.4.1812" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f378b98f749 code=0x7ffc0000
[  571.549595][    C1] vkms_vblank_simulate: vblank timer overrun
[  571.591741][   T30] audit: type=1326 audit(1764857259.733:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12989 comm="syz.4.1812" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f378b98f749 code=0x7ffc0000
[  571.622529][   T30] audit: type=1326 audit(1764857259.733:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12989 comm="syz.4.1812" exe="/root/syz-executor" sig=0 arch=c000003e syscall=63 compat=0 ip=0x7f378b98f749 code=0x7ffc0000
[  571.645306][   T30] audit: type=1326 audit(1764857259.733:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12989 comm="syz.4.1812" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f378b98f749 code=0x7ffc0000
[  571.667635][    C1] vkms_vblank_simulate: vblank timer overrun
[  571.676754][   T30] audit: type=1326 audit(1764857259.733:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12989 comm="syz.4.1812" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f378b98f749 code=0x7ffc0000
[  571.699090][    C1] vkms_vblank_simulate: vblank timer overrun
[  571.758286][T12992] binder: 12991:12992 ioctl c0306201 2000000001c0 returned -22
[  571.766567][T12992] netlink: 'syz.4.1814': attribute type 1 has an invalid length.
[  571.840227][   T30] audit: type=1326 audit(1764857259.733:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12989 comm="syz.4.1812" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f378b98f749 code=0x7ffc0000
[  571.903237][T12996] bond2: entered promiscuous mode
[  571.934346][T12992] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1814'.
[  571.959199][   T30] audit: type=1326 audit(1764857259.733:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12989 comm="syz.4.1812" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f378b98f749 code=0x7ffc0000
[  571.995705][T12996] bond2: entered allmulticast mode
[  572.260853][   T30] audit: type=1326 audit(1764857259.733:287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12989 comm="syz.4.1812" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f378b98f749 code=0x7ffc0000
[  572.283241][    C1] vkms_vblank_simulate: vblank timer overrun
[  572.292503][   T30] audit: type=1326 audit(1764857259.733:288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12989 comm="syz.4.1812" exe="/root/syz-executor" sig=0 arch=c000003e syscall=51 compat=0 ip=0x7f378b98f749 code=0x7ffc0000
[  572.399629][   T30] audit: type=1326 audit(1764857259.733:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12989 comm="syz.4.1812" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f378b98f749 code=0x7ffc0000
[  572.516645][    C1] bridge0: port 2(bridge_slave_1) entered forwarding state
[  572.523918][    C1] bridge0: topology change detected, propagating
[  572.530605][    C1] bridge0: port 1(bridge_slave_0) entered forwarding state
[  572.537825][    C1] bridge0: topology change detected, propagating
[  573.195336][ T5912] usb 1-1: new high-speed USB device number 84 using dummy_hcd
[  573.570046][ T5912] usb 1-1: config 160 has an invalid interface number: 200 but max is 0
[  573.578513][ T5912] usb 1-1: config 160 has no interface number 0
[  573.584811][ T5912] usb 1-1: config 160 interface 200 has no altsetting 0
[  573.604350][ T5912] usb 1-1: New USB device found, idVendor=21bb, idProduct=2070, bcdDevice=87.0b
[  573.620470][ T5912] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  573.638445][ T5912] usb 1-1: Product: syz
[  573.730127][ T5912] usb 1-1: Manufacturer: syz
[  573.743697][ T5912] usb 1-1: SerialNumber: syz
[  573.775154][ T5838] usb 4-1: new high-speed USB device number 72 using dummy_hcd
[  573.996694][ T5912] usb 1-1: Quirk or no altset; falling back to MIDI 1.0
[  574.004138][ T5912] usb 1-1: MIDIStreaming interface descriptor not found
[  574.055936][ T5838] usb 4-1: too many configurations: 9, using maximum allowed: 8
[  574.068558][ T5838] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9
[  574.084015][ T5838] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  574.105803][T13032] loop2: detected capacity change from 0 to 7
[  574.110092][ T5912] usb 1-1: USB disconnect, device number 84
[  574.130350][T13032] Dev loop2: unable to read RDB block 7
[  574.146219][ T5838] usb 4-1: config 0 interface 0 has no altsetting 0
[  574.184120][ T5838] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9
[  574.203276][T13032]  loop2: AHDI p1 p2 p3
[  574.212610][ T8473] udevd[8473]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:160.200/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  574.213386][ T5838] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  574.314783][T13032] loop2: partition table partially beyond EOD, truncated
[  574.379564][ T5838] usb 4-1: config 0 interface 0 has no altsetting 0
[  574.380905][T13032] loop2: p1 start 1601398130 is beyond EOD, truncated
[  574.482015][T13032] loop2: p2 start 1702059890 is beyond EOD, truncated
[  574.561841][ T5838] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9
[  574.575014][ T5838] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  574.703853][ T5838] usb 4-1: config 0 interface 0 has no altsetting 0
[  574.734705][ T5838] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9
[  574.810706][ T5838] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  574.837745][T13040] fuse: Bad value for 'user_id'
[  574.842714][ T5838] usb 4-1: config 0 interface 0 has no altsetting 0
[  574.849927][T13040] fuse: Bad value for 'user_id'
[  574.856299][ T5838] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9
[  574.988743][ T5838] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  575.005642][ T5838] usb 4-1: config 0 interface 0 has no altsetting 0
[  575.050556][ T5838] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9
[  575.059619][ T5838] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  575.111410][ T5838] usb 4-1: config 0 interface 0 has no altsetting 0
[  575.140086][ T5838] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9
[  575.163813][ T5838] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  575.186337][T13043] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1831'.
[  575.195686][ T5838] usb 4-1: config 0 interface 0 has no altsetting 0
[  575.228330][ T5838] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 9
[  575.255136][ T5838] usb 4-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 0, changing to 7
[  575.281593][ T5838] usb 4-1: config 0 interface 0 has no altsetting 0
[  575.299278][ T5838] usb 4-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e
[  575.309325][ T5838] usb 4-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168
[  575.318024][ T5838] usb 4-1: Product: syz
[  575.322949][ T5838] usb 4-1: Manufacturer: syz
[  575.332663][ T5838] usb 4-1: SerialNumber: syz
[  575.367170][ T5838] usb 4-1: config 0 descriptor??
[  575.384985][ T5838] yurex 4-1:0.0: USB YUREX device now attached to Yurex #0
[  575.598532][    T9] usb 4-1: USB disconnect, device number 72
[  575.616963][    T9] yurex 4-1:0.0: USB YUREX #0 now disconnected
[  576.509689][T13075] program syz.3.1839 is using a deprecated SCSI ioctl, please convert it to SG_IO
[  576.976159][    T9] usb 1-1: new high-speed USB device number 85 using dummy_hcd
[  577.135148][    T9] usb 1-1: Using ep0 maxpacket: 32
[  577.142178][    T9] usb 1-1: config 2 has an invalid interface number: 157 but max is 0
[  577.153094][    T9] usb 1-1: config 2 has 2 interfaces, different from the descriptor's value: 1
[  577.205181][    T9] usb 1-1: config 2 has no interface number 1
[  577.243283][    T9] usb 1-1: too many endpoints for config 2 interface 0 altsetting 5: 142, using maximum allowed: 30
[  577.274053][    T9] usb 1-1: config 2 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 142
[  577.303703][    T9] usb 1-1: config 2 interface 0 has no altsetting 0
[  577.321249][    T9] usb 1-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=a4.1b
[  577.330601][    T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  577.339115][    T9] usb 1-1: Product: syz
[  577.348249][    T9] usb 1-1: Manufacturer: syz
[  577.360718][    T9] usb 1-1: SerialNumber: syz
[  577.424186][    T9] imon 1-1:2.157: inconsistent driver matching
[  577.441134][    T9] imon 1-1:2.157: unable to register, err -22
[  577.454840][    T9] imon 1-1:2.157: probe with driver imon failed with error -22
[  578.170128][    T9] imon:imon_find_endpoints: no valid input (IR) endpoint found
[  578.191880][    T9] imon 1-1:2.0: unable to initialize intf0, err -19
[  578.204365][    T9] imon:imon_probe: failed to initialize context!
[  578.216455][    T9] imon 1-1:2.0: unable to register, err -19
[  578.246034][    T9] usb 1-1: USB disconnect, device number 85
[  578.345195][T12597] usb 4-1: new high-speed USB device number 73 using dummy_hcd
[  578.475190][T12597] usb 4-1: device descriptor read/64, error -71
[  578.668996][T13106] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1845'.
[  578.715179][T12597] usb 4-1: new high-speed USB device number 74 using dummy_hcd
[  578.832237][   T30] kauditd_printk_skb: 8 callbacks suppressed
[  578.832255][   T30] audit: type=1326 audit(1764857267.003:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13105 comm="syz.1.1850" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc63898f749 code=0x0
[  578.855284][T12597] usb 4-1: device descriptor read/64, error -71
[  579.004307][T12597] usb usb4-port1: attempt power cycle
[  579.604212][T12597] usb 4-1: new high-speed USB device number 75 using dummy_hcd
[  579.704428][T12597] usb 4-1: device descriptor read/8, error -71
[  579.947508][T12597] usb 4-1: new high-speed USB device number 76 using dummy_hcd
[  579.976405][T12597] usb 4-1: device descriptor read/8, error -71
[  580.044947][T13117] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1852'.
[  580.126234][T12597] usb usb4-port1: unable to enumerate USB device
[  580.895224][    T9] usb 3-1: new high-speed USB device number 78 using dummy_hcd
[  581.024497][T13132] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1857'.
[  581.118697][    T9] usb 3-1: config 36 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  581.167642][    T9] usb 3-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29
[  581.220003][    T9] usb 3-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16
[  581.246587][    T9] usb 3-1: Manufacturer: syz
[  581.256315][    T9] usb 3-1: SerialNumber: syz
[  581.462716][T13140] netlink: 'syz.3.1859': attribute type 10 has an invalid length.
[  581.541386][T13141] netlink: 'syz.3.1859': attribute type 10 has an invalid length.
[  581.580611][T13140] bond0: (slave netdevsim0): Releasing backup interface
[  581.602172][T13140] team0: Port device netdevsim0 added
[  581.657127][T13141] team0: Port device netdevsim0 removed
[  582.038705][T13141] bond0: (slave netdevsim0): Enslaving as an active interface with an up link
[  582.299766][T13123] tipc: Can't bind to reserved service type 2
[  582.691157][T13155] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode
[  582.710955][T13155] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check.
[  582.798445][   T30] audit: type=1326 audit(1764857270.973:299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13156 comm="syz.3.1864" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8091d8f749 code=0x0
[  583.485606][T13166] binder: 13165:13166 ioctl c0306201 2000000001c0 returned -22
[  583.505740][T13166] netlink: 'syz.4.1867': attribute type 1 has an invalid length.
[  583.607122][    T9] usbhid 3-1:36.0: couldn't find an input interrupt endpoint
[  583.634068][    T9] usb 3-1: USB disconnect, device number 78
[  583.659577][T13174] bond3: entered promiscuous mode
[  583.679779][T13174] bond3: entered allmulticast mode
[  583.706961][T13166] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1867'.
[  583.714422][T13175] batadv1: entered promiscuous mode
[  586.235175][ T5912] usb 2-1: new high-speed USB device number 100 using dummy_hcd
[  586.406164][ T5912] usb 2-1: Using ep0 maxpacket: 8
[  586.422327][ T5912] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0
[  586.439244][T13215] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1880'.
[  586.452863][ T5912] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83
[  586.470196][ T5912] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7
[  586.564126][ T5912] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0
[  586.585577][ T5912] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0
[  586.711474][ T5912] usb 2-1: New USB device found, idVendor=1870, idProduct=0001, bcdDevice=e6.7f
[  586.721477][ T5912] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  586.729953][ T5912] usb 2-1: Product: syz
[  586.734399][ T5912] usb 2-1: Manufacturer: syz
[  586.741434][ T5912] usb 2-1: SerialNumber: syz
[  586.761083][ T5912] usb 2-1: config 0 descriptor??
[  586.775493][ T5912] usbtouchscreen 2-1:0.0: probe with driver usbtouchscreen failed with error -8
[  586.993592][  T986] usb 2-1: USB disconnect, device number 100
[  587.045216][ T5912] usb 3-1: new high-speed USB device number 79 using dummy_hcd
[  587.115640][   T24] usb 5-1: new high-speed USB device number 68 using dummy_hcd
[  587.195255][ T5912] usb 3-1: Using ep0 maxpacket: 32
[  587.206774][ T5912] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40
[  587.226216][ T5912] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  587.256121][ T5912] usb 3-1: config 0 descriptor??
[  587.265169][   T24] usb 5-1: Using ep0 maxpacket: 32
[  587.289709][   T24] usb 5-1: config 0 has an invalid interface number: 111 but max is 1
[  587.298308][   T24] usb 5-1: config 0 has no interface number 1
[  587.308798][   T24] usb 5-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=4a.83
[  587.325515][   T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  587.333798][   T24] usb 5-1: Product: syz
[  587.354676][   T24] usb 5-1: Manufacturer: syz
[  587.362661][   T24] usb 5-1: SerialNumber: syz
[  587.385568][   T24] usb 5-1: config 0 descriptor??
[  587.479097][ T5912] dvb-usb: found a 'Elgato EyeTV DTT' in warm state.
[  587.503480][ T5912] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  587.519919][ T5912] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT)
[  587.529023][ T5912] usb 3-1: media controller created
[  587.640371][ T5912] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  587.649623][T13224] input: syz1 as /devices/virtual/input/input78
[  587.667249][T13224] input: failed to attach handler leds to device input78, error: -6
[  587.713908][T13229] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9)
[  587.720677][T13229] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed)
[  587.728880][   T30] audit: type=1326 audit(1764857275.903:300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13226 comm="syz.1.1885" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fc63898f749 code=0x0
[  587.734697][T13229] vhci_hcd vhci_hcd.0: Device attached
[  587.858274][ T5912] DVB: Unable to find symbol dib7000p_attach()
[  587.864496][ T5912] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT'
[  587.884616][T13229] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  587.922273][T13229] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  587.966948][T13229] ------------[ cut here ]------------
[  587.972785][T13229] usb 3-1: BOGUS control dir, pipe 80004f80 doesn't match bRequestType c0
[  587.981449][T13229] WARNING: drivers/usb/core/urb.c:414 at 0x0, CPU#0: syz.4.1882/13229
[  587.989842][T13229] Modules linked in:
[  587.994008][T13229] CPU: 0 UID: 0 PID: 13229 Comm: syz.4.1882 Not tainted syzkaller #0 PREEMPT(full) 
[  588.003444][T13229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  588.013590][T13229] RIP: 0010:usb_submit_urb+0x112e/0x1890
[  588.017605][  T986] usb 41-1: new low-speed USB device number 4 using vhci_hcd
[  588.019303][T13229] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 99 f2 ff ff 89 e9
[  588.046775][T13229] RSP: 0018:ffffc90002eb7820 EFLAGS: 00010246
[  588.052880][T13229] RAX: 0000000000000000 RBX: ffff8880227abc00 RCX: 0000000080004f80
[  588.060950][T13229] RDX: ffff8880301f7040 RSI: ffffffff8c12edc0 RDI: ffffffff8f8d4cc0
[  588.069004][T13229] RBP: 1ffff1101372a9c8 R08: 00000000000000c0 R09: 0000000000000000
[  588.077128][T13229] R10: ffffc90002eb7920 R11: fffff520005d6f30 R12: ffff888021bdb100
[  588.085178][T13229] R13: ffff88809b954e40 R14: 0000000080004f80 R15: ffff8880301f7040
[  588.093168][T13229] FS:  00007f378c8996c0(0000) GS:ffff8881260a6000(0000) knlGS:0000000000000000
[  588.102192][T13229] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  588.108863][T13229] CR2: 000000110c28b202 CR3: 0000000064aba000 CR4: 00000000003526f0
[  588.116903][T13229] Call Trace:
[  588.120197][T13229]  <TASK>
[  588.123145][T13229]  ? __init_swait_queue_head+0xa9/0x150
[  588.128794][T13229]  usb_start_wait_urb+0x114/0x4c0
[  588.133835][T13229]  ? __pfx_usb_start_wait_urb+0x10/0x10
[  588.139439][T13229]  usb_control_msg+0x232/0x3e0
[  588.144227][T13229]  dib0700_i2c_xfer+0xba7/0xf70
[  588.149153][T13229]  __i2c_transfer+0x871/0x20e0
[  588.153934][T13229]  ? lockdep_hardirqs_on+0x98/0x140
[  588.159202][T13229]  ? __pfx___i2c_transfer+0x10/0x10
[  588.164404][T13229]  ? rt_mutex_lock_nested+0x15e/0x1e0
[  588.169922][T13229]  ? i2c_transfer+0x120/0x3a0
[  588.174604][T13229]  i2c_transfer+0x25b/0x3a0
[  588.179155][T13229]  ? __pfx_i2c_transfer+0x10/0x10
[  588.184273][T13229]  ? _copy_from_user+0x94/0xb0
[  588.189105][T13229]  i2cdev_ioctl_rdwr+0x460/0x740
[  588.194053][T13229]  i2cdev_ioctl+0x64b/0x7f0
[  588.198660][T13229]  ? __pfx_i2cdev_ioctl+0x10/0x10
[  588.203701][T13229]  ? bpf_lsm_file_ioctl+0x9/0x20
[  588.208693][T13229]  ? __pfx_i2cdev_ioctl+0x10/0x10
[  588.213734][T13229]  __se_sys_ioctl+0xfc/0x170
[  588.218398][T13229]  do_syscall_64+0xfa/0xf80
[  588.222914][T13229]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  588.229091][T13229]  ? clear_bhb_loop+0x60/0xb0
[  588.233768][T13229]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  588.239745][T13229] RIP: 0033:0x7f378b98f749
[  588.244154][T13229] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  588.263902][T13229] RSP: 002b:00007f378c899038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  588.272352][T13229] RAX: ffffffffffffffda RBX: 00007f378bbe6090 RCX: 00007f378b98f749
[  588.280500][T13229] RDX: 0000200000000080 RSI: 0000000000000707 RDI: 000000000000000c
[  588.288499][T13229] RBP: 00007f378ba13f91 R08: 0000000000000000 R09: 0000000000000000
[  588.296522][T13229] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  588.304492][T13229] R13: 00007f378bbe6128 R14: 00007f378bbe6090 R15: 00007f378bd0fa28
[  588.312551][T13229]  </TASK>
[  588.315697][T13229] Kernel panic - not syncing: kernel: panic_on_warn set ...
[  588.322981][T13229] CPU: 0 UID: 0 PID: 13229 Comm: syz.4.1882 Not tainted syzkaller #0 PREEMPT(full) 
[  588.332360][T13229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[  588.342413][T13229] Call Trace:
[  588.345688][T13229]  <TASK>
[  588.348620][T13229]  dump_stack_lvl+0x99/0x250
[  588.353216][T13229]  ? __asan_memcpy+0x40/0x70
[  588.357810][T13229]  ? __pfx_dump_stack_lvl+0x10/0x10
[  588.362991][T13229]  ? __pfx__printk+0x10/0x10
[  588.367575][T13229]  vpanic+0x237/0x6d0
[  588.371558][T13229]  ? __pfx_vpanic+0x10/0x10
[  588.376058][T13229]  ? is_bpf_text_address+0x292/0x2b0
[  588.381346][T13229]  ? is_bpf_text_address+0x26/0x2b0
[  588.386558][T13229]  panic+0xb9/0xc0
[  588.390262][T13229]  ? __pfx_panic+0x10/0x10
[  588.394673][T13229]  __warn+0x317/0x4b0
[  588.398665][T13229]  __report_bug+0x288/0x500
[  588.403182][T13229]  ? __pfx___report_bug+0x10/0x10
[  588.408221][T13229]  ? stack_depot_save_flags+0x422/0x850
[  588.413764][T13229]  report_bug_entry+0x16a/0x220
[  588.418612][T13229]  ? usb_submit_urb+0x112e/0x1890
[  588.423646][T13229]  ? usb_submit_urb+0x1133/0x1890
[  588.428680][T13229]  handle_bug+0xca/0x200
[  588.432924][T13229]  exc_invalid_op+0x1a/0x50
[  588.437420][T13229]  asm_exc_invalid_op+0x1a/0x20
[  588.442268][T13229] RIP: 0010:usb_submit_urb+0x112e/0x1890
[  588.447897][T13229] Code: b8 00 00 00 00 00 fc ff df 0f b6 44 05 00 84 c0 0f 85 a7 05 00 00 45 0f b6 45 00 48 8b 3c 24 48 8b 74 24 20 4c 89 fa 44 89 f1 <67> 48 0f b9 3a 49 bf 00 00 00 00 00 fc ff df e9 99 f2 ff ff 89 e9
[  588.467489][T13229] RSP: 0018:ffffc90002eb7820 EFLAGS: 00010246
[  588.473558][T13229] RAX: 0000000000000000 RBX: ffff8880227abc00 RCX: 0000000080004f80
[  588.481538][T13229] RDX: ffff8880301f7040 RSI: ffffffff8c12edc0 RDI: ffffffff8f8d4cc0
[  588.489524][T13229] RBP: 1ffff1101372a9c8 R08: 00000000000000c0 R09: 0000000000000000
[  588.497520][T13229] R10: ffffc90002eb7920 R11: fffff520005d6f30 R12: ffff888021bdb100
[  588.505510][T13229] R13: ffff88809b954e40 R14: 0000000080004f80 R15: ffff8880301f7040
[  588.513494][T13229]  ? __init_swait_queue_head+0xa9/0x150
[  588.519033][T13229]  usb_start_wait_urb+0x114/0x4c0
[  588.524052][T13229]  ? __pfx_usb_start_wait_urb+0x10/0x10
[  588.529605][T13229]  usb_control_msg+0x232/0x3e0
[  588.534370][T13229]  dib0700_i2c_xfer+0xba7/0xf70
[  588.539222][T13229]  __i2c_transfer+0x871/0x20e0
[  588.543979][T13229]  ? lockdep_hardirqs_on+0x98/0x140
[  588.549164][T13229]  ? __pfx___i2c_transfer+0x10/0x10
[  588.554346][T13229]  ? rt_mutex_lock_nested+0x15e/0x1e0
[  588.559704][T13229]  ? i2c_transfer+0x120/0x3a0
[  588.564374][T13229]  i2c_transfer+0x25b/0x3a0
[  588.568884][T13229]  ? __pfx_i2c_transfer+0x10/0x10
[  588.573894][T13229]  ? _copy_from_user+0x94/0xb0
[  588.578655][T13229]  i2cdev_ioctl_rdwr+0x460/0x740
[  588.583622][T13229]  i2cdev_ioctl+0x64b/0x7f0
[  588.588137][T13229]  ? __pfx_i2cdev_ioctl+0x10/0x10
[  588.593160][T13229]  ? bpf_lsm_file_ioctl+0x9/0x20
[  588.598082][T13229]  ? __pfx_i2cdev_ioctl+0x10/0x10
[  588.603102][T13229]  __se_sys_ioctl+0xfc/0x170
[  588.607682][T13229]  do_syscall_64+0xfa/0xf80
[  588.612175][T13229]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  588.618226][T13229]  ? clear_bhb_loop+0x60/0xb0
[  588.622891][T13229]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  588.628771][T13229] RIP: 0033:0x7f378b98f749
[  588.633182][T13229] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  588.652776][T13229] RSP: 002b:00007f378c899038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  588.661184][T13229] RAX: ffffffffffffffda RBX: 00007f378bbe6090 RCX: 00007f378b98f749
[  588.669151][T13229] RDX: 0000200000000080 RSI: 0000000000000707 RDI: 000000000000000c
[  588.677120][T13229] RBP: 00007f378ba13f91 R08: 0000000000000000 R09: 0000000000000000
[  588.685094][T13229] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  588.693054][T13229] R13: 00007f378bbe6128 R14: 00007f378bbe6090 R15: 00007f378bd0fa28
[  588.701028][T13229]  </TASK>
[  588.704369][T13229] Kernel Offset: disabled
[  588.708683][T13229] Rebooting in 86400 seconds..