2154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1057.489321][ T3656] Bluetooth: hci7: sending frame failed (-49) [ 1057.495628][T19716] Bluetooth: hci7: Opcode 0x1003 failed: -49 [ 1057.511818][ T5904] Bluetooth: hci7: Frame reassembly failed (-84) [ 1057.528506][T26709] can0 (unregistered): slcan off ptm1. [ 1057.554063][ T5905] Bluetooth: hci8: Frame reassembly failed (-84) 16:10:13 executing program 0: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000140), 0x111201, 0x0) write$FUSE_NOTIFY_RETRIEVE(r0, &(0x7f00000001c0)={0x30, 0x5, 0x0, {0x0, 0x6, 0x10000, 0x1}}, 0x30) (async) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async, rerun: 64) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000340), 0x438002, 0x0) (rerun: 64) ioctl$TCSETS(r3, 0x5402, &(0x7f0000000380)={0x2, 0x86db, 0xfffffff9, 0x1, 0xe, "360f1798ab8f3cf4d52107d0f6105fb9a7b2d3"}) (async) r4 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f0000000280)) r5 = dup2(r4, r4) ioctl$TCSETSW(r5, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r5, 0x5607) (async, rerun: 32) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x11, 0x4, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfc5, 0x0, 0x0, 0x0, 0x7}, [@call={0x85, 0x0, 0x0, 0x97}]}, &(0x7f0000000400)='GPL\x00', 0x5, 0xb4, &(0x7f0000000500)=""/180, 0x40f00, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0x2, 0x2}, 0x8, 0x10, &(0x7f00000005c0)={0x3, 0x2, 0x7, 0x5}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000600)=[0xffffffffffffffff, r0, 0xffffffffffffffff, r5]}, 0x80) (rerun: 32) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) r6 = getpgrp(0x0) syz_open_procfs(r6, &(0x7f0000000100)='attr\x00') (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f00000002c0)='svc_stats_latency\x00', r0}, 0x10) 16:10:13 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5424, 0x0) 16:10:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_GET_SCAN(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x10, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x80) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0xfffffffffffffe3c}, 0x1, 0x0, 0x0, 0x400c0}, 0x0) 16:10:13 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0xffffff7f, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:13 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (rerun: 64) r2 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_GET_SCAN(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x10, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x80) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0xfffffffffffffe3c}, 0x1, 0x0, 0x0, 0x400c0}, 0x0) [ 1059.316901][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1059.326875][ T3638] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1059.372525][T26781] can0: slcan on ptm0. [ 1059.411877][T19718] Bluetooth: hci6: sending frame failed (-49) [ 1059.418723][ T3638] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1059.427417][T26776] can0 (unregistered): slcan off ptm0. 16:10:14 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x4) ioctl$TIOCSTI(r3, 0x5437, 0x0) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRESDEC=r3, @ANYRESDEC=r0, @ANYRES32=r0, @ANYRESOCT=r0], 0x2c}, 0x1, 0x0, 0x0, 0x24004080}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r3, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRESDEC=r3, @ANYRESDEC=r0, @ANYRES32=r0, @ANYRESOCT=r0], 0x2c}, 0x1, 0x0, 0x0, 0x24004080}, 0x0) (async) 16:10:14 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5425, 0x0) 16:10:14 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0xffffff9e, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) r2 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_GET_SCAN(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x10, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x80) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0xfffffffffffffe3c}, 0x1, 0x0, 0x0, 0x400c0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) socket$netlink(0x10, 0x3, 0xc) (async) sendmsg$NL80211_CMD_GET_SCAN(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x10, 0x70bd2b, 0x25dfdbfb, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20004000}, 0x80) (async) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0xfffffffffffffe3c}, 0x1, 0x0, 0x0, 0x400c0}, 0x0) (async) 16:10:14 executing program 3: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xbf2d583e2fffccc, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffde1}, 0x80) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r2 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000100), 0x101000, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x4) ioctl$TIOCSTI(r3, 0x5437, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r4, 0x5437, 0x0) r5 = socket$tipc(0x1e, 0x4, 0x0) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff}, 0x80) r7 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ip_mr_vif\x00') ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000002c0)=ANY=[@ANYBLOB='\t\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\t\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r2, @ANYBLOB="0000000001feffffffffffff00"/28, @ANYRES32=r3, @ANYBLOB="00000000070000000000000000000000000000000100000000000000", @ANYRES32=r4, @ANYBLOB="00000000ff0100"/28, @ANYRES32=r5, @ANYBLOB='\x00\x00\x00\x00\a\x00'/28, @ANYRES32=r0, @ANYBLOB="00000000000000000100"/28, @ANYRES32=r1, @ANYBLOB="00000000040c00"/28, @ANYRES32=r6, @ANYBLOB="000000003dc30000000000150c497000"/28, @ANYRES32=r0, @ANYBLOB="000000000500"/28, @ANYRES32=r7, @ANYBLOB="000000000600"/28]) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r8, 0x400455c8, 0x4) ioctl$TIOCSTI(r8, 0x5437, 0x0) 16:10:14 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x4, 0x85, &(0x7f0000000000)=""/133, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x6) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180)=0x20) ioprio_set$pid(0x2, 0x0, 0x4004) syz_open_pts(r0, 0x108200) ioctl$TIOCSTI(r0, 0x5437, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140), 0x20a001, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) clock_gettime(0x0, &(0x7f0000004e80)={0x0, 0x0}) recvmmsg$unix(r1, &(0x7f0000004c40)=[{{&(0x7f00000001c0)=@abs, 0x6e, &(0x7f0000001300)=[{&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/13, 0xd}], 0x2, &(0x7f0000001340)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb0}}, {{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000001400)=""/22, 0x16}], 0x1, &(0x7f0000001480)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa8}}, {{&(0x7f0000001540), 0x6e, &(0x7f0000001740)=[{&(0x7f00000015c0)=""/130, 0x82}, {&(0x7f0000001680)=""/107, 0x6b}, {&(0x7f0000001700)=""/31, 0x1f}], 0x3}}, {{&(0x7f0000001780), 0x6e, &(0x7f0000001b00)=[{&(0x7f0000001800)}, {&(0x7f0000001840)=""/197, 0xc5}, {&(0x7f0000001940)=""/228, 0xe4}, {&(0x7f0000001a40)=""/96, 0x60}, {&(0x7f0000001ac0)=""/19, 0x13}], 0x5, &(0x7f0000001b80)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x168}}, {{&(0x7f0000001d00)=@abs, 0x6e, &(0x7f0000001f00)=[{&(0x7f0000001d80)=""/190, 0xbe}, {&(0x7f0000001e40)=""/185, 0xb9}], 0x2, &(0x7f0000001f40)=[@rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}, {{&(0x7f0000001f80), 0x6e, &(0x7f00000020c0)=[{&(0x7f0000002000)=""/151, 0x97}], 0x1}}, {{0x0, 0x0, &(0x7f0000003580)=[{&(0x7f0000002100)=""/117, 0x75}, {&(0x7f0000002180)=""/253, 0xfd}, {&(0x7f0000002280)=""/73, 0x49}, {&(0x7f0000002300)=""/4096, 0x1000}, {&(0x7f0000003300)=""/181, 0xb5}, {&(0x7f00000033c0)=""/129, 0x81}, {&(0x7f0000003480)=""/193, 0xc1}], 0x7, &(0x7f0000003600)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x160}}, {{0x0, 0x0, &(0x7f00000047c0)=[{&(0x7f0000003780)=""/4096, 0x1000}, {&(0x7f0000004780)}], 0x2, &(0x7f0000004800)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xc8}}, {{&(0x7f0000004900), 0x6e, &(0x7f0000004b40)=[{&(0x7f0000004980)=""/30, 0x1e}, {&(0x7f00000049c0)=""/57, 0x39}, {&(0x7f0000004a00)}, {&(0x7f0000004a40)=""/232, 0xe8}], 0x4, &(0x7f0000004b80)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa8}}], 0x9, 0x60010010, &(0x7f0000004ec0)={r2, r3+60000000}) r4 = memfd_secret(0x0) ioctl$TIOCOUTQ(r4, 0x5411, &(0x7f0000000100)) [ 1059.556925][ T3656] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1059.563130][ T3656] Bluetooth: hci7: command 0x1003 tx timeout [ 1059.567992][T19716] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:10:14 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0xfffffff0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r3, 0x5607) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r4, 0x105, 0x0, 0x18000000}, 0x14}}, 0x0) sendmsg$NL80211_CMD_ABORT_SCAN(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r4, 0x20, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40408f0}, 0x28000080) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) [ 1059.615244][T26813] can0: slcan on ptm0. [ 1059.628607][ T3656] Bluetooth: hci6: sending frame failed (-49) [ 1059.632377][T19718] Bluetooth: hci7: sending frame failed (-49) [ 1059.640952][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1059.647525][ T3638] Bluetooth: hci7: Opcode 0x1003 failed: -49 16:10:14 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x3, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x4, 0x85, &(0x7f0000000000)=""/133, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x6) (async) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180)=0x20) (async) ioprio_set$pid(0x2, 0x0, 0x4004) (async) syz_open_pts(r0, 0x108200) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140), 0x20a001, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) clock_gettime(0x0, &(0x7f0000004e80)={0x0, 0x0}) recvmmsg$unix(r1, &(0x7f0000004c40)=[{{&(0x7f00000001c0)=@abs, 0x6e, &(0x7f0000001300)=[{&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/13, 0xd}], 0x2, &(0x7f0000001340)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb0}}, {{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000001400)=""/22, 0x16}], 0x1, &(0x7f0000001480)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa8}}, {{&(0x7f0000001540), 0x6e, &(0x7f0000001740)=[{&(0x7f00000015c0)=""/130, 0x82}, {&(0x7f0000001680)=""/107, 0x6b}, {&(0x7f0000001700)=""/31, 0x1f}], 0x3}}, {{&(0x7f0000001780), 0x6e, &(0x7f0000001b00)=[{&(0x7f0000001800)}, {&(0x7f0000001840)=""/197, 0xc5}, {&(0x7f0000001940)=""/228, 0xe4}, {&(0x7f0000001a40)=""/96, 0x60}, {&(0x7f0000001ac0)=""/19, 0x13}], 0x5, &(0x7f0000001b80)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x168}}, {{&(0x7f0000001d00)=@abs, 0x6e, &(0x7f0000001f00)=[{&(0x7f0000001d80)=""/190, 0xbe}, {&(0x7f0000001e40)=""/185, 0xb9}], 0x2, &(0x7f0000001f40)=[@rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}, {{&(0x7f0000001f80), 0x6e, &(0x7f00000020c0)=[{&(0x7f0000002000)=""/151, 0x97}], 0x1}}, {{0x0, 0x0, &(0x7f0000003580)=[{&(0x7f0000002100)=""/117, 0x75}, {&(0x7f0000002180)=""/253, 0xfd}, {&(0x7f0000002280)=""/73, 0x49}, {&(0x7f0000002300)=""/4096, 0x1000}, {&(0x7f0000003300)=""/181, 0xb5}, {&(0x7f00000033c0)=""/129, 0x81}, {&(0x7f0000003480)=""/193, 0xc1}], 0x7, &(0x7f0000003600)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x160}}, {{0x0, 0x0, &(0x7f00000047c0)=[{&(0x7f0000003780)=""/4096, 0x1000}, {&(0x7f0000004780)}], 0x2, &(0x7f0000004800)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xc8}}, {{&(0x7f0000004900), 0x6e, &(0x7f0000004b40)=[{&(0x7f0000004980)=""/30, 0x1e}, {&(0x7f00000049c0)=""/57, 0x39}, {&(0x7f0000004a00)}, {&(0x7f0000004a40)=""/232, 0xe8}], 0x4, &(0x7f0000004b80)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa8}}], 0x9, 0x60010010, &(0x7f0000004ec0)={r2, r3+60000000}) r4 = memfd_secret(0x0) ioctl$TIOCOUTQ(r4, 0x5411, &(0x7f0000000100)) 16:10:14 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0xfffffffd, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:14 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r3, 0x5607) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r4, 0x105, 0x0, 0x18000000}, 0x14}}, 0x0) sendmsg$NL80211_CMD_ABORT_SCAN(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r4, 0x20, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40408f0}, 0x28000080) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) syz_open_dev$tty20(0xc, 0x4, 0x0) (async) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) (async) dup2(r2, r2) (async) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r3, 0x5607) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_RELOAD_REGDB(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r4, 0x105, 0x0, 0x18000000}, 0x14}}, 0x0) (async) sendmsg$NL80211_CMD_ABORT_SCAN(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r4, 0x20, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40408f0}, 0x28000080) (async) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) (async) [ 1059.684574][ T9631] Bluetooth: hci6: Frame reassembly failed (-84) 16:10:14 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5427, 0x0) [ 1059.728627][T26808] can0 (unregistered): slcan off ptm0. [ 1059.740322][ T5905] Bluetooth: hci8: Frame reassembly failed (-84) [ 1059.757281][T26840] can0: slcan on ptm6. [ 1059.786394][ T9631] Bluetooth: hci9: Frame reassembly failed (-84) [ 1059.807406][T26839] can0 (unregistered): slcan off ptm6. [ 1061.726913][ T3647] Bluetooth: hci6: command 0x1003 tx timeout [ 1061.727028][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:10:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRESDEC=r3, @ANYRESDEC=r0, @ANYRES32=r0, @ANYRESOCT=r0], 0x2c}, 0x1, 0x0, 0x0, 0x24004080}, 0x0) 16:10:16 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x4, 0x85, &(0x7f0000000000)=""/133, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x6) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180)=0x20) ioprio_set$pid(0x2, 0x0, 0x4004) syz_open_pts(r0, 0x108200) ioctl$TIOCSTI(r0, 0x5437, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000140), 0x20a001, 0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) clock_gettime(0x0, &(0x7f0000004e80)={0x0, 0x0}) recvmmsg$unix(r1, &(0x7f0000004c40)=[{{&(0x7f00000001c0)=@abs, 0x6e, &(0x7f0000001300)=[{&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/13, 0xd}], 0x2, &(0x7f0000001340)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb0}}, {{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000001400)=""/22, 0x16}], 0x1, &(0x7f0000001480)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa8}}, {{&(0x7f0000001540), 0x6e, &(0x7f0000001740)=[{&(0x7f00000015c0)=""/130, 0x82}, {&(0x7f0000001680)=""/107, 0x6b}, {&(0x7f0000001700)=""/31, 0x1f}], 0x3}}, {{&(0x7f0000001780), 0x6e, &(0x7f0000001b00)=[{&(0x7f0000001800)}, {&(0x7f0000001840)=""/197, 0xc5}, {&(0x7f0000001940)=""/228, 0xe4}, {&(0x7f0000001a40)=""/96, 0x60}, {&(0x7f0000001ac0)=""/19, 0x13}], 0x5, &(0x7f0000001b80)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x168}}, {{&(0x7f0000001d00)=@abs, 0x6e, &(0x7f0000001f00)=[{&(0x7f0000001d80)=""/190, 0xbe}, {&(0x7f0000001e40)=""/185, 0xb9}], 0x2, &(0x7f0000001f40)=[@rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}, {{&(0x7f0000001f80), 0x6e, &(0x7f00000020c0)=[{&(0x7f0000002000)=""/151, 0x97}], 0x1}}, {{0x0, 0x0, &(0x7f0000003580)=[{&(0x7f0000002100)=""/117, 0x75}, {&(0x7f0000002180)=""/253, 0xfd}, {&(0x7f0000002280)=""/73, 0x49}, {&(0x7f0000002300)=""/4096, 0x1000}, {&(0x7f0000003300)=""/181, 0xb5}, {&(0x7f00000033c0)=""/129, 0x81}, {&(0x7f0000003480)=""/193, 0xc1}], 0x7, &(0x7f0000003600)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x160}}, {{0x0, 0x0, &(0x7f00000047c0)=[{&(0x7f0000003780)=""/4096, 0x1000}, {&(0x7f0000004780)}], 0x2, &(0x7f0000004800)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xc8}}, {{&(0x7f0000004900), 0x6e, &(0x7f0000004b40)=[{&(0x7f0000004980)=""/30, 0x1e}, {&(0x7f00000049c0)=""/57, 0x39}, {&(0x7f0000004a00)}, {&(0x7f0000004a40)=""/232, 0xe8}], 0x4, &(0x7f0000004b80)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa8}}], 0x9, 0x60010010, &(0x7f0000004ec0)={r2, r3+60000000}) r4 = memfd_secret(0x0) ioctl$TIOCOUTQ(r4, 0x5411, &(0x7f0000000100)) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x3, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x4, 0x85, &(0x7f0000000000)=""/133, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r0, 0x400455c8, 0x6) (async) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000180)=0x20) (async) ioprio_set$pid(0x2, 0x0, 0x4004) (async) syz_open_pts(r0, 0x108200) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000140), 0x20a001, 0x0) (async) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) (async) clock_gettime(0x0, &(0x7f0000004e80)) (async) recvmmsg$unix(r1, &(0x7f0000004c40)=[{{&(0x7f00000001c0)=@abs, 0x6e, &(0x7f0000001300)=[{&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/13, 0xd}], 0x2, &(0x7f0000001340)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb0}}, {{0x0, 0x0, &(0x7f0000001440)=[{&(0x7f0000001400)=""/22, 0x16}], 0x1, &(0x7f0000001480)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xa8}}, {{&(0x7f0000001540), 0x6e, &(0x7f0000001740)=[{&(0x7f00000015c0)=""/130, 0x82}, {&(0x7f0000001680)=""/107, 0x6b}, {&(0x7f0000001700)=""/31, 0x1f}], 0x3}}, {{&(0x7f0000001780), 0x6e, &(0x7f0000001b00)=[{&(0x7f0000001800)}, {&(0x7f0000001840)=""/197, 0xc5}, {&(0x7f0000001940)=""/228, 0xe4}, {&(0x7f0000001a40)=""/96, 0x60}, {&(0x7f0000001ac0)=""/19, 0x13}], 0x5, &(0x7f0000001b80)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x168}}, {{&(0x7f0000001d00)=@abs, 0x6e, &(0x7f0000001f00)=[{&(0x7f0000001d80)=""/190, 0xbe}, {&(0x7f0000001e40)=""/185, 0xb9}], 0x2, &(0x7f0000001f40)=[@rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}, {{&(0x7f0000001f80), 0x6e, &(0x7f00000020c0)=[{&(0x7f0000002000)=""/151, 0x97}], 0x1}}, {{0x0, 0x0, &(0x7f0000003580)=[{&(0x7f0000002100)=""/117, 0x75}, {&(0x7f0000002180)=""/253, 0xfd}, {&(0x7f0000002280)=""/73, 0x49}, {&(0x7f0000002300)=""/4096, 0x1000}, {&(0x7f0000003300)=""/181, 0xb5}, {&(0x7f00000033c0)=""/129, 0x81}, {&(0x7f0000003480)=""/193, 0xc1}], 0x7, &(0x7f0000003600)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x160}}, {{0x0, 0x0, &(0x7f00000047c0)=[{&(0x7f0000003780)=""/4096, 0x1000}, {&(0x7f0000004780)}], 0x2, &(0x7f0000004800)=[@cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0xc8}}, {{&(0x7f0000004900), 0x6e, &(0x7f0000004b40)=[{&(0x7f0000004980)=""/30, 0x1e}, {&(0x7f00000049c0)=""/57, 0x39}, {&(0x7f0000004a00)}, {&(0x7f0000004a40)=""/232, 0xe8}], 0x4, &(0x7f0000004b80)=[@cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa8}}], 0x9, 0x60010010, &(0x7f0000004ec0)={r2, r3+60000000}) (async) memfd_secret(0x0) (async) ioctl$TIOCOUTQ(r4, 0x5411, &(0x7f0000000100)) (async) 16:10:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0xffffffff, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) (async) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r3, 0x5607) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r4, 0x105, 0x0, 0x18000000}, 0x14}}, 0x0) (async) sendmsg$NL80211_CMD_ABORT_SCAN(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, r4, 0x20, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40408f0}, 0x28000080) (async) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) 16:10:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0xb8b, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5428, 0x0) [ 1061.796902][ T3638] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1061.796942][T19716] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1061.803056][ T3638] Bluetooth: hci7: command tx timeout [ 1061.809931][T19718] Bluetooth: hci9: command 0x1003 tx timeout [ 1061.815244][ T3638] Bluetooth: hci8: command 0x1003 tx timeout [ 1061.821973][ T3656] Bluetooth: hci9: Opcode 0x1003 failed: -110 16:10:16 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) sched_setattr(r1, &(0x7f0000000380)={0x38, 0x0, 0x0, 0x10001, 0x1, 0xfffffffffffffffe, 0xb, 0x8, 0x8, 0x9}, 0x0) process_vm_readv(r1, &(0x7f0000001780)=[{&(0x7f00000002c0)=""/196, 0xc4}, {&(0x7f00000003c0)=""/131, 0x83}, {&(0x7f0000000500)=""/224, 0xe0}, {&(0x7f0000000100)=""/126, 0x7e}, {&(0x7f0000000600)=""/226, 0xe2}, {&(0x7f0000000700)=""/101, 0x65}, {&(0x7f0000000780)=""/4096, 0x1000}], 0x7, &(0x7f0000001bc0)=[{&(0x7f00000001c0)=""/11, 0xb}, {&(0x7f0000001800)=""/124, 0x7c}, {&(0x7f0000001880)=""/109, 0x6d}, {&(0x7f0000001900)=""/140, 0x8c}, {&(0x7f00000019c0)=""/251, 0xfb}, {&(0x7f0000001ac0)=""/197, 0xc5}, {&(0x7f0000000480)=""/15, 0xf}], 0x7, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:10:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x8080) r3 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x10}, 0x10) statx(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x100, 0x1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000001640)=ANY=[@ANYBLOB="f02100001600100025bd7000fedbdf25050800003e102a8008003500", @ANYRES32=0xee01, @ANYBLOB="4d8358eeef3f1b20f0f511bad6f99eecfd060c8ef45559e80dfa12ddf4d98d8fad0274d618bd9592e2a66dcf25991d3b832b1282593c548982797c01e63b9a495a0353fdc20d72d1f2719e171f47e86fd61d4c50fc17ef13a620c440e2ae37e26168a1c582c095380e3c08d6f319890aff0ef53e71f5e4a9a17008584586355a4ad9128be21ea2796fbd3cbfd47be7f1ccf1ba63318f19f5c41d6198677a3f19ce726e47e52808b724967ed51150a9c731fc54d93e9db078a15619a38c5296209dbf27b34ecdbdb754c61a609d0c1eb86325100efb09b973b73727df783bdedd0b48a5f458b562efdc27e8afceb33c14ac7ea5bbda6b721fad2184b2e0d5ffc730db41a2b4ca53066dba6133803b8f1fb44849295082c0904d37e3c237bf3bb6e7972dfbaa4ecb651be952afeaef12db15fe296896f2f40807e0247cb63c05ec1e89d69f10f6fdf3aeee03932fc66ca947508cc187ff98675943ea4f1201ce98da4b189b57e3b80128db17392a368865765c79db299a2d91b3d7a5996d3aa4a7111e26324b84d1a82679779a90affa0a8427c388ea4bafeea6e7f49df33d7bf0a58b7d056f857cdab944b4d463f834289df1db7ab851b2fc5beeebb8b28c803531ceb84c9755e192731b2b57f04c7c96f15e0e0e65f7fc38f42366d1876b9f3ef6835d82e4a5635073aade39f981a945f93e21dcf584d3f1fd77a643f3d8883dd29384b602bebfcdcf08bb47e606e558f27c9d5115a366acd8eb1a9cde54ab71bc89e14fbf13db46a3c3673711dd74c4982d05c7f8ab66e621d9c14b53865f5ab019321b2346e7c57c4be19cc27fa11a9666f9ee77ef76feb9ca4906e1b31fb2a89b3f7c00a320885c6bfdc149b1edcc9fe6d90df0b1ccc6fb3ab80b13b8c53667eb339199bf2d103720a6ca328b7627d324a07f6fa00d5422a27b5dd52bf8550ed82486965c1da26044ff13e5dcac520ef2db7a1c5f9923fb7e8597829adb96903eb65e3a4e89c13963c5ded23b968044260c29427cff83037c7370dd26a6c66f04e9f02d08716bf530e23a4d6e5d6c2fb1e78f12fd9b276dd44346b3389b77b768860704fd3cf7877b4cb8939ca0ba3a276dc354b2366023e9ab47997c2683171a2feb1ed25bbb72f24bb8a9fd0c0e96cc97dc597986927ecaa2e072f0bb800d3e225d7d5a9a430d098890fe8f9a0cd956d40c86956595e601fec271c247d1f5d809aeb8cbf5e3b91bfdc94171d2d3fbf2c58ffec1346dbf3f2e35818468d563cce2835bbc17e8b04deaa2fa2594da349054c9848ec734f05b9c5d06377795b0a9c3b1766c94bb422535aa2442d43fa69a99ac852ec476e64b941214b375879d278d335dd560c2fe13b8b0cd0aff51f30a1adff968df3c98defd331976e2a89e6a5958ae142525fd7a17031fd8302bed338dd43cddf71853eaced677c95f02f7adb657158ed8546c21a8a63ee860386893e33f58b7fa97e67233fe4414d2d288f27404193645aa7b4f409c94151318e1252895e31a0a4fded8c4d324483b0292f44f7b81bccaf93c5c049c611b35b5bf2e1a17e1504b97bab44d7c6887cd6d9f5d0dd7ca4662359da149e4c8571a3a4d92291e511f77ceced3b8dc1eede28e5cdc4184a2da07d73027763f13f54900036993da2fc2a238c171993d295a8045f466ac770f6b53447fd2f85fdda7520efcaa983ba0ed6b4e858c2c175e44f47ddbe6169a4fa5b720e1e30cddc30280146d77357ee42a9b5cfcb61ecc689240673d269cb49f2678165d3fa82fbe909db6cd3feac8f9bb6847c778d8ec2e182e3e0312b92331597f585c52feb3b2241b6ef5d327d2b6afb1d4d3f1b82a411a7ef1771ff21d8de27933fbab51053ada9416f8951cb68118b94827eebf1ec23adb821dcb16569e5586ff7fc112124281b56bb47a8461791ce437ce80a2b7d4fd93ec1e45361f151e48d312066ce119094107940d21618901a6861e49e9e261efda31547d7e47f1acdbe9c11a8c61da2afc785bf4b99afe296c86a2d307e930cf76573f25c61034c905b042490198cdc467599bc973330d750039467e946921247947e60658510696d1246a83556e883018f06fa075155b841276600f198e622bd7e4e14ffb903bfb124caae75919f2fc6d75f791ef2042665a6872f99caf6735254e6091f061348e76aa6cfd23fd2e0357d4d99dbe3f52f6d065a3f164136728abb996820685a81771b0e78ca18635406c71fc92feeb866c1f1111f8de6b7c1d83338051eecacaa63db6c33ef2dff7f365c9b6aaa05333956dd9ea4e978adba184ac186ad199ef517150597726e19f3535fb8001848ed60fb62e464605b1f5ebdbcafa08113a97ceab21d65fe57df87407bb577d126262fbfbb9c285edb0aa152d8f6daa6f3a56c823a9e2a66f690465843586593da8618061bf658fc66a1f9b3107b7a9a03e7970aa9edb8f625cc03b5fc7da1024a9707d64a0f8225f745b6abf75cdb12518ef635b439ed74f2d83ab2cdb4d74292a53de33d3bd43258374724262dca409fe8b96abda3a6a597a57b94321f8f8cc914ea0dcfc3698148142238032baef370de40916b249b0ce2715e73c1931cb00eaaf44736e6706580a1976a7a99798469d11fe837c51ba279dfb1ad350726b19e78533ed042f9c2b20f7253169db6fcdd2adb3edca2be8024aaef710797f403d8849a125454212a268fb1e27ad1b721f12715043b1da974c3f8c8a01d45f16bf93525117d210957da7b8d4f724866ed3b0b7e8fa7b7bd5982f326080e209f10be8573a00f129855e44669752a27bbc7952c6a95474c6d271df7461a2c614d80b2a3f1ff7c8e7c571c34b9b6db344595816564b6725ba8484399f58e31a69864b23415ce9fe16a5c080fcfa036c0013855ef4588e761dbfdbf247dbcbdd2b4fd716748ccff258ced47a9ed0012a275049d2281fc4467f8c069db15a14efd330059291f68077c2633e3153edcb1d682c5c3ce6c2901d55c01f4a0786eb9f3b87b889046b67f676ed698fd3206933e163cc4e75fcdd5a02529a5a234ffa0a0699ae20c87d1891bc8ffb69725ab1a6fc85c6e59fba510cd2e498d7a8678f233f195da57e906155a9b903c95c0fbd82254de08a399008da110275749a1e9dadce27c1074625c1e4ca125f74d1b70c994cda8afb3ac98b59685067fd7a9c93d2a4004b50627cd89abacb8366ca4f2c9ccf2612a2f9eb41cd27cc426a385356c43157bbba1152052aaba7352f4fcde750c4d9c0a2ec6405cca5850fc4e6802f89c63dbce6df5518f306e329fb8d79e28387cc8d50871e2aab81bb2b95b5fe98dc3a4cfaba508dbfbc69df01620770d0e1a0f849f4f6ed391e4e1290c2dd80c819929256af1a19954d617b4394bd49e8c7444486441fb046a161cf67c1491742612caef41aee52f814f216d3dc7da482b5fa3da7932ade3062418bb71151af73e271fd7076291328b9122aeeb14d501127bb86b76ea4020db20fd156fee330602fed3f3566bd279437773c236c9acc87791d9cf96fba34f0eccdcc5d0e6be1318cda8a62d49d5f0fce6c0ab8631ba149ae45c312bca0a62eb232070a0ff0cb238cb38fb965f410be5163a574fb3e2f77dd32040873a30cce80ff44d7678fd0aff141cfc218ddec562f5203ca755b3823ab463f90839034c9dec677c29d5d303ff65b92f6cd6f7ee71270f37f763023b2dc3592625005b8b27a41ed19a0baea8b3967ec1c8a50e0ec50c40e928cbce0ecc92c18f14a07a990b20d3d6e8b70892714161b5bfad1efa29e70364a06914a4169b276811d3ab39978a1f9b38437929455e6ffd0398aaa55f2c580bc0bff1dcddc0fcd395638ba307e793275f63838f04cae740fbcda0bf984a07960291f4c644292b98eab629b819689119746bc95d78d13ccbdc1edd3c6ac7cc836d0681d882d12a070028eef6ce1b205e261cbabc589c8a269914d01fbd76b35d0671fae4d49da9319f3f5fcebcf54d81a0f19dcdd4604f40b4e9864f198935fb8a81f9b6afccbcccbfce26946bf7fb9004411ef0bc8ab918ff3ff68ce84a949dd8ced89cd0f1d6e35efb8b14b0fdfb35db7c987e7e334f04d73a30be25e21761c686da23b4f13288f08ef56ad91d5d4d2780dec6ab207e9ffd1a0209d96963739fc04520caee0a46be218fc9a235a9ccb00052a267cb5ad30d1aafa6f0257a25cbbf50773344d2ff3c727c4c9a4045542998bc8365f6e667d5370cd0892fabdc6323f21ff349035b92e6d20ad5a54083aa94161ae90f087d47dfd5ab074ad5cee15eb3e4bd1cbba5fe7a01d35083733da877fdb00f92b82169915b7a87f0ba1b72fb2dcd2810f80110e945bb40aa9c234b49780dd3b890ff9d71a8a33620c7745b5dca056fae3fd64c6838951be65f16d238a502844862ea0685cf137b3c9381c1ce65b9d518cbd4e30992e1b008bb459ce581115809ed6d429007602afb454ae9ce741651ae83c63f07f718be2a2f8ddac391c937c1fd5416cf54685ff94a0492eb13197b0f2986c8f0569fe630d58d5962c44496841d771db61ff0e0b17d912fc23b7065b0f18fe368a5d74b0f0704316a68041da2169ba44a713148eb297e1ff7a7891637860b085fd008015cf684836bb67351650ec2f8a1d10bf1e909e0fccf483cb610671a40e3096d2526e61e125a77f9331d19bf4ea92f610fa88f33fd9a54cb80fc764d94e54453621b18097ef68a32981f61e3cec198de055840aec5300fbc270f417ba5b729c21bd74a3be014bb32e69c7a0be51994935ce879bc1d641127e3be5f6302f57c9d2e9b8ab99e8c7ace465f3f64f9c32940586365c1c797ca65bef13b7c9c925ec465787cf64c779c487690ff48bfc5570091f415aa1fd48a3185f49ead223d53c0505b995e45b1dbdf94242818b6bf8d4eea8aceae5c220fa5366d776c72a8cad0eedbe7490dc840b9a3b4c5d8ca1416cbb95260dd9b0b9e1d05403b072aa9a54a5ea628510efebe42b984c773251a59a96164c08644d89c71616bbbbce4786b83319ba5c9f14f61bff810e36434e08a0992af5ca1cd72d1ab4e161c5621bae5b9a1550cb8dcaa1dbac277544b8491c5cd730df78b3d71168d8bab6af4daa0dc7e7345dbeb42db5af8cb3f8c894b7b62310ce1a62b8a9409685f92327875f6fcf516c01612340b1410caabefb9045e6ff48de8b6fdb4cc49a2df3e60504e3f8e69faf486a10b4f95ae1e4ff0d8ee454594e52cfcc844068cfbf6a6774ba0e85a72e6f10af7e2b4e70e89f8de9532f140df0ce3dd6b2cbb7bb0e860090b2249a13d57a5c05b93ed4357af13dab9fc7a08f5cc3416c11781ee9258277af4d0b12cd4e5e8e04b912cd4d5eef2a441d68f01f543a8aacb4c22083951d30b80737baa3fda46f219e9191d32f57ed2d972f4795c44bf3cd59c2cbfd760f990c6dceac7d50899a38e1c3576ff5d54b1b090a2fc2ea4dac32ca0843323f248726c9b54a9d71a79828af6e3f477e28a6e63a6bbacce678d36c8aa8b0801093259cd7c54e88757f2ffb885f28d3c8569518111a557fcad960403ac88d6a51d40e974ae48b1d21fa5f235f43efed1c231223f11e70d83b23b934be11b0bccad5fcb96901807516c3f68dcecff49638860b26c55357ba75b60ad185c03dccabcd95be18abf8e7f6a87ad7be79779b21027c4f2de4b99f9a0bd6797f35e430258ea90775c5b3e7e6e392a5348b3ca552357602aba37c1cec90b92f0201b6e6aca7dafd67f3a5f5240dd06f08d17f1ac5d79fbc24ff0ba84ba98e55e4be8be53a07cdb457070057002b5b0000c4f886bec6a35fd4ac4cd2bd21b6ed6ecb8b9bb9786e50e1b4beaffc753936555d3ae4742ec123000008000600", @ANYRES32=r2, @ANYBLOB='\b\x00t\x00', @ANYRES32=r3, @ANYBLOB="e8108f8008007100", @ANYRES32=r4, @ANYBLOB="04106000ffab41c6811856238314a48f0707803225ca594fe376e72d7890c515259c38ebc91e0239b5b016e69c5afb10baa93011314bab8bfd3f385b50729f853a912d2c7c0095c462e4823abf8d8ea0c66851e1be13e122a8af4893b9f406d778b26d7cf8b3391ac5efd1fcc8c6f3e9b072b931c17b89c6a17c5087b6e70317ee3ca426b6c3b30f37f9867f4239828cfc43a2f132124d8523e04e8d070d65ac4b687ba47656e739d96e2e354d7e3abf9b2b3637985db6714da32b102a2470b2004525016382603c414c6ff64f0ee25e18eee27d2b04b20be629238139b82af04eb90dca87cbccd0e0066c1512f4d0cf945f7656c0a89a10732cad0e5fe22ecf2574bfaddab4ec8288b851f59fa1531e8501140a901ccd3b25a47899127030c8a22af89ea2fd067d081835f8dd345b9b11df05396b3e35c52f437fe6da3393811be06f8468ebc06196cec4f8991c1d6c1bf8a9d82464f73e3f39a2fcb15bae911c1596359b5eaeedf9222e7e77e91a94807f27322fdf991cad6b235c386e19295fb21e5dadde681a80d17e513e9d94abf1eba397ccabe8c1dfa60158ff5cff5a2bb968a2fddb5ef71479c50d19ec476c7900bf9f81ccda6af95d190b03b3b6fd2bc0d9e57200702d07c28cc5b552e86838be0cc861372eac0fff6e25e3bdda6efad26651cd0cb871bae29f5db78e1664d4c2e7cfee76b16da55387edd9c2f6ef99fe4b56bba75b0559c0ff62893c9758eb1ca87e23ca49072776c42d99d9321b374de37b4bf469ceaf389fe945da18049b01f7f784fb0a9f5f757aa9b91aa41e39a251245efc8266eade7a8d4c53c4ef2faf65a4a711133878c3e1fbfae393883641fda883652a7957955c251055ebb5989d48bb00f4ad9163e04fa70e3dfe4031b96af15132194fcdc351c0b7337ed3d390c34fa8596a6559b82ccfc3dd23ce3c1f17209861704ba561e0c1e68efdc5c37d9a26b6defe07a75c0c7e021fc3c01fe77cb852bae79f59cb5ae1d1f79c6670e5f29b60fbc612aa574943adb969d7a5dce5c28c154666a5967eb05e664ad7b29dc499641b92dc510870a66a1d3b61cc50675d25d6af8bdbd389d46c1481911ad035e3b47118a8a884d02987f9ee989e101e0b0083078b54966d133c7c384b0a19cb0f7ffdff4ff8d2b9d9a16fcb66bda9cc7fc250cbeba6cc8b8d9e89ea387eb0f911ccf80cf59398edda707a23e964ee5c405894939bf1cab9819c4e01198a4a4b8dc551a1501ecf2f6f96411e8ddf913cebb80772b5aa99d92ddb69d8101f36f3d52f87f749934caa2cf44ab59ab342152c3b69ba00341db0c5ece14a3ec7e5f83c848fa0af84485d911c941f19db59b3358464cbf829d6da84681cb4443f4719ac98ecd7940a7d28924feb21fc198f429f79c91646e429a987e142645bc34974b16e75d6260ca7ef7e0d5dc176901a3fc175c212a65516158a92b289b5628cefe92a0041a9e9f4df8d882211ad52f4b5a7e3249f206b354a857b70622757aad980432f30168ac2bc51d117ea321e706b991c386eb932972f7068b7d4a029a578bbf574bd713f2dba655095798336c906b4b927fd66b592fb761708d30e060c6d7f0aa29cba12b5f8525bcf6a38676dc697822e1f5088bdb9744aae45ba8fd788c0e6c3a6d12b244292477f8712b3705b51d2b1ede2270ddaf67fb83ae54919e6bd3d4ea233c41519aba97f698080c58e7ca1ae08f744e16d6ee70849b8b72314b32a32f62fd9787de8c2675ce5fda9386bdeb23ba4585c3edfc6cebef48ddddfebf8e32e6fff10f86c650410a07adb690c13dec07c87ec68d50c0a2384f32a41f69f73c9b902629517a95672a99cdf4542a3119f9a7443d6b18525898292458f16a3aa374978b479f83ee54807043c6c66958a95d6ac09731ab81bee9dd0e20acfb4ae14c0c2a33d9a8da319a1f091029e92a5009944c8022679d22694546cadba26d1d0a6eb86bc827006a0711f25176e03112df05180c934ce931a7452327c4594817e172342975ae3151503645c564b11b2ae4c9eb7b2e11c31b806c2ac81274adfa7807a15e84b71a3a19ed4a6593f51d1ea93fd7d96b6f9aa99f3cbcc5253cd43fe27c7735103af05952949f30fcdba9ce8a0c8b2a659529b777c1cf17f68f2d6fbcff10288332a7c697237a20a1b55b3e3628dafd6e44eaf42d8867217ed9cb38d45c5e47d85692c24fedea760c55a6b6cf28fdce7fd345d9bb1f0b68bde2e7ba5aa189dd6269ca621a312d5e409e0b9f11b73213c5a3aa3400b5078eedadb6cb0a17e9c87807879917fb710a37f92c7546ad6d82dd04c17597c2ee07a2d9fd34ee98e23568b498b7f79880a1391dfc5f23cdb360b38f3d22df71bf8a55b9d3428b8b20dd19a4cb9c638e5becc987e033bb1af53b3ff12b8b53fa8dd174cbfce23ed7a591c027695b5efcfc9613a4f48465d13758cff5344b2a8ab412664e2ee8cfd49f5cff28564e300609163d582ec9487e480e89bb2f5c02500d2b3f590616e13c50b45eed9daae2bec77435219e0b823dcccf908eb6561b38b1e5f486af8e6a778a65b7f64b830c29d15efb99ca5aad2263252658db2e4db22f35a8af8509b456b0dc5a9659143985b28216a906a20fd06577d9cf45b9bae81f1c1ddec0e28f02c6b8ea15e4b43bbe6b98501b99ce8378ee671948a9cfe85a9f80643f35c8057cc6bf0d627bec1f55b73231e3e3e6ec32d64d4dbb0d30d11be1821b63b160f6af1552f4a1d3bd93134885e3ae5330bd5c2252889b63a56961aef8e804792c3fe54eded41a32c59a6d0ab7caaf1c06767b67d7f95d49c29095b7d84870c20ee31e3cff8fc05f3b5d1cdc2af2a7510dedd7d132a9e85a0d83533ddd7f8560104b7ca7cdbcbb1c8f82481571ec5a73fae0dcb77ec612092e071d76e9f8d31c1613338c5176aac8d033559e55eb119548be4250f5d552afdabfb8ff069bcfc9bcc72467736026a22db2ece31c01527e0f163f712661844dc0d5f8adb9013418c3912008f8aa7185ecdd2518b0d1691d071b6a00250dd51a124ca2efea721b547e2ae1c0c6bdac0ae9adc2c0abe60af5f4f1034b3692534c270b1abe7525199e4e98660038a7182d27720e6a32201702d31828c2daf69ed5e4729aa22633aa695d589714aa6a10348b90ea6be6f20479bfc9ad682be3a59fca887874bd81b7d3fa9f68b0d08c9205316b2146f0e634dfe5dca68ee07ecce33ebd1ca731e4d5e9ec991eb4ead76584cd9bdf4ff7656fb92b2b40b7d7bee836707a10199a3de93ca2d2966e77a62f7d681b03a38a8efd6781e74a9c4c46bae5e35af767f49409fa552d5daf401e2b90dfe0c8df2c5eba99022b0f22e13e9f72b47dc018227517796f4b66e3c003ff2f207fad6cd2daaf4faaf16def998750c7a1159f0b1d3770e7778e95cfb82b4958164c1df1db743c6601908e06f71f98da589bdd08795b6b14aa4ba1dfa5cceb6785bcbdacd51e2bcbae2f0dddda07fcc1d80f811a8810e0f991e5dee1bcf0eb5311a2de32f241cd68fcd6370e2de303d01cd6307ad01627dc8f2c906c659e5f91af204fbaa69175aeb03d75a60e8b89c2e65d5cb35264a7a5c694e1f97392528a8651f5928ad03806a738bb713d864b1afe3f4ad8280bde8bf9007a1f9be1f1bdd0dd84c7d43949efb32e4a6e57d4eff20e0dd2dbfc0b50fc5aa0143a1c1c95e6430037226a9bf507e83cfe804938683914332ea65ea1cedae48ec2dcefac4b2f04fc9331f47cf9126a3bf2d5a9e21d1d363df68765a5f6c552de8dbf663440310af6a3f4e62edcc9a5c9df9ba51adb2407df3b148dab4de92d260801771dc1c69d358ee909dbc97a2ad9ccd8312a1abc4d7e5a76be1936ff5cce37f6785b8de9aefd1841ebe13df814fbe603ef821afd9fb482c8a50d963b83de96fdcbd9fded7defa6dc50db1c2ccd9277c6fec8da769cb9eeb4efc03fb437263dbe5d26a8a144e4c79ed369677acdff67ccf0126836fd20f42bd63549955f3e4d55db4dcac6abd8ab21ca3c858e55966895f33171bc46595232598c0d448f1bef1afaf9ea215d3f44d3c230db46d8f12f04b8e90fc4a35fa769073085d190f6e1e967bebd35c4f373260bbe6ae9f62546aa9bd7e2bb9915062d6fddb9abf4f09a7a7bc95f753839e17116531d78ac9d7ad9f6112a239bf26ea888f02931e703692fa9c0abab14d0ae5773484450143c58f940169076346d5db15e214528b581bd9cdc30493b3beaeb2d416d58d1e0cabdc17dd9232eff4e0835896cd8a586bacbae3f28ea2149bda66e3ce17397dc11e59e1d54b456894ae81037cbffb6687f621d93ea2060335a66b3d31b9bede334f417b659e880b0c60f4fbfc462f9609cd124cddb7579d9db53f67d93ae466b963c6b38df1dd7acec437b47e20914baf602de2452d320dc861408d3cf2acd81f4c1fda684ccd07eb9e2973869d691dbbafa92a70b638626a8f232493f372d0a4c681f7fb2c9bb650fcbab21da4a53fa7044d28c8d85b3992decea66b9cd7cca3f6ef25f6bbb6d731b05dd8c675f6818c0d796e69c076d23c314c9448df8017ed583a26811f9cfee3376fd09321328ded70938958b35a562d79f423e4733bf64a867677ee95d7f79227250d34822abb06e7a1405be0a3e25a332fe5456268e6f564660b90a5cf1f074d234097aca90cdd4236cbbdf1b519c1833f1ebf1461a803547a337aea67dee8dd114cd0a0ae8ac1b2b7c634433978dd917fb20edbc87e546a0b0b6d8d9153e6c9408f403df32250283f84536bc9bc743c8a456541ec6a722bd01970ec97feabb3af3d9138361e3bfb32f144f2601c53648b600afe494814377eab50f4250b71ac4c86782c4966b57a2336d3a797584003195d7b7689ffa630638140e49cc1cfb503676740e4c88b94a59ec398d189cb7eed80e57ae285947d5807fe660baccdb3c1c09ca6f98f850befb612547cec3616982ab642c195e257195007846deba79050f2fe7f328afff22e330de6e85b96aa388a3e0b0df492b3870353fe19620845bcbee8d980d81d885e02164b561c29edc457c4ddadecd16cd63834c455fbee9c992133129fbac4dc213d380e9d268d9ab127225dbebb369eca955967332d5860e915809933332a0f4dfe990fa12c2d4cad0ea67abab440a90914cf98d45e6af53f070461a8736093040ebc76f0cca417f0e0f64f17696e7d769890ccfe6d7c485f87a73994531626835c62a892c2c0b01425c05c9302c97b2eb028b022661d77b7987e0cc1385fd413a9ae72f164220f433f5a13180415aa6e0deb91a0bc28f5f1731e4e989d353da7c9bd37c8753bf0d755b40f769e560702eae3ad0acce8f0c9b5ce5c8168992f80e12963beffc97536bc8ed54bd680ef1724eec3bd190cf382ffff348d9a010b22f1c4c9d1569455d9049e69f06d3158aee022b2493a5499bd5879f76a9b5d65f62feb8e1b8274e2bf7e956e08ea413b5410d21006304db2a8e5aa4d19c5a3d7de2675fc498d6087462f78e8802998911bdda3682ea979518d45ba508698f77775c70684b195e2aa14ff1b6609abc8dac67ff82454d8a9b564c180a5dad81b2543abdbc944dcfefcfb6d636fb8e9bd2231f0e9f3fc788c01405563b37ee42b0900811cf16d96a2a7bd1dd96b76346430ee839645709d18d14dd478903154ff489cb3004badf421b455fb726897acd5b3e8f8bde3433a2287764f82fd752c18793ed6927b054bcf024e442b585b2799fdb1c1c5c5258db5cddd9dfc729ed76b268edbbdc04d8897f974687ae21400910000000000000000000000000000000001349e9e7f50ecc4749b3a8c4df376b6feb4597ac212c5d4befdc8f908dc6f6e61f6bb6b9cda863ce6f1b741ab782adb31248f5f52d21c462f09f8c09db1f6943129fa8558963ea95222683d5805ceafa98c5b809f327bcc4811ba21ce87ea18ff8e964ae1735bdd861f3e601076e6ba9d120ff79d3de7127b0797a3e3f90b20caff8b1f29c5390fe7cf1d68bf8d351ecf1af050d88ce2aec17e81dfd7c8693eaafa861215b509b143238ff99fd176e02c80ffb82a3c813cfd3507bbaed358104a04000f00cc50ed91bbfcaca65f34b72a479df90c37b01576b482da33796c5e7d767d896d93b7127fef5fbf22cf582044b18ee0acc98521374f7e7c0bf26d3f6b877019a293d01da3267c7458df627259443848816394499f7af8f4945d25b3d4778f5d863c1a7f5142b69a1c9ffbf6e6f3a8ac21e498f966f2f560d6b6e47234d9f1549722498d049abdfcfe9b38a7ddf482f2fa61b61aa46209dcfaeb0f08007b00010000800000"], 0x21f0}, 0x1, 0x0, 0x0, 0x48000}, 0x200040c0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000005c0)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x0, 0x3, "ce2d1bf257e6487b9d0f84d624afeb1d56fdd47658ab9addbee74b4ec961fa4fa2c96a0b49c19d7d410f53547404b9dc7d707fea29d9e4b7de6b902a30ee34cce9f0f7466f9da03758602071d8023de376fadb21112cecb2b122aae62746b3e53b1282c88a09ec6497c920991cc36b37ce0acf795d43e5104d31eba79ed5184028ea2f418a9c3d5b3595907a3bdb4ae486f3a6e22ba0fcb00c1ee74e28e7740c012f928e126fc0992358ffa09ac88008577f1019dcaf0ca6ec0fca0d76f1b8aa5fe2937c6e94d8fa1b668e42b354b5a4fb407ac1577f10417eeb606dd83740674e933d00f953a362dd9e17723ced6b8bd2de083e7223a141592ac21f1248bfce70575b2ae7c48fa84b6d74ae1e5f091e6f8af94ae605c4cafbe0c81605ce103ff5fa45f7eaafbd7850dc215568e56b3250183ca175abf639a502f924b13fbefb7511f6668ea99c1aec3ee91b8cbc66821a3a413f0daf864d99704b9c2b7bef36f1d82ad3fac4aa7bf580d1dcc5b66e2a4b5c538ff83ba528330168e1103a8801411d2fefb9dbc6bc9170db9b07338bc5933f4bfa6907f53d00ec842f000926b0faaa37e9b9ca40f42600fa62cf8f9a55ddb570fea292228a05d525a6a3918c83dbf379e8e37a9ca44513fbb600417628470c3c24666baa8b9f2eba26af3abe2ae0551f2baf04092812360870bf7f5c41705d6a74523475a7c3efc8d0a7c1b1e5be845d5d32bde084c994f9d4d9afd2f4f6e44e4b2a696de6c1ca371fba2852a63ca053dfcd3180e9755ce65da151a3fcf9cebb4c6641a01a587dabc808028a8ec2cf84d85cefb6ee363eac789fc1c6fa87892c9e9cb96b9c7430dc6dc3d74634b0362d9825562b235d1d47704c17984534c64f827e94a2686340cf9a3ec00611f3b5689c5195b9e6388655dce5c9170672c00758c89d92a527219a0c893c0075b58a85bb98093f4e9d215e5d323eec9daad5cb4815a57cf116d1e622a88274d567607dfb088ff6b954256e426a0ec85a8eaa6dd62bc98bead530bb9a8c19819e12774ec6c0a3c6e0212fa8f601fa1e451d86384acbabb41547fa843157338b5e7103eb7ce312ce9900c38f639827c90965ce9e390d3f64cd9394a170c6915932d78961bddf0364884c4f0ceb7370cc4ee7b661ab5fde73fed5d5cabe95e2b8f29037cfb49f0aa37eb96fefe7b6748e5c6ccb0df6fcfe300f19f95dbfc15f8f3651e2b314622b62b709e8dffbcdccf6b6bfaa81139dea20260425334d3f5c568d3f79be39323c0df24584963780aaf256292f57de4847cf5ee831ab071ba4c58c186926960165b77fe3103d27c8f0bf1ab0f7ca936b1e57d8bfe9bd89d82174de76d5a9c50dbf207272e8adabd817adc032bbf07537adb72abbbc077f7cf2100978bd9a26b2f2851c5ab1ccc3cd18de15de5e72b7ceb6e1c7cca65ea9ff28aa18ef5470f1140c9fdb15415c54c1f1896913e1028e0e069dd36e256a32f425aba4fcdeb782b4aae3aae18f4aa2b23cb9a13e13adc728898f03b60776bc25329aada306e111af68068635de46893df123294ffaab21e815b1676d814096a9685a4ce1ca2840b4dd82f9a413ce366e9354861ba02dde7ecf12238241089a231f73325612894e441ed49583ea83d59ee358505cfac5247bd3576570f04d9e3a0b38b525ae08b3cdfe36059c95a94bc8e19e4c154507c34f6d012cb0bf7e01fe0f256f51dd90f0e99642b4f6075a09a07166a8a4c557285aaf2884b24183ec6cde28a1769b57410bf093efb01099ed4993f983ca801662c34497ad3ef5bd56ffcd8d949f64190ac10d057ee82b0391e7ecc555eebb9c859691fdb6acfb6305d735c7f1c991dd0a1e05bff1f9dd67d441bd803a4f69b5e24b3f94b9db9c29d7bc34dbcb198dd96e6bef6ab0325ffd78b74477b834db50adbd637d4d80ba109dbdc850942c3b778f34b6aeb12afde4d8be7371bf1a7f03357f19aa168d468394c8c8c52b0f7c5d0de1e2575e738f2d7c0af06d5be9b8bde82cb81da96b4da818b757d5e8872cae652e1f5111d55fd80313c868a58033a505b1fd0d50fffa546aaa5818f02ec95a69efb1240b1490ba4bcef4c5e419d2f02eda0abd46da29549966f7fea62262ff8a6568a16d08497903965f3452d1cd79a089db4e7c215c18b5910e2012ecf11617c87ac47bbd7b1c8646bee83d8c6af7842818e6c568a5b4dbb25cca3b2b9781a945b703709e5aa73b1c84f5faacba0714b7d52f7aae015de4c652c7f8f8ea8f67d5d15cee6ba760f6ef9b49b9298b44a8254cb636569108fca0625c670ca4cd65b95d3e938fdc0ed18f463163762eca8696d18a1dd7942fd9fe6a186d9dd101b7df62c38ca5d7e936d18169043ebd44869771e50d65e94c52aea49d1162cbc96d51333e5287b1d7e50adb8025e3334d977ae086bf9315f6816c6e14496fa97359e234f6b263cd31c3fefede33905ca7d83901d5a64d1c2ade6a42271bf7a321354caea040305dfef27cbe475ba1e8877a5dbcce115e56e8b30fce145a00da81469ec0e0eb11caa7e197305a3657f4b46684c9a7743b3b7c1a956b2e391b1c5ae11a6bcddcccc2af554c19046f0182bfdc596e3bb6b12246141a45266b9504fc13054ac5e08b48eea677c0d592780e4d52ac6d7e9ae429fd5fc37c2fe81d439605b52bcb9f615a22f0e865b84a22a92a63f6b713ea8ff2e2e6065738fbf45339e88b56c384fb3f6971977ea467d753b44df7741c9e29ceaea56aac4d8392182cb0750121186d62610396265dd1edb27986d0ce80be0d974f94ae5a70ad615bc3814e2992b1bc77eeb5f4dd2d2fc972dff2728d4a83f8e762f98bc42aeeb0ed6989ba905f48357a9834cfd89d11d3b58c4ded69580c8ed875b64a51a7cf87504db699aecda371365afb7b7773958da5df3243ac10e0e666345239af2089ffb15ea317a9d5bb04f6874a0f5a50480c0c4a35ecd7b1a705205c154c4bbf26d2000c2444fadc44ff2a26dd734e97f7390fa486ee53c6e63da4fd7fb498d2c2838e2615cd70e83c1600af441eabbabc5315c7bf1e9cf034451635d54cb3a1e3e2a353701bf927b245372eff6bfc52e4b5fc68f0bebbd07285582330c35f769c5266ba891f5363874689c49e40b366770fd6c051fc2c3778aa755f0266f38d6976ba1733e40f62109b1b68dfdbe0bee6db2be15952d9466a46ec51ec1f0c4bcb00ca2abe543619ef5be11d337bf5c868abf47301faa09ec53281cd47d96deaffdc9d22dd802bbcdfbd65be7f91cb778b02d5e7c897206d60b968b8c66990c0e33e00ffc166395e73ae1729325118e3b1e6a68a97a5ec5022d82ed4f28c367647eb2d4196e38c17e1050413d8d494a7600e597b6ae1120c3a9ae7de35ab88a998d1ba554346cf3fd8b1e48595b00fce2ab738f4aadf74e42378931a44af4ce5d5d8adf6e12aec78bcf7f46c82ee5122a366a280acde57afd9d48c4b48449168e7e9b20f6d3b849b5cba74fe9bf099f1efaa9fb967f69dee47b043e9881a709c83baa5dc767dc8cb99d2cc6647681e3db013a01e0eebf7faf1037d026f3613dbb33a14146caf165d41a9af5de86ac374221eb518213371d542be0a8687e0c9785a80d8a4e9021cb90b289485646d363ed7b25624f2ac01eac9770df96dda0278d8e6c55636f229d22ad8a71dada497bf89551df3724eb1bd565b1011b4f67b06939e4f2f45280535869c7163a4ca2a474afc787b2f003b98a5ba7bbb5d2a7c632eb15c101518afb57e71f4e259ac1f1e363eb1ed98ef56af253fe637bf45d099cedc15dc0c54b430e91affde2a9fff94f1e123e3e2b9db937edd530ab8ceae77f4a373c7c4a7ba9cae04fa69bf97dc89a1f68e38fdc1026bd800b8f3b333c35b747dd0b486d7dfda05475f870734d52cef998264fa126dfd11b008a2b2fa0a0220546610390712aa3f29317d6d6c88f891afa305d3278088e399ccdf2047e160c689d93f377496f81bcb83a8c63a46418731402aa1163a9563818796eb57fba0b492ca8908020e1186e5e0ecd44d98e95404c81ea90f389318162a943cbaef63bf547fdc48a967a0193778448da9bfe3b28812502ae6c7ca67086ab93d11b52a24e81e55fc5bbc1b560b79fa4d28a10765039825a73586106fe62abb4cea6d025c373e7253d24dca5d3d681988d728817f7466ad81f9a4d70918eff16b601646801f23bac66fd1bd9983f02cdf4d750e864e1edda8d6b4f53696e230154840745b5c4cd17ecc01da1cbd864da4c201ed12ac727b93fbbc03539862a437531aab059d8f648ee68a2af4061c8b90031dad68c2d413ee91b7ec7fcb747ac1fed470e143be104057c3dc42579867d0ba39d00a66424035d562dda85fb40bc337d6cafc2c0db7a76ae2d46730e7cffe0a95abb355b0d87400fc001504e75022e8294b23681934cdbf6d7a3dc77313ff002e1282756da00fb97eaa5f23be002456221a648a2cfc53469fd2f3fb8dce2674508cdc7a0c1102fe4685936304e6d54fa17aee2b5acf17d007b1e91603d75fe4a9f6587a2ab0c10590a4256e4e1d1003debc20cea4abd5862e2a747a7b93bc96a86043f89a53ba02077677143e4e565bb0a4bfe35e33f6588c32672b793cdc346677b30c49e5c0d57c261902f44592745bd0ca28887fcf482ba51d53778c4337e80c8d2880721d697a09084710d55a3e7b1150dc8998baa92d66f07a3434129e8876676f7bbbd242c39cddfb4b4b9b9315ad4edb1ac91815b0672508e7bb409963c6637e9108c91567f38470d29aca080db5ff1a65eae087aa3b29478154bcabe0bbfac76eec5c4e4851140aa7945be060f59b5cb4a415a6b19975e2cc853a6a98a94ca4b4ce128ddb03547a9179252215051ea60415131010cc6b734fd9346d38f57eb64904df506420c713ab40914f48694bd857735929a6a9dc9db2dbc6d0e79145331fce919c519532de33b9a471c0cc48614e97ae771e5e81f00f8c77f86316a7580805697d68fb1891e7c6264937c3aff17f9cb80e9fd963821c7c1dbbf6da4530d50a78742034bd0c44e3ed5a7e692bb0e247e1ee26148cf974f022cf4d02606fb9326f6f9f64fcd3aa497d5313e3d2b340fa88d31ddf596348ef0e9d81285ac157aec4d418030088ac1e0f5a446964f2e21fee54405bf9a1fc639ee7b57677d32d547b977429079ec14253901cc1feb9d7ae44202a8aa8ac72774e94b16b5bde9dea7a78845af82aed90bc113494d6595c5c38f46143343c499084bacdc95acf7e7815101125d052c372c25db95c5d98eb17c44dcaa1e83a27ab40c061cadeb879672cd7d305cd9a9dd632e9eb4b1c71307215316f4491c0ac5a2df4fe9c4755735095f4fdb1c186d7e4db1873514102281fd6712e51121b6946aacf40903ddaa240a248b2c447b29f2c80fb7817a9e9dcab90a79f94af399f017996bbc161c6039d4ae9659e28cb47ca4bd3730de5bea3af8afba10690750f867ee3cac6f01b9801cf04fa37e24ea8db64696d4b51e34027f7ef7935567814f056f866d192e465ff89695d48a30a7656a119f90652016ce8fda8fe65a33cd3d4e0db0783317a75aaf107bc0886f4f70d0b6442ff4776a7b5ff2adfa962dfe62e2920d89712686125719fe8e5b307d61398916fcde3c0b95e00c04b3b6c51a77f1ea219b423cc8448650c9edeac8fcf828ba1b6fd26925d8e0dde7149e79a20d841ca9237f0d03f4200f134c4bf233ad17c43f91d434b6a8661a5c0682510600b52140df2088b0607703a92f565be5bfa96f3388b69"}, @TIPC_NLA_NODE_KEY={0x0, 0x4, {'gcm(aes)\x00', 0x0, "fa8d66fc678dbd4ac9b86e47e23dd272e3f2437339620423af5db2146847e78f"}}, @TIPC_NLA_NODE_REKEYING={0x0, 0x6, 0x1}, @TIPC_NLA_NODE_ADDR={0x0, 0x1, 0x6}]}]}, 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x4051) write$P9_RVERSION(r2, &(0x7f0000000300)={0x15, 0x65, 0xffff, 0x0, 0x8, '9P2000.u'}, 0x15) 16:10:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1061.874956][T26893] can0: slcan on ptm0. [ 1061.886315][T19718] Bluetooth: hci6: sending frame failed (-49) [ 1061.893122][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:10:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x8080) (async) r3 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x10}, 0x10) (async) statx(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x100, 0x1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000001640)=ANY=[@ANYBLOB="f02100001600100025bd7000fedbdf25050800003e102a8008003500", @ANYRES32=0xee01, @ANYBLOB="4d8358eeef3f1b20f0f511bad6f99eecfd060c8ef45559e80dfa12ddf4d98d8fad0274d618bd9592e2a66dcf25991d3b832b1282593c548982797c01e63b9a495a0353fdc20d72d1f2719e171f47e86fd61d4c50fc17ef13a620c440e2ae37e26168a1c582c095380e3c08d6f319890aff0ef53e71f5e4a9a17008584586355a4ad9128be21ea2796fbd3cbfd47be7f1ccf1ba63318f19f5c41d6198677a3f19ce726e47e52808b724967ed51150a9c731fc54d93e9db078a15619a38c5296209dbf27b34ecdbdb754c61a609d0c1eb86325100efb09b973b73727df783bdedd0b48a5f458b562efdc27e8afceb33c14ac7ea5bbda6b721fad2184b2e0d5ffc730db41a2b4ca53066dba6133803b8f1fb44849295082c0904d37e3c237bf3bb6e7972dfbaa4ecb651be952afeaef12db15fe296896f2f40807e0247cb63c05ec1e89d69f10f6fdf3aeee03932fc66ca947508cc187ff98675943ea4f1201ce98da4b189b57e3b80128db17392a368865765c79db299a2d91b3d7a5996d3aa4a7111e26324b84d1a82679779a90affa0a8427c388ea4bafeea6e7f49df33d7bf0a58b7d056f857cdab944b4d463f834289df1db7ab851b2fc5beeebb8b28c803531ceb84c9755e192731b2b57f04c7c96f15e0e0e65f7fc38f42366d1876b9f3ef6835d82e4a5635073aade39f981a945f93e21dcf584d3f1fd77a643f3d8883dd29384b602bebfcdcf08bb47e606e558f27c9d5115a366acd8eb1a9cde54ab71bc89e14fbf13db46a3c3673711dd74c4982d05c7f8ab66e621d9c14b53865f5ab019321b2346e7c57c4be19cc27fa11a9666f9ee77ef76feb9ca4906e1b31fb2a89b3f7c00a320885c6bfdc149b1edcc9fe6d90df0b1ccc6fb3ab80b13b8c53667eb339199bf2d103720a6ca328b7627d324a07f6fa00d5422a27b5dd52bf8550ed82486965c1da26044ff13e5dcac520ef2db7a1c5f9923fb7e8597829adb96903eb65e3a4e89c13963c5ded23b968044260c29427cff83037c7370dd26a6c66f04e9f02d08716bf530e23a4d6e5d6c2fb1e78f12fd9b276dd44346b3389b77b768860704fd3cf7877b4cb8939ca0ba3a276dc354b2366023e9ab47997c2683171a2feb1ed25bbb72f24bb8a9fd0c0e96cc97dc597986927ecaa2e072f0bb800d3e225d7d5a9a430d098890fe8f9a0cd956d40c86956595e601fec271c247d1f5d809aeb8cbf5e3b91bfdc94171d2d3fbf2c58ffec1346dbf3f2e35818468d563cce2835bbc17e8b04deaa2fa2594da349054c9848ec734f05b9c5d06377795b0a9c3b1766c94bb422535aa2442d43fa69a99ac852ec476e64b941214b375879d278d335dd560c2fe13b8b0cd0aff51f30a1adff968df3c98defd331976e2a89e6a5958ae142525fd7a17031fd8302bed338dd43cddf71853eaced677c95f02f7adb657158ed8546c21a8a63ee860386893e33f58b7fa97e67233fe4414d2d288f27404193645aa7b4f409c94151318e1252895e31a0a4fded8c4d324483b0292f44f7b81bccaf93c5c049c611b35b5bf2e1a17e1504b97bab44d7c6887cd6d9f5d0dd7ca4662359da149e4c8571a3a4d92291e511f77ceced3b8dc1eede28e5cdc4184a2da07d73027763f13f54900036993da2fc2a238c171993d295a8045f466ac770f6b53447fd2f85fdda7520efcaa983ba0ed6b4e858c2c175e44f47ddbe6169a4fa5b720e1e30cddc30280146d77357ee42a9b5cfcb61ecc689240673d269cb49f2678165d3fa82fbe909db6cd3feac8f9bb6847c778d8ec2e182e3e0312b92331597f585c52feb3b2241b6ef5d327d2b6afb1d4d3f1b82a411a7ef1771ff21d8de27933fbab51053ada9416f8951cb68118b94827eebf1ec23adb821dcb16569e5586ff7fc112124281b56bb47a8461791ce437ce80a2b7d4fd93ec1e45361f151e48d312066ce119094107940d21618901a6861e49e9e261efda31547d7e47f1acdbe9c11a8c61da2afc785bf4b99afe296c86a2d307e930cf76573f25c61034c905b042490198cdc467599bc973330d750039467e946921247947e60658510696d1246a83556e883018f06fa075155b841276600f198e622bd7e4e14ffb903bfb124caae75919f2fc6d75f791ef2042665a6872f99caf6735254e6091f061348e76aa6cfd23fd2e0357d4d99dbe3f52f6d065a3f164136728abb996820685a81771b0e78ca18635406c71fc92feeb866c1f1111f8de6b7c1d83338051eecacaa63db6c33ef2dff7f365c9b6aaa05333956dd9ea4e978adba184ac186ad199ef517150597726e19f3535fb8001848ed60fb62e464605b1f5ebdbcafa08113a97ceab21d65fe57df87407bb577d126262fbfbb9c285edb0aa152d8f6daa6f3a56c823a9e2a66f690465843586593da8618061bf658fc66a1f9b3107b7a9a03e7970aa9edb8f625cc03b5fc7da1024a9707d64a0f8225f745b6abf75cdb12518ef635b439ed74f2d83ab2cdb4d74292a53de33d3bd43258374724262dca409fe8b96abda3a6a597a57b94321f8f8cc914ea0dcfc3698148142238032baef370de40916b249b0ce2715e73c1931cb00eaaf44736e6706580a1976a7a99798469d11fe837c51ba279dfb1ad350726b19e78533ed042f9c2b20f7253169db6fcdd2adb3edca2be8024aaef710797f403d8849a125454212a268fb1e27ad1b721f12715043b1da974c3f8c8a01d45f16bf93525117d210957da7b8d4f724866ed3b0b7e8fa7b7bd5982f326080e209f10be8573a00f129855e44669752a27bbc7952c6a95474c6d271df7461a2c614d80b2a3f1ff7c8e7c571c34b9b6db344595816564b6725ba8484399f58e31a69864b23415ce9fe16a5c080fcfa036c0013855ef4588e761dbfdbf247dbcbdd2b4fd716748ccff258ced47a9ed0012a275049d2281fc4467f8c069db15a14efd330059291f68077c2633e3153edcb1d682c5c3ce6c2901d55c01f4a0786eb9f3b87b889046b67f676ed698fd3206933e163cc4e75fcdd5a02529a5a234ffa0a0699ae20c87d1891bc8ffb69725ab1a6fc85c6e59fba510cd2e498d7a8678f233f195da57e906155a9b903c95c0fbd82254de08a399008da110275749a1e9dadce27c1074625c1e4ca125f74d1b70c994cda8afb3ac98b59685067fd7a9c93d2a4004b50627cd89abacb8366ca4f2c9ccf2612a2f9eb41cd27cc426a385356c43157bbba1152052aaba7352f4fcde750c4d9c0a2ec6405cca5850fc4e6802f89c63dbce6df5518f306e329fb8d79e28387cc8d50871e2aab81bb2b95b5fe98dc3a4cfaba508dbfbc69df01620770d0e1a0f849f4f6ed391e4e1290c2dd80c819929256af1a19954d617b4394bd49e8c7444486441fb046a161cf67c1491742612caef41aee52f814f216d3dc7da482b5fa3da7932ade3062418bb71151af73e271fd7076291328b9122aeeb14d501127bb86b76ea4020db20fd156fee330602fed3f3566bd279437773c236c9acc87791d9cf96fba34f0eccdcc5d0e6be1318cda8a62d49d5f0fce6c0ab8631ba149ae45c312bca0a62eb232070a0ff0cb238cb38fb965f410be5163a574fb3e2f77dd32040873a30cce80ff44d7678fd0aff141cfc218ddec562f5203ca755b3823ab463f90839034c9dec677c29d5d303ff65b92f6cd6f7ee71270f37f763023b2dc3592625005b8b27a41ed19a0baea8b3967ec1c8a50e0ec50c40e928cbce0ecc92c18f14a07a990b20d3d6e8b70892714161b5bfad1efa29e70364a06914a4169b276811d3ab39978a1f9b38437929455e6ffd0398aaa55f2c580bc0bff1dcddc0fcd395638ba307e793275f63838f04cae740fbcda0bf984a07960291f4c644292b98eab629b819689119746bc95d78d13ccbdc1edd3c6ac7cc836d0681d882d12a070028eef6ce1b205e261cbabc589c8a269914d01fbd76b35d0671fae4d49da9319f3f5fcebcf54d81a0f19dcdd4604f40b4e9864f198935fb8a81f9b6afccbcccbfce26946bf7fb9004411ef0bc8ab918ff3ff68ce84a949dd8ced89cd0f1d6e35efb8b14b0fdfb35db7c987e7e334f04d73a30be25e21761c686da23b4f13288f08ef56ad91d5d4d2780dec6ab207e9ffd1a0209d96963739fc04520caee0a46be218fc9a235a9ccb00052a267cb5ad30d1aafa6f0257a25cbbf50773344d2ff3c727c4c9a4045542998bc8365f6e667d5370cd0892fabdc6323f21ff349035b92e6d20ad5a54083aa94161ae90f087d47dfd5ab074ad5cee15eb3e4bd1cbba5fe7a01d35083733da877fdb00f92b82169915b7a87f0ba1b72fb2dcd2810f80110e945bb40aa9c234b49780dd3b890ff9d71a8a33620c7745b5dca056fae3fd64c6838951be65f16d238a502844862ea0685cf137b3c9381c1ce65b9d518cbd4e30992e1b008bb459ce581115809ed6d429007602afb454ae9ce741651ae83c63f07f718be2a2f8ddac391c937c1fd5416cf54685ff94a0492eb13197b0f2986c8f0569fe630d58d5962c44496841d771db61ff0e0b17d912fc23b7065b0f18fe368a5d74b0f0704316a68041da2169ba44a713148eb297e1ff7a7891637860b085fd008015cf684836bb67351650ec2f8a1d10bf1e909e0fccf483cb610671a40e3096d2526e61e125a77f9331d19bf4ea92f610fa88f33fd9a54cb80fc764d94e54453621b18097ef68a32981f61e3cec198de055840aec5300fbc270f417ba5b729c21bd74a3be014bb32e69c7a0be51994935ce879bc1d641127e3be5f6302f57c9d2e9b8ab99e8c7ace465f3f64f9c32940586365c1c797ca65bef13b7c9c925ec465787cf64c779c487690ff48bfc5570091f415aa1fd48a3185f49ead223d53c0505b995e45b1dbdf94242818b6bf8d4eea8aceae5c220fa5366d776c72a8cad0eedbe7490dc840b9a3b4c5d8ca1416cbb95260dd9b0b9e1d05403b072aa9a54a5ea628510efebe42b984c773251a59a96164c08644d89c71616bbbbce4786b83319ba5c9f14f61bff810e36434e08a0992af5ca1cd72d1ab4e161c5621bae5b9a1550cb8dcaa1dbac277544b8491c5cd730df78b3d71168d8bab6af4daa0dc7e7345dbeb42db5af8cb3f8c894b7b62310ce1a62b8a9409685f92327875f6fcf516c01612340b1410caabefb9045e6ff48de8b6fdb4cc49a2df3e60504e3f8e69faf486a10b4f95ae1e4ff0d8ee454594e52cfcc844068cfbf6a6774ba0e85a72e6f10af7e2b4e70e89f8de9532f140df0ce3dd6b2cbb7bb0e860090b2249a13d57a5c05b93ed4357af13dab9fc7a08f5cc3416c11781ee9258277af4d0b12cd4e5e8e04b912cd4d5eef2a441d68f01f543a8aacb4c22083951d30b80737baa3fda46f219e9191d32f57ed2d972f4795c44bf3cd59c2cbfd760f990c6dceac7d50899a38e1c3576ff5d54b1b090a2fc2ea4dac32ca0843323f248726c9b54a9d71a79828af6e3f477e28a6e63a6bbacce678d36c8aa8b0801093259cd7c54e88757f2ffb885f28d3c8569518111a557fcad960403ac88d6a51d40e974ae48b1d21fa5f235f43efed1c231223f11e70d83b23b934be11b0bccad5fcb96901807516c3f68dcecff49638860b26c55357ba75b60ad185c03dccabcd95be18abf8e7f6a87ad7be79779b21027c4f2de4b99f9a0bd6797f35e430258ea90775c5b3e7e6e392a5348b3ca552357602aba37c1cec90b92f0201b6e6aca7dafd67f3a5f5240dd06f08d17f1ac5d79fbc24ff0ba84ba98e55e4be8be53a07cdb457070057002b5b0000c4f886bec6a35fd4ac4cd2bd21b6ed6ecb8b9bb9786e50e1b4beaffc753936555d3ae4742ec123000008000600", @ANYRES32=r2, @ANYBLOB='\b\x00t\x00', @ANYRES32=r3, @ANYBLOB="e8108f8008007100", @ANYRES32=r4, @ANYBLOB="04106000ffab41c6811856238314a48f0707803225ca594fe376e72d7890c515259c38ebc91e0239b5b016e69c5afb10baa93011314bab8bfd3f385b50729f853a912d2c7c0095c462e4823abf8d8ea0c66851e1be13e122a8af4893b9f406d778b26d7cf8b3391ac5efd1fcc8c6f3e9b072b931c17b89c6a17c5087b6e70317ee3ca426b6c3b30f37f9867f4239828cfc43a2f132124d8523e04e8d070d65ac4b687ba47656e739d96e2e354d7e3abf9b2b3637985db6714da32b102a2470b2004525016382603c414c6ff64f0ee25e18eee27d2b04b20be629238139b82af04eb90dca87cbccd0e0066c1512f4d0cf945f7656c0a89a10732cad0e5fe22ecf2574bfaddab4ec8288b851f59fa1531e8501140a901ccd3b25a47899127030c8a22af89ea2fd067d081835f8dd345b9b11df05396b3e35c52f437fe6da3393811be06f8468ebc06196cec4f8991c1d6c1bf8a9d82464f73e3f39a2fcb15bae911c1596359b5eaeedf9222e7e77e91a94807f27322fdf991cad6b235c386e19295fb21e5dadde681a80d17e513e9d94abf1eba397ccabe8c1dfa60158ff5cff5a2bb968a2fddb5ef71479c50d19ec476c7900bf9f81ccda6af95d190b03b3b6fd2bc0d9e57200702d07c28cc5b552e86838be0cc861372eac0fff6e25e3bdda6efad26651cd0cb871bae29f5db78e1664d4c2e7cfee76b16da55387edd9c2f6ef99fe4b56bba75b0559c0ff62893c9758eb1ca87e23ca49072776c42d99d9321b374de37b4bf469ceaf389fe945da18049b01f7f784fb0a9f5f757aa9b91aa41e39a251245efc8266eade7a8d4c53c4ef2faf65a4a711133878c3e1fbfae393883641fda883652a7957955c251055ebb5989d48bb00f4ad9163e04fa70e3dfe4031b96af15132194fcdc351c0b7337ed3d390c34fa8596a6559b82ccfc3dd23ce3c1f17209861704ba561e0c1e68efdc5c37d9a26b6defe07a75c0c7e021fc3c01fe77cb852bae79f59cb5ae1d1f79c6670e5f29b60fbc612aa574943adb969d7a5dce5c28c154666a5967eb05e664ad7b29dc499641b92dc510870a66a1d3b61cc50675d25d6af8bdbd389d46c1481911ad035e3b47118a8a884d02987f9ee989e101e0b0083078b54966d133c7c384b0a19cb0f7ffdff4ff8d2b9d9a16fcb66bda9cc7fc250cbeba6cc8b8d9e89ea387eb0f911ccf80cf59398edda707a23e964ee5c405894939bf1cab9819c4e01198a4a4b8dc551a1501ecf2f6f96411e8ddf913cebb80772b5aa99d92ddb69d8101f36f3d52f87f749934caa2cf44ab59ab342152c3b69ba00341db0c5ece14a3ec7e5f83c848fa0af84485d911c941f19db59b3358464cbf829d6da84681cb4443f4719ac98ecd7940a7d28924feb21fc198f429f79c91646e429a987e142645bc34974b16e75d6260ca7ef7e0d5dc176901a3fc175c212a65516158a92b289b5628cefe92a0041a9e9f4df8d882211ad52f4b5a7e3249f206b354a857b70622757aad980432f30168ac2bc51d117ea321e706b991c386eb932972f7068b7d4a029a578bbf574bd713f2dba655095798336c906b4b927fd66b592fb761708d30e060c6d7f0aa29cba12b5f8525bcf6a38676dc697822e1f5088bdb9744aae45ba8fd788c0e6c3a6d12b244292477f8712b3705b51d2b1ede2270ddaf67fb83ae54919e6bd3d4ea233c41519aba97f698080c58e7ca1ae08f744e16d6ee70849b8b72314b32a32f62fd9787de8c2675ce5fda9386bdeb23ba4585c3edfc6cebef48ddddfebf8e32e6fff10f86c650410a07adb690c13dec07c87ec68d50c0a2384f32a41f69f73c9b902629517a95672a99cdf4542a3119f9a7443d6b18525898292458f16a3aa374978b479f83ee54807043c6c66958a95d6ac09731ab81bee9dd0e20acfb4ae14c0c2a33d9a8da319a1f091029e92a5009944c8022679d22694546cadba26d1d0a6eb86bc827006a0711f25176e03112df05180c934ce931a7452327c4594817e172342975ae3151503645c564b11b2ae4c9eb7b2e11c31b806c2ac81274adfa7807a15e84b71a3a19ed4a6593f51d1ea93fd7d96b6f9aa99f3cbcc5253cd43fe27c7735103af05952949f30fcdba9ce8a0c8b2a659529b777c1cf17f68f2d6fbcff10288332a7c697237a20a1b55b3e3628dafd6e44eaf42d8867217ed9cb38d45c5e47d85692c24fedea760c55a6b6cf28fdce7fd345d9bb1f0b68bde2e7ba5aa189dd6269ca621a312d5e409e0b9f11b73213c5a3aa3400b5078eedadb6cb0a17e9c87807879917fb710a37f92c7546ad6d82dd04c17597c2ee07a2d9fd34ee98e23568b498b7f79880a1391dfc5f23cdb360b38f3d22df71bf8a55b9d3428b8b20dd19a4cb9c638e5becc987e033bb1af53b3ff12b8b53fa8dd174cbfce23ed7a591c027695b5efcfc9613a4f48465d13758cff5344b2a8ab412664e2ee8cfd49f5cff28564e300609163d582ec9487e480e89bb2f5c02500d2b3f590616e13c50b45eed9daae2bec77435219e0b823dcccf908eb6561b38b1e5f486af8e6a778a65b7f64b830c29d15efb99ca5aad2263252658db2e4db22f35a8af8509b456b0dc5a9659143985b28216a906a20fd06577d9cf45b9bae81f1c1ddec0e28f02c6b8ea15e4b43bbe6b98501b99ce8378ee671948a9cfe85a9f80643f35c8057cc6bf0d627bec1f55b73231e3e3e6ec32d64d4dbb0d30d11be1821b63b160f6af1552f4a1d3bd93134885e3ae5330bd5c2252889b63a56961aef8e804792c3fe54eded41a32c59a6d0ab7caaf1c06767b67d7f95d49c29095b7d84870c20ee31e3cff8fc05f3b5d1cdc2af2a7510dedd7d132a9e85a0d83533ddd7f8560104b7ca7cdbcbb1c8f82481571ec5a73fae0dcb77ec612092e071d76e9f8d31c1613338c5176aac8d033559e55eb119548be4250f5d552afdabfb8ff069bcfc9bcc72467736026a22db2ece31c01527e0f163f712661844dc0d5f8adb9013418c3912008f8aa7185ecdd2518b0d1691d071b6a00250dd51a124ca2efea721b547e2ae1c0c6bdac0ae9adc2c0abe60af5f4f1034b3692534c270b1abe7525199e4e98660038a7182d27720e6a32201702d31828c2daf69ed5e4729aa22633aa695d589714aa6a10348b90ea6be6f20479bfc9ad682be3a59fca887874bd81b7d3fa9f68b0d08c9205316b2146f0e634dfe5dca68ee07ecce33ebd1ca731e4d5e9ec991eb4ead76584cd9bdf4ff7656fb92b2b40b7d7bee836707a10199a3de93ca2d2966e77a62f7d681b03a38a8efd6781e74a9c4c46bae5e35af767f49409fa552d5daf401e2b90dfe0c8df2c5eba99022b0f22e13e9f72b47dc018227517796f4b66e3c003ff2f207fad6cd2daaf4faaf16def998750c7a1159f0b1d3770e7778e95cfb82b4958164c1df1db743c6601908e06f71f98da589bdd08795b6b14aa4ba1dfa5cceb6785bcbdacd51e2bcbae2f0dddda07fcc1d80f811a8810e0f991e5dee1bcf0eb5311a2de32f241cd68fcd6370e2de303d01cd6307ad01627dc8f2c906c659e5f91af204fbaa69175aeb03d75a60e8b89c2e65d5cb35264a7a5c694e1f97392528a8651f5928ad03806a738bb713d864b1afe3f4ad8280bde8bf9007a1f9be1f1bdd0dd84c7d43949efb32e4a6e57d4eff20e0dd2dbfc0b50fc5aa0143a1c1c95e6430037226a9bf507e83cfe804938683914332ea65ea1cedae48ec2dcefac4b2f04fc9331f47cf9126a3bf2d5a9e21d1d363df68765a5f6c552de8dbf663440310af6a3f4e62edcc9a5c9df9ba51adb2407df3b148dab4de92d260801771dc1c69d358ee909dbc97a2ad9ccd8312a1abc4d7e5a76be1936ff5cce37f6785b8de9aefd1841ebe13df814fbe603ef821afd9fb482c8a50d963b83de96fdcbd9fded7defa6dc50db1c2ccd9277c6fec8da769cb9eeb4efc03fb437263dbe5d26a8a144e4c79ed369677acdff67ccf0126836fd20f42bd63549955f3e4d55db4dcac6abd8ab21ca3c858e55966895f33171bc46595232598c0d448f1bef1afaf9ea215d3f44d3c230db46d8f12f04b8e90fc4a35fa769073085d190f6e1e967bebd35c4f373260bbe6ae9f62546aa9bd7e2bb9915062d6fddb9abf4f09a7a7bc95f753839e17116531d78ac9d7ad9f6112a239bf26ea888f02931e703692fa9c0abab14d0ae5773484450143c58f940169076346d5db15e214528b581bd9cdc30493b3beaeb2d416d58d1e0cabdc17dd9232eff4e0835896cd8a586bacbae3f28ea2149bda66e3ce17397dc11e59e1d54b456894ae81037cbffb6687f621d93ea2060335a66b3d31b9bede334f417b659e880b0c60f4fbfc462f9609cd124cddb7579d9db53f67d93ae466b963c6b38df1dd7acec437b47e20914baf602de2452d320dc861408d3cf2acd81f4c1fda684ccd07eb9e2973869d691dbbafa92a70b638626a8f232493f372d0a4c681f7fb2c9bb650fcbab21da4a53fa7044d28c8d85b3992decea66b9cd7cca3f6ef25f6bbb6d731b05dd8c675f6818c0d796e69c076d23c314c9448df8017ed583a26811f9cfee3376fd09321328ded70938958b35a562d79f423e4733bf64a867677ee95d7f79227250d34822abb06e7a1405be0a3e25a332fe5456268e6f564660b90a5cf1f074d234097aca90cdd4236cbbdf1b519c1833f1ebf1461a803547a337aea67dee8dd114cd0a0ae8ac1b2b7c634433978dd917fb20edbc87e546a0b0b6d8d9153e6c9408f403df32250283f84536bc9bc743c8a456541ec6a722bd01970ec97feabb3af3d9138361e3bfb32f144f2601c53648b600afe494814377eab50f4250b71ac4c86782c4966b57a2336d3a797584003195d7b7689ffa630638140e49cc1cfb503676740e4c88b94a59ec398d189cb7eed80e57ae285947d5807fe660baccdb3c1c09ca6f98f850befb612547cec3616982ab642c195e257195007846deba79050f2fe7f328afff22e330de6e85b96aa388a3e0b0df492b3870353fe19620845bcbee8d980d81d885e02164b561c29edc457c4ddadecd16cd63834c455fbee9c992133129fbac4dc213d380e9d268d9ab127225dbebb369eca955967332d5860e915809933332a0f4dfe990fa12c2d4cad0ea67abab440a90914cf98d45e6af53f070461a8736093040ebc76f0cca417f0e0f64f17696e7d769890ccfe6d7c485f87a73994531626835c62a892c2c0b01425c05c9302c97b2eb028b022661d77b7987e0cc1385fd413a9ae72f164220f433f5a13180415aa6e0deb91a0bc28f5f1731e4e989d353da7c9bd37c8753bf0d755b40f769e560702eae3ad0acce8f0c9b5ce5c8168992f80e12963beffc97536bc8ed54bd680ef1724eec3bd190cf382ffff348d9a010b22f1c4c9d1569455d9049e69f06d3158aee022b2493a5499bd5879f76a9b5d65f62feb8e1b8274e2bf7e956e08ea413b5410d21006304db2a8e5aa4d19c5a3d7de2675fc498d6087462f78e8802998911bdda3682ea979518d45ba508698f77775c70684b195e2aa14ff1b6609abc8dac67ff82454d8a9b564c180a5dad81b2543abdbc944dcfefcfb6d636fb8e9bd2231f0e9f3fc788c01405563b37ee42b0900811cf16d96a2a7bd1dd96b76346430ee839645709d18d14dd478903154ff489cb3004badf421b455fb726897acd5b3e8f8bde3433a2287764f82fd752c18793ed6927b054bcf024e442b585b2799fdb1c1c5c5258db5cddd9dfc729ed76b268edbbdc04d8897f974687ae21400910000000000000000000000000000000001349e9e7f50ecc4749b3a8c4df376b6feb4597ac212c5d4befdc8f908dc6f6e61f6bb6b9cda863ce6f1b741ab782adb31248f5f52d21c462f09f8c09db1f6943129fa8558963ea95222683d5805ceafa98c5b809f327bcc4811ba21ce87ea18ff8e964ae1735bdd861f3e601076e6ba9d120ff79d3de7127b0797a3e3f90b20caff8b1f29c5390fe7cf1d68bf8d351ecf1af050d88ce2aec17e81dfd7c8693eaafa861215b509b143238ff99fd176e02c80ffb82a3c813cfd3507bbaed358104a04000f00cc50ed91bbfcaca65f34b72a479df90c37b01576b482da33796c5e7d767d896d93b7127fef5fbf22cf582044b18ee0acc98521374f7e7c0bf26d3f6b877019a293d01da3267c7458df627259443848816394499f7af8f4945d25b3d4778f5d863c1a7f5142b69a1c9ffbf6e6f3a8ac21e498f966f2f560d6b6e47234d9f1549722498d049abdfcfe9b38a7ddf482f2fa61b61aa46209dcfaeb0f08007b00010000800000"], 0x21f0}, 0x1, 0x0, 0x0, 0x48000}, 0x200040c0) (async) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000005c0)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x0, 0x3, "ce2d1bf257e6487b9d0f84d624afeb1d56fdd47658ab9addbee74b4ec961fa4fa2c96a0b49c19d7d410f53547404b9dc7d707fea29d9e4b7de6b902a30ee34cce9f0f7466f9da03758602071d8023de376fadb21112cecb2b122aae62746b3e53b1282c88a09ec6497c920991cc36b37ce0acf795d43e5104d31eba79ed5184028ea2f418a9c3d5b3595907a3bdb4ae486f3a6e22ba0fcb00c1ee74e28e7740c012f928e126fc0992358ffa09ac88008577f1019dcaf0ca6ec0fca0d76f1b8aa5fe2937c6e94d8fa1b668e42b354b5a4fb407ac1577f10417eeb606dd83740674e933d00f953a362dd9e17723ced6b8bd2de083e7223a141592ac21f1248bfce70575b2ae7c48fa84b6d74ae1e5f091e6f8af94ae605c4cafbe0c81605ce103ff5fa45f7eaafbd7850dc215568e56b3250183ca175abf639a502f924b13fbefb7511f6668ea99c1aec3ee91b8cbc66821a3a413f0daf864d99704b9c2b7bef36f1d82ad3fac4aa7bf580d1dcc5b66e2a4b5c538ff83ba528330168e1103a8801411d2fefb9dbc6bc9170db9b07338bc5933f4bfa6907f53d00ec842f000926b0faaa37e9b9ca40f42600fa62cf8f9a55ddb570fea292228a05d525a6a3918c83dbf379e8e37a9ca44513fbb600417628470c3c24666baa8b9f2eba26af3abe2ae0551f2baf04092812360870bf7f5c41705d6a74523475a7c3efc8d0a7c1b1e5be845d5d32bde084c994f9d4d9afd2f4f6e44e4b2a696de6c1ca371fba2852a63ca053dfcd3180e9755ce65da151a3fcf9cebb4c6641a01a587dabc808028a8ec2cf84d85cefb6ee363eac789fc1c6fa87892c9e9cb96b9c7430dc6dc3d74634b0362d9825562b235d1d47704c17984534c64f827e94a2686340cf9a3ec00611f3b5689c5195b9e6388655dce5c9170672c00758c89d92a527219a0c893c0075b58a85bb98093f4e9d215e5d323eec9daad5cb4815a57cf116d1e622a88274d567607dfb088ff6b954256e426a0ec85a8eaa6dd62bc98bead530bb9a8c19819e12774ec6c0a3c6e0212fa8f601fa1e451d86384acbabb41547fa843157338b5e7103eb7ce312ce9900c38f639827c90965ce9e390d3f64cd9394a170c6915932d78961bddf0364884c4f0ceb7370cc4ee7b661ab5fde73fed5d5cabe95e2b8f29037cfb49f0aa37eb96fefe7b6748e5c6ccb0df6fcfe300f19f95dbfc15f8f3651e2b314622b62b709e8dffbcdccf6b6bfaa81139dea20260425334d3f5c568d3f79be39323c0df24584963780aaf256292f57de4847cf5ee831ab071ba4c58c186926960165b77fe3103d27c8f0bf1ab0f7ca936b1e57d8bfe9bd89d82174de76d5a9c50dbf207272e8adabd817adc032bbf07537adb72abbbc077f7cf2100978bd9a26b2f2851c5ab1ccc3cd18de15de5e72b7ceb6e1c7cca65ea9ff28aa18ef5470f1140c9fdb15415c54c1f1896913e1028e0e069dd36e256a32f425aba4fcdeb782b4aae3aae18f4aa2b23cb9a13e13adc728898f03b60776bc25329aada306e111af68068635de46893df123294ffaab21e815b1676d814096a9685a4ce1ca2840b4dd82f9a413ce366e9354861ba02dde7ecf12238241089a231f73325612894e441ed49583ea83d59ee358505cfac5247bd3576570f04d9e3a0b38b525ae08b3cdfe36059c95a94bc8e19e4c154507c34f6d012cb0bf7e01fe0f256f51dd90f0e99642b4f6075a09a07166a8a4c557285aaf2884b24183ec6cde28a1769b57410bf093efb01099ed4993f983ca801662c34497ad3ef5bd56ffcd8d949f64190ac10d057ee82b0391e7ecc555eebb9c859691fdb6acfb6305d735c7f1c991dd0a1e05bff1f9dd67d441bd803a4f69b5e24b3f94b9db9c29d7bc34dbcb198dd96e6bef6ab0325ffd78b74477b834db50adbd637d4d80ba109dbdc850942c3b778f34b6aeb12afde4d8be7371bf1a7f03357f19aa168d468394c8c8c52b0f7c5d0de1e2575e738f2d7c0af06d5be9b8bde82cb81da96b4da818b757d5e8872cae652e1f5111d55fd80313c868a58033a505b1fd0d50fffa546aaa5818f02ec95a69efb1240b1490ba4bcef4c5e419d2f02eda0abd46da29549966f7fea62262ff8a6568a16d08497903965f3452d1cd79a089db4e7c215c18b5910e2012ecf11617c87ac47bbd7b1c8646bee83d8c6af7842818e6c568a5b4dbb25cca3b2b9781a945b703709e5aa73b1c84f5faacba0714b7d52f7aae015de4c652c7f8f8ea8f67d5d15cee6ba760f6ef9b49b9298b44a8254cb636569108fca0625c670ca4cd65b95d3e938fdc0ed18f463163762eca8696d18a1dd7942fd9fe6a186d9dd101b7df62c38ca5d7e936d18169043ebd44869771e50d65e94c52aea49d1162cbc96d51333e5287b1d7e50adb8025e3334d977ae086bf9315f6816c6e14496fa97359e234f6b263cd31c3fefede33905ca7d83901d5a64d1c2ade6a42271bf7a321354caea040305dfef27cbe475ba1e8877a5dbcce115e56e8b30fce145a00da81469ec0e0eb11caa7e197305a3657f4b46684c9a7743b3b7c1a956b2e391b1c5ae11a6bcddcccc2af554c19046f0182bfdc596e3bb6b12246141a45266b9504fc13054ac5e08b48eea677c0d592780e4d52ac6d7e9ae429fd5fc37c2fe81d439605b52bcb9f615a22f0e865b84a22a92a63f6b713ea8ff2e2e6065738fbf45339e88b56c384fb3f6971977ea467d753b44df7741c9e29ceaea56aac4d8392182cb0750121186d62610396265dd1edb27986d0ce80be0d974f94ae5a70ad615bc3814e2992b1bc77eeb5f4dd2d2fc972dff2728d4a83f8e762f98bc42aeeb0ed6989ba905f48357a9834cfd89d11d3b58c4ded69580c8ed875b64a51a7cf87504db699aecda371365afb7b7773958da5df3243ac10e0e666345239af2089ffb15ea317a9d5bb04f6874a0f5a50480c0c4a35ecd7b1a705205c154c4bbf26d2000c2444fadc44ff2a26dd734e97f7390fa486ee53c6e63da4fd7fb498d2c2838e2615cd70e83c1600af441eabbabc5315c7bf1e9cf034451635d54cb3a1e3e2a353701bf927b245372eff6bfc52e4b5fc68f0bebbd07285582330c35f769c5266ba891f5363874689c49e40b366770fd6c051fc2c3778aa755f0266f38d6976ba1733e40f62109b1b68dfdbe0bee6db2be15952d9466a46ec51ec1f0c4bcb00ca2abe543619ef5be11d337bf5c868abf47301faa09ec53281cd47d96deaffdc9d22dd802bbcdfbd65be7f91cb778b02d5e7c897206d60b968b8c66990c0e33e00ffc166395e73ae1729325118e3b1e6a68a97a5ec5022d82ed4f28c367647eb2d4196e38c17e1050413d8d494a7600e597b6ae1120c3a9ae7de35ab88a998d1ba554346cf3fd8b1e48595b00fce2ab738f4aadf74e42378931a44af4ce5d5d8adf6e12aec78bcf7f46c82ee5122a366a280acde57afd9d48c4b48449168e7e9b20f6d3b849b5cba74fe9bf099f1efaa9fb967f69dee47b043e9881a709c83baa5dc767dc8cb99d2cc6647681e3db013a01e0eebf7faf1037d026f3613dbb33a14146caf165d41a9af5de86ac374221eb518213371d542be0a8687e0c9785a80d8a4e9021cb90b289485646d363ed7b25624f2ac01eac9770df96dda0278d8e6c55636f229d22ad8a71dada497bf89551df3724eb1bd565b1011b4f67b06939e4f2f45280535869c7163a4ca2a474afc787b2f003b98a5ba7bbb5d2a7c632eb15c101518afb57e71f4e259ac1f1e363eb1ed98ef56af253fe637bf45d099cedc15dc0c54b430e91affde2a9fff94f1e123e3e2b9db937edd530ab8ceae77f4a373c7c4a7ba9cae04fa69bf97dc89a1f68e38fdc1026bd800b8f3b333c35b747dd0b486d7dfda05475f870734d52cef998264fa126dfd11b008a2b2fa0a0220546610390712aa3f29317d6d6c88f891afa305d3278088e399ccdf2047e160c689d93f377496f81bcb83a8c63a46418731402aa1163a9563818796eb57fba0b492ca8908020e1186e5e0ecd44d98e95404c81ea90f389318162a943cbaef63bf547fdc48a967a0193778448da9bfe3b28812502ae6c7ca67086ab93d11b52a24e81e55fc5bbc1b560b79fa4d28a10765039825a73586106fe62abb4cea6d025c373e7253d24dca5d3d681988d728817f7466ad81f9a4d70918eff16b601646801f23bac66fd1bd9983f02cdf4d750e864e1edda8d6b4f53696e230154840745b5c4cd17ecc01da1cbd864da4c201ed12ac727b93fbbc03539862a437531aab059d8f648ee68a2af4061c8b90031dad68c2d413ee91b7ec7fcb747ac1fed470e143be104057c3dc42579867d0ba39d00a66424035d562dda85fb40bc337d6cafc2c0db7a76ae2d46730e7cffe0a95abb355b0d87400fc001504e75022e8294b23681934cdbf6d7a3dc77313ff002e1282756da00fb97eaa5f23be002456221a648a2cfc53469fd2f3fb8dce2674508cdc7a0c1102fe4685936304e6d54fa17aee2b5acf17d007b1e91603d75fe4a9f6587a2ab0c10590a4256e4e1d1003debc20cea4abd5862e2a747a7b93bc96a86043f89a53ba02077677143e4e565bb0a4bfe35e33f6588c32672b793cdc346677b30c49e5c0d57c261902f44592745bd0ca28887fcf482ba51d53778c4337e80c8d2880721d697a09084710d55a3e7b1150dc8998baa92d66f07a3434129e8876676f7bbbd242c39cddfb4b4b9b9315ad4edb1ac91815b0672508e7bb409963c6637e9108c91567f38470d29aca080db5ff1a65eae087aa3b29478154bcabe0bbfac76eec5c4e4851140aa7945be060f59b5cb4a415a6b19975e2cc853a6a98a94ca4b4ce128ddb03547a9179252215051ea60415131010cc6b734fd9346d38f57eb64904df506420c713ab40914f48694bd857735929a6a9dc9db2dbc6d0e79145331fce919c519532de33b9a471c0cc48614e97ae771e5e81f00f8c77f86316a7580805697d68fb1891e7c6264937c3aff17f9cb80e9fd963821c7c1dbbf6da4530d50a78742034bd0c44e3ed5a7e692bb0e247e1ee26148cf974f022cf4d02606fb9326f6f9f64fcd3aa497d5313e3d2b340fa88d31ddf596348ef0e9d81285ac157aec4d418030088ac1e0f5a446964f2e21fee54405bf9a1fc639ee7b57677d32d547b977429079ec14253901cc1feb9d7ae44202a8aa8ac72774e94b16b5bde9dea7a78845af82aed90bc113494d6595c5c38f46143343c499084bacdc95acf7e7815101125d052c372c25db95c5d98eb17c44dcaa1e83a27ab40c061cadeb879672cd7d305cd9a9dd632e9eb4b1c71307215316f4491c0ac5a2df4fe9c4755735095f4fdb1c186d7e4db1873514102281fd6712e51121b6946aacf40903ddaa240a248b2c447b29f2c80fb7817a9e9dcab90a79f94af399f017996bbc161c6039d4ae9659e28cb47ca4bd3730de5bea3af8afba10690750f867ee3cac6f01b9801cf04fa37e24ea8db64696d4b51e34027f7ef7935567814f056f866d192e465ff89695d48a30a7656a119f90652016ce8fda8fe65a33cd3d4e0db0783317a75aaf107bc0886f4f70d0b6442ff4776a7b5ff2adfa962dfe62e2920d89712686125719fe8e5b307d61398916fcde3c0b95e00c04b3b6c51a77f1ea219b423cc8448650c9edeac8fcf828ba1b6fd26925d8e0dde7149e79a20d841ca9237f0d03f4200f134c4bf233ad17c43f91d434b6a8661a5c0682510600b52140df2088b0607703a92f565be5bfa96f3388b69"}, @TIPC_NLA_NODE_KEY={0x0, 0x4, {'gcm(aes)\x00', 0x0, "fa8d66fc678dbd4ac9b86e47e23dd272e3f2437339620423af5db2146847e78f"}}, @TIPC_NLA_NODE_REKEYING={0x0, 0x6, 0x1}, @TIPC_NLA_NODE_ADDR={0x0, 0x1, 0x6}]}]}, 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x4051) (async) write$P9_RVERSION(r2, &(0x7f0000000300)={0x15, 0x65, 0xffff, 0x0, 0x8, '9P2000.u'}, 0x15) 16:10:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00 ', @ANYRES16=r1, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) [ 1061.937599][ T5904] Bluetooth: hci6: Frame reassembly failed (-84) 16:10:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async, rerun: 32) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) (async, rerun: 32) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x8080) (async) r3 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x10}, 0x10) statx(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x100, 0x1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_generic(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000001640)=ANY=[@ANYBLOB="f02100001600100025bd7000fedbdf25050800003e102a8008003500", @ANYRES32=0xee01, @ANYBLOB="4d8358eeef3f1b20f0f511bad6f99eecfd060c8ef45559e80dfa12ddf4d98d8fad0274d618bd9592e2a66dcf25991d3b832b1282593c548982797c01e63b9a495a0353fdc20d72d1f2719e171f47e86fd61d4c50fc17ef13a620c440e2ae37e26168a1c582c095380e3c08d6f319890aff0ef53e71f5e4a9a17008584586355a4ad9128be21ea2796fbd3cbfd47be7f1ccf1ba63318f19f5c41d6198677a3f19ce726e47e52808b724967ed51150a9c731fc54d93e9db078a15619a38c5296209dbf27b34ecdbdb754c61a609d0c1eb86325100efb09b973b73727df783bdedd0b48a5f458b562efdc27e8afceb33c14ac7ea5bbda6b721fad2184b2e0d5ffc730db41a2b4ca53066dba6133803b8f1fb44849295082c0904d37e3c237bf3bb6e7972dfbaa4ecb651be952afeaef12db15fe296896f2f40807e0247cb63c05ec1e89d69f10f6fdf3aeee03932fc66ca947508cc187ff98675943ea4f1201ce98da4b189b57e3b80128db17392a368865765c79db299a2d91b3d7a5996d3aa4a7111e26324b84d1a82679779a90affa0a8427c388ea4bafeea6e7f49df33d7bf0a58b7d056f857cdab944b4d463f834289df1db7ab851b2fc5beeebb8b28c803531ceb84c9755e192731b2b57f04c7c96f15e0e0e65f7fc38f42366d1876b9f3ef6835d82e4a5635073aade39f981a945f93e21dcf584d3f1fd77a643f3d8883dd29384b602bebfcdcf08bb47e606e558f27c9d5115a366acd8eb1a9cde54ab71bc89e14fbf13db46a3c3673711dd74c4982d05c7f8ab66e621d9c14b53865f5ab019321b2346e7c57c4be19cc27fa11a9666f9ee77ef76feb9ca4906e1b31fb2a89b3f7c00a320885c6bfdc149b1edcc9fe6d90df0b1ccc6fb3ab80b13b8c53667eb339199bf2d103720a6ca328b7627d324a07f6fa00d5422a27b5dd52bf8550ed82486965c1da26044ff13e5dcac520ef2db7a1c5f9923fb7e8597829adb96903eb65e3a4e89c13963c5ded23b968044260c29427cff83037c7370dd26a6c66f04e9f02d08716bf530e23a4d6e5d6c2fb1e78f12fd9b276dd44346b3389b77b768860704fd3cf7877b4cb8939ca0ba3a276dc354b2366023e9ab47997c2683171a2feb1ed25bbb72f24bb8a9fd0c0e96cc97dc597986927ecaa2e072f0bb800d3e225d7d5a9a430d098890fe8f9a0cd956d40c86956595e601fec271c247d1f5d809aeb8cbf5e3b91bfdc94171d2d3fbf2c58ffec1346dbf3f2e35818468d563cce2835bbc17e8b04deaa2fa2594da349054c9848ec734f05b9c5d06377795b0a9c3b1766c94bb422535aa2442d43fa69a99ac852ec476e64b941214b375879d278d335dd560c2fe13b8b0cd0aff51f30a1adff968df3c98defd331976e2a89e6a5958ae142525fd7a17031fd8302bed338dd43cddf71853eaced677c95f02f7adb657158ed8546c21a8a63ee860386893e33f58b7fa97e67233fe4414d2d288f27404193645aa7b4f409c94151318e1252895e31a0a4fded8c4d324483b0292f44f7b81bccaf93c5c049c611b35b5bf2e1a17e1504b97bab44d7c6887cd6d9f5d0dd7ca4662359da149e4c8571a3a4d92291e511f77ceced3b8dc1eede28e5cdc4184a2da07d73027763f13f54900036993da2fc2a238c171993d295a8045f466ac770f6b53447fd2f85fdda7520efcaa983ba0ed6b4e858c2c175e44f47ddbe6169a4fa5b720e1e30cddc30280146d77357ee42a9b5cfcb61ecc689240673d269cb49f2678165d3fa82fbe909db6cd3feac8f9bb6847c778d8ec2e182e3e0312b92331597f585c52feb3b2241b6ef5d327d2b6afb1d4d3f1b82a411a7ef1771ff21d8de27933fbab51053ada9416f8951cb68118b94827eebf1ec23adb821dcb16569e5586ff7fc112124281b56bb47a8461791ce437ce80a2b7d4fd93ec1e45361f151e48d312066ce119094107940d21618901a6861e49e9e261efda31547d7e47f1acdbe9c11a8c61da2afc785bf4b99afe296c86a2d307e930cf76573f25c61034c905b042490198cdc467599bc973330d750039467e946921247947e60658510696d1246a83556e883018f06fa075155b841276600f198e622bd7e4e14ffb903bfb124caae75919f2fc6d75f791ef2042665a6872f99caf6735254e6091f061348e76aa6cfd23fd2e0357d4d99dbe3f52f6d065a3f164136728abb996820685a81771b0e78ca18635406c71fc92feeb866c1f1111f8de6b7c1d83338051eecacaa63db6c33ef2dff7f365c9b6aaa05333956dd9ea4e978adba184ac186ad199ef517150597726e19f3535fb8001848ed60fb62e464605b1f5ebdbcafa08113a97ceab21d65fe57df87407bb577d126262fbfbb9c285edb0aa152d8f6daa6f3a56c823a9e2a66f690465843586593da8618061bf658fc66a1f9b3107b7a9a03e7970aa9edb8f625cc03b5fc7da1024a9707d64a0f8225f745b6abf75cdb12518ef635b439ed74f2d83ab2cdb4d74292a53de33d3bd43258374724262dca409fe8b96abda3a6a597a57b94321f8f8cc914ea0dcfc3698148142238032baef370de40916b249b0ce2715e73c1931cb00eaaf44736e6706580a1976a7a99798469d11fe837c51ba279dfb1ad350726b19e78533ed042f9c2b20f7253169db6fcdd2adb3edca2be8024aaef710797f403d8849a125454212a268fb1e27ad1b721f12715043b1da974c3f8c8a01d45f16bf93525117d210957da7b8d4f724866ed3b0b7e8fa7b7bd5982f326080e209f10be8573a00f129855e44669752a27bbc7952c6a95474c6d271df7461a2c614d80b2a3f1ff7c8e7c571c34b9b6db344595816564b6725ba8484399f58e31a69864b23415ce9fe16a5c080fcfa036c0013855ef4588e761dbfdbf247dbcbdd2b4fd716748ccff258ced47a9ed0012a275049d2281fc4467f8c069db15a14efd330059291f68077c2633e3153edcb1d682c5c3ce6c2901d55c01f4a0786eb9f3b87b889046b67f676ed698fd3206933e163cc4e75fcdd5a02529a5a234ffa0a0699ae20c87d1891bc8ffb69725ab1a6fc85c6e59fba510cd2e498d7a8678f233f195da57e906155a9b903c95c0fbd82254de08a399008da110275749a1e9dadce27c1074625c1e4ca125f74d1b70c994cda8afb3ac98b59685067fd7a9c93d2a4004b50627cd89abacb8366ca4f2c9ccf2612a2f9eb41cd27cc426a385356c43157bbba1152052aaba7352f4fcde750c4d9c0a2ec6405cca5850fc4e6802f89c63dbce6df5518f306e329fb8d79e28387cc8d50871e2aab81bb2b95b5fe98dc3a4cfaba508dbfbc69df01620770d0e1a0f849f4f6ed391e4e1290c2dd80c819929256af1a19954d617b4394bd49e8c7444486441fb046a161cf67c1491742612caef41aee52f814f216d3dc7da482b5fa3da7932ade3062418bb71151af73e271fd7076291328b9122aeeb14d501127bb86b76ea4020db20fd156fee330602fed3f3566bd279437773c236c9acc87791d9cf96fba34f0eccdcc5d0e6be1318cda8a62d49d5f0fce6c0ab8631ba149ae45c312bca0a62eb232070a0ff0cb238cb38fb965f410be5163a574fb3e2f77dd32040873a30cce80ff44d7678fd0aff141cfc218ddec562f5203ca755b3823ab463f90839034c9dec677c29d5d303ff65b92f6cd6f7ee71270f37f763023b2dc3592625005b8b27a41ed19a0baea8b3967ec1c8a50e0ec50c40e928cbce0ecc92c18f14a07a990b20d3d6e8b70892714161b5bfad1efa29e70364a06914a4169b276811d3ab39978a1f9b38437929455e6ffd0398aaa55f2c580bc0bff1dcddc0fcd395638ba307e793275f63838f04cae740fbcda0bf984a07960291f4c644292b98eab629b819689119746bc95d78d13ccbdc1edd3c6ac7cc836d0681d882d12a070028eef6ce1b205e261cbabc589c8a269914d01fbd76b35d0671fae4d49da9319f3f5fcebcf54d81a0f19dcdd4604f40b4e9864f198935fb8a81f9b6afccbcccbfce26946bf7fb9004411ef0bc8ab918ff3ff68ce84a949dd8ced89cd0f1d6e35efb8b14b0fdfb35db7c987e7e334f04d73a30be25e21761c686da23b4f13288f08ef56ad91d5d4d2780dec6ab207e9ffd1a0209d96963739fc04520caee0a46be218fc9a235a9ccb00052a267cb5ad30d1aafa6f0257a25cbbf50773344d2ff3c727c4c9a4045542998bc8365f6e667d5370cd0892fabdc6323f21ff349035b92e6d20ad5a54083aa94161ae90f087d47dfd5ab074ad5cee15eb3e4bd1cbba5fe7a01d35083733da877fdb00f92b82169915b7a87f0ba1b72fb2dcd2810f80110e945bb40aa9c234b49780dd3b890ff9d71a8a33620c7745b5dca056fae3fd64c6838951be65f16d238a502844862ea0685cf137b3c9381c1ce65b9d518cbd4e30992e1b008bb459ce581115809ed6d429007602afb454ae9ce741651ae83c63f07f718be2a2f8ddac391c937c1fd5416cf54685ff94a0492eb13197b0f2986c8f0569fe630d58d5962c44496841d771db61ff0e0b17d912fc23b7065b0f18fe368a5d74b0f0704316a68041da2169ba44a713148eb297e1ff7a7891637860b085fd008015cf684836bb67351650ec2f8a1d10bf1e909e0fccf483cb610671a40e3096d2526e61e125a77f9331d19bf4ea92f610fa88f33fd9a54cb80fc764d94e54453621b18097ef68a32981f61e3cec198de055840aec5300fbc270f417ba5b729c21bd74a3be014bb32e69c7a0be51994935ce879bc1d641127e3be5f6302f57c9d2e9b8ab99e8c7ace465f3f64f9c32940586365c1c797ca65bef13b7c9c925ec465787cf64c779c487690ff48bfc5570091f415aa1fd48a3185f49ead223d53c0505b995e45b1dbdf94242818b6bf8d4eea8aceae5c220fa5366d776c72a8cad0eedbe7490dc840b9a3b4c5d8ca1416cbb95260dd9b0b9e1d05403b072aa9a54a5ea628510efebe42b984c773251a59a96164c08644d89c71616bbbbce4786b83319ba5c9f14f61bff810e36434e08a0992af5ca1cd72d1ab4e161c5621bae5b9a1550cb8dcaa1dbac277544b8491c5cd730df78b3d71168d8bab6af4daa0dc7e7345dbeb42db5af8cb3f8c894b7b62310ce1a62b8a9409685f92327875f6fcf516c01612340b1410caabefb9045e6ff48de8b6fdb4cc49a2df3e60504e3f8e69faf486a10b4f95ae1e4ff0d8ee454594e52cfcc844068cfbf6a6774ba0e85a72e6f10af7e2b4e70e89f8de9532f140df0ce3dd6b2cbb7bb0e860090b2249a13d57a5c05b93ed4357af13dab9fc7a08f5cc3416c11781ee9258277af4d0b12cd4e5e8e04b912cd4d5eef2a441d68f01f543a8aacb4c22083951d30b80737baa3fda46f219e9191d32f57ed2d972f4795c44bf3cd59c2cbfd760f990c6dceac7d50899a38e1c3576ff5d54b1b090a2fc2ea4dac32ca0843323f248726c9b54a9d71a79828af6e3f477e28a6e63a6bbacce678d36c8aa8b0801093259cd7c54e88757f2ffb885f28d3c8569518111a557fcad960403ac88d6a51d40e974ae48b1d21fa5f235f43efed1c231223f11e70d83b23b934be11b0bccad5fcb96901807516c3f68dcecff49638860b26c55357ba75b60ad185c03dccabcd95be18abf8e7f6a87ad7be79779b21027c4f2de4b99f9a0bd6797f35e430258ea90775c5b3e7e6e392a5348b3ca552357602aba37c1cec90b92f0201b6e6aca7dafd67f3a5f5240dd06f08d17f1ac5d79fbc24ff0ba84ba98e55e4be8be53a07cdb457070057002b5b0000c4f886bec6a35fd4ac4cd2bd21b6ed6ecb8b9bb9786e50e1b4beaffc753936555d3ae4742ec123000008000600", @ANYRES32=r2, @ANYBLOB='\b\x00t\x00', @ANYRES32=r3, @ANYBLOB="e8108f8008007100", @ANYRES32=r4, @ANYBLOB="04106000ffab41c6811856238314a48f0707803225ca594fe376e72d7890c515259c38ebc91e0239b5b016e69c5afb10baa93011314bab8bfd3f385b50729f853a912d2c7c0095c462e4823abf8d8ea0c66851e1be13e122a8af4893b9f406d778b26d7cf8b3391ac5efd1fcc8c6f3e9b072b931c17b89c6a17c5087b6e70317ee3ca426b6c3b30f37f9867f4239828cfc43a2f132124d8523e04e8d070d65ac4b687ba47656e739d96e2e354d7e3abf9b2b3637985db6714da32b102a2470b2004525016382603c414c6ff64f0ee25e18eee27d2b04b20be629238139b82af04eb90dca87cbccd0e0066c1512f4d0cf945f7656c0a89a10732cad0e5fe22ecf2574bfaddab4ec8288b851f59fa1531e8501140a901ccd3b25a47899127030c8a22af89ea2fd067d081835f8dd345b9b11df05396b3e35c52f437fe6da3393811be06f8468ebc06196cec4f8991c1d6c1bf8a9d82464f73e3f39a2fcb15bae911c1596359b5eaeedf9222e7e77e91a94807f27322fdf991cad6b235c386e19295fb21e5dadde681a80d17e513e9d94abf1eba397ccabe8c1dfa60158ff5cff5a2bb968a2fddb5ef71479c50d19ec476c7900bf9f81ccda6af95d190b03b3b6fd2bc0d9e57200702d07c28cc5b552e86838be0cc861372eac0fff6e25e3bdda6efad26651cd0cb871bae29f5db78e1664d4c2e7cfee76b16da55387edd9c2f6ef99fe4b56bba75b0559c0ff62893c9758eb1ca87e23ca49072776c42d99d9321b374de37b4bf469ceaf389fe945da18049b01f7f784fb0a9f5f757aa9b91aa41e39a251245efc8266eade7a8d4c53c4ef2faf65a4a711133878c3e1fbfae393883641fda883652a7957955c251055ebb5989d48bb00f4ad9163e04fa70e3dfe4031b96af15132194fcdc351c0b7337ed3d390c34fa8596a6559b82ccfc3dd23ce3c1f17209861704ba561e0c1e68efdc5c37d9a26b6defe07a75c0c7e021fc3c01fe77cb852bae79f59cb5ae1d1f79c6670e5f29b60fbc612aa574943adb969d7a5dce5c28c154666a5967eb05e664ad7b29dc499641b92dc510870a66a1d3b61cc50675d25d6af8bdbd389d46c1481911ad035e3b47118a8a884d02987f9ee989e101e0b0083078b54966d133c7c384b0a19cb0f7ffdff4ff8d2b9d9a16fcb66bda9cc7fc250cbeba6cc8b8d9e89ea387eb0f911ccf80cf59398edda707a23e964ee5c405894939bf1cab9819c4e01198a4a4b8dc551a1501ecf2f6f96411e8ddf913cebb80772b5aa99d92ddb69d8101f36f3d52f87f749934caa2cf44ab59ab342152c3b69ba00341db0c5ece14a3ec7e5f83c848fa0af84485d911c941f19db59b3358464cbf829d6da84681cb4443f4719ac98ecd7940a7d28924feb21fc198f429f79c91646e429a987e142645bc34974b16e75d6260ca7ef7e0d5dc176901a3fc175c212a65516158a92b289b5628cefe92a0041a9e9f4df8d882211ad52f4b5a7e3249f206b354a857b70622757aad980432f30168ac2bc51d117ea321e706b991c386eb932972f7068b7d4a029a578bbf574bd713f2dba655095798336c906b4b927fd66b592fb761708d30e060c6d7f0aa29cba12b5f8525bcf6a38676dc697822e1f5088bdb9744aae45ba8fd788c0e6c3a6d12b244292477f8712b3705b51d2b1ede2270ddaf67fb83ae54919e6bd3d4ea233c41519aba97f698080c58e7ca1ae08f744e16d6ee70849b8b72314b32a32f62fd9787de8c2675ce5fda9386bdeb23ba4585c3edfc6cebef48ddddfebf8e32e6fff10f86c650410a07adb690c13dec07c87ec68d50c0a2384f32a41f69f73c9b902629517a95672a99cdf4542a3119f9a7443d6b18525898292458f16a3aa374978b479f83ee54807043c6c66958a95d6ac09731ab81bee9dd0e20acfb4ae14c0c2a33d9a8da319a1f091029e92a5009944c8022679d22694546cadba26d1d0a6eb86bc827006a0711f25176e03112df05180c934ce931a7452327c4594817e172342975ae3151503645c564b11b2ae4c9eb7b2e11c31b806c2ac81274adfa7807a15e84b71a3a19ed4a6593f51d1ea93fd7d96b6f9aa99f3cbcc5253cd43fe27c7735103af05952949f30fcdba9ce8a0c8b2a659529b777c1cf17f68f2d6fbcff10288332a7c697237a20a1b55b3e3628dafd6e44eaf42d8867217ed9cb38d45c5e47d85692c24fedea760c55a6b6cf28fdce7fd345d9bb1f0b68bde2e7ba5aa189dd6269ca621a312d5e409e0b9f11b73213c5a3aa3400b5078eedadb6cb0a17e9c87807879917fb710a37f92c7546ad6d82dd04c17597c2ee07a2d9fd34ee98e23568b498b7f79880a1391dfc5f23cdb360b38f3d22df71bf8a55b9d3428b8b20dd19a4cb9c638e5becc987e033bb1af53b3ff12b8b53fa8dd174cbfce23ed7a591c027695b5efcfc9613a4f48465d13758cff5344b2a8ab412664e2ee8cfd49f5cff28564e300609163d582ec9487e480e89bb2f5c02500d2b3f590616e13c50b45eed9daae2bec77435219e0b823dcccf908eb6561b38b1e5f486af8e6a778a65b7f64b830c29d15efb99ca5aad2263252658db2e4db22f35a8af8509b456b0dc5a9659143985b28216a906a20fd06577d9cf45b9bae81f1c1ddec0e28f02c6b8ea15e4b43bbe6b98501b99ce8378ee671948a9cfe85a9f80643f35c8057cc6bf0d627bec1f55b73231e3e3e6ec32d64d4dbb0d30d11be1821b63b160f6af1552f4a1d3bd93134885e3ae5330bd5c2252889b63a56961aef8e804792c3fe54eded41a32c59a6d0ab7caaf1c06767b67d7f95d49c29095b7d84870c20ee31e3cff8fc05f3b5d1cdc2af2a7510dedd7d132a9e85a0d83533ddd7f8560104b7ca7cdbcbb1c8f82481571ec5a73fae0dcb77ec612092e071d76e9f8d31c1613338c5176aac8d033559e55eb119548be4250f5d552afdabfb8ff069bcfc9bcc72467736026a22db2ece31c01527e0f163f712661844dc0d5f8adb9013418c3912008f8aa7185ecdd2518b0d1691d071b6a00250dd51a124ca2efea721b547e2ae1c0c6bdac0ae9adc2c0abe60af5f4f1034b3692534c270b1abe7525199e4e98660038a7182d27720e6a32201702d31828c2daf69ed5e4729aa22633aa695d589714aa6a10348b90ea6be6f20479bfc9ad682be3a59fca887874bd81b7d3fa9f68b0d08c9205316b2146f0e634dfe5dca68ee07ecce33ebd1ca731e4d5e9ec991eb4ead76584cd9bdf4ff7656fb92b2b40b7d7bee836707a10199a3de93ca2d2966e77a62f7d681b03a38a8efd6781e74a9c4c46bae5e35af767f49409fa552d5daf401e2b90dfe0c8df2c5eba99022b0f22e13e9f72b47dc018227517796f4b66e3c003ff2f207fad6cd2daaf4faaf16def998750c7a1159f0b1d3770e7778e95cfb82b4958164c1df1db743c6601908e06f71f98da589bdd08795b6b14aa4ba1dfa5cceb6785bcbdacd51e2bcbae2f0dddda07fcc1d80f811a8810e0f991e5dee1bcf0eb5311a2de32f241cd68fcd6370e2de303d01cd6307ad01627dc8f2c906c659e5f91af204fbaa69175aeb03d75a60e8b89c2e65d5cb35264a7a5c694e1f97392528a8651f5928ad03806a738bb713d864b1afe3f4ad8280bde8bf9007a1f9be1f1bdd0dd84c7d43949efb32e4a6e57d4eff20e0dd2dbfc0b50fc5aa0143a1c1c95e6430037226a9bf507e83cfe804938683914332ea65ea1cedae48ec2dcefac4b2f04fc9331f47cf9126a3bf2d5a9e21d1d363df68765a5f6c552de8dbf663440310af6a3f4e62edcc9a5c9df9ba51adb2407df3b148dab4de92d260801771dc1c69d358ee909dbc97a2ad9ccd8312a1abc4d7e5a76be1936ff5cce37f6785b8de9aefd1841ebe13df814fbe603ef821afd9fb482c8a50d963b83de96fdcbd9fded7defa6dc50db1c2ccd9277c6fec8da769cb9eeb4efc03fb437263dbe5d26a8a144e4c79ed369677acdff67ccf0126836fd20f42bd63549955f3e4d55db4dcac6abd8ab21ca3c858e55966895f33171bc46595232598c0d448f1bef1afaf9ea215d3f44d3c230db46d8f12f04b8e90fc4a35fa769073085d190f6e1e967bebd35c4f373260bbe6ae9f62546aa9bd7e2bb9915062d6fddb9abf4f09a7a7bc95f753839e17116531d78ac9d7ad9f6112a239bf26ea888f02931e703692fa9c0abab14d0ae5773484450143c58f940169076346d5db15e214528b581bd9cdc30493b3beaeb2d416d58d1e0cabdc17dd9232eff4e0835896cd8a586bacbae3f28ea2149bda66e3ce17397dc11e59e1d54b456894ae81037cbffb6687f621d93ea2060335a66b3d31b9bede334f417b659e880b0c60f4fbfc462f9609cd124cddb7579d9db53f67d93ae466b963c6b38df1dd7acec437b47e20914baf602de2452d320dc861408d3cf2acd81f4c1fda684ccd07eb9e2973869d691dbbafa92a70b638626a8f232493f372d0a4c681f7fb2c9bb650fcbab21da4a53fa7044d28c8d85b3992decea66b9cd7cca3f6ef25f6bbb6d731b05dd8c675f6818c0d796e69c076d23c314c9448df8017ed583a26811f9cfee3376fd09321328ded70938958b35a562d79f423e4733bf64a867677ee95d7f79227250d34822abb06e7a1405be0a3e25a332fe5456268e6f564660b90a5cf1f074d234097aca90cdd4236cbbdf1b519c1833f1ebf1461a803547a337aea67dee8dd114cd0a0ae8ac1b2b7c634433978dd917fb20edbc87e546a0b0b6d8d9153e6c9408f403df32250283f84536bc9bc743c8a456541ec6a722bd01970ec97feabb3af3d9138361e3bfb32f144f2601c53648b600afe494814377eab50f4250b71ac4c86782c4966b57a2336d3a797584003195d7b7689ffa630638140e49cc1cfb503676740e4c88b94a59ec398d189cb7eed80e57ae285947d5807fe660baccdb3c1c09ca6f98f850befb612547cec3616982ab642c195e257195007846deba79050f2fe7f328afff22e330de6e85b96aa388a3e0b0df492b3870353fe19620845bcbee8d980d81d885e02164b561c29edc457c4ddadecd16cd63834c455fbee9c992133129fbac4dc213d380e9d268d9ab127225dbebb369eca955967332d5860e915809933332a0f4dfe990fa12c2d4cad0ea67abab440a90914cf98d45e6af53f070461a8736093040ebc76f0cca417f0e0f64f17696e7d769890ccfe6d7c485f87a73994531626835c62a892c2c0b01425c05c9302c97b2eb028b022661d77b7987e0cc1385fd413a9ae72f164220f433f5a13180415aa6e0deb91a0bc28f5f1731e4e989d353da7c9bd37c8753bf0d755b40f769e560702eae3ad0acce8f0c9b5ce5c8168992f80e12963beffc97536bc8ed54bd680ef1724eec3bd190cf382ffff348d9a010b22f1c4c9d1569455d9049e69f06d3158aee022b2493a5499bd5879f76a9b5d65f62feb8e1b8274e2bf7e956e08ea413b5410d21006304db2a8e5aa4d19c5a3d7de2675fc498d6087462f78e8802998911bdda3682ea979518d45ba508698f77775c70684b195e2aa14ff1b6609abc8dac67ff82454d8a9b564c180a5dad81b2543abdbc944dcfefcfb6d636fb8e9bd2231f0e9f3fc788c01405563b37ee42b0900811cf16d96a2a7bd1dd96b76346430ee839645709d18d14dd478903154ff489cb3004badf421b455fb726897acd5b3e8f8bde3433a2287764f82fd752c18793ed6927b054bcf024e442b585b2799fdb1c1c5c5258db5cddd9dfc729ed76b268edbbdc04d8897f974687ae21400910000000000000000000000000000000001349e9e7f50ecc4749b3a8c4df376b6feb4597ac212c5d4befdc8f908dc6f6e61f6bb6b9cda863ce6f1b741ab782adb31248f5f52d21c462f09f8c09db1f6943129fa8558963ea95222683d5805ceafa98c5b809f327bcc4811ba21ce87ea18ff8e964ae1735bdd861f3e601076e6ba9d120ff79d3de7127b0797a3e3f90b20caff8b1f29c5390fe7cf1d68bf8d351ecf1af050d88ce2aec17e81dfd7c8693eaafa861215b509b143238ff99fd176e02c80ffb82a3c813cfd3507bbaed358104a04000f00cc50ed91bbfcaca65f34b72a479df90c37b01576b482da33796c5e7d767d896d93b7127fef5fbf22cf582044b18ee0acc98521374f7e7c0bf26d3f6b877019a293d01da3267c7458df627259443848816394499f7af8f4945d25b3d4778f5d863c1a7f5142b69a1c9ffbf6e6f3a8ac21e498f966f2f560d6b6e47234d9f1549722498d049abdfcfe9b38a7ddf482f2fa61b61aa46209dcfaeb0f08007b00010000800000"], 0x21f0}, 0x1, 0x0, 0x0, 0x48000}, 0x200040c0) (async, rerun: 64) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000005c0)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x0, 0x3, "ce2d1bf257e6487b9d0f84d624afeb1d56fdd47658ab9addbee74b4ec961fa4fa2c96a0b49c19d7d410f53547404b9dc7d707fea29d9e4b7de6b902a30ee34cce9f0f7466f9da03758602071d8023de376fadb21112cecb2b122aae62746b3e53b1282c88a09ec6497c920991cc36b37ce0acf795d43e5104d31eba79ed5184028ea2f418a9c3d5b3595907a3bdb4ae486f3a6e22ba0fcb00c1ee74e28e7740c012f928e126fc0992358ffa09ac88008577f1019dcaf0ca6ec0fca0d76f1b8aa5fe2937c6e94d8fa1b668e42b354b5a4fb407ac1577f10417eeb606dd83740674e933d00f953a362dd9e17723ced6b8bd2de083e7223a141592ac21f1248bfce70575b2ae7c48fa84b6d74ae1e5f091e6f8af94ae605c4cafbe0c81605ce103ff5fa45f7eaafbd7850dc215568e56b3250183ca175abf639a502f924b13fbefb7511f6668ea99c1aec3ee91b8cbc66821a3a413f0daf864d99704b9c2b7bef36f1d82ad3fac4aa7bf580d1dcc5b66e2a4b5c538ff83ba528330168e1103a8801411d2fefb9dbc6bc9170db9b07338bc5933f4bfa6907f53d00ec842f000926b0faaa37e9b9ca40f42600fa62cf8f9a55ddb570fea292228a05d525a6a3918c83dbf379e8e37a9ca44513fbb600417628470c3c24666baa8b9f2eba26af3abe2ae0551f2baf04092812360870bf7f5c41705d6a74523475a7c3efc8d0a7c1b1e5be845d5d32bde084c994f9d4d9afd2f4f6e44e4b2a696de6c1ca371fba2852a63ca053dfcd3180e9755ce65da151a3fcf9cebb4c6641a01a587dabc808028a8ec2cf84d85cefb6ee363eac789fc1c6fa87892c9e9cb96b9c7430dc6dc3d74634b0362d9825562b235d1d47704c17984534c64f827e94a2686340cf9a3ec00611f3b5689c5195b9e6388655dce5c9170672c00758c89d92a527219a0c893c0075b58a85bb98093f4e9d215e5d323eec9daad5cb4815a57cf116d1e622a88274d567607dfb088ff6b954256e426a0ec85a8eaa6dd62bc98bead530bb9a8c19819e12774ec6c0a3c6e0212fa8f601fa1e451d86384acbabb41547fa843157338b5e7103eb7ce312ce9900c38f639827c90965ce9e390d3f64cd9394a170c6915932d78961bddf0364884c4f0ceb7370cc4ee7b661ab5fde73fed5d5cabe95e2b8f29037cfb49f0aa37eb96fefe7b6748e5c6ccb0df6fcfe300f19f95dbfc15f8f3651e2b314622b62b709e8dffbcdccf6b6bfaa81139dea20260425334d3f5c568d3f79be39323c0df24584963780aaf256292f57de4847cf5ee831ab071ba4c58c186926960165b77fe3103d27c8f0bf1ab0f7ca936b1e57d8bfe9bd89d82174de76d5a9c50dbf207272e8adabd817adc032bbf07537adb72abbbc077f7cf2100978bd9a26b2f2851c5ab1ccc3cd18de15de5e72b7ceb6e1c7cca65ea9ff28aa18ef5470f1140c9fdb15415c54c1f1896913e1028e0e069dd36e256a32f425aba4fcdeb782b4aae3aae18f4aa2b23cb9a13e13adc728898f03b60776bc25329aada306e111af68068635de46893df123294ffaab21e815b1676d814096a9685a4ce1ca2840b4dd82f9a413ce366e9354861ba02dde7ecf12238241089a231f73325612894e441ed49583ea83d59ee358505cfac5247bd3576570f04d9e3a0b38b525ae08b3cdfe36059c95a94bc8e19e4c154507c34f6d012cb0bf7e01fe0f256f51dd90f0e99642b4f6075a09a07166a8a4c557285aaf2884b24183ec6cde28a1769b57410bf093efb01099ed4993f983ca801662c34497ad3ef5bd56ffcd8d949f64190ac10d057ee82b0391e7ecc555eebb9c859691fdb6acfb6305d735c7f1c991dd0a1e05bff1f9dd67d441bd803a4f69b5e24b3f94b9db9c29d7bc34dbcb198dd96e6bef6ab0325ffd78b74477b834db50adbd637d4d80ba109dbdc850942c3b778f34b6aeb12afde4d8be7371bf1a7f03357f19aa168d468394c8c8c52b0f7c5d0de1e2575e738f2d7c0af06d5be9b8bde82cb81da96b4da818b757d5e8872cae652e1f5111d55fd80313c868a58033a505b1fd0d50fffa546aaa5818f02ec95a69efb1240b1490ba4bcef4c5e419d2f02eda0abd46da29549966f7fea62262ff8a6568a16d08497903965f3452d1cd79a089db4e7c215c18b5910e2012ecf11617c87ac47bbd7b1c8646bee83d8c6af7842818e6c568a5b4dbb25cca3b2b9781a945b703709e5aa73b1c84f5faacba0714b7d52f7aae015de4c652c7f8f8ea8f67d5d15cee6ba760f6ef9b49b9298b44a8254cb636569108fca0625c670ca4cd65b95d3e938fdc0ed18f463163762eca8696d18a1dd7942fd9fe6a186d9dd101b7df62c38ca5d7e936d18169043ebd44869771e50d65e94c52aea49d1162cbc96d51333e5287b1d7e50adb8025e3334d977ae086bf9315f6816c6e14496fa97359e234f6b263cd31c3fefede33905ca7d83901d5a64d1c2ade6a42271bf7a321354caea040305dfef27cbe475ba1e8877a5dbcce115e56e8b30fce145a00da81469ec0e0eb11caa7e197305a3657f4b46684c9a7743b3b7c1a956b2e391b1c5ae11a6bcddcccc2af554c19046f0182bfdc596e3bb6b12246141a45266b9504fc13054ac5e08b48eea677c0d592780e4d52ac6d7e9ae429fd5fc37c2fe81d439605b52bcb9f615a22f0e865b84a22a92a63f6b713ea8ff2e2e6065738fbf45339e88b56c384fb3f6971977ea467d753b44df7741c9e29ceaea56aac4d8392182cb0750121186d62610396265dd1edb27986d0ce80be0d974f94ae5a70ad615bc3814e2992b1bc77eeb5f4dd2d2fc972dff2728d4a83f8e762f98bc42aeeb0ed6989ba905f48357a9834cfd89d11d3b58c4ded69580c8ed875b64a51a7cf87504db699aecda371365afb7b7773958da5df3243ac10e0e666345239af2089ffb15ea317a9d5bb04f6874a0f5a50480c0c4a35ecd7b1a705205c154c4bbf26d2000c2444fadc44ff2a26dd734e97f7390fa486ee53c6e63da4fd7fb498d2c2838e2615cd70e83c1600af441eabbabc5315c7bf1e9cf034451635d54cb3a1e3e2a353701bf927b245372eff6bfc52e4b5fc68f0bebbd07285582330c35f769c5266ba891f5363874689c49e40b366770fd6c051fc2c3778aa755f0266f38d6976ba1733e40f62109b1b68dfdbe0bee6db2be15952d9466a46ec51ec1f0c4bcb00ca2abe543619ef5be11d337bf5c868abf47301faa09ec53281cd47d96deaffdc9d22dd802bbcdfbd65be7f91cb778b02d5e7c897206d60b968b8c66990c0e33e00ffc166395e73ae1729325118e3b1e6a68a97a5ec5022d82ed4f28c367647eb2d4196e38c17e1050413d8d494a7600e597b6ae1120c3a9ae7de35ab88a998d1ba554346cf3fd8b1e48595b00fce2ab738f4aadf74e42378931a44af4ce5d5d8adf6e12aec78bcf7f46c82ee5122a366a280acde57afd9d48c4b48449168e7e9b20f6d3b849b5cba74fe9bf099f1efaa9fb967f69dee47b043e9881a709c83baa5dc767dc8cb99d2cc6647681e3db013a01e0eebf7faf1037d026f3613dbb33a14146caf165d41a9af5de86ac374221eb518213371d542be0a8687e0c9785a80d8a4e9021cb90b289485646d363ed7b25624f2ac01eac9770df96dda0278d8e6c55636f229d22ad8a71dada497bf89551df3724eb1bd565b1011b4f67b06939e4f2f45280535869c7163a4ca2a474afc787b2f003b98a5ba7bbb5d2a7c632eb15c101518afb57e71f4e259ac1f1e363eb1ed98ef56af253fe637bf45d099cedc15dc0c54b430e91affde2a9fff94f1e123e3e2b9db937edd530ab8ceae77f4a373c7c4a7ba9cae04fa69bf97dc89a1f68e38fdc1026bd800b8f3b333c35b747dd0b486d7dfda05475f870734d52cef998264fa126dfd11b008a2b2fa0a0220546610390712aa3f29317d6d6c88f891afa305d3278088e399ccdf2047e160c689d93f377496f81bcb83a8c63a46418731402aa1163a9563818796eb57fba0b492ca8908020e1186e5e0ecd44d98e95404c81ea90f389318162a943cbaef63bf547fdc48a967a0193778448da9bfe3b28812502ae6c7ca67086ab93d11b52a24e81e55fc5bbc1b560b79fa4d28a10765039825a73586106fe62abb4cea6d025c373e7253d24dca5d3d681988d728817f7466ad81f9a4d70918eff16b601646801f23bac66fd1bd9983f02cdf4d750e864e1edda8d6b4f53696e230154840745b5c4cd17ecc01da1cbd864da4c201ed12ac727b93fbbc03539862a437531aab059d8f648ee68a2af4061c8b90031dad68c2d413ee91b7ec7fcb747ac1fed470e143be104057c3dc42579867d0ba39d00a66424035d562dda85fb40bc337d6cafc2c0db7a76ae2d46730e7cffe0a95abb355b0d87400fc001504e75022e8294b23681934cdbf6d7a3dc77313ff002e1282756da00fb97eaa5f23be002456221a648a2cfc53469fd2f3fb8dce2674508cdc7a0c1102fe4685936304e6d54fa17aee2b5acf17d007b1e91603d75fe4a9f6587a2ab0c10590a4256e4e1d1003debc20cea4abd5862e2a747a7b93bc96a86043f89a53ba02077677143e4e565bb0a4bfe35e33f6588c32672b793cdc346677b30c49e5c0d57c261902f44592745bd0ca28887fcf482ba51d53778c4337e80c8d2880721d697a09084710d55a3e7b1150dc8998baa92d66f07a3434129e8876676f7bbbd242c39cddfb4b4b9b9315ad4edb1ac91815b0672508e7bb409963c6637e9108c91567f38470d29aca080db5ff1a65eae087aa3b29478154bcabe0bbfac76eec5c4e4851140aa7945be060f59b5cb4a415a6b19975e2cc853a6a98a94ca4b4ce128ddb03547a9179252215051ea60415131010cc6b734fd9346d38f57eb64904df506420c713ab40914f48694bd857735929a6a9dc9db2dbc6d0e79145331fce919c519532de33b9a471c0cc48614e97ae771e5e81f00f8c77f86316a7580805697d68fb1891e7c6264937c3aff17f9cb80e9fd963821c7c1dbbf6da4530d50a78742034bd0c44e3ed5a7e692bb0e247e1ee26148cf974f022cf4d02606fb9326f6f9f64fcd3aa497d5313e3d2b340fa88d31ddf596348ef0e9d81285ac157aec4d418030088ac1e0f5a446964f2e21fee54405bf9a1fc639ee7b57677d32d547b977429079ec14253901cc1feb9d7ae44202a8aa8ac72774e94b16b5bde9dea7a78845af82aed90bc113494d6595c5c38f46143343c499084bacdc95acf7e7815101125d052c372c25db95c5d98eb17c44dcaa1e83a27ab40c061cadeb879672cd7d305cd9a9dd632e9eb4b1c71307215316f4491c0ac5a2df4fe9c4755735095f4fdb1c186d7e4db1873514102281fd6712e51121b6946aacf40903ddaa240a248b2c447b29f2c80fb7817a9e9dcab90a79f94af399f017996bbc161c6039d4ae9659e28cb47ca4bd3730de5bea3af8afba10690750f867ee3cac6f01b9801cf04fa37e24ea8db64696d4b51e34027f7ef7935567814f056f866d192e465ff89695d48a30a7656a119f90652016ce8fda8fe65a33cd3d4e0db0783317a75aaf107bc0886f4f70d0b6442ff4776a7b5ff2adfa962dfe62e2920d89712686125719fe8e5b307d61398916fcde3c0b95e00c04b3b6c51a77f1ea219b423cc8448650c9edeac8fcf828ba1b6fd26925d8e0dde7149e79a20d841ca9237f0d03f4200f134c4bf233ad17c43f91d434b6a8661a5c0682510600b52140df2088b0607703a92f565be5bfa96f3388b69"}, @TIPC_NLA_NODE_KEY={0x0, 0x4, {'gcm(aes)\x00', 0x0, "fa8d66fc678dbd4ac9b86e47e23dd272e3f2437339620423af5db2146847e78f"}}, @TIPC_NLA_NODE_REKEYING={0x0, 0x6, 0x1}, @TIPC_NLA_NODE_ADDR={0x0, 0x1, 0x6}]}]}, 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x4051) (rerun: 64) write$P9_RVERSION(r2, &(0x7f0000000300)={0x15, 0x65, 0xffff, 0x0, 0x8, '9P2000.u'}, 0x15) 16:10:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x2, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00 ', @ANYRES16=r1, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) 16:10:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5441, 0x0) 16:10:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)={0x128, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}, @TIPC_NLA_LINK={0x54, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x360727f7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffff20f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff8000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}]}]}, @TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_BEARER={0x84, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xd0bc}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x8, @remote, 0x101}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x6, @empty, 0x5}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x34ef0915}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x128}}, 0x0) [ 1061.987332][T26892] can0 (unregistered): slcan off ptm0. 16:10:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00 ', @ANYRES16=r1, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) [ 1062.085218][T26944] can0: slcan on ptm0. [ 1062.130218][T26942] can0 (unregistered): slcan off ptm0. 16:10:18 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) (fail_nth: 1) 16:10:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)={0x128, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}, @TIPC_NLA_LINK={0x54, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x360727f7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffff20f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff8000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}]}]}, @TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_BEARER={0x84, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xd0bc}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x8, @remote, 0x101}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x6, @empty, 0x5}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x34ef0915}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x128}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) (async) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)={0x128, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}, @TIPC_NLA_LINK={0x54, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x360727f7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffff20f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff8000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}]}]}, @TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_BEARER={0x84, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xd0bc}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x8, @remote, 0x101}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x6, @empty, 0x5}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x34ef0915}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x128}}, 0x0) (async) 16:10:18 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) sched_setattr(r1, &(0x7f0000000380)={0x38, 0x0, 0x0, 0x10001, 0x1, 0xfffffffffffffffe, 0xb, 0x8, 0x8, 0x9}, 0x0) (async) process_vm_readv(r1, &(0x7f0000001780)=[{&(0x7f00000002c0)=""/196, 0xc4}, {&(0x7f00000003c0)=""/131, 0x83}, {&(0x7f0000000500)=""/224, 0xe0}, {&(0x7f0000000100)=""/126, 0x7e}, {&(0x7f0000000600)=""/226, 0xe2}, {&(0x7f0000000700)=""/101, 0x65}, {&(0x7f0000000780)=""/4096, 0x1000}], 0x7, &(0x7f0000001bc0)=[{&(0x7f00000001c0)=""/11, 0xb}, {&(0x7f0000001800)=""/124, 0x7c}, {&(0x7f0000001880)=""/109, 0x6d}, {&(0x7f0000001900)=""/140, 0x8c}, {&(0x7f00000019c0)=""/251, 0xfb}, {&(0x7f0000001ac0)=""/197, 0xc5}, {&(0x7f0000000480)=""/15, 0xf}], 0x7, 0x0) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:10:18 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x3, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:18 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5450, 0x0) 16:10:18 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r0) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r0) [ 1063.956906][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1063.956916][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:10:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)={0x128, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}, @TIPC_NLA_LINK={0x54, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x360727f7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffff20f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff8000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}]}]}, @TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_BEARER={0x84, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}]}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xd0bc}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x8, @remote, 0x101}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x6, @empty, 0x5}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x34ef0915}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x128}}, 0x0) 16:10:18 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x4, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:18 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r0) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r0) [ 1064.002650][T26995] can0: slcan on ptm0. [ 1064.009807][T26994] FAULT_INJECTION: forcing a failure. [ 1064.009807][T26994] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1064.025584][T26994] CPU: 1 PID: 26994 Comm: syz-executor.3 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0 [ 1064.035791][T26994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 1064.045893][T26994] Call Trace: [ 1064.049200][T26994] [ 1064.052132][T26994] dump_stack_lvl+0xcd/0x134 [ 1064.056728][T26994] should_fail.cold+0x5/0xa [ 1064.062750][T26994] _copy_from_user+0x2a/0x170 [ 1064.067441][T26994] copy_msghdr_from_user+0x89/0x150 [ 1064.072658][T26994] ? __copy_msghdr+0x4a0/0x4a0 [ 1064.077421][T26994] ? kstrtouint+0xd2/0x120 [ 1064.081843][T26994] ? _kstrtoul+0xf0/0xf0 [ 1064.086089][T26994] ? rcu_read_lock_sched_held+0xd/0x70 [ 1064.091582][T26994] ? lock_acquire+0x480/0x570 [ 1064.096257][T26994] ? rcu_read_lock_sched_held+0xd/0x70 [ 1064.101729][T26994] ___sys_sendmsg+0xdd/0x1b0 [ 1064.106320][T26994] ? do_recvmmsg+0x6e0/0x6e0 [ 1064.110909][T26994] ? lock_acquire+0x480/0x570 [ 1064.115583][T26994] ? rcu_read_lock_sched_held+0xd/0x70 [ 1064.121399][T26994] ? lock_release+0x560/0x780 [ 1064.126160][T26994] ? __fget_files+0x248/0x440 [ 1064.130847][T26994] ? lock_downgrade+0x6e0/0x6e0 [ 1064.135703][T26994] ? ksys_write+0x127/0x250 [ 1064.140217][T26994] ? lock_downgrade+0x6e0/0x6e0 [ 1064.145068][T26994] ? rcu_read_lock_sched_held+0xd/0x70 [ 1064.150544][T26994] ? lock_release+0x560/0x780 [ 1064.155217][T26994] ? proc_task_getattr+0x1f0/0x1f0 [ 1064.160341][T26994] ? ksys_write+0x20c/0x250 [ 1064.164897][T26994] ? __fget_files+0x26a/0x440 [ 1064.169578][T26994] ? __fget_light+0xe5/0x270 [ 1064.174170][T26994] __sys_sendmsg+0xf3/0x1c0 [ 1064.178677][T26994] ? __sys_sendmsg_sock+0x30/0x30 [ 1064.183785][T26994] ? lock_downgrade+0x6e0/0x6e0 [ 1064.188637][T26994] ? vtime_user_exit+0x218/0x6c0 [ 1064.193583][T26994] ? trace_hardirqs_on+0x2d/0x120 [ 1064.198615][T26994] do_syscall_64+0x35/0xb0 [ 1064.203032][T26994] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1064.208922][T26994] RIP: 0033:0x7f5e7c68b5a9 [ 1064.213328][T26994] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1064.233031][T26994] RSP: 002b:00007f5e7d81a168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1064.241448][T26994] RAX: ffffffffffffffda RBX: 00007f5e7c7abf80 RCX: 00007f5e7c68b5a9 [ 1064.250209][T26994] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000004 [ 1064.258179][T26994] RBP: 00007f5e7d81a1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1064.266147][T26994] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1064.274116][T26994] R13: 00007fff2bb1ca9f R14: 00007f5e7d81a300 R15: 0000000000022000 [ 1064.282099][T26994] 16:10:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) ioctl$FAT_IOCTL_GET_VOLUME_ID(r0, 0x80047213, &(0x7f0000000340)) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f00000005c0)={0x3e0, r1, 0x10, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0xa4, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffe0}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x667b}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_LINK={0xec, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x627a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8d94}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200000}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_SOCK={0x38, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_CON_FLAG={0x8}]}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x100}]}, @TIPC_NLA_MEDIA={0x9c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffe01}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NODE={0x20, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x8}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xfffffffe}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x74}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x200}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK={0xd0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe2a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x389}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x81}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_MON={0x3c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2458}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3fc000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7fff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x15d}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xb2}]}]}, 0x3e0}, 0x1, 0x0, 0x0, 0x4000000}, 0x400c014) r2 = accept(r0, &(0x7f0000000000)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x80) sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x9}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7fff}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8010}, 0x48080) 16:10:18 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async, rerun: 32) syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r0) (rerun: 32) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) (async, rerun: 32) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000100), r0) 16:10:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r0) (async) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) (async) ioctl$FAT_IOCTL_GET_VOLUME_ID(r0, 0x80047213, &(0x7f0000000340)) (async) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f00000005c0)={0x3e0, r1, 0x10, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0xa4, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffe0}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x667b}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_LINK={0xec, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x627a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8d94}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200000}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_SOCK={0x38, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_CON_FLAG={0x8}]}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x100}]}, @TIPC_NLA_MEDIA={0x9c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffe01}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NODE={0x20, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x8}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xfffffffe}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x74}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x200}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK={0xd0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe2a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x389}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x81}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_MON={0x3c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2458}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3fc000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7fff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x15d}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xb2}]}]}, 0x3e0}, 0x1, 0x0, 0x0, 0x4000000}, 0x400c014) (async) r2 = accept(r0, &(0x7f0000000000)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x80) sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x9}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7fff}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8010}, 0x48080) 16:10:18 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) (fail_nth: 2) 16:10:18 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x5, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1064.303637][T19716] Bluetooth: hci6: sending frame failed (-49) [ 1064.312760][T26987] can0 (unregistered): slcan off ptm0. [ 1064.318448][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1064.365334][T27018] FAULT_INJECTION: forcing a failure. [ 1064.365334][T27018] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1064.386325][T27018] CPU: 1 PID: 27018 Comm: syz-executor.3 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0 [ 1064.396547][T27018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 1064.406711][T27018] Call Trace: [ 1064.410005][T27018] [ 1064.412949][T27018] dump_stack_lvl+0xcd/0x134 [ 1064.417572][T27018] should_fail.cold+0x5/0xa [ 1064.422088][T27018] _copy_from_user+0x2a/0x170 [ 1064.426773][T27018] iovec_from_user+0x149/0x3a0 [ 1064.431548][T27018] ? __might_fault+0xd1/0x170 [ 1064.436234][T27018] __import_iovec+0x65/0x610 [ 1064.440833][T27018] import_iovec+0x10c/0x150 [ 1064.445337][T27018] copy_msghdr_from_user+0xed/0x150 [ 1064.450655][T27018] ? __copy_msghdr+0x4a0/0x4a0 [ 1064.455417][T27018] ? rcu_read_lock_sched_held+0xd/0x70 [ 1064.460880][T27018] ? lock_acquire+0x480/0x570 [ 1064.465724][T27018] ? rcu_read_lock_sched_held+0xd/0x70 [ 1064.471368][T27018] ___sys_sendmsg+0xdd/0x1b0 [ 1064.475964][T27018] ? do_recvmmsg+0x6e0/0x6e0 [ 1064.480555][T27018] ? lock_acquire+0x480/0x570 [ 1064.485272][T27018] ? rcu_read_lock_sched_held+0xd/0x70 [ 1064.491113][T27018] ? lock_release+0x560/0x780 [ 1064.495793][T27018] ? __fget_files+0x248/0x440 [ 1064.500561][T27018] ? lock_downgrade+0x6e0/0x6e0 [ 1064.505415][T27018] ? ksys_write+0x127/0x250 [ 1064.509921][T27018] ? lock_downgrade+0x6e0/0x6e0 [ 1064.514770][T27018] ? rcu_read_lock_sched_held+0xd/0x70 [ 1064.520233][T27018] ? lock_release+0x560/0x780 [ 1064.524908][T27018] ? proc_task_getattr+0x1f0/0x1f0 [ 1064.530028][T27018] ? ksys_write+0x20c/0x250 [ 1064.534542][T27018] ? __fget_files+0x26a/0x440 [ 1064.539228][T27018] ? __fget_light+0xe5/0x270 [ 1064.543824][T27018] __sys_sendmsg+0xf3/0x1c0 [ 1064.548330][T27018] ? __sys_sendmsg_sock+0x30/0x30 [ 1064.553354][T27018] ? lock_downgrade+0x6e0/0x6e0 [ 1064.558207][T27018] ? trace_hardirqs_on+0x2d/0x120 [ 1064.563238][T27018] do_syscall_64+0x35/0xb0 [ 1064.567676][T27018] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1064.573654][T27018] RIP: 0033:0x7f5e7c68b5a9 [ 1064.578098][T27018] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1064.598587][T27018] RSP: 002b:00007f5e7d81a168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1064.607128][T27018] RAX: ffffffffffffffda RBX: 00007f5e7c7abf80 RCX: 00007f5e7c68b5a9 16:10:19 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) (async) sched_setattr(r1, &(0x7f0000000380)={0x38, 0x0, 0x0, 0x10001, 0x1, 0xfffffffffffffffe, 0xb, 0x8, 0x8, 0x9}, 0x0) process_vm_readv(r1, &(0x7f0000001780)=[{&(0x7f00000002c0)=""/196, 0xc4}, {&(0x7f00000003c0)=""/131, 0x83}, {&(0x7f0000000500)=""/224, 0xe0}, {&(0x7f0000000100)=""/126, 0x7e}, {&(0x7f0000000600)=""/226, 0xe2}, {&(0x7f0000000700)=""/101, 0x65}, {&(0x7f0000000780)=""/4096, 0x1000}], 0x7, &(0x7f0000001bc0)=[{&(0x7f00000001c0)=""/11, 0xb}, {&(0x7f0000001800)=""/124, 0x7c}, {&(0x7f0000001880)=""/109, 0x6d}, {&(0x7f0000001900)=""/140, 0x8c}, {&(0x7f00000019c0)=""/251, 0xfb}, {&(0x7f0000001ac0)=""/197, 0xc5}, {&(0x7f0000000480)=""/15, 0xf}], 0x7, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:10:19 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) sendmsg$NL802154_CMD_NEW_INTERFACE(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x44, r3, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0xffffffff}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x24044080}, 0x20004800) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000100edffffff040008002007000005000700"/38], 0x2c}}, 0x0) 16:10:19 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5451, 0x0) 16:10:19 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x6, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), r0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) (async) ioctl$FAT_IOCTL_GET_VOLUME_ID(r0, 0x80047213, &(0x7f0000000340)) (async) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f00000005c0)={0x3e0, r1, 0x10, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0xa4, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffe0}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x667b}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_LINK={0xec, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x627a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x81}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8d94}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200000}]}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_SOCK={0x38, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_CON_FLAG={0x8}]}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x100}]}, @TIPC_NLA_MEDIA={0x9c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffe01}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfff}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NODE={0x20, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x8}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xfffffffe}]}, @TIPC_NLA_NET={0x30, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x74}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x200}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK={0xd0, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe2a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x389}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x81}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_MON={0x3c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2458}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3fc000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7fff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x15d}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xb2}]}]}, 0x3e0}, 0x1, 0x0, 0x0, 0x4000000}, 0x400c014) (async) r2 = accept(r0, &(0x7f0000000000)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, &(0x7f0000000080)=0x80) sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x44, 0x0, 0x10, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x9}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7fff}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8010}, 0x48080) 16:10:19 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) (fail_nth: 3) [ 1064.615098][T27018] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000004 [ 1064.623085][T27018] RBP: 00007f5e7d81a1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1064.631066][T27018] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1064.639038][T27018] R13: 00007fff2bb1ca9f R14: 00007f5e7d81a300 R15: 0000000000022000 [ 1064.647188][T27018] 16:10:19 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) (fail_nth: 4) 16:10:19 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x7, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:19 executing program 4: ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7aaeca65b9323b728bd706a11b3d19b2ee8522391e97af3a0edc83939493a5620135d4942d788165e07fd1eff637cd8d5355b117b45e6f3a42c564eee7bc0e92d77d5711e163924f58065102f0b4275f1d6de46529a8cbd5bc9f6b93bf9cc37f7bc853b473fdf35c4d3eaaab", @ANYRES16=r0, @ANYBLOB="01330200000000000000050000000400600f"], 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 16:10:19 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) sendmsg$NL802154_CMD_NEW_INTERFACE(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x44, r3, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0xffffffff}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x24044080}, 0x20004800) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000100edffffff040008002007000005000700"/38], 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) (async) sendmsg$NL802154_CMD_NEW_INTERFACE(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x44, r3, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0xffffffff}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x24044080}, 0x20004800) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000100edffffff040008002007000005000700"/38], 0x2c}}, 0x0) (async) [ 1064.691569][ T9631] Bluetooth: hci6: Frame reassembly failed (-84) [ 1064.703977][T27030] can0: slcan on ptm0. 16:10:19 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) (fail_nth: 5) 16:10:19 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x9, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1064.776953][T27026] can0 (unregistered): slcan off ptm0. [ 1064.796180][T27058] FAULT_INJECTION: forcing a failure. [ 1064.796180][T27058] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1064.822931][T27058] CPU: 1 PID: 27058 Comm: syz-executor.3 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0 [ 1064.833334][T27058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 1064.843419][T27058] Call Trace: [ 1064.846811][T27058] [ 1064.849762][T27058] dump_stack_lvl+0xcd/0x134 [ 1064.854386][T27058] should_fail.cold+0x5/0xa [ 1064.858942][T27058] copyin+0x19/0x120 [ 1064.862880][T27058] _copy_from_iter+0x36e/0x11c0 [ 1064.867767][T27058] ? csum_and_copy_to_iter+0x16e0/0x16e0 [ 1064.873428][T27058] ? memset+0x20/0x40 [ 1064.877447][T27058] ? __virt_addr_valid+0x5d/0x2d0 [ 1064.882480][T27058] ? __phys_addr+0xc4/0x140 [ 1064.886984][T27058] ? __phys_addr_symbol+0x2c/0x70 [ 1064.892005][T27058] ? __check_object_size+0x2de/0x700 [ 1064.897301][T27058] netlink_sendmsg+0x875/0xe10 [ 1064.902073][T27058] ? netlink_unicast+0x7f0/0x7f0 [ 1064.907014][T27058] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1064.912307][T27058] ? netlink_unicast+0x7f0/0x7f0 [ 1064.917243][T27058] sock_sendmsg+0xcf/0x120 [ 1064.921666][T27058] ____sys_sendmsg+0x712/0x8c0 [ 1064.926468][T27058] ? copy_msghdr_from_user+0xfc/0x150 [ 1064.931850][T27058] ? kernel_sendmsg+0x50/0x50 [ 1064.936548][T27058] ? rcu_read_lock_sched_held+0xd/0x70 [ 1064.942025][T27058] ? lock_acquire+0x480/0x570 [ 1064.946704][T27058] ? rcu_read_lock_sched_held+0xd/0x70 [ 1064.952182][T27058] ___sys_sendmsg+0x110/0x1b0 [ 1064.956862][T27058] ? do_recvmmsg+0x6e0/0x6e0 [ 1064.961452][T27058] ? lock_acquire+0x480/0x570 [ 1064.966127][T27058] ? rcu_read_lock_sched_held+0xd/0x70 [ 1064.971601][T27058] ? __fget_files+0x248/0x440 [ 1064.976285][T27058] ? lock_downgrade+0x6e0/0x6e0 [ 1064.981147][T27058] ? ksys_write+0x127/0x250 [ 1064.985656][T27058] ? lock_downgrade+0x6e0/0x6e0 [ 1064.990514][T27058] ? rcu_read_lock_sched_held+0xd/0x70 [ 1064.996008][T27058] ? lock_release+0x560/0x780 [ 1065.000690][T27058] ? proc_task_getattr+0x1f0/0x1f0 [ 1065.005809][T27058] ? ksys_write+0x20c/0x250 [ 1065.010325][T27058] ? __fget_files+0x26a/0x440 [ 1065.015003][T27058] ? __fget_light+0xe5/0x270 [ 1065.019599][T27058] __sys_sendmsg+0xf3/0x1c0 [ 1065.024101][T27058] ? __sys_sendmsg_sock+0x30/0x30 [ 1065.029147][T27058] ? lock_downgrade+0x6e0/0x6e0 [ 1065.034004][T27058] ? trace_hardirqs_on+0x2d/0x120 [ 1065.039035][T27058] do_syscall_64+0x35/0xb0 [ 1065.043458][T27058] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1065.049382][T27058] RIP: 0033:0x7f5e7c68b5a9 [ 1065.053795][T27058] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1065.073852][T27058] RSP: 002b:00007f5e7d81a168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1065.082276][T27058] RAX: ffffffffffffffda RBX: 00007f5e7c7abf80 RCX: 00007f5e7c68b5a9 [ 1065.090254][T27058] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000004 [ 1065.098492][T27058] RBP: 00007f5e7d81a1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1065.106809][T27058] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1065.114802][T27058] R13: 00007fff2bb1ca9f R14: 00007f5e7d81a300 R15: 0000000000022000 [ 1065.123158][T27058] 16:10:21 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sched_setscheduler(0xffffffffffffffff, 0x0, &(0x7f0000000100)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:10:21 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5452, 0x0) 16:10:21 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) sendmsg$NL802154_CMD_NEW_INTERFACE(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x44, r3, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0xffffffff}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x24044080}, 0x20004800) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000100edffffff040008002007000005000700"/38], 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) (async) sendmsg$NL802154_CMD_NEW_INTERFACE(r2, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x44, r3, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0x1}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0002}}, @NL802154_ATTR_IFTYPE={0x8, 0x5, 0xffffffff}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x24044080}, 0x20004800) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000100edffffff040008002007000005000700"/38], 0x2c}}, 0x0) (async) 16:10:21 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xf, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:21 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) (fail_nth: 6) 16:10:21 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xf0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:21 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) (fail_nth: 7) [ 1066.757016][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1066.758467][ T3656] Bluetooth: hci6: command 0x1003 tx timeout 16:10:21 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x300, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:21 executing program 4: ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7aaeca65b9323b728bd706a11b3d19b2ee8522391e97af3a0edc83939493a5620135d4942d788165e07fd1eff637cd8d5355b117b45e6f3a42c564eee7bc0e92d77d5711e163924f58065102f0b4275f1d6de46529a8cbd5bc9f6b93bf9cc37f7bc853b473fdf35c4d3eaaab", @ANYRES16=r0, @ANYBLOB="01330200000000000000050000000400600f"], 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 16:10:21 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x500, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:21 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) (fail_nth: 8) 16:10:21 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x600, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1066.836945][T19716] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1066.837517][T19718] Bluetooth: hci7: command 0x1003 tx timeout [ 1066.854981][T27104] can0: slcan on ptm0. [ 1066.897992][T27131] FAULT_INJECTION: forcing a failure. [ 1066.897992][T27131] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1066.917324][T27101] can0 (unregistered): slcan off ptm0. [ 1066.956368][T27131] CPU: 1 PID: 27131 Comm: syz-executor.3 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0 [ 1066.966502][T27131] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 1066.976582][T27131] Call Trace: [ 1066.979871][T27131] [ 1066.982807][T27131] dump_stack_lvl+0xcd/0x134 [ 1066.987412][T27131] should_fail.cold+0x5/0xa [ 1066.991933][T27131] _copy_to_user+0x2a/0x140 [ 1066.996552][T27131] simple_read_from_buffer+0xcc/0x160 [ 1067.002065][T27131] proc_fail_nth_read+0x187/0x220 [ 1067.007126][T27131] ? proc_exe_link+0x1d0/0x1d0 [ 1067.012013][T27131] ? security_file_permission+0xab/0xd0 [ 1067.017598][T27131] vfs_read+0x257/0x930 [ 1067.021803][T27131] ? proc_exe_link+0x1d0/0x1d0 [ 1067.026601][T27131] ? kernel_read+0x1c0/0x1c0 [ 1067.031242][T27131] ? __fget_files+0x26a/0x440 [ 1067.035944][T27131] ksys_read+0x127/0x250 [ 1067.040227][T27131] ? vfs_write+0xdd0/0xdd0 [ 1067.044675][T27131] ? trace_hardirqs_on+0x2d/0x120 [ 1067.050025][T27131] do_syscall_64+0x35/0xb0 [ 1067.054494][T27131] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1067.060444][T27131] RIP: 0033:0x7f5e7c63d2ec [ 1067.064891][T27131] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1067.084634][T27131] RSP: 002b:00007f5e7d81a160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1067.093131][T27131] RAX: ffffffffffffffda RBX: 00007f5e7c7abf80 RCX: 00007f5e7c63d2ec [ 1067.101254][T27131] RDX: 000000000000000f RSI: 00007f5e7d81a1e0 RDI: 0000000000000003 [ 1067.109245][T27131] RBP: 00007f5e7d81a1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1067.117309][T27131] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1067.125338][T27131] R13: 00007fff2bb1ca9f R14: 00007f5e7d81a300 R15: 0000000000022000 [ 1067.133806][T27131] 16:10:23 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sched_setscheduler(0xffffffffffffffff, 0x0, &(0x7f0000000100)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) sched_setscheduler(0xffffffffffffffff, 0x0, &(0x7f0000000100)) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) 16:10:23 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x545d, 0x0) 16:10:23 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x700, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:23 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:23 executing program 4: ioctl$BTRFS_IOC_SCRUB_CANCEL(0xffffffffffffffff, 0x941c, 0x0) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000000c0)=ANY=[@ANYBLOB="7aaeca65b9323b728bd706a11b3d19b2ee8522391e97af3a0edc83939493a5620135d4942d788165e07fd1eff637cd8d5355b117b45e6f3a42c564eee7bc0e92d77d5711e163924f58065102f0b4275f1d6de46529a8cbd5bc9f6b93bf9cc37f7bc853b473fdf35c4d3eaaab", @ANYRES16=r0, @ANYBLOB="01330200000000000000050000000400600f"], 0x18}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 16:10:23 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r4) sendmsg$IEEE802154_LLSEC_ADD_DEV(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r8, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) statx(0xffffffffffffffff, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r9, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(0xffffffffffffffff, 0x5608) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="78000000020101010000000000000000790000006400018006002340000200000c000280010001002100000006000340000200000c0c028005000100110000000c00028005000100060000002c00018014000300fc01000000000000000000000000000014000400fe880000000000000000000000000101"], 0x78}, 0x1, 0x0, 0x0, 0x2004401c}, 0x40000) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r10, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(r10, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="100000fbdbdf2503000000"], 0x14}, 0x1, 0x0, 0x0, 0x30044810}, 0x2000c108) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r3, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008005}, 0x0) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) 16:10:23 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:23 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x900, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1068.916987][ T3656] Bluetooth: hci7: command 0x1003 tx timeout [ 1068.916990][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1068.917044][T19718] Bluetooth: hci6: command tx timeout [ 1068.923209][T19716] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:10:23 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async, rerun: 32) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async, rerun: 32) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) (rerun: 32) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r4) sendmsg$IEEE802154_LLSEC_ADD_DEV(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r8, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) (async) statx(0xffffffffffffffff, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r9, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) ioctl$VT_DISALLOCATE(0xffffffffffffffff, 0x5608) (async, rerun: 32) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="78000000020101010000000000000000790000006400018006002340000200000c000280010001002100000006000340000200000c0c028005000100110000000c00028005000100060000002c00018014000300fc01000000000000000000000000000014000400fe880000000000000000000000000101"], 0x78}, 0x1, 0x0, 0x0, 0x2004401c}, 0x40000) (rerun: 32) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r10, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(r10, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="100000fbdbdf2503000000"], 0x14}, 0x1, 0x0, 0x0, 0x30044810}, 0x2000c108) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r3, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008005}, 0x0) (async, rerun: 32) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) (rerun: 32) 16:10:23 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x2, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1068.979220][ T3647] Bluetooth: hci6: sending frame failed (-49) [ 1068.985495][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1068.991919][T27178] can0: slcan on ptm0. 16:10:23 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sched_setscheduler(0xffffffffffffffff, 0x0, &(0x7f0000000100)) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:10:23 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xb8b, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000280)) r2 = dup2(r1, r1) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r2, 0x5607) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r2) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) 16:10:23 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5460, 0x0) 16:10:23 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xf00, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:23 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r4) sendmsg$IEEE802154_LLSEC_ADD_DEV(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r8, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) statx(0xffffffffffffffff, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r9, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(0xffffffffffffffff, 0x5608) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="78000000020101010000000000000000790000006400018006002340000200000c000280010001002100000006000340000200000c0c028005000100110000000c00028005000100060000002c00018014000300fc01000000000000000000000000000014000400fe880000000000000000000000000101"], 0x78}, 0x1, 0x0, 0x0, 0x2004401c}, 0x40000) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r10, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(r10, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="100000fbdbdf2503000000"], 0x14}, 0x1, 0x0, 0x0, 0x30044810}, 0x2000c108) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r3, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008005}, 0x0) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000080)={'wpan1\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r4) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r8, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) (async) statx(0xffffffffffffffff, 0x0, 0x400, 0x20, &(0x7f000000bb00)) (async) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r9, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) ioctl$VT_DISALLOCATE(0xffffffffffffffff, 0x5608) (async) sendmsg$IPCTNL_MSG_CT_DELETE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)=ANY=[@ANYBLOB="78000000020101010000000000000000790000006400018006002340000200000c000280010001002100000006000340000200000c0c028005000100110000000c00028005000100060000002c00018014000300fc01000000000000000000000000000014000400fe880000000000000000000000000101"], 0x78}, 0x1, 0x0, 0x0, 0x2004401c}, 0x40000) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r10, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) sendmsg$NLBL_UNLABEL_C_STATICADD(r10, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="100000fbdbdf2503000000"], 0x14}, 0x1, 0x0, 0x0, 0x30044810}, 0x2000c108) (async) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x40, r3, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008005}, 0x0) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) (async) 16:10:23 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x3, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000280)) (async) r2 = dup2(r1, r1) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r2, 0x5607) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r2) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) [ 1069.087577][T27174] can0 (unregistered): slcan off ptm0. [ 1069.096361][ T3647] Bluetooth: hci6: sending frame failed (-49) [ 1069.103387][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:10:23 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x3f00, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000280)) (async) r2 = dup2(r1, r1) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r2, 0x5607) (async, rerun: 32) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r2) (rerun: 32) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) 16:10:23 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x200002, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:10:23 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x4, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1069.201707][T27226] can0: slcan on ptm0. 16:10:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)={0x48, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000}]}, @TIPC_NLA_BEARER={0x18, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'ip6_vti0\x00'}}]}]}, 0x48}}, 0x0) 16:10:23 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x8b0b, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:23 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x200002, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:10:23 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x8933, 0x0) 16:10:23 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x5, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:23 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000090000000800010000000000050008000000000005000700000000007b4735b53237a19c6416038852855c4d1d2dbec13e8622f232ee6a73dcc8fc837a6f9f7c07fb2810088c15ae7a50ee2c49ac6b2a9f6ea35127532cf60032962e468621eac53fce981523e020a24274ab7ff8429b14b56414950de43e433d8eaca6dec952dcd5ac4ddca1bbf890fab5e47b03f1159edc24"], 0x2c}}, 0x0) 16:10:23 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xf000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) (async) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)={0x48, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000}]}, @TIPC_NLA_BEARER={0x18, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'ip6_vti0\x00'}}]}]}, 0x48}}, 0x0) 16:10:23 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x200002, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) [ 1069.317676][T27225] can0 (unregistered): slcan off ptm0. 16:10:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)={0x48, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000}]}, @TIPC_NLA_BEARER={0x18, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'ip6_vti0\x00'}}]}]}, 0x48}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r0) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r0) (async) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r0) (async) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)={0x48, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}, @TIPC_NLA_NET={0x18, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000}]}, @TIPC_NLA_BEARER={0x18, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0x11, 0x1, @l2={'eth', 0x3a, 'ip6_vti0\x00'}}]}]}, 0x48}}, 0x0) (async) 16:10:24 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x6, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:24 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x34000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:24 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000090000000800010000000000050008000000000005000700000000007b4735b53237a19c6416038852855c4d1d2dbec13e8622f232ee6a73dcc8fc837a6f9f7c07fb2810088c15ae7a50ee2c49ac6b2a9f6ea35127532cf60032962e468621eac53fce981523e020a24274ab7ff8429b14b56414950de43e433d8eaca6dec952dcd5ac4ddca1bbf890fab5e47b03f1159edc24"], 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000090000000800010000000000050008000000000005000700000000007b4735b53237a19c6416038852855c4d1d2dbec13e8622f232ee6a73dcc8fc837a6f9f7c07fb2810088c15ae7a50ee2c49ac6b2a9f6ea35127532cf60032962e468621eac53fce981523e020a24274ab7ff8429b14b56414950de43e433d8eaca6dec952dcd5ac4ddca1bbf890fab5e47b03f1159edc24"], 0x2c}}, 0x0) (async) [ 1069.408881][T27281] can0: slcan on ptm0. 16:10:24 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) r3 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r3, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r3, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r4, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r3, 0x5608) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0xee00, 0xffffffffffffffff}}, './file0\x00'}) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r6, 0x4b3b, &(0x7f0000000280)) r7 = dup2(r6, r6) ioctl$TCSETSW(r7, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r7, 0x5607) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x5, &(0x7f0000000100)=@raw=[@map_fd={0x18, 0x9}, @call={0x85, 0x0, 0x0, 0xb5}, @jmp={0x5, 0x0, 0x6, 0x0, 0x9, 0x1, 0x10}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}], &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000500)=""/4096, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x1, 0x5}, 0x8, 0x10, &(0x7f00000002c0)={0x3, 0x7, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x1, r3, 0x1, r5, 0x1, 0xffffffffffffffff, 0x1, r7]}, 0x80) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:10:24 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x7, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:24 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x400448c9, 0x0) 16:10:24 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000090000000800010000000000050008000000000005000700000000007b4735b53237a19c6416038852855c4d1d2dbec13e8622f232ee6a73dcc8fc837a6f9f7c07fb2810088c15ae7a50ee2c49ac6b2a9f6ea35127532cf60032962e468621eac53fce981523e020a24274ab7ff8429b14b56414950de43e433d8eaca6dec952dcd5ac4ddca1bbf890fab5e47b03f1159edc24"], 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000090000000800010000000000050008000000000005000700000000007b4735b53237a19c6416038852855c4d1d2dbec13e8622f232ee6a73dcc8fc837a6f9f7c07fb2810088c15ae7a50ee2c49ac6b2a9f6ea35127532cf60032962e468621eac53fce981523e020a24274ab7ff8429b14b56414950de43e433d8eaca6dec952dcd5ac4ddca1bbf890fab5e47b03f1159edc24"], 0x2c}}, 0x0) (async) 16:10:24 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x400300, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:24 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000280)) r1 = dup2(r0, r0) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r1, 0x5607) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f0000000000)=0x2, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r1) sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000080)={0x3c, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0x28, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x800}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffff91}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) [ 1069.478068][T27273] can0 (unregistered): slcan off ptm0. 16:10:24 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x9, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:24 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000280)) (async) r1 = dup2(r0, r0) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r1, 0x5607) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f0000000000)=0x2, 0x4) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r1) sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000080)={0x3c, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0x28, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x800}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffff91}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) 16:10:24 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xf0ffff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:24 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xf, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1069.545616][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) [ 1069.553795][T27325] can0: slcan on ptm1. 16:10:24 executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r0, 0x4b3b, &(0x7f0000000280)) r1 = dup2(r0, r0) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r1, 0x5607) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r1, 0x110, 0x4, &(0x7f0000000000)=0x2, 0x4) (async, rerun: 64) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r1) sendmsg$TIPC_NL_BEARER_SET(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000080)={0x3c, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0x28, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x800}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffff91}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc000}, 0x0) 16:10:24 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x1000000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1069.637284][T27322] can0 (unregistered): slcan off ptm1. 16:10:26 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) (async) r3 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r3, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async, rerun: 64) statx(r3, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r4, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r3, 0x5608) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0xee00, 0xffffffffffffffff}}, './file0\x00'}) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r6, 0x4b3b, &(0x7f0000000280)) r7 = dup2(r6, r6) ioctl$TCSETSW(r7, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r7, 0x5607) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x5, &(0x7f0000000100)=@raw=[@map_fd={0x18, 0x9}, @call={0x85, 0x0, 0x0, 0xb5}, @jmp={0x5, 0x0, 0x6, 0x0, 0x9, 0x1, 0x10}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}], &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000500)=""/4096, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x1, 0x5}, 0x8, 0x10, &(0x7f00000002c0)={0x3, 0x7, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x1, r3, 0x1, r5, 0x1, 0xffffffffffffffff, 0x1, r7]}, 0x80) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:10:26 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x1a, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x400448dd, 0x0) 16:10:26 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x2000000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r1, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r2, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r1, 0x5608) sendmsg$NL80211_CMD_DISASSOCIATE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x1, 0x33}}}}, [@NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xfff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x24000001) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) 16:10:26 executing program 5: shmctl$SHM_LOCK(0x0, 0xb) shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x7000) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x44, r1, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0xb}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004090}, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), r0) r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) shmat(r2, &(0x7f0000ffc000/0x4000)=nil, 0x4000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r5) sendmsg$IEEE802154_LLSEC_ADD_DEV(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r9, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r7}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="7c020000", @ANYRES16=r1, @ANYBLOB="000827bd7000fddbdf251d00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0006000200616663ed7cccc3905db43700000200000008000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=r7, @ANYBLOB="340224804c00038005000200030000000c000500f5c10000000000000c00050005000000000000000c000500030000000000000008000100000000000c000500630000000000000005000200010000002401038008000100000000000c00050006ce0000000000000800010003000000380003800c0004000203aaaaaaaaaaaa0c0004000202aaaaaaaaaaaa06000100010000000c0004000201aaaaaaaaaaaa06000100010000000c0003800600010003000000050002000000000008000400010000005400038006000100ffff0000060001000200000006000100010000000c000400000000000000000006000100030000000600010000000000060001000000000006000100020000000c0004000200aaaaaaaaaaaa54000380060001000300000008000200010000000c0004000203aaaaaaaaaaaa08000200000000000c0004000203aaaaaaaaaaaa0800020002000000060001000000000006000100ffff0000080002000200000008000100000000003800038005000200010000000c0005000000000005000000080004000000000008000100020000000500020000000000050002000000000080000380100003800c0004000000000000000000100003800c0004000200aaaaaaaaaaaa0c00050000000000000000003800038006000100000000000600030000000000060001000300000006000300ffff00000c000400000000000000000006000100000000000c00050004000000000000000c0005004b05000000000000080001000000000008000300", @ANYRES32=r10, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB], 0x27c}, 0x1, 0x0, 0x0, 0x24085080}, 0x400c0) shmctl$SHM_UNLOCK(r2, 0xc) 16:10:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r1, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r2, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r1, 0x5608) sendmsg$NL80211_CMD_DISASSOCIATE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x1, 0x33}}}}, [@NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xfff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x24000001) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) (async) openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(r1, 0x0, 0x400, 0x20, &(0x7f000000bb00)) (async) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r2, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) ioctl$VT_DISALLOCATE(r1, 0x5608) (async) sendmsg$NL80211_CMD_DISASSOCIATE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x1, 0x33}}}}, [@NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xfff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x24000001) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) (async) 16:10:26 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x3000000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:26 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xf0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1071.557035][ T3647] Bluetooth: hci6: command 0x1003 tx timeout [ 1071.563201][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1071.593017][T27376] can0: slcan on ptm0. 16:10:26 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x4000000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:26 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) r3 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r3, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(r3, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r4, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) ioctl$VT_DISALLOCATE(r3, 0x5608) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000300)={{0x1, 0x1, 0x18, r1, {0xee00, 0xffffffffffffffff}}, './file0\x00'}) (async) r6 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r6, 0x4b3b, &(0x7f0000000280)) r7 = dup2(r6, r6) ioctl$TCSETSW(r7, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r7, 0x5607) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x5, &(0x7f0000000100)=@raw=[@map_fd={0x18, 0x9}, @call={0x85, 0x0, 0x0, 0xb5}, @jmp={0x5, 0x0, 0x6, 0x0, 0x9, 0x1, 0x10}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}], &(0x7f0000000140)='GPL\x00', 0x5, 0x1000, &(0x7f0000000500)=""/4096, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000001c0)={0x1, 0x5}, 0x8, 0x10, &(0x7f00000002c0)={0x3, 0x7, 0x7, 0x2}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x1, r3, 0x1, r5, 0x1, 0xffffffffffffffff, 0x1, r7]}, 0x80) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:10:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x400454ca, 0x0) 16:10:26 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x300, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1071.658993][T27369] can0 (unregistered): slcan off ptm0. 16:10:26 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r3, 0x5607) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)=0x0) mq_notify(r3, &(0x7f0000000140)={0x0, 0x18, 0x4, @tid=r4}) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:10:26 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x5000000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:26 executing program 5: shmctl$SHM_LOCK(0x0, 0xb) (async) shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x7000) (async, rerun: 32) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x44, r1, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0xb}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004090}, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), r0) (async) r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) shmat(r2, &(0x7f0000ffc000/0x4000)=nil, 0x4000) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r5) sendmsg$IEEE802154_LLSEC_ADD_DEV(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r9, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r7}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="7c020000", @ANYRES16=r1, @ANYBLOB="000827bd7000fddbdf251d00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0006000200616663ed7cccc3905db43700000200000008000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=r7, @ANYBLOB="340224804c00038005000200030000000c000500f5c10000000000000c00050005000000000000000c000500030000000000000008000100000000000c000500630000000000000005000200010000002401038008000100000000000c00050006ce0000000000000800010003000000380003800c0004000203aaaaaaaaaaaa0c0004000202aaaaaaaaaaaa06000100010000000c0004000201aaaaaaaaaaaa06000100010000000c0003800600010003000000050002000000000008000400010000005400038006000100ffff0000060001000200000006000100010000000c000400000000000000000006000100030000000600010000000000060001000000000006000100020000000c0004000200aaaaaaaaaaaa54000380060001000300000008000200010000000c0004000203aaaaaaaaaaaa08000200000000000c0004000203aaaaaaaaaaaa0800020002000000060001000000000006000100ffff0000080002000200000008000100000000003800038005000200010000000c0005000000000005000000080004000000000008000100020000000500020000000000050002000000000080000380100003800c0004000000000000000000100003800c0004000200aaaaaaaaaaaa0c00050000000000000000003800038006000100000000000600030000000000060001000300000006000300ffff00000c000400000000000000000006000100000000000c00050004000000000000000c0005004b05000000000000080001000000000008000300", @ANYRES32=r10, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB], 0x27c}, 0x1, 0x0, 0x0, 0x24085080}, 0x400c0) (async) shmctl$SHM_UNLOCK(r2, 0xc) 16:10:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r1, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r2, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r1, 0x5608) sendmsg$NL80211_CMD_DISASSOCIATE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x1, 0x33}}}}, [@NL80211_ATTR_LOCAL_STATE_CHANGE={0x4}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xfff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x24000001) (async) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) 16:10:26 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x500, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:26 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x6000000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1071.766358][T27410] can0: slcan on ptm0. 16:10:26 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x600, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:26 executing program 4: ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(0xffffffffffffffff, 0x942e, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0x430, 0x3f3, 0x200, 0x70bd2d, 0x25dfdbff, {0x1, 0x0, 0x15, [0x6, 0x1, 0x3, 0x0, 0x101, 0x9, 0x8860, 0x2, 0x40, 0x5, 0x4, 0x8, 0x5, 0x8000, 0x0, 0x200, 0x3f, 0x2, 0x91, 0x7, 0x4, 0x8, 0x2, 0x80, 0xa48, 0x50999312, 0x2, 0x7, 0xc5c, 0xfffffff9, 0x0, 0x3ff, 0xff, 0x4, 0x7f, 0x3e, 0x1, 0x90, 0x3, 0x3, 0x9, 0x6, 0x40, 0x7f, 0x9, 0x2, 0x200, 0x9, 0x4, 0x9, 0xfffffff7, 0x2, 0x74f, 0x7fff, 0x3, 0x6, 0x5, 0x100, 0x2, 0x2, 0x71, 0x180a, 0x9], [0x2, 0x0, 0x3, 0xd28, 0x9, 0x5, 0x80, 0x6, 0x7, 0x78, 0x1, 0xd15c, 0x3, 0x2, 0x5, 0x1, 0x4, 0x100, 0x3, 0xfffffffc, 0x800, 0x8, 0x3, 0xffffa812, 0x4, 0x1, 0x6, 0x400, 0x1, 0x3, 0xfffeffff, 0x4, 0xfffffffe, 0xfffffff8, 0x71015ea4, 0x5, 0x4, 0x101, 0x6, 0x1303db8d, 0x50000, 0x3, 0x9, 0x5, 0x6, 0x101, 0x3, 0xde4e, 0x0, 0x81, 0x1, 0x8001, 0x1, 0x3ff, 0x401, 0x67a0, 0x7, 0x9, 0x9, 0x3, 0x8001, 0x40, 0x1, 0x1], [0x4, 0xc1bae051, 0xffffffff, 0x8, 0x5, 0xf37, 0x9, 0x7, 0x1000, 0x40, 0x5, 0x9, 0x0, 0x7, 0x5, 0x1f, 0x3, 0xffffb1d1, 0x2, 0x0, 0x4, 0x8a6, 0x1, 0x6, 0x7, 0x80000001, 0x0, 0xfffffffb, 0x9, 0x1f, 0x4e81, 0x40000000, 0x8000, 0x5, 0x1, 0x3, 0x879, 0x7fff, 0x0, 0x9, 0x5, 0x7f, 0x1, 0xffff, 0x0, 0x22, 0xce, 0x2, 0x599a99a4, 0x9, 0x8001, 0x1, 0x5, 0x2, 0x3ff, 0x1, 0x2, 0x6, 0x5, 0xffff98f0, 0x78d, 0x5, 0x1, 0x1], [0x0, 0x2, 0x2, 0x2, 0x3, 0x7ff, 0xffff4920, 0x5, 0x6, 0x3, 0x8000, 0x5, 0x223, 0x1, 0x5, 0xffffff00, 0x6, 0x5, 0x6, 0x4, 0x9, 0xe247, 0x8, 0x3, 0x0, 0x94, 0x4, 0x75, 0x2, 0x1543, 0x80, 0xff, 0x2, 0x4acf, 0x0, 0x3, 0x9, 0x200, 0x80, 0x3ff, 0x80000000, 0x57a4, 0x3, 0x80000000, 0xff, 0xfffffffe, 0x4, 0x5, 0x9b5, 0xfffffffc, 0xdf, 0x6, 0x2, 0x5, 0x40, 0x0, 0x7, 0x9, 0x7, 0x4, 0x3, 0x8000, 0x6, 0x1], 0xe, ['!\x00', '+%]#!][$\x00', '{]\x00']}, ["", ""]}, 0x430}, 0x1, 0x0, 0x0, 0x4040001}, 0x4044001) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000500000004000180264471aaa005ee7af1ec91b47dd77a2c9c17870d8cc034485972777fbc1deaa87f5c22807a84fc33389bfd0ec235a96b953241f472dd3d4f32e5ad1349a776a95ea818c7b3885bb0438a4371eea90f0d17000000000000000000"], 0x18}}, 0x0) 16:10:26 executing program 4: ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(0xffffffffffffffff, 0x942e, 0x0) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0x430, 0x3f3, 0x200, 0x70bd2d, 0x25dfdbff, {0x1, 0x0, 0x15, [0x6, 0x1, 0x3, 0x0, 0x101, 0x9, 0x8860, 0x2, 0x40, 0x5, 0x4, 0x8, 0x5, 0x8000, 0x0, 0x200, 0x3f, 0x2, 0x91, 0x7, 0x4, 0x8, 0x2, 0x80, 0xa48, 0x50999312, 0x2, 0x7, 0xc5c, 0xfffffff9, 0x0, 0x3ff, 0xff, 0x4, 0x7f, 0x3e, 0x1, 0x90, 0x3, 0x3, 0x9, 0x6, 0x40, 0x7f, 0x9, 0x2, 0x200, 0x9, 0x4, 0x9, 0xfffffff7, 0x2, 0x74f, 0x7fff, 0x3, 0x6, 0x5, 0x100, 0x2, 0x2, 0x71, 0x180a, 0x9], [0x2, 0x0, 0x3, 0xd28, 0x9, 0x5, 0x80, 0x6, 0x7, 0x78, 0x1, 0xd15c, 0x3, 0x2, 0x5, 0x1, 0x4, 0x100, 0x3, 0xfffffffc, 0x800, 0x8, 0x3, 0xffffa812, 0x4, 0x1, 0x6, 0x400, 0x1, 0x3, 0xfffeffff, 0x4, 0xfffffffe, 0xfffffff8, 0x71015ea4, 0x5, 0x4, 0x101, 0x6, 0x1303db8d, 0x50000, 0x3, 0x9, 0x5, 0x6, 0x101, 0x3, 0xde4e, 0x0, 0x81, 0x1, 0x8001, 0x1, 0x3ff, 0x401, 0x67a0, 0x7, 0x9, 0x9, 0x3, 0x8001, 0x40, 0x1, 0x1], [0x4, 0xc1bae051, 0xffffffff, 0x8, 0x5, 0xf37, 0x9, 0x7, 0x1000, 0x40, 0x5, 0x9, 0x0, 0x7, 0x5, 0x1f, 0x3, 0xffffb1d1, 0x2, 0x0, 0x4, 0x8a6, 0x1, 0x6, 0x7, 0x80000001, 0x0, 0xfffffffb, 0x9, 0x1f, 0x4e81, 0x40000000, 0x8000, 0x5, 0x1, 0x3, 0x879, 0x7fff, 0x0, 0x9, 0x5, 0x7f, 0x1, 0xffff, 0x0, 0x22, 0xce, 0x2, 0x599a99a4, 0x9, 0x8001, 0x1, 0x5, 0x2, 0x3ff, 0x1, 0x2, 0x6, 0x5, 0xffff98f0, 0x78d, 0x5, 0x1, 0x1], [0x0, 0x2, 0x2, 0x2, 0x3, 0x7ff, 0xffff4920, 0x5, 0x6, 0x3, 0x8000, 0x5, 0x223, 0x1, 0x5, 0xffffff00, 0x6, 0x5, 0x6, 0x4, 0x9, 0xe247, 0x8, 0x3, 0x0, 0x94, 0x4, 0x75, 0x2, 0x1543, 0x80, 0xff, 0x2, 0x4acf, 0x0, 0x3, 0x9, 0x200, 0x80, 0x3ff, 0x80000000, 0x57a4, 0x3, 0x80000000, 0xff, 0xfffffffe, 0x4, 0x5, 0x9b5, 0xfffffffc, 0xdf, 0x6, 0x2, 0x5, 0x40, 0x0, 0x7, 0x9, 0x7, 0x4, 0x3, 0x8000, 0x6, 0x1], 0xe, ['!\x00', '+%]#!][$\x00', '{]\x00']}, ["", ""]}, 0x430}, 0x1, 0x0, 0x0, 0x4040001}, 0x4044001) (async) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000500000004000180264471aaa005ee7af1ec91b47dd77a2c9c17870d8cc034485972777fbc1deaa87f5c22807a84fc33389bfd0ec235a96b953241f472dd3d4f32e5ad1349a776a95ea818c7b3885bb0438a4371eea90f0d17000000000000000000"], 0x18}}, 0x0) 16:10:26 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x7000000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x40049409, 0x0) 16:10:26 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x700, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1071.846944][T27409] can0 (unregistered): slcan off ptm0. [ 1071.946314][T27442] can0: slcan on ptm0. [ 1072.018558][T27440] can0 (unregistered): slcan off ptm0. 16:10:28 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) (async) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r3, 0x5607) (async) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)=0x0) mq_notify(r3, &(0x7f0000000140)={0x0, 0x18, 0x4, @tid=r4}) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:10:28 executing program 4: ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(0xffffffffffffffff, 0x942e, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000040)={&(0x7f00000005c0)={0x430, 0x3f3, 0x200, 0x70bd2d, 0x25dfdbff, {0x1, 0x0, 0x15, [0x6, 0x1, 0x3, 0x0, 0x101, 0x9, 0x8860, 0x2, 0x40, 0x5, 0x4, 0x8, 0x5, 0x8000, 0x0, 0x200, 0x3f, 0x2, 0x91, 0x7, 0x4, 0x8, 0x2, 0x80, 0xa48, 0x50999312, 0x2, 0x7, 0xc5c, 0xfffffff9, 0x0, 0x3ff, 0xff, 0x4, 0x7f, 0x3e, 0x1, 0x90, 0x3, 0x3, 0x9, 0x6, 0x40, 0x7f, 0x9, 0x2, 0x200, 0x9, 0x4, 0x9, 0xfffffff7, 0x2, 0x74f, 0x7fff, 0x3, 0x6, 0x5, 0x100, 0x2, 0x2, 0x71, 0x180a, 0x9], [0x2, 0x0, 0x3, 0xd28, 0x9, 0x5, 0x80, 0x6, 0x7, 0x78, 0x1, 0xd15c, 0x3, 0x2, 0x5, 0x1, 0x4, 0x100, 0x3, 0xfffffffc, 0x800, 0x8, 0x3, 0xffffa812, 0x4, 0x1, 0x6, 0x400, 0x1, 0x3, 0xfffeffff, 0x4, 0xfffffffe, 0xfffffff8, 0x71015ea4, 0x5, 0x4, 0x101, 0x6, 0x1303db8d, 0x50000, 0x3, 0x9, 0x5, 0x6, 0x101, 0x3, 0xde4e, 0x0, 0x81, 0x1, 0x8001, 0x1, 0x3ff, 0x401, 0x67a0, 0x7, 0x9, 0x9, 0x3, 0x8001, 0x40, 0x1, 0x1], [0x4, 0xc1bae051, 0xffffffff, 0x8, 0x5, 0xf37, 0x9, 0x7, 0x1000, 0x40, 0x5, 0x9, 0x0, 0x7, 0x5, 0x1f, 0x3, 0xffffb1d1, 0x2, 0x0, 0x4, 0x8a6, 0x1, 0x6, 0x7, 0x80000001, 0x0, 0xfffffffb, 0x9, 0x1f, 0x4e81, 0x40000000, 0x8000, 0x5, 0x1, 0x3, 0x879, 0x7fff, 0x0, 0x9, 0x5, 0x7f, 0x1, 0xffff, 0x0, 0x22, 0xce, 0x2, 0x599a99a4, 0x9, 0x8001, 0x1, 0x5, 0x2, 0x3ff, 0x1, 0x2, 0x6, 0x5, 0xffff98f0, 0x78d, 0x5, 0x1, 0x1], [0x0, 0x2, 0x2, 0x2, 0x3, 0x7ff, 0xffff4920, 0x5, 0x6, 0x3, 0x8000, 0x5, 0x223, 0x1, 0x5, 0xffffff00, 0x6, 0x5, 0x6, 0x4, 0x9, 0xe247, 0x8, 0x3, 0x0, 0x94, 0x4, 0x75, 0x2, 0x1543, 0x80, 0xff, 0x2, 0x4acf, 0x0, 0x3, 0x9, 0x200, 0x80, 0x3ff, 0x80000000, 0x57a4, 0x3, 0x80000000, 0xff, 0xfffffffe, 0x4, 0x5, 0x9b5, 0xfffffffc, 0xdf, 0x6, 0x2, 0x5, 0x40, 0x0, 0x7, 0x9, 0x7, 0x4, 0x3, 0x8000, 0x6, 0x1], 0xe, ['!\x00', '+%]#!][$\x00', '{]\x00']}, ["", ""]}, 0x430}, 0x1, 0x0, 0x0, 0x4040001}, 0x4044001) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000500000004000180264471aaa005ee7af1ec91b47dd77a2c9c17870d8cc034485972777fbc1deaa87f5c22807a84fc33389bfd0ec235a96b953241f472dd3d4f32e5ad1349a776a95ea818c7b3885bb0438a4371eea90f0d17000000000000000000"], 0x18}}, 0x0) 16:10:28 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x9000000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:28 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x900, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:28 executing program 5: shmctl$SHM_LOCK(0x0, 0xb) shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x7000) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x44, r1, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0xb}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004090}, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), r0) r2 = shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) shmat(r2, &(0x7f0000ffc000/0x4000)=nil, 0x4000) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r5) sendmsg$IEEE802154_LLSEC_ADD_DEV(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r9, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r7}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="7c020000", @ANYRES16=r1, @ANYBLOB="000827bd7000fddbdf251d00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0006000200616663ed7cccc3905db43700000200000008000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=r7, @ANYBLOB="340224804c00038005000200030000000c000500f5c10000000000000c00050005000000000000000c000500030000000000000008000100000000000c000500630000000000000005000200010000002401038008000100000000000c00050006ce0000000000000800010003000000380003800c0004000203aaaaaaaaaaaa0c0004000202aaaaaaaaaaaa06000100010000000c0004000201aaaaaaaaaaaa06000100010000000c0003800600010003000000050002000000000008000400010000005400038006000100ffff0000060001000200000006000100010000000c000400000000000000000006000100030000000600010000000000060001000000000006000100020000000c0004000200aaaaaaaaaaaa54000380060001000300000008000200010000000c0004000203aaaaaaaaaaaa08000200000000000c0004000203aaaaaaaaaaaa0800020002000000060001000000000006000100ffff0000080002000200000008000100000000003800038005000200010000000c0005000000000005000000080004000000000008000100020000000500020000000000050002000000000080000380100003800c0004000000000000000000100003800c0004000200aaaaaaaaaaaa0c00050000000000000000003800038006000100000000000600030000000000060001000300000006000300ffff00000c000400000000000000000006000100000000000c00050004000000000000000c0005004b05000000000000080001000000000008000300", @ANYRES32=r10, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB], 0x27c}, 0x1, 0x0, 0x0, 0x24085080}, 0x400c0) shmctl$SHM_UNLOCK(r2, 0xc) shmctl$SHM_LOCK(0x0, 0xb) (async) shmat(0x0, &(0x7f0000ffd000/0x2000)=nil, 0x7000) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x44, r1, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0xb}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004090}, 0x0) (async) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000080), r0) (async) shmget$private(0x0, 0x2000, 0x0, &(0x7f0000ffb000/0x2000)=nil) (async) shmat(r2, &(0x7f0000ffc000/0x4000)=nil, 0x4000) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), 0xffffffffffffffff) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000080)={'wpan1\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r5) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r9, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r7}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan4\x00'}) (async) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="7c020000", @ANYRES16=r1, @ANYBLOB="000827bd7000fddbdf251d00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0006000200616663ed7cccc3905db43700000200000008000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=r7, @ANYBLOB="340224804c00038005000200030000000c000500f5c10000000000000c00050005000000000000000c000500030000000000000008000100000000000c000500630000000000000005000200010000002401038008000100000000000c00050006ce0000000000000800010003000000380003800c0004000203aaaaaaaaaaaa0c0004000202aaaaaaaaaaaa06000100010000000c0004000201aaaaaaaaaaaa06000100010000000c0003800600010003000000050002000000000008000400010000005400038006000100ffff0000060001000200000006000100010000000c000400000000000000000006000100030000000600010000000000060001000000000006000100020000000c0004000200aaaaaaaaaaaa54000380060001000300000008000200010000000c0004000203aaaaaaaaaaaa08000200000000000c0004000203aaaaaaaaaaaa0800020002000000060001000000000006000100ffff0000080002000200000008000100000000003800038005000200010000000c0005000000000005000000080004000000000008000100020000000500020000000000050002000000000080000380100003800c0004000000000000000000100003800c0004000200aaaaaaaaaaaa0c00050000000000000000003800038006000100000000000600030000000000060001000300000006000300ffff00000c000400000000000000000006000100000000000c00050004000000000000000c0005004b05000000000000080001000000000008000300", @ANYRES32=r10, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB], 0x27c}, 0x1, 0x0, 0x0, 0x24085080}, 0x400c0) (async) shmctl$SHM_UNLOCK(r2, 0xc) (async) 16:10:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x40086602, 0x0) [ 1073.796913][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1073.796953][T19718] Bluetooth: hci6: command 0x1003 tx timeout 16:10:28 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xf000000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x20) r3 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r3, &(0x7f0000000040), 0x10) setsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000507000004000000000000000000", @ANYRES32=r6, @ANYBLOB="00000000000000004b581dfc8f280012000c1f01ed9aa9cf3bc99610822dbca27a337bfb97767a188c10a1adeb72eaded5991a7028583b9989bdffc1448b91a29770e3cf60769aac1b3923e2f338211fb9f7c1079f3ef8bce055e2bc63327605fd3ee3e49bd54bd502748278ff136ab37548d81d35c8d1068ac089963b4dfaa803ff33fe9e999bf4"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000980)=@deltclass={0x460, 0x29, 0x100, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff1, 0xfff3}, {0xc, 0x4}, {0x10, 0xf}}, [@tclass_kind_options=@c_taprio={0xb}, @tclass_kind_options=@c_sfq={0x8}, @TCA_RATE={0x6, 0x5, {0xb2, 0x5d}}, @tclass_kind_options=@c_cbs={0x8}, @tclass_kind_options=@c_cbq={{0x8}, {0x408, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0xe3, 0x81, 0xfff, 0x8, 0x33, 0x5e, 0x7ff, 0x1000, 0x458, 0x100, 0x6, 0x8, 0xffff, 0x7fff, 0x8000, 0x295, 0x1, 0x100, 0xfff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89bd, 0x2, 0x4, 0x7fff, 0x5, 0x1, 0x6, 0x80000001, 0x2, 0xffff, 0xfc9, 0x7, 0xfffffffe, 0x0, 0x1000, 0x4, 0x3, 0x3, 0x200, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x1, 0x7fffffff, 0x1, 0x1, 0x0, 0x73d, 0x4, 0x8, 0xff, 0x9, 0xffffffff, 0xea9, 0x6, 0x1, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, 0x40, 0x9, 0x7, 0x2, 0x9, 0xfffffff9, 0x4, 0x3, 0x3, 0x44, 0x7fffffff, 0x9, 0x10000, 0x1000, 0x8eb, 0x70, 0x8, 0x5, 0x15, 0xffff, 0xfffffff9, 0x7, 0x8, 0x2, 0x81, 0x2, 0x2, 0x8000, 0x5, 0x5b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffe01]}]}}, @TCA_RATE={0x6, 0x5, {0x5, 0xbb}}]}, 0x460}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f00000002c0)={'gre0\x00', &(0x7f0000000240)={'ip_vti0\x00', r6, 0x7800, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @multicast2}}}}) bind$can_raw(r3, &(0x7f0000000000)={0x1d, r6}, 0x10) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=@delqdisc={0x194, 0x25, 0x400, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xa, 0xfff3}, {0xe, 0xffe0}, {0x1, 0x7}}, [@qdisc_kind_options=@q_blackhole={0xe}, @qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x200, 0x2, 0x9}}}}, @TCA_RATE={0x6, 0x5, {0x3, 0x81}}, @TCA_STAB={0xb4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0xb, 0x6, 0x8000, 0x1, 0x8000, 0x2, 0x3}}, {0xa, 0x2, [0x3, 0x6, 0x3ff]}}, {{0x1c, 0x1, {0x0, 0x9, 0x8, 0x2, 0x1, 0x0, 0x0, 0x6}}, {0x10, 0x2, [0xff7f, 0x5, 0x0, 0x9, 0x954, 0x5]}}, {{0x1c, 0x1, {0x9, 0x8, 0xffff, 0x4, 0x2, 0x1, 0x800, 0x7}}, {0x12, 0x2, [0x5, 0x7f, 0x1, 0x8, 0x9, 0x6, 0x1]}}, {{0x1c, 0x1, {0x7f, 0x6, 0x1, 0xdc0, 0x0, 0x4, 0x81, 0x6}}, {0x10, 0x2, [0x200, 0x4b, 0x0, 0x4, 0x4, 0x6]}}]}, @TCA_STAB={0x7c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x8, 0x9, 0x6, 0x1, 0xa0e, 0xff, 0x2}}, {0x8, 0x2, [0xf801, 0x5]}}, {{0x1c, 0x1, {0x3, 0x81, 0x2, 0x8, 0x1, 0x7, 0x0, 0x3}}, {0xa, 0x2, [0x3, 0x6, 0x1770]}}, {{0x1c, 0x1, {0x67, 0x5, 0xe9a1, 0x3, 0x7db9dd6ab91026c, 0x10001, 0x3, 0x5}}, {0xe, 0x2, [0xffff, 0x401, 0x8, 0x5, 0x5]}}]}, @TCA_RATE={0x6, 0x5, {0x9, 0xff}}]}, 0x194}, 0x1, 0x0, 0x0, 0x40804}, 0x80) 16:10:28 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x3f000000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1073.839732][T27486] can0: slcan on ptm0. 16:10:28 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xb8b, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:28 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x7fffefb0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x40186366, 0x0) [ 1073.894047][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) [ 1073.896650][T27504] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1073.918181][T27483] can0 (unregistered): slcan off ptm0. [ 1074.005662][T27528] can0: slcan on ptm0. [ 1074.039152][T27526] can0 (unregistered): slcan off ptm0. 16:10:30 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) (async) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r3, 0x5607) (async) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000100)=0x0) mq_notify(r3, &(0x7f0000000140)={0x0, 0x18, 0x4, @tid=r4}) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:10:30 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xb8d, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:30 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES8=r0, @ANYRES16=r1, @ANYRES16=r1], 0x2c}, 0x1, 0x0, 0x0, 0x50000}, 0x0) 16:10:30 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x8b0b0000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x20) r3 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r3, &(0x7f0000000040), 0x10) setsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000507000004000000000000000000", @ANYRES32=r6, @ANYBLOB="00000000000000004b581dfc8f280012000c1f01ed9aa9cf3bc99610822dbca27a337bfb97767a188c10a1adeb72eaded5991a7028583b9989bdffc1448b91a29770e3cf60769aac1b3923e2f338211fb9f7c1079f3ef8bce055e2bc63327605fd3ee3e49bd54bd502748278ff136ab37548d81d35c8d1068ac089963b4dfaa803ff33fe9e999bf4"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000980)=@deltclass={0x460, 0x29, 0x100, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff1, 0xfff3}, {0xc, 0x4}, {0x10, 0xf}}, [@tclass_kind_options=@c_taprio={0xb}, @tclass_kind_options=@c_sfq={0x8}, @TCA_RATE={0x6, 0x5, {0xb2, 0x5d}}, @tclass_kind_options=@c_cbs={0x8}, @tclass_kind_options=@c_cbq={{0x8}, {0x408, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0xe3, 0x81, 0xfff, 0x8, 0x33, 0x5e, 0x7ff, 0x1000, 0x458, 0x100, 0x6, 0x8, 0xffff, 0x7fff, 0x8000, 0x295, 0x1, 0x100, 0xfff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89bd, 0x2, 0x4, 0x7fff, 0x5, 0x1, 0x6, 0x80000001, 0x2, 0xffff, 0xfc9, 0x7, 0xfffffffe, 0x0, 0x1000, 0x4, 0x3, 0x3, 0x200, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x1, 0x7fffffff, 0x1, 0x1, 0x0, 0x73d, 0x4, 0x8, 0xff, 0x9, 0xffffffff, 0xea9, 0x6, 0x1, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, 0x40, 0x9, 0x7, 0x2, 0x9, 0xfffffff9, 0x4, 0x3, 0x3, 0x44, 0x7fffffff, 0x9, 0x10000, 0x1000, 0x8eb, 0x70, 0x8, 0x5, 0x15, 0xffff, 0xfffffff9, 0x7, 0x8, 0x2, 0x81, 0x2, 0x2, 0x8000, 0x5, 0x5b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffe01]}]}}, @TCA_RATE={0x6, 0x5, {0x5, 0xbb}}]}, 0x460}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f00000002c0)={'gre0\x00', &(0x7f0000000240)={'ip_vti0\x00', r6, 0x7800, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @multicast2}}}}) bind$can_raw(r3, &(0x7f0000000000)={0x1d, r6}, 0x10) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=@delqdisc={0x194, 0x25, 0x400, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xa, 0xfff3}, {0xe, 0xffe0}, {0x1, 0x7}}, [@qdisc_kind_options=@q_blackhole={0xe}, @qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x200, 0x2, 0x9}}}}, @TCA_RATE={0x6, 0x5, {0x3, 0x81}}, @TCA_STAB={0xb4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0xb, 0x6, 0x8000, 0x1, 0x8000, 0x2, 0x3}}, {0xa, 0x2, [0x3, 0x6, 0x3ff]}}, {{0x1c, 0x1, {0x0, 0x9, 0x8, 0x2, 0x1, 0x0, 0x0, 0x6}}, {0x10, 0x2, [0xff7f, 0x5, 0x0, 0x9, 0x954, 0x5]}}, {{0x1c, 0x1, {0x9, 0x8, 0xffff, 0x4, 0x2, 0x1, 0x800, 0x7}}, {0x12, 0x2, [0x5, 0x7f, 0x1, 0x8, 0x9, 0x6, 0x1]}}, {{0x1c, 0x1, {0x7f, 0x6, 0x1, 0xdc0, 0x0, 0x4, 0x81, 0x6}}, {0x10, 0x2, [0x200, 0x4b, 0x0, 0x4, 0x4, 0x6]}}]}, @TCA_STAB={0x7c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x8, 0x9, 0x6, 0x1, 0xa0e, 0xff, 0x2}}, {0x8, 0x2, [0xf801, 0x5]}}, {{0x1c, 0x1, {0x3, 0x81, 0x2, 0x8, 0x1, 0x7, 0x0, 0x3}}, {0xa, 0x2, [0x3, 0x6, 0x1770]}}, {{0x1c, 0x1, {0x67, 0x5, 0xe9a1, 0x3, 0x7db9dd6ab91026c, 0x10001, 0x3, 0x5}}, {0xe, 0x2, [0xffff, 0x401, 0x8, 0x5, 0x5]}}]}, @TCA_RATE={0x6, 0x5, {0x9, 0xff}}]}, 0x194}, 0x1, 0x0, 0x0, 0x40804}, 0x80) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) (async) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) (async) creat(&(0x7f0000000000)='./file0\x00', 0x20) (async) socket$can_raw(0x1d, 0x3, 0x1) (async) bind$can_raw(r3, &(0x7f0000000040), 0x10) (async) setsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, 0x0, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) (async) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000507000004000000000000000000", @ANYRES32=r6, @ANYBLOB="00000000000000004b581dfc8f280012000c1f01ed9aa9cf3bc99610822dbca27a337bfb97767a188c10a1adeb72eaded5991a7028583b9989bdffc1448b91a29770e3cf60769aac1b3923e2f338211fb9f7c1079f3ef8bce055e2bc63327605fd3ee3e49bd54bd502748278ff136ab37548d81d35c8d1068ac089963b4dfaa803ff33fe9e999bf4"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000980)=@deltclass={0x460, 0x29, 0x100, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff1, 0xfff3}, {0xc, 0x4}, {0x10, 0xf}}, [@tclass_kind_options=@c_taprio={0xb}, @tclass_kind_options=@c_sfq={0x8}, @TCA_RATE={0x6, 0x5, {0xb2, 0x5d}}, @tclass_kind_options=@c_cbs={0x8}, @tclass_kind_options=@c_cbq={{0x8}, {0x408, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0xe3, 0x81, 0xfff, 0x8, 0x33, 0x5e, 0x7ff, 0x1000, 0x458, 0x100, 0x6, 0x8, 0xffff, 0x7fff, 0x8000, 0x295, 0x1, 0x100, 0xfff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89bd, 0x2, 0x4, 0x7fff, 0x5, 0x1, 0x6, 0x80000001, 0x2, 0xffff, 0xfc9, 0x7, 0xfffffffe, 0x0, 0x1000, 0x4, 0x3, 0x3, 0x200, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x1, 0x7fffffff, 0x1, 0x1, 0x0, 0x73d, 0x4, 0x8, 0xff, 0x9, 0xffffffff, 0xea9, 0x6, 0x1, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, 0x40, 0x9, 0x7, 0x2, 0x9, 0xfffffff9, 0x4, 0x3, 0x3, 0x44, 0x7fffffff, 0x9, 0x10000, 0x1000, 0x8eb, 0x70, 0x8, 0x5, 0x15, 0xffff, 0xfffffff9, 0x7, 0x8, 0x2, 0x81, 0x2, 0x2, 0x8000, 0x5, 0x5b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffe01]}]}}, @TCA_RATE={0x6, 0x5, {0x5, 0xbb}}]}, 0x460}}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f00000002c0)={'gre0\x00', &(0x7f0000000240)={'ip_vti0\x00', r6, 0x7800, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @multicast2}}}}) (async) bind$can_raw(r3, &(0x7f0000000000)={0x1d, r6}, 0x10) (async) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=@delqdisc={0x194, 0x25, 0x400, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xa, 0xfff3}, {0xe, 0xffe0}, {0x1, 0x7}}, [@qdisc_kind_options=@q_blackhole={0xe}, @qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x200, 0x2, 0x9}}}}, @TCA_RATE={0x6, 0x5, {0x3, 0x81}}, @TCA_STAB={0xb4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0xb, 0x6, 0x8000, 0x1, 0x8000, 0x2, 0x3}}, {0xa, 0x2, [0x3, 0x6, 0x3ff]}}, {{0x1c, 0x1, {0x0, 0x9, 0x8, 0x2, 0x1, 0x0, 0x0, 0x6}}, {0x10, 0x2, [0xff7f, 0x5, 0x0, 0x9, 0x954, 0x5]}}, {{0x1c, 0x1, {0x9, 0x8, 0xffff, 0x4, 0x2, 0x1, 0x800, 0x7}}, {0x12, 0x2, [0x5, 0x7f, 0x1, 0x8, 0x9, 0x6, 0x1]}}, {{0x1c, 0x1, {0x7f, 0x6, 0x1, 0xdc0, 0x0, 0x4, 0x81, 0x6}}, {0x10, 0x2, [0x200, 0x4b, 0x0, 0x4, 0x4, 0x6]}}]}, @TCA_STAB={0x7c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x8, 0x9, 0x6, 0x1, 0xa0e, 0xff, 0x2}}, {0x8, 0x2, [0xf801, 0x5]}}, {{0x1c, 0x1, {0x3, 0x81, 0x2, 0x8, 0x1, 0x7, 0x0, 0x3}}, {0xa, 0x2, [0x3, 0x6, 0x1770]}}, {{0x1c, 0x1, {0x67, 0x5, 0xe9a1, 0x3, 0x7db9dd6ab91026c, 0x10001, 0x3, 0x5}}, {0xe, 0x2, [0xffff, 0x401, 0x8, 0x5, 0x5]}}]}, @TCA_RATE={0x6, 0x5, {0x9, 0xff}}]}, 0x194}, 0x1, 0x0, 0x0, 0x40804}, 0x80) (async) 16:10:30 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x401c5820, 0x0) 16:10:30 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xf00, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:30 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x9effffff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1075.956863][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1075.956868][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:10:30 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xa57a61b5, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:30 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xb0efff7f, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1076.000599][T27573] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. 16:10:30 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES8=r0, @ANYRES16=r1, @ANYRES16=r1], 0x2c}, 0x1, 0x0, 0x0, 0x50000}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES8=r0, @ANYRES16=r1, @ANYRES16=r1], 0x2c}, 0x1, 0x0, 0x0, 0x50000}, 0x0) (async) 16:10:30 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xb5617aa5, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1076.049804][T27574] can0: slcan on ptm0. [ 1076.060628][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) [ 1076.107805][T27567] can0 (unregistered): slcan off ptm0. 16:10:32 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x0, 0x0) r2 = epoll_create1(0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x3, &(0x7f00000000c0)=@framed, &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) recvmmsg(r1, &(0x7f0000000d40)=[{{&(0x7f0000000400)=@nfc, 0x80, 0x0, 0x0, &(0x7f0000000680)=""/220, 0xdc}}, {{0x0, 0x0, 0x0}}], 0x2, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) ppoll(&(0x7f0000000000)=[{r0, 0x0, 0xb00}, {r2, 0x4b57, 0x64}], 0x2, 0x0, 0x0, 0x1473bf3) epoll_wait(r2, &(0x7f00000005c0)=[{}], 0x1, 0x101) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000000)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000002c0)={0x200c}) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r5}, 0x10) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r6, 0x400455c8, 0x4) 16:10:32 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x1a00, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:32 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYRES8=r0, @ANYRES16=r1, @ANYRES16=r1], 0x2c}, 0x1, 0x0, 0x0, 0x50000}, 0x0) 16:10:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)={0x18, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x4}]}, 0x18}}, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x20) (async) r3 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r3, &(0x7f0000000040), 0x10) (async) setsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, 0x0, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000507000004000000000000000000", @ANYRES32=r6, @ANYBLOB="00000000000000004b581dfc8f280012000c1f01ed9aa9cf3bc99610822dbca27a337bfb97767a188c10a1adeb72eaded5991a7028583b9989bdffc1448b91a29770e3cf60769aac1b3923e2f338211fb9f7c1079f3ef8bce055e2bc63327605fd3ee3e49bd54bd502748278ff136ab37548d81d35c8d1068ac089963b4dfaa803ff33fe9e999bf4"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000980)=@deltclass={0x460, 0x29, 0x100, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xfff1, 0xfff3}, {0xc, 0x4}, {0x10, 0xf}}, [@tclass_kind_options=@c_taprio={0xb}, @tclass_kind_options=@c_sfq={0x8}, @TCA_RATE={0x6, 0x5, {0xb2, 0x5d}}, @tclass_kind_options=@c_cbs={0x8}, @tclass_kind_options=@c_cbq={{0x8}, {0x408, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0xe3, 0x81, 0xfff, 0x8, 0x33, 0x5e, 0x7ff, 0x1000, 0x458, 0x100, 0x6, 0x8, 0xffff, 0x7fff, 0x8000, 0x295, 0x1, 0x100, 0xfff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89bd, 0x2, 0x4, 0x7fff, 0x5, 0x1, 0x6, 0x80000001, 0x2, 0xffff, 0xfc9, 0x7, 0xfffffffe, 0x0, 0x1000, 0x4, 0x3, 0x3, 0x200, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x1, 0x7fffffff, 0x1, 0x1, 0x0, 0x73d, 0x4, 0x8, 0xff, 0x9, 0xffffffff, 0xea9, 0x6, 0x1, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, 0x40, 0x9, 0x7, 0x2, 0x9, 0xfffffff9, 0x4, 0x3, 0x3, 0x44, 0x7fffffff, 0x9, 0x10000, 0x1000, 0x8eb, 0x70, 0x8, 0x5, 0x15, 0xffff, 0xfffffff9, 0x7, 0x8, 0x2, 0x81, 0x2, 0x2, 0x8000, 0x5, 0x5b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffe01]}]}}, @TCA_RATE={0x6, 0x5, {0x5, 0xbb}}]}, 0x460}}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f00000002c0)={'gre0\x00', &(0x7f0000000240)={'ip_vti0\x00', r6, 0x7800, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @multicast2}}}}) (async) bind$can_raw(r3, &(0x7f0000000000)={0x1d, r6}, 0x10) (async) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000080)={&(0x7f0000000140)=@delqdisc={0x194, 0x25, 0x400, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xa, 0xfff3}, {0xe, 0xffe0}, {0x1, 0x7}}, [@qdisc_kind_options=@q_blackhole={0xe}, @qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x200, 0x2, 0x9}}}}, @TCA_RATE={0x6, 0x5, {0x3, 0x81}}, @TCA_STAB={0xb4, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x1, 0xb, 0x6, 0x8000, 0x1, 0x8000, 0x2, 0x3}}, {0xa, 0x2, [0x3, 0x6, 0x3ff]}}, {{0x1c, 0x1, {0x0, 0x9, 0x8, 0x2, 0x1, 0x0, 0x0, 0x6}}, {0x10, 0x2, [0xff7f, 0x5, 0x0, 0x9, 0x954, 0x5]}}, {{0x1c, 0x1, {0x9, 0x8, 0xffff, 0x4, 0x2, 0x1, 0x800, 0x7}}, {0x12, 0x2, [0x5, 0x7f, 0x1, 0x8, 0x9, 0x6, 0x1]}}, {{0x1c, 0x1, {0x7f, 0x6, 0x1, 0xdc0, 0x0, 0x4, 0x81, 0x6}}, {0x10, 0x2, [0x200, 0x4b, 0x0, 0x4, 0x4, 0x6]}}]}, @TCA_STAB={0x7c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x8, 0x9, 0x6, 0x1, 0xa0e, 0xff, 0x2}}, {0x8, 0x2, [0xf801, 0x5]}}, {{0x1c, 0x1, {0x3, 0x81, 0x2, 0x8, 0x1, 0x7, 0x0, 0x3}}, {0xa, 0x2, [0x3, 0x6, 0x1770]}}, {{0x1c, 0x1, {0x67, 0x5, 0xe9a1, 0x3, 0x7db9dd6ab91026c, 0x10001, 0x3, 0x5}}, {0xe, 0x2, [0xffff, 0x401, 0x8, 0x5, 0x5]}}]}, @TCA_RATE={0x6, 0x5, {0x9, 0xff}}]}, 0x194}, 0x1, 0x0, 0x0, 0x40804}, 0x80) 16:10:32 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xf0ffffff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:32 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x4020940d, 0x0) 16:10:32 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x3f00, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1078.116941][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1078.117030][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:10:32 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xfdffffff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:32 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xfffff000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1078.159194][T27661] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'. [ 1078.184817][T27663] can0: slcan on ptm0. 16:10:32 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xffffff7f, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:32 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x8b0b, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:32 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xffffff9e, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1078.270382][T27659] can0 (unregistered): slcan off ptm0. [ 1078.417328][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) 16:10:35 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x0, 0x0) (async) r2 = epoll_create1(0x0) (async) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x3, &(0x7f00000000c0)=@framed, &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) recvmmsg(r1, &(0x7f0000000d40)=[{{&(0x7f0000000400)=@nfc, 0x80, 0x0, 0x0, &(0x7f0000000680)=""/220, 0xdc}}, {{0x0, 0x0, 0x0}}], 0x2, 0x1, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) (async) ppoll(&(0x7f0000000000)=[{r0, 0x0, 0xb00}, {r2, 0x4b57, 0x64}], 0x2, 0x0, 0x0, 0x1473bf3) epoll_wait(r2, &(0x7f00000005c0)=[{}], 0x1, 0x101) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000000)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000002c0)={0x200c}) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r5}, 0x10) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r6, 0x400455c8, 0x4) 16:10:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x80045432, 0x0) 16:10:35 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x40049409, 0x0) 16:10:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x8d0b, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:35 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x2}]}, 0x2c}}, 0x0) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, r4, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x80}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000011) 16:10:35 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xfffffff0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xf000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1080.436870][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:10:35 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x0, 0x0) (async) r2 = epoll_create1(0x0) (async) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x3, &(0x7f00000000c0)=@framed, &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) recvmmsg(r1, &(0x7f0000000d40)=[{{&(0x7f0000000400)=@nfc, 0x80, 0x0, 0x0, &(0x7f0000000680)=""/220, 0xdc}}, {{0x0, 0x0, 0x0}}], 0x2, 0x1, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) (async) ppoll(&(0x7f0000000000)=[{r0, 0x0, 0xb00}, {r2, 0x4b57, 0x64}], 0x2, 0x0, 0x0, 0x1473bf3) epoll_wait(r2, &(0x7f00000005c0)=[{}], 0x1, 0x101) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.current\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000000)=ANY=[], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f00000002c0)={0x200c}) (async) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r5}, 0x10) (async) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r6, 0x400455c8, 0x4) 16:10:35 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xfffffffd, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x30000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:35 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x2}]}, 0x2c}}, 0x0) (async) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, r4, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x80}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000011) 16:10:35 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0xffffffff, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xf0ffff, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1080.526908][T27736] can1: slcan on ptm0. [ 1080.539505][T27737] can0: slcan on ptm1. 16:10:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x80045440, 0x0) [ 1080.637780][T27728] can1 (unregistered): slcan off ptm0. [ 1080.660264][T27771] can0: slcan on ptm0. 16:10:35 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x3}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:35 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x7000000, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:35 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sched_setscheduler(0xffffffffffffffff, 0x0, &(0x7f0000000100)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:10:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x1000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:35 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r4, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x2}]}, 0x2c}}, 0x0) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, r4, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x80}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4800}, 0x4000011) [ 1080.696972][T27730] can0 (unregistered): slcan off ptm1. 16:10:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x2000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:35 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x9}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x80086301, 0x0) 16:10:35 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) (fail_nth: 1) [ 1080.718939][T27770] can0 (unregistered): slcan off ptm0. 16:10:35 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0xd}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x3000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1080.789117][ T5904] Bluetooth: hci6: Frame reassembly failed (-84) 16:10:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x4000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1080.848295][T27798] can0: slcan on ptm1. 16:10:35 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x13}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x5000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1080.920530][ T5905] Bluetooth: hci7: Frame reassembly failed (-84) [ 1080.928241][T27797] can0 (unregistered): slcan off ptm1. [ 1080.934692][T27805] ERROR: Out of memory at tomoyo_realpath_from_path. 16:10:37 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x4000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:37 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x21}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x80086601, 0x0) 16:10:37 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x6000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:37 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r2) sendmsg$IEEE802154_LLSEC_ADD_DEV(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r6, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r6, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004885}, 0x40000) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='.\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) 16:10:37 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x7000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1082.836961][ T3647] Bluetooth: hci6: command 0x1003 tx timeout [ 1082.839713][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1082.873465][T27844] can0: slcan on ptm0. [ 1082.935329][T27841] can0 (unregistered): slcan off ptm0. 16:10:37 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:10:37 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r2) sendmsg$IEEE802154_LLSEC_ADD_DEV(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r6, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r6, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004885}, 0x40000) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='.\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) 16:10:37 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x22}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:37 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x4000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:37 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x9000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x801c581f, 0x0) [ 1082.996925][T19716] Bluetooth: hci7: command 0x1003 tx timeout [ 1082.997517][T19718] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:10:37 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xf000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:37 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r2) sendmsg$IEEE802154_LLSEC_ADD_DEV(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r6, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r6, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4004885}, 0x40000) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='.\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) 16:10:37 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) (fail_nth: 1) 16:10:37 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x23}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1083.047536][T27872] can0: slcan on ptm0. 16:10:37 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x1a000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0xc0045878, 0x0) [ 1083.107117][T27871] can0 (unregistered): slcan off ptm0. [ 1083.221725][ T3647] Bluetooth: hci6: sending frame failed (-49) [ 1083.228164][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1083.243465][T27898] can0: slcan on ptm2. [ 1083.261656][T27883] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1083.338095][T27893] can0 (unregistered): slcan off ptm2. 16:10:38 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x24}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:38 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:38 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, 0x0, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x7}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0x2}, @IEEE802154_ATTR_CSMA_MIN_BE={0x5, 0x26, 0x5}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x10000}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x58}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004014}, 0x4) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000009000000008000000000000005000800000000000500070000000000"], 0x2c}}, 0x0) 16:10:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0xc0045878, 0x0) 16:10:38 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) (fail_nth: 2) 16:10:38 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, 0x0, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x7}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0x2}, @IEEE802154_ATTR_CSMA_MIN_BE={0x5, 0x26, 0x5}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x10000}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x58}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004014}, 0x4) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000009000000008000000000000005000800000000000500070000000000"], 0x2c}}, 0x0) 16:10:38 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x3}, 0x3) r3 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r1, &(0x7f0000000180)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e22, 0x81, @mcast2}}, 0x24) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000400)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r3, 0x0, &(0x7f00000006c0)={0x0, 0xfffffffffffffe15, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x10}}, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) syz_io_uring_setup(0x27fa, &(0x7f00000002c0)={0x0, 0x6475, 0x8, 0x3, 0x4208}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ee7000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x40, &(0x7f0000000180)=0x307c, 0x0, 0x4) r7 = syz_io_uring_setup(0x56c, &(0x7f00000001c0), &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000280)=@IORING_OP_TIMEOUT={0xb, 0x3, 0x0, 0x0, 0x6, &(0x7f0000000240)={0x0, 0x3938700}, 0x1, 0x1, 0x1}, 0x36a) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x4, 0x0, @fd, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r10}}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000140)=@IORING_OP_CONNECT={0x10, 0x1, 0x0, r4, 0x80, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @loopback}, 0x3, 0x4, 0x0, 0x3}}, 0x0, 0x0, 0x1, {0x0, r10}}, 0xffff2ec7) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:10:38 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x8b0b0000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1083.673722][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) [ 1083.681164][T27931] ERROR: Out of memory at tomoyo_realpath_from_path. 16:10:38 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x25}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:38 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, 0x0, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x7}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0x2}, @IEEE802154_ATTR_CSMA_MIN_BE={0x5, 0x26, 0x5}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x10000}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x58}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004014}, 0x4) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000009000000008000000000000005000800000000000500070000000000"], 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_SET_MACPARAMS(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x44, 0x0, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x7}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0x2}, @IEEE802154_ATTR_CSMA_MIN_BE={0x5, 0x26, 0x5}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x10000}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x58}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x4004014}, 0x4) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="0100000000000000000009000000008000000000000005000800000000000500070000000000"], 0x2c}}, 0x0) (async) 16:10:38 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x26}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1083.716930][T27933] can0: slcan on ptm0. 16:10:38 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x2c, r1, 0x20, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x13}]}, 0x2c}}, 0x0) 16:10:38 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x8d0b0000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:38 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x27}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0xc0189436, 0x0) 16:10:38 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x2c, r1, 0x20, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x13}]}, 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x2c, r1, 0x20, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x13}]}, 0x2c}}, 0x0) (async) [ 1083.797675][T27928] can0 (unregistered): slcan off ptm0. [ 1083.891172][T27963] can0: slcan on ptm0. [ 1084.007463][T27962] can0 (unregistered): slcan off ptm0. 16:10:40 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x9effffff, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:40 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x28}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:40 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:10:40 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x3}, 0x3) r3 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r1, &(0x7f0000000180)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e22, 0x81, @mcast2}}, 0x24) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000400)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r3, 0x0, &(0x7f00000006c0)={0x0, 0xfffffffffffffe15, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x10}}, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) syz_io_uring_setup(0x27fa, &(0x7f00000002c0)={0x0, 0x6475, 0x8, 0x3, 0x4208}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ee7000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x40, &(0x7f0000000180)=0x307c, 0x0, 0x4) r7 = syz_io_uring_setup(0x56c, &(0x7f00000001c0), &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000280)=@IORING_OP_TIMEOUT={0xb, 0x3, 0x0, 0x0, 0x6, &(0x7f0000000240)={0x0, 0x3938700}, 0x1, 0x1, 0x1}, 0x36a) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x4, 0x0, @fd, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r10}}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000140)=@IORING_OP_CONNECT={0x10, 0x1, 0x0, r4, 0x80, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @loopback}, 0x3, 0x4, 0x0, 0x3}}, 0x0, 0x0, 0x1, {0x0, r10}}, 0xffff2ec7) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSTI(r2, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x3}, 0x3) (async) socket$rxrpc(0x21, 0x2, 0xa) (async) bind$rxrpc(r1, &(0x7f0000000180)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e22, 0x81, @mcast2}}, 0x24) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000400)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r3, 0x0, &(0x7f00000006c0)={0x0, 0xfffffffffffffe15, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x10}}, 0x0) (async) socket$tipc(0x1e, 0x2, 0x0) (async) syz_io_uring_setup(0x27fa, &(0x7f00000002c0)={0x0, 0x6475, 0x8, 0x3, 0x4208}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ee7000/0x4000)=nil, &(0x7f0000000140), &(0x7f0000000080)) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x40, &(0x7f0000000180)=0x307c, 0x0, 0x4) (async) syz_io_uring_setup(0x56c, &(0x7f00000001c0), &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000040), &(0x7f00000000c0)) (async) io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) (async) syz_io_uring_submit(r8, r9, &(0x7f0000000280)=@IORING_OP_TIMEOUT={0xb, 0x3, 0x0, 0x0, 0x6, &(0x7f0000000240)={0x0, 0x3938700}, 0x1, 0x1, 0x1}, 0x36a) (async) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x4, 0x0, @fd, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r10}}, 0x0) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000140)=@IORING_OP_CONNECT={0x10, 0x1, 0x0, r4, 0x80, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @loopback}, 0x3, 0x4, 0x0, 0x3}}, 0x0, 0x0, 0x1, {0x0, r10}}, 0xffff2ec7) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) 16:10:40 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x2c, r1, 0x20, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x13}]}, 0x2c}}, 0x0) 16:10:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0xc020660b, 0x0) 16:10:40 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) syz_genetlink_get_family_id$net_dm(&(0x7f0000000000), r0) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) [ 1085.716856][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1085.716941][ T3647] Bluetooth: hci6: command 0x1003 tx timeout 16:10:40 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xf0ffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1085.772170][T28018] can0: slcan on ptm0. [ 1085.818909][ T3647] Bluetooth: hci6: sending frame failed (-49) [ 1085.825113][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:10:40 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x29}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x361001, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:10:40 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) syz_genetlink_get_family_id$net_dm(&(0x7f0000000000), r0) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) 16:10:40 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xfcffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:40 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x2, 0x0) [ 1085.877563][T28010] can0 (unregistered): slcan off ptm0. 16:10:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x361001, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:10:40 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xfffff000, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:40 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x32}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:40 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) syz_genetlink_get_family_id$net_dm(&(0x7f0000000000), r0) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$net_dm(&(0x7f0000000000), r0) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) (async) 16:10:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x361001, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:10:40 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 32) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) (async, rerun: 32) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x3}, 0x3) r3 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r1, &(0x7f0000000180)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e22, 0x81, @mcast2}}, 0x24) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000400)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r3, 0x0, &(0x7f00000006c0)={0x0, 0xfffffffffffffe15, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x10}}, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) syz_io_uring_setup(0x27fa, &(0x7f00000002c0)={0x0, 0x6475, 0x8, 0x3, 0x4208}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ee7000/0x4000)=nil, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x40, &(0x7f0000000180)=0x307c, 0x0, 0x4) r7 = syz_io_uring_setup(0x56c, &(0x7f00000001c0), &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000040)=0x0, &(0x7f00000000c0)=0x0) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) (async, rerun: 64) syz_io_uring_submit(r8, r9, &(0x7f0000000280)=@IORING_OP_TIMEOUT={0xb, 0x3, 0x0, 0x0, 0x6, &(0x7f0000000240)={0x0, 0x3938700}, 0x1, 0x1, 0x1}, 0x36a) (rerun: 64) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x4, 0x0, @fd, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r10}}, 0x0) (async, rerun: 32) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000140)=@IORING_OP_CONNECT={0x10, 0x1, 0x0, r4, 0x80, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @loopback}, 0x3, 0x4, 0x0, 0x3}}, 0x0, 0x0, 0x1, {0x0, r10}}, 0xffff2ec7) (rerun: 32) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:10:40 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xffffff7f, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:40 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000000c0)=0xfffffffa) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x80000016) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)=0x4) ioctl$TIOCSTI(r0, 0x5437, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) r2 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r2, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r3, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r2, 0x5608) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1c, 0x5, &(0x7f0000000200)=@raw=[@map_idx_val={0x18, 0x4, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0xd9b}, @jmp={0x5, 0x1, 0xc, 0xa, 0x6, 0xfffffffffffffffc, 0xffffffffffffffff}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x80}], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, 0xb, r2, 0x8, &(0x7f0000000280)={0x3, 0x2}, 0x8, 0x10, &(0x7f00000002c0)={0x1, 0xb, 0x8, 0x2}, 0x10, 0x0, r1, 0x0, &(0x7f0000000300)=[r1, r1]}, 0x80) ioctl$TCSETSF2(r1, 0x402c542d, &(0x7f0000000180)={0x3, 0x9, 0x196, 0x3f, 0xff, "52ebe833c7a2f096270a3a49b377dff9bbb6b8", 0x5, 0x9}) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r4, 0x5437, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x541c, &(0x7f00000001c0)) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$TCSBRK(r5, 0x5409, 0x7) [ 1086.033086][ T3647] Bluetooth: hci6: sending frame failed (-49) [ 1086.040425][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:10:40 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x2}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:40 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xffffff9e, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:40 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x10, 0x0) 16:10:40 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000f20000000009000000080001000000000005000800000000000500070000570add"], 0x2c}}, 0x0) [ 1086.104549][T28080] ptm ptm5: ldisc open failed (-12), clearing slot 5 16:10:40 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xfffffff0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:40 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x340141) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TCXONC(r1, 0x540a, 0x3) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:10:40 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000f20000000009000000080001000000000005000800000000000500070000570add"], 0x2c}}, 0x0) 16:10:40 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x3}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1086.158504][ T5903] Bluetooth: hci6: Frame reassembly failed (-84) [ 1086.194534][ T5903] Bluetooth: hci7: Frame reassembly failed (-84) 16:10:40 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xfffffffc, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:40 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000f20000000009000000080001000000000005000800000000000500070000570add"], 0x2c}}, 0x0) 16:10:40 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x4}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1086.258912][ T3656] Bluetooth: hci8: sending frame failed (-49) [ 1086.265555][T19716] Bluetooth: hci8: Opcode 0x1003 failed: -49 16:10:42 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5409, 0x0) 16:10:42 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000000c0)=0xfffffffa) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x80000016) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)=0x4) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) r2 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r2, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r3, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) ioctl$VT_DISALLOCATE(r2, 0x5608) (async) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1c, 0x5, &(0x7f0000000200)=@raw=[@map_idx_val={0x18, 0x4, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0xd9b}, @jmp={0x5, 0x1, 0xc, 0xa, 0x6, 0xfffffffffffffffc, 0xffffffffffffffff}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x80}], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, 0xb, r2, 0x8, &(0x7f0000000280)={0x3, 0x2}, 0x8, 0x10, &(0x7f00000002c0)={0x1, 0xb, 0x8, 0x2}, 0x10, 0x0, r1, 0x0, &(0x7f0000000300)=[r1, r1]}, 0x80) (async) ioctl$TCSETSF2(r1, 0x402c542d, &(0x7f0000000180)={0x3, 0x9, 0x196, 0x3f, 0xff, "52ebe833c7a2f096270a3a49b377dff9bbb6b8", 0x5, 0x9}) (async) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r4, 0x5437, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x541c, &(0x7f00000001c0)) (async) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$TCSBRK(r5, 0x5409, 0x7) 16:10:42 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x340141) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TCXONC(r1, 0x540a, 0x3) ioctl$TIOCSTI(r2, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x340141) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TCXONC(r1, 0x540a, 0x3) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) 16:10:42 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x5}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:42 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0xffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:42 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEV(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, 0x0, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x6c, r1, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x9}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4040}, 0x20004048) 16:10:42 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x6}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1088.196940][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1088.207044][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1088.208932][T19718] Bluetooth: hci7: command 0x1003 tx timeout 16:10:42 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0xf, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:42 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x7}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:42 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEV(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, 0x0, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) (async) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x6c, r1, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x9}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4040}, 0x20004048) [ 1088.258200][T19718] Bluetooth: hci6: sending frame failed (-49) [ 1088.264461][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1088.272643][ T3734] Bluetooth: hci7: Frame reassembly failed (-84) 16:10:42 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000000c0)=0xfffffffa) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x80000016) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)=0x4) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x42000, 0x0) (async) r2 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(r2, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r3, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) ioctl$VT_DISALLOCATE(r2, 0x5608) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1c, 0x5, &(0x7f0000000200)=@raw=[@map_idx_val={0x18, 0x4, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0xd9b}, @jmp={0x5, 0x1, 0xc, 0xa, 0x6, 0xfffffffffffffffc, 0xffffffffffffffff}, @map_idx_val={0x18, 0x9, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x80}], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, 0xb, r2, 0x8, &(0x7f0000000280)={0x3, 0x2}, 0x8, 0x10, &(0x7f00000002c0)={0x1, 0xb, 0x8, 0x2}, 0x10, 0x0, r1, 0x0, &(0x7f0000000300)=[r1, r1]}, 0x80) (async) ioctl$TCSETSF2(r1, 0x402c542d, &(0x7f0000000180)={0x3, 0x9, 0x196, 0x3f, 0xff, "52ebe833c7a2f096270a3a49b377dff9bbb6b8", 0x5, 0x9}) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r4, 0x5437, 0x0) ioctl$TIOCL_GETMOUSEREPORTING(r4, 0x541c, &(0x7f00000001c0)) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$TCSBRK(r5, 0x5409, 0x7) 16:10:42 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x9}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:42 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x14, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1088.376612][ T5903] Bluetooth: hci6: Frame reassembly failed (-84) 16:10:44 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x540b, 0x0) 16:10:44 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEV(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, 0x0, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x6c, r1, 0x200, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x4}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0x9}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4040}, 0x20004048) 16:10:44 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x340141) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TCXONC(r1, 0x540a, 0x3) ioctl$TIOCSTI(r2, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x340141) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TCXONC(r1, 0x540a, 0x3) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) 16:10:44 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0xf}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:44 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0xc0, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:44 executing program 5: ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x4, 0x1545, 0x5, 0x1, 0x3, "5fadf7ff421c9665d7e194141c7c2560e4e515"}) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0xc9da5efc79fd1e7a}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) [ 1090.276889][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1090.283360][T19716] Bluetooth: hci7: command tx timeout 16:10:44 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0xec0, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:44 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x33fe0, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:44 executing program 5: ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x4, 0x1545, 0x5, 0x1, 0x3, "5fadf7ff421c9665d7e194141c7c2560e4e515"}) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0xc9da5efc79fd1e7a}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x4, 0x1545, 0x5, 0x1, 0x3, "5fadf7ff421c9665d7e194141c7c2560e4e515"}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0xc9da5efc79fd1e7a}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) (async) [ 1090.323570][T19716] Bluetooth: hci7: sending frame failed (-49) [ 1090.330207][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -49 [ 1090.378668][T19716] Bluetooth: hci7: sending frame failed (-49) [ 1090.385159][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -49 16:10:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000000)) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:10:45 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:45 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000000c0)={0x2, 0xf9b, 0x3, 0x10001, 0x6741}) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:10:45 executing program 5: ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x4, 0x1545, 0x5, 0x1, 0x3, "5fadf7ff421c9665d7e194141c7c2560e4e515"}) (async) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @empty}, @NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0xc9da5efc79fd1e7a}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) (async, rerun: 32) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) 16:10:45 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x7ffff000, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:45 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x540c, 0x0) 16:10:45 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x2}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1090.436914][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1090.436989][ T3647] Bluetooth: hci6: command 0x1003 tx timeout 16:10:45 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x3}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:45 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0xfffffdef, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1090.500376][T28233] can0: slcan on ptm0. 16:10:45 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x2, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:45 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x4}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1090.565072][ T3647] Bluetooth: hci6: sending frame failed (-49) [ 1090.571340][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:10:45 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x5, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1090.718583][T28252] can0 (unregistered): slcan off ptm0. 16:10:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000000)) ioctl$TIOCSTI(r0, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000000)) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) 16:10:47 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x5}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:47 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x0, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x40}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) 16:10:47 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x540d, 0x0) 16:10:47 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x6, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:47 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async, rerun: 32) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (rerun: 32) r1 = dup(r0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000000c0)={0x2, 0xf9b, 0x3, 0x10001, 0x6741}) (async, rerun: 64) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async, rerun: 64) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async, rerun: 64) ioctl$TIOCSTI(r2, 0x5437, 0x0) (rerun: 64) 16:10:47 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x7, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:47 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x6}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1092.596882][ T3647] Bluetooth: hci7: command 0x1003 tx timeout [ 1092.596996][T19718] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1092.633133][T28303] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. 16:10:47 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x8, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:47 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x0, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x40}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) 16:10:47 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) (async) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000000c0)={0x2, 0xf9b, 0x3, 0x10001, 0x6741}) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) [ 1092.689968][T28307] can0: slcan on ptm0. [ 1092.694637][ T5903] Bluetooth: hci6: Frame reassembly failed (-84) [ 1092.714519][ T3734] Bluetooth: hci7: Frame reassembly failed (-84) 16:10:47 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r3 = gettid() process_vm_writev(r3, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x6076, &(0x7f0000001300), &(0x7f00006c3000/0x3000)=nil, &(0x7f000043b000/0x2000)=nil, &(0x7f0000001380), 0x0) migrate_pages(0x0, 0x8, &(0x7f0000000040)=0x1, &(0x7f0000000100)=0x2) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) [ 1092.760138][T28324] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1092.806964][T28327] can0 (unregistered): slcan off ptm0. [ 1092.819139][T28327] ptm ptm3: ldisc open failed (-12), clearing slot 3 [ 1093.071323][ T3656] Bluetooth: hci8: sending frame failed (-49) [ 1093.077995][ T3647] Bluetooth: hci8: Opcode 0x1003 failed: -49 16:10:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async, rerun: 32) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async, rerun: 32) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000000)) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:10:49 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x9, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:49 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x0, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x40}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) [ 1094.757096][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1094.757459][ T3647] Bluetooth: hci7: command 0x1003 tx timeout [ 1094.763464][T19718] Bluetooth: hci6: command tx timeout [ 1094.775728][T19716] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:10:49 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5412, 0x0) 16:10:49 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x7}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:49 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r3 = gettid() process_vm_writev(r3, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x6076, &(0x7f0000001300), &(0x7f00006c3000/0x3000)=nil, &(0x7f000043b000/0x2000)=nil, &(0x7f0000001380), 0x0) migrate_pages(0x0, 0x8, &(0x7f0000000040)=0x1, &(0x7f0000000100)=0x2) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) (async) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) (async) gettid() (async) process_vm_writev(r3, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) (async) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_io_uring_setup(0x6076, &(0x7f0000001300), &(0x7f00006c3000/0x3000)=nil, &(0x7f000043b000/0x2000)=nil, &(0x7f0000001380), 0x0) (async) migrate_pages(0x0, 0x8, &(0x7f0000000040)=0x1, &(0x7f0000000100)=0x2) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) 16:10:49 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x9}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:49 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0xa, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1094.799317][T28376] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1094.811980][T28380] can0: slcan on ptm0. [ 1094.824567][T19718] Bluetooth: hci6: sending frame failed (-49) [ 1094.830927][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:10:49 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x12d00500}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x8840}, 0x40000) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="ffffffff2b956c11cde52d98f3b017a5a0ebc0b3aa3b87", @ANYRES16=r2, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) 16:10:49 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x12d00500}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x8840}, 0x40000) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="ffffffff2b956c11cde52d98f3b017a5a0ebc0b3aa3b87", @ANYRES16=r2, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x12d00500}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x8840}, 0x40000) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="ffffffff2b956c11cde52d98f3b017a5a0ebc0b3aa3b87", @ANYRES16=r2, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) (async) 16:10:49 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0xb, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:49 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0xf}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x6) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xc) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)) [ 1094.950151][ T9631] Bluetooth: hci6: Frame reassembly failed (-84) [ 1094.957759][T28384] can0 (unregistered): slcan off ptm0. 16:10:49 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x12d00500}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x8840}, 0x40000) (async, rerun: 64) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 64) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="ffffffff2b956c11cde52d98f3b017a5a0ebc0b3aa3b87", @ANYRES16=r2, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) 16:10:49 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x10, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1095.036436][ T9631] Bluetooth: hci7: Frame reassembly failed (-84) 16:10:51 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x11, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:51 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0xf0}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1096.996940][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1096.996942][ T3647] Bluetooth: hci6: command 0x1003 tx timeout 16:10:51 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000090000000800010000000000050008e527fa7341c79d3800000000005d9004b52aecc064970291e26236224a5f909c04a05f217895218e23c95b3a2e650d33ffecbe84ea79fd"], 0x2c}}, 0x0) 16:10:51 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5413, 0x0) 16:10:51 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x300}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:51 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r3 = gettid() process_vm_writev(r3, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x6076, &(0x7f0000001300), &(0x7f00006c3000/0x3000)=nil, &(0x7f000043b000/0x2000)=nil, &(0x7f0000001380), 0x0) migrate_pages(0x0, 0x8, &(0x7f0000000040)=0x1, &(0x7f0000000100)=0x2) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) (async) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) (async) gettid() (async) process_vm_writev(r3, &(0x7f0000000000)=[{&(0x7f00008f9f09)=""/247, 0xf7}], 0x1, &(0x7f0000121000)=[{&(0x7f0000217f28)=""/231, 0xffffff4e}], 0x23a, 0x0) (async) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_io_uring_setup(0x6076, &(0x7f0000001300), &(0x7f00006c3000/0x3000)=nil, &(0x7f000043b000/0x2000)=nil, &(0x7f0000001380), 0x0) (async) migrate_pages(0x0, 0x8, &(0x7f0000000040)=0x1, &(0x7f0000000100)=0x2) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) 16:10:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x6) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xc) (async) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)) 16:10:51 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1d, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1097.076911][T19716] Bluetooth: hci7: command 0x1003 tx timeout [ 1097.087151][T19718] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:10:51 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x500}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x6) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xc) (async) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)) 16:10:51 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x25, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1097.122652][ T3647] Bluetooth: hci6: sending frame failed (-49) [ 1097.129355][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1097.134851][T28479] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 16:10:51 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5414, 0x0) 16:10:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x4) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x48) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000180)=0x4) ioctl$TIOCSTI(0xffffffffffffffff, 0x5437, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x8002, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000240)=0x4) lseek(r0, 0x10001, 0x2) fallocate(0xffffffffffffffff, 0x6c, 0x2000000000000d5, 0x2000000000001) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x81}) ioctl$KDADDIO(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r3, 0x5437, 0x0) ioctl$BTRFS_IOC_QGROUP_LIMIT(r3, 0x8030942b, &(0x7f0000000000)={0x9, {0xb, 0x4, 0x100, 0x6e88f416, 0x8000}}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f00000000c0)={0x0, 0x3, 0x2, 0x2, 0x4, "283bf9fb5147adbfa915dd4cf1f507e4e7ef59"}) 16:10:51 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000090000000800010000000000050008e527fa7341c79d3800000000005d9004b52aecc064970291e26236224a5f909c04a05f217895218e23c95b3a2e650d33ffecbe84ea79fd"], 0x2c}}, 0x0) 16:10:51 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1097.217727][ T5904] Bluetooth: hci6: Frame reassembly failed (-84) [ 1097.291270][T28505] can0: slcan on ptm0. [ 1097.299371][T28507] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1097.383227][ T3734] Bluetooth: hci7: Frame reassembly failed (-84) [ 1097.389714][T28505] can0 (unregistered): slcan off ptm0. [ 1099.236920][T19716] Bluetooth: hci6: command 0x1003 tx timeout [ 1099.246914][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:10:54 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x2, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:54 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x600}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:54 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000090000000800010000000000050008e527fa7341c79d3800000000005d9004b52aecc064970291e26236224a5f909c04a05f217895218e23c95b3a2e650d33ffecbe84ea79fd"], 0x2c}}, 0x0) 16:10:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x4) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x48) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000180)=0x4) ioctl$TIOCSTI(0xffffffffffffffff, 0x5437, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x8002, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000240)=0x4) lseek(r0, 0x10001, 0x2) fallocate(0xffffffffffffffff, 0x6c, 0x2000000000000d5, 0x2000000000001) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x81}) ioctl$KDADDIO(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r3, 0x5437, 0x0) ioctl$BTRFS_IOC_QGROUP_LIMIT(r3, 0x8030942b, &(0x7f0000000000)={0x9, {0xb, 0x4, 0x100, 0x6e88f416, 0x8000}}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f00000000c0)={0x0, 0x3, 0x2, 0x2, 0x4, "283bf9fb5147adbfa915dd4cf1f507e4e7ef59"}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x4) (async) creat(&(0x7f0000000140)='./file0\x00', 0x48) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000180)=0x4) (async) ioctl$TIOCSTI(0xffffffffffffffff, 0x5437, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x8002, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000240)=0x4) (async) lseek(r0, 0x10001, 0x2) (async) fallocate(0xffffffffffffffff, 0x6c, 0x2000000000000d5, 0x2000000000001) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x81}) (async) ioctl$KDADDIO(r4, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) (async) ioctl$BTRFS_IOC_QGROUP_LIMIT(r3, 0x8030942b, &(0x7f0000000000)={0x9, {0xb, 0x4, 0x100, 0x6e88f416, 0x8000}}) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) ioctl$TCSETSF(r0, 0x5404, &(0x7f00000000c0)={0x0, 0x3, 0x2, 0x2, 0x4, "283bf9fb5147adbfa915dd4cf1f507e4e7ef59"}) (async) 16:10:54 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x3, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x101101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x4) ioctl$TIOCSTI(r3, 0x5437, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, &(0x7f0000000140)) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000100)='attr/current\x00') ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) 16:10:54 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5415, 0x0) 16:10:54 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x3, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1099.396937][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1099.432014][T28575] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1099.463014][T28572] can0: slcan on ptm0. 16:10:54 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x4, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:54 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x700}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:54 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000000)={'wpan0\x00'}) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) 16:10:54 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x5, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x4) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x48) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000180)=0x4) ioctl$TIOCSTI(0xffffffffffffffff, 0x5437, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x8002, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000240)=0x4) lseek(r0, 0x10001, 0x2) fallocate(0xffffffffffffffff, 0x6c, 0x2000000000000d5, 0x2000000000001) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x81}) ioctl$KDADDIO(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r3, 0x5437, 0x0) ioctl$BTRFS_IOC_QGROUP_LIMIT(r3, 0x8030942b, &(0x7f0000000000)={0x9, {0xb, 0x4, 0x100, 0x6e88f416, 0x8000}}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f00000000c0)={0x0, 0x3, 0x2, 0x2, 0x4, "283bf9fb5147adbfa915dd4cf1f507e4e7ef59"}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x4) (async) creat(&(0x7f0000000140)='./file0\x00', 0x48) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000180)=0x4) (async) ioctl$TIOCSTI(0xffffffffffffffff, 0x5437, 0x0) (async) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200), 0x8002, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000240)=0x4) (async) lseek(r0, 0x10001, 0x2) (async) fallocate(0xffffffffffffffff, 0x6c, 0x2000000000000d5, 0x2000000000001) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$F2FS_IOC_MOVE_RANGE(r3, 0xc020f509, &(0x7f00000001c0)={r1, 0x0, 0x0, 0x81}) (async) ioctl$KDADDIO(r4, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) (async) ioctl$BTRFS_IOC_QGROUP_LIMIT(r3, 0x8030942b, &(0x7f0000000000)={0x9, {0xb, 0x4, 0x100, 0x6e88f416, 0x8000}}) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) ioctl$TCSETSF(r0, 0x5404, &(0x7f00000000c0)={0x0, 0x3, 0x2, 0x2, 0x4, "283bf9fb5147adbfa915dd4cf1f507e4e7ef59"}) (async) 16:10:54 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async, rerun: 64) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000000)={'wpan0\x00'}) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) [ 1099.541595][T28572] can0 (unregistered): slcan off ptm0. [ 1099.557650][ T5903] Bluetooth: hci7: Frame reassembly failed (-84) 16:10:54 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x900}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:54 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x6, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1099.614651][ T5905] Bluetooth: hci8: Frame reassembly failed (-84) [ 1099.648241][T28611] can0: slcan on ptm0. 16:10:54 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x7, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1099.708941][T28619] can0 (unregistered): slcan off ptm0. [ 1101.476905][T19716] Bluetooth: hci6: command 0x1003 tx timeout [ 1101.476899][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:10:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x480200, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000080), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) r4 = creat(&(0x7f0000000180)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000402) fallocate(r3, 0x0, 0x0, 0x110001) r5 = socket$inet6(0xa, 0x805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010100}}]}, &(0x7f00000002c0)=0x10) getsockopt$bt_hci(r5, 0x84, 0x81, 0x0, &(0x7f00000010c0)) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000040)={0xc, r4}) syz_open_dev$usbmon(&(0x7f0000001080), 0x1, 0xc0040) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000140), &(0x7f0000000200)=0x4) r6 = ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x2) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r6) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:10:56 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0xb8b}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:56 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x9, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:56 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000000)={'wpan0\x00'}) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000000)={'wpan0\x00'}) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) (async) 16:10:56 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x3, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x101101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x4) ioctl$TIOCSTI(r3, 0x5437, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, &(0x7f0000000140)) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000100)='attr/current\x00') ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x3, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x101101) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r3, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) (async) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, &(0x7f0000000140)) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)) (async) syz_open_procfs(r4, &(0x7f0000000100)='attr/current\x00') (async) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) (async) 16:10:56 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5416, 0x0) [ 1101.637050][ T3656] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1101.637050][T19718] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1101.637119][ T3656] Bluetooth: hci8: command tx timeout [ 1101.643301][T19718] Bluetooth: hci7: command tx timeout 16:10:56 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xf, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:56 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0xf00}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:56 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="000000009f5b387bcdc4c276decf18eb9f958fa273fe1c6b0138e757f4790d6d63fddfdb8e04099a8e3a23a0f0b0ba22d1442db9102a1feb6b4171c5288410cd076fb7e786ae54d8712184e44505332fbb13f472c4e460d13fde88743a3ae19b047c7015007c09f1054ee3c0f5c6d1ed827df250cb082a3f6148102dc339be6248e1c2e3ff1205dbe13297ba3f0b6fc17fd580f4e9f74b7e529ef1fb6c39b3433ec51043d9c288b79575b346168ca090e8e8ae83773b382c30b0cf929ea5de3b796433ac54", @ANYRES16=r1, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) 16:10:56 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x1a, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:56 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x3f00}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:56 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xf0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1101.825211][ T5904] Bluetooth: hci7: Frame reassembly failed (-84) [ 1101.879499][T19716] Bluetooth: hci8: sending frame failed (-49) [ 1101.885746][ T3647] Bluetooth: hci8: Opcode 0x1003 failed: -49 [ 1101.898146][T28704] can0: slcan on ptm0. [ 1101.998214][T28704] can0 (unregistered): slcan off ptm0. 16:10:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, 0x0, 0x480200, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r1 = syz_open_dev$sndmidi(&(0x7f0000000080), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) r4 = creat(&(0x7f0000000180)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000402) (async) fallocate(r3, 0x0, 0x0, 0x110001) (async) r5 = socket$inet6(0xa, 0x805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010100}}]}, &(0x7f00000002c0)=0x10) (async) getsockopt$bt_hci(r5, 0x84, 0x81, 0x0, &(0x7f00000010c0)) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000040)={0xc, r4}) (async) syz_open_dev$usbmon(&(0x7f0000001080), 0x1, 0xc0040) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000140), &(0x7f0000000200)=0x4) r6 = ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x2) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r6) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:10:57 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="000000009f5b387bcdc4c276decf18eb9f958fa273fe1c6b0138e757f4790d6d63fddfdb8e04099a8e3a23a0f0b0ba22d1442db9102a1feb6b4171c5288410cd076fb7e786ae54d8712184e44505332fbb13f472c4e460d13fde88743a3ae19b047c7015007c09f1054ee3c0f5c6d1ed827df250cb082a3f6148102dc339be6248e1c2e3ff1205dbe13297ba3f0b6fc17fd580f4e9f74b7e529ef1fb6c39b3433ec51043d9c288b79575b346168ca090e8e8ae83773b382c30b0cf929ea5de3b796433ac54", @ANYRES16=r1, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) 16:10:57 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x300, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1103.716854][ T3647] Bluetooth: hci6: command 0x1003 tx timeout [ 1103.716866][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:10:58 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x3, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x101101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x4) ioctl$TIOCSTI(r3, 0x5437, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, &(0x7f0000000140)) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)=0x0) syz_open_procfs(r4, &(0x7f0000000100)='attr/current\x00') ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x3, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x101101) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r3, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) (async) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, &(0x7f0000000140)) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f00000000c0)) (async) syz_open_procfs(r4, &(0x7f0000000100)='attr/current\x00') (async) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) (async) 16:10:58 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0x8b0b}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:10:58 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="000000009f5b387bcdc4c276decf18eb9f958fa273fe1c6b0138e757f4790d6d63fddfdb8e04099a8e3a23a0f0b0ba22d1442db9102a1feb6b4171c5288410cd076fb7e786ae54d8712184e44505332fbb13f472c4e460d13fde88743a3ae19b047c7015007c09f1054ee3c0f5c6d1ed827df250cb082a3f6148102dc339be6248e1c2e3ff1205dbe13297ba3f0b6fc17fd580f4e9f74b7e529ef1fb6c39b3433ec51043d9c288b79575b346168ca090e8e8ae83773b382c30b0cf929ea5de3b796433ac54", @ANYRES16=r1, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="000000009f5b387bcdc4c276decf18eb9f958fa273fe1c6b0138e757f4790d6d63fddfdb8e04099a8e3a23a0f0b0ba22d1442db9102a1feb6b4171c5288410cd076fb7e786ae54d8712184e44505332fbb13f472c4e460d13fde88743a3ae19b047c7015007c09f1054ee3c0f5c6d1ed827df250cb082a3f6148102dc339be6248e1c2e3ff1205dbe13297ba3f0b6fc17fd580f4e9f74b7e529ef1fb6c39b3433ec51043d9c288b79575b346168ca090e8e8ae83773b382c30b0cf929ea5de3b796433ac54", @ANYRES16=r1, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) (async) 16:10:58 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x500, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:10:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, 0x0, 0x480200, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r1 = syz_open_dev$sndmidi(&(0x7f0000000080), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpu.stat\x00', 0x275a, 0x0) r4 = creat(&(0x7f0000000180)='./file0\x00', 0x0) fallocate(r4, 0x0, 0x0, 0x2000402) (async) fallocate(r3, 0x0, 0x0, 0x110001) (async) r5 = socket$inet6(0xa, 0x805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010100}}]}, &(0x7f00000002c0)=0x10) getsockopt$bt_hci(r5, 0x84, 0x81, 0x0, &(0x7f00000010c0)) (async) ioctl$EXT4_IOC_MOVE_EXT(r3, 0xc028660f, &(0x7f0000000040)={0xc, r4}) syz_open_dev$usbmon(&(0x7f0000001080), 0x1, 0xc0040) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(0xffffffffffffffff, 0x84, 0x20, &(0x7f0000000140), &(0x7f0000000200)=0x4) (async) r6 = ioctl$LOOP_CTL_ADD(r3, 0x4c80, 0x2) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, r6) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:10:58 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5418, 0x0) 16:10:58 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0xf000}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1103.876923][ T3647] Bluetooth: hci7: command 0x1003 tx timeout [ 1103.876979][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:10:58 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) 16:10:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r1, &(0x7f0000000000)={0x30000007}) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:10:58 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) 16:10:58 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x600, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1104.013141][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) 16:10:58 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) [ 1104.076064][T19716] Bluetooth: hci8: sending frame failed (-49) [ 1104.083022][T19718] Bluetooth: hci8: Opcode 0x1003 failed: -49 [ 1104.110274][T28798] can0: slcan on ptm3. [ 1104.217588][T28819] can0 (unregistered): slcan off ptm3. [ 1106.036967][T19716] Bluetooth: hci6: command 0x1003 tx timeout [ 1106.037664][ T3656] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:11:00 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffffffffffdad) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000006, 0x1010, r1, 0x8000000) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) sendmmsg(r4, &(0x7f0000000100), 0x0, 0x10) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r5, 0x400455c8, 0x4) ioctl$TIOCSTI(r5, 0x5437, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_FADVISE={0x18, 0x4, 0x0, @fd=r5, 0x3, 0x0, 0x80, 0x1, 0x1}, 0x2) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:00 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x700, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:00 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {0x2a, 0x0, 0xffff}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:00 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x541b, 0x0) 16:11:00 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2299222e3df4bea2f6", @ANYRES16=r1, @ANYBLOB="010000000000000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000090000000800010000000000050008000000000005000700020000002294902afa72880c752bf417057a2b1e71ac318116b5edba9b900ce69b0e6bcb595f2b6d8b42bdcc56fc59677c77e71426c5df01f61b217379724fe2a1b21b446c559176d1"], 0x2c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r4, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) 16:11:00 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x3}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1106.116903][ T3656] Bluetooth: hci7: command 0x1003 tx timeout [ 1106.116902][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:11:00 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x900, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r1, &(0x7f0000000000)={0x30000007}) ioctl$TIOCSTI(r0, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r1, &(0x7f0000000000)={0x30000007}) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) [ 1106.168777][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) [ 1106.179571][T19716] Bluetooth: hci7: sending frame failed (-49) [ 1106.186146][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -49 [ 1106.196851][T19718] Bluetooth: hci9: Opcode 0x1003 failed: -110 [ 1106.203004][ T3656] Bluetooth: hci9: command 0x1003 tx timeout 16:11:00 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x4}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:00 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2299222e3df4bea2f6", @ANYRES16=r1, @ANYBLOB="010000000000000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000090000000800010000000000050008000000000005000700020000002294902afa72880c752bf417057a2b1e71ac318116b5edba9b900ce69b0e6bcb595f2b6d8b42bdcc56fc59677c77e71426c5df01f61b217379724fe2a1b21b446c559176d1"], 0x2c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r4, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2299222e3df4bea2f6", @ANYRES16=r1, @ANYBLOB="010000000000000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000090000000800010000000000050008000000000005000700020000002294902afa72880c752bf417057a2b1e71ac318116b5edba9b900ce69b0e6bcb595f2b6d8b42bdcc56fc59677c77e71426c5df01f61b217379724fe2a1b21b446c559176d1"], 0x2c}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan0\x00'}) (async) sendmsg$NL802154_CMD_GET_SEC_KEY(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r4, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) (async) 16:11:00 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xb8b, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1106.230562][T28871] netlink: 60 bytes leftover after parsing attributes in process `syz-executor.1'. [ 1106.245212][ T3734] Bluetooth: hci7: Frame reassembly failed (-84) 16:11:00 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 64) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2299222e3df4bea2f6", @ANYRES16=r1, @ANYBLOB="010000000000000000080001000000000005000800000000000500070000000000"], 0x2c}}, 0x0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={0x0}}, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000090000000800010000000000050008000000000005000700020000002294902afa72880c752bf417057a2b1e71ac318116b5edba9b900ce69b0e6bcb595f2b6d8b42bdcc56fc59677c77e71426c5df01f61b217379724fe2a1b21b446c559176d1"], 0x2c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x34, r4, 0x20, 0x70bd2b, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) [ 1106.281503][T28877] netlink: 'syz-executor.1': attribute type 47 has an invalid length. [ 1106.282168][T28884] can0: slcan on ptm3. [ 1106.305339][ T3734] Bluetooth: hci8: Frame reassembly failed (-84) [ 1106.409795][T28892] can0 (unregistered): slcan off ptm3. [ 1108.196966][ T3656] Bluetooth: hci6: command 0x1003 tx timeout [ 1108.206884][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:11:02 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffffffffffdad) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000006, 0x1010, r1, 0x8000000) (async) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) sendmmsg(r4, &(0x7f0000000100), 0x0, 0x10) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r5, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r5, 0x5437, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_FADVISE={0x18, 0x4, 0x0, @fd=r5, 0x3, 0x0, 0x80, 0x1, 0x1}, 0x2) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:02 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x6}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:02 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xb8d, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:02 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_NETNS_FD={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004040}, 0x40004000) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) 16:11:02 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x541d, 0x0) [ 1108.276947][T19718] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1108.277008][ T3647] Bluetooth: hci7: command 0x1003 tx timeout [ 1108.308923][T28948] netlink: 'syz-executor.1': attribute type 47 has an invalid length. 16:11:02 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xf00, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:02 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_NETNS_FD={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004040}, 0x40004000) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) [ 1108.325267][ T5903] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async, rerun: 32) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 32) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r1, &(0x7f0000000000)={0x30000007}) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:11:02 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x18}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:02 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x1a00, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1108.357017][T19716] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1108.363429][T19716] Bluetooth: hci8: command tx timeout 16:11:03 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x3f00, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:03 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_NETNS_FD={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004040}, 0x40004000) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x10, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_NETNS_FD={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004040}, 0x40004000) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) (async) [ 1108.401734][T28965] can0: slcan on ptm3. [ 1108.410326][T28967] netlink: 'syz-executor.1': attribute type 47 has an invalid length. [ 1108.528314][T28970] can0 (unregistered): slcan off ptm3. 16:11:04 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x3c}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:04 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffffffffffdad) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) r3 = mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000006, 0x1010, r1, 0x8000000) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) sendmmsg(r4, &(0x7f0000000100), 0x0, 0x10) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r5, 0x400455c8, 0x4) ioctl$TIOCSTI(r5, 0x5437, 0x0) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_FADVISE={0x18, 0x4, 0x0, @fd=r5, 0x3, 0x0, 0x80, 0x1, 0x1}, 0x2) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffffffffffdad) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1000006, 0x1010, r1, 0x8000000) (async) socket$phonet_pipe(0x23, 0x5, 0x2) (async) sendmmsg(r4, &(0x7f0000000100), 0x0, 0x10) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r5, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r5, 0x5437, 0x0) (async) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_FADVISE={0x18, 0x4, 0x0, @fd=r5, 0x3, 0x0, 0x80, 0x1, 0x1}, 0x2) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) 16:11:04 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:04 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x8b0b, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:04 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x541e, 0x0) 16:11:04 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="68b88cf0", @ANYRES16=r1, @ANYBLOB="01000400000000000000090000000500080004000000050008000c0000000500070000000000"], 0x2c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x2}]}, 0x2c}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), r0) sendmsg$NL802154_CMD_SET_CHANNEL(r2, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x28, r5, 0x800, 0x70bd2a, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x28}, 0x1, 0x0, 0x0, 0x200000c4}, 0x20000044) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r6, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x2}]}, 0x2c}}, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000480), r2) r11 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r7) sendmsg$IEEE802154_LLSEC_ADD_DEV(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r11, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) sendmsg$NL802154_CMD_GET_INTERFACE(r2, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x80, r6, 0x200, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000000}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x80}}, 0x4000) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, r3, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_CCA_MODE={0x8, 0xc, 0x3}]}, 0x28}, 0x1, 0x0, 0x0, 0x24004800}, 0x0) [ 1110.356867][T19718] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1110.356869][ T3638] Bluetooth: hci6: command 0x1003 tx timeout [ 1110.356932][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1110.366838][ T3638] Bluetooth: hci7: command tx timeout 16:11:05 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x38}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:05 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x8d0b, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1110.412217][T29025] netlink: 'syz-executor.1': attribute type 47 has an invalid length. [ 1110.432091][T29026] can0: slcan on ptm0. [ 1110.440622][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:05 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:05 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x2}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1110.472149][T19718] Bluetooth: hci7: sending frame failed (-49) [ 1110.478515][ T3638] Bluetooth: hci7: Opcode 0x1003 failed: -49 [ 1110.491661][T19718] Bluetooth: hci8: sending frame failed (-49) [ 1110.497992][ T3638] Bluetooth: hci8: Opcode 0x1003 failed: -49 16:11:05 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="68b88cf0", @ANYRES16=r1, @ANYBLOB="01000400000000000000090000000500080004000000050008000c0000000500070000000000"], 0x2c}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x2}]}, 0x2c}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), r0) sendmsg$NL802154_CMD_SET_CHANNEL(r2, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x28, r5, 0x800, 0x70bd2a, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x28}, 0x1, 0x0, 0x0, 0x200000c4}, 0x20000044) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r6, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x2}]}, 0x2c}}, 0x0) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) (async) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000480), r2) (async) r11 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r7) sendmsg$IEEE802154_LLSEC_ADD_DEV(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r11, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) (async) sendmsg$NL802154_CMD_GET_INTERFACE(r2, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x80, r6, 0x200, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000000}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x80}}, 0x4000) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, r3, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_CCA_MODE={0x8, 0xc, 0x3}]}, 0x28}, 0x1, 0x0, 0x0, 0x24004800}, 0x0) 16:11:05 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x3}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:05 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x4}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1110.529577][ T5903] Bluetooth: hci7: Frame reassembly failed (-84) [ 1110.553642][ T3734] Bluetooth: hci8: Frame reassembly failed (-84) [ 1110.800050][T24118] IPv6: ADDRCONF(NETDEV_CHANGE): can0: link becomes ready [ 1111.298830][T29020] can0 (unregistered): slcan off ptm0. 16:11:07 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xf000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1112.516962][T19716] Bluetooth: hci6: command 0x1003 tx timeout [ 1112.517054][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:11:07 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) ioctl$TIOCSTI(r2, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) 16:11:07 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) dup(r0) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:07 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x5}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:07 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="68b88cf0", @ANYRES16=r1, @ANYBLOB="01000400000000000000090000000500080004000000050008000c0000000500070000000000"], 0x2c}}, 0x0) (async, rerun: 32) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x2}]}, 0x2c}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), r0) sendmsg$NL802154_CMD_SET_CHANNEL(r2, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x28, r5, 0x800, 0x70bd2a, 0x25dfdbfb, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x28}, 0x1, 0x0, 0x0, 0x200000c4}, 0x20000044) (async) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r6, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x2}]}, 0x2c}}, 0x0) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) (async) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000480), r2) (async) r11 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r7) sendmsg$IEEE802154_LLSEC_ADD_DEV(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r11, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) (async, rerun: 64) sendmsg$NL802154_CMD_GET_INTERFACE(r2, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x80, r6, 0x200, 0x70bd27, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000000}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x80}}, 0x4000) (async, rerun: 64) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, r3, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_CCA_MODE={0x8, 0xc, 0x3}]}, 0x28}, 0x1, 0x0, 0x0, 0x24004800}, 0x0) 16:11:07 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x30000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:07 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x541e, 0x0) [ 1112.596898][T19718] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1112.596934][ T3638] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1112.603114][T19718] Bluetooth: hci7: command 0x1003 tx timeout [ 1112.609952][ T3638] Bluetooth: hci8: command tx timeout 16:11:07 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x6}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:07 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xf0ffff, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1112.677360][T29162] can0: slcan on ptm1. [ 1112.682121][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:07 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x7}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:07 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x1000000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1112.736571][ T5905] Bluetooth: hci8: Frame reassembly failed (-84) [ 1112.746481][T19716] Bluetooth: hci9: sending frame failed (-49) [ 1112.752769][ T3656] Bluetooth: hci9: Opcode 0x1003 failed: -49 16:11:07 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x9}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:07 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xf}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1112.789137][T29174] ptm ptm5: ldisc open failed (-12), clearing slot 5 [ 1113.171521][ T8515] IPv6: ADDRCONF(NETDEV_CHANGE): can0: link becomes ready [ 1114.756922][ T3656] Bluetooth: hci8: command 0x1003 tx timeout [ 1114.756941][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1114.763027][ T3656] Bluetooth: hci7: command 0x1003 tx timeout [ 1114.770383][T19718] Bluetooth: hci6: command tx timeout [ 1114.775296][ T3638] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1114.786850][ T3647] Bluetooth: hci8: Opcode 0x1003 failed: -110 16:11:09 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x2000000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:09 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5421, 0x0) 16:11:09 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xf0}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:09 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f00000004c0)={0x1fc, r1, 0x20, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MLSLVLLST={0x28, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x72a7a12c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xeb}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xc635640}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f188cbd}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_MLSCATLST={0x80, 0xc, 0x0, 0x1, [{0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf861}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5898}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x20b7837c}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa06b}]}, {0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5558999b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x69d682ec}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5b4ece4c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbb91}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x74ccdbed}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4663a0fd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x56b3}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6a85f7b8}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MLSCATLST={0x118, 0xc, 0x0, 0x1, [{0x5c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x71b3253f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x58e9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb0fc}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x182b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x55269898}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x27a4169c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xeb65}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d89650c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d8c2265}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xc661}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9c87}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x834a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x26a62ba4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x64cef7d8}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4fa6ddd2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdde7}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x744d71f2}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6198b96e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x59a4239}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5ff22ecd}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3ff}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x56a5f30a}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x61c2478c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x679f3a6e}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf9a2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xd4282}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x978}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2e24}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2db1}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xaf97}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6197cc00}]}]}]}, 0x1fc}, 0x1, 0x0, 0x0, 0x40040}, 0x4008000) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000ef99c68c8bd29672834badda05cb1a46cf90a265c8a2bc898c5c46fc991ab21fe2d55f8087d74f410a82e859fe39b053820aa9dd70664855006ab938ffd640693c853f8dcc523a689e4b82a5cc28fd8048b79211cced0843782ff7"], 0x2c}}, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x81000) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x48, r4, 0x100, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xc0000}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80000000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9430}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1ff}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x81}, 0xb98a81522fd28af2) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000240)='1', 0x1) 16:11:09 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) dup(r0) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:09 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) ioctl$TIOCSTI(r2, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) 16:11:09 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x300}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:09 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x3000000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:09 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f00000004c0)={0x1fc, r1, 0x20, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MLSLVLLST={0x28, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x72a7a12c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xeb}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xc635640}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f188cbd}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_MLSCATLST={0x80, 0xc, 0x0, 0x1, [{0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf861}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5898}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x20b7837c}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa06b}]}, {0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5558999b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x69d682ec}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5b4ece4c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbb91}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x74ccdbed}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4663a0fd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x56b3}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6a85f7b8}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MLSCATLST={0x118, 0xc, 0x0, 0x1, [{0x5c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x71b3253f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x58e9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb0fc}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x182b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x55269898}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x27a4169c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xeb65}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d89650c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d8c2265}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xc661}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9c87}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x834a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x26a62ba4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x64cef7d8}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4fa6ddd2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdde7}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x744d71f2}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6198b96e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x59a4239}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5ff22ecd}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3ff}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x56a5f30a}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x61c2478c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x679f3a6e}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf9a2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xd4282}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x978}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2e24}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2db1}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xaf97}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6197cc00}]}]}]}, 0x1fc}, 0x1, 0x0, 0x0, 0x40040}, 0x4008000) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000ef99c68c8bd29672834badda05cb1a46cf90a265c8a2bc898c5c46fc991ab21fe2d55f8087d74f410a82e859fe39b053820aa9dd70664855006ab938ffd640693c853f8dcc523a689e4b82a5cc28fd8048b79211cced0843782ff7"], 0x2c}}, 0x0) (async) r3 = open_tree(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x81000) (async) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x48, r4, 0x100, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xc0000}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80000000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9430}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1ff}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x81}, 0xb98a81522fd28af2) (async) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000240)='1', 0x1) [ 1114.849691][T29170] can0 (unregistered): slcan off ptm1. [ 1114.879008][T29224] can0: slcan on ptm0. 16:11:09 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) dup(r0) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:09 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x500}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1114.945215][T19716] Bluetooth: hci7: sending frame failed (-49) [ 1114.952345][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -49 16:11:09 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x4000000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1115.038826][ T5904] Bluetooth: hci8: Frame reassembly failed (-84) [ 1115.078102][ T1236] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.084438][ T1236] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.819967][ T8515] IPv6: ADDRCONF(NETDEV_CHANGE): can0: link becomes ready [ 1116.916932][ T3638] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1116.916934][ T3647] Bluetooth: hci6: command 0x1003 tx timeout [ 1117.076931][T19716] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1117.076992][ T3638] Bluetooth: hci8: command 0x1003 tx timeout [ 1117.083095][T19716] Bluetooth: hci7: command 0x1003 tx timeout [ 1117.095117][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:11:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x2) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x20) 16:11:11 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f00000004c0)={0x1fc, r1, 0x20, 0x70bd28, 0x25dfdbfd, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}, @NLBL_CIPSOV4_A_MLSLVLLST={0x28, 0x8, 0x0, 0x1, [{0x24, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x72a7a12c}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xeb}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xc635640}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f188cbd}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x2}, @NLBL_CIPSOV4_A_MLSCATLST={0x80, 0xc, 0x0, 0x1, [{0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf861}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x5898}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x20b7837c}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xa06b}]}, {0x2c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5558999b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x69d682ec}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5b4ece4c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xbb91}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x74ccdbed}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4663a0fd}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x56b3}]}, {0xc, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6a85f7b8}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}, @NLBL_CIPSOV4_A_MLSCATLST={0x118, 0xc, 0x0, 0x1, [{0x5c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x71b3253f}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x58e9}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xb0fc}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x182b}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x55269898}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x27a4169c}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xeb65}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d89650c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x7d8c2265}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xc661}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x9c87}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x834a}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x26a62ba4}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x64cef7d8}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x4fa6ddd2}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xdde7}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x744d71f2}]}, {0x1c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6198b96e}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x59a4239}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x5ff22ecd}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x3ff}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x56a5f30a}]}, {0x3c, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x61c2478c}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x679f3a6e}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xf9a2}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0xd4282}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x978}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2e24}, @NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0x2db1}]}, {0x14, 0xb, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSCATREM={0x8, 0xa, 0xaf97}, @NLBL_CIPSOV4_A_MLSCATLOC={0x8, 0x9, 0x6197cc00}]}]}]}, 0x1fc}, 0x1, 0x0, 0x0, 0x40040}, 0x4008000) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000009000000080001000000000005000800000000000500070000000000ef99c68c8bd29672834badda05cb1a46cf90a265c8a2bc898c5c46fc991ab21fe2d55f8087d74f410a82e859fe39b053820aa9dd70664855006ab938ffd640693c853f8dcc523a689e4b82a5cc28fd8048b79211cced0843782ff7"], 0x2c}}, 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x81000) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r3, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x48, r4, 0x100, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xc0000}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x9}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x80000000}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9430}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1ff}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x81}, 0xb98a81522fd28af2) (async) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000240)='1', 0x1) 16:11:11 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x600}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:11 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5423, 0x0) 16:11:11 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x5000000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:11 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x501000, 0x0) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) 16:11:11 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x700}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1117.159779][T29224] can0 (unregistered): slcan off ptm0. [ 1117.194146][ T5903] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:11 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 16:11:11 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x6000000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1117.226496][T29353] can0: slcan on ptm1. [ 1117.242288][ T5904] Bluetooth: hci7: Frame reassembly failed (-84) 16:11:11 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x900}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1117.277264][T29353] can0 (unregistered): slcan off ptm1. [ 1117.305482][ T3734] Bluetooth: hci8: Frame reassembly failed (-84) 16:11:11 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x7000000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:11 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xb8b}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1119.236934][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1119.236946][ T3638] Bluetooth: hci6: command 0x1003 tx timeout 16:11:13 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x2) (async) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x20) 16:11:13 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x9000000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:13 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xf00}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:13 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5424, 0x0) 16:11:13 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) 16:11:13 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x501000, 0x0) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) 16:11:13 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x3f00}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1119.316916][T19716] Bluetooth: hci8: command 0x1003 tx timeout [ 1119.316951][ T3647] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1119.323181][T19716] Bluetooth: hci7: command 0x1003 tx timeout [ 1119.335293][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:11:13 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x8b0b}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:13 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xf000000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:14 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xf000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:14 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 16:11:14 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x1a000000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1119.380207][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) [ 1119.407641][T29431] Bluetooth: hci6: Frame reassembly failed (-84) [ 1119.468138][T19718] Bluetooth: hci8: sending frame failed (-49) [ 1119.474366][ T3647] Bluetooth: hci8: Opcode 0x1003 failed: -49 16:11:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f00000000c0)=0x2) (async) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x20) 16:11:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x3f000000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002bbd7000000000000900000005000700110000004600950000000000050007000000000092097f"], 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4840) ioctl$KDGETMODE(0xffffffffffffffff, 0x4b3b, &(0x7f0000000280)) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r2, 0x5607) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100), 0xc000, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/key-users\x00', 0x0, 0x0) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r5, 0x4b3b, &(0x7f00000000c0)) r6 = dup2(r5, r5) ioctl$TCSETSW(r6, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r6, 0x5607) r7 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r7, 0x4b3b, &(0x7f0000000280)) r8 = dup2(r7, r7) ioctl$TCSETSW(r8, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r8, 0x5607) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b0000000", @ANYRES16=0x0, @ANYBLOB="10002dbd7000ffdbdf25010000000c00060002000000000000000c00040007000000000000000c00030003000000000000000c00060003000000000000004c00078008000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB='\b\x00*V', @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c00078008000100", @ANYRES32, @ANYBLOB="0c00078008000100", @ANYRES32, @ANYBLOB], 0xb0}, 0x1, 0x0, 0x0, 0x28040000}, 0x4000000) 16:11:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x34000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1121.396907][ T3656] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1121.396922][ T3647] Bluetooth: hci6: command 0x1003 tx timeout [ 1121.427965][T29456] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1121.452031][T29459] can0: slcan on ptm0. 16:11:16 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5425, 0x0) 16:11:16 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async, rerun: 64) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (rerun: 64) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async, rerun: 32) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 32) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x501000, 0x0) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) 16:11:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x400300}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002bbd7000000000000900000005000700110000004600950000000000050007000000000092097f"], 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4840) ioctl$KDGETMODE(0xffffffffffffffff, 0x4b3b, &(0x7f0000000280)) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r2, 0x5607) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100), 0xc000, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/key-users\x00', 0x0, 0x0) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r5, 0x4b3b, &(0x7f00000000c0)) r6 = dup2(r5, r5) ioctl$TCSETSW(r6, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r6, 0x5607) r7 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r7, 0x4b3b, &(0x7f0000000280)) r8 = dup2(r7, r7) ioctl$TCSETSW(r8, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r8, 0x5607) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b0000000", @ANYRES16=0x0, @ANYBLOB="10002dbd7000ffdbdf25010000000c00060002000000000000000c00040007000000000000000c00030003000000000000000c00060003000000000000004c00078008000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB='\b\x00*V', @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c00078008000100", @ANYRES32, @ANYBLOB="0c00078008000100", @ANYRES32, @ANYBLOB], 0xb0}, 0x1, 0x0, 0x0, 0x28040000}, 0x4000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002bbd7000000000000900000005000700110000004600950000000000050007000000000092097f"], 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4840) (async) ioctl$KDGETMODE(0xffffffffffffffff, 0x4b3b, &(0x7f0000000280)) (async) dup2(0xffffffffffffffff, 0xffffffffffffffff) (async) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r2, 0x5607) (async) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100), 0xc000, 0x0) (async) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/key-users\x00', 0x0, 0x0) (async) syz_open_dev$tty20(0xc, 0x4, 0x0) (async) ioctl$KDGETMODE(r5, 0x4b3b, &(0x7f00000000c0)) (async) dup2(r5, r5) (async) ioctl$TCSETSW(r6, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r6, 0x5607) (async) syz_open_dev$tty20(0xc, 0x4, 0x0) (async) ioctl$KDGETMODE(r7, 0x4b3b, &(0x7f0000000280)) (async) dup2(r7, r7) (async) ioctl$TCSETSW(r8, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r8, 0x5607) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b0000000", @ANYRES16=0x0, @ANYBLOB="10002dbd7000ffdbdf25010000000c00060002000000000000000c00040007000000000000000c00030003000000000000000c00060003000000000000004c00078008000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB='\b\x00*V', @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c00078008000100", @ANYRES32, @ANYBLOB="0c00078008000100", @ANYRES32, @ANYBLOB], 0xb0}, 0x1, 0x0, 0x0, 0x28040000}, 0x4000000) (async) 16:11:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x8b0b0000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1121.477118][ T3656] Bluetooth: hci7: command 0x1003 tx timeout [ 1121.479549][T19716] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1121.506069][T29460] can0 (unregistered): slcan off ptm0. 16:11:16 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) syz_io_uring_setup(0x0, &(0x7f0000001a80), &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000001b00), &(0x7f0000001b40)) faccessat(r0, &(0x7f0000000040)='./file0\x00', 0x153) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1, {0xffffffffffffffff, 0xee00}}, './file0/file0\x00'}) statx(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x1000, 0x440, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r4, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r4, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) r6 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r6, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r6, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r7, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) inotify_init() setxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000300)={{}, {0x1, 0x3}, [{0x2, 0x3, r2}, {0x2, 0x4, 0xffffffffffffffff}, {0x2, 0x0, 0xee01}, {0x2, 0x2, r3}], {}, [{}, {0x8, 0x6, r5}, {0x8, 0x7, r7}, {0x8, 0x1, 0xee00}, {0x8, 0x4, 0xee01}], {0x10, 0x1}, {0x20, 0x1}}, 0x6c, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:11:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x8d0b0000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xf0ffff}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1121.520864][T29472] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.5'. 16:11:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x9effffff, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1121.589206][T19718] Bluetooth: hci6: sending frame failed (-49) [ 1121.595500][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1121.624363][T29478] ptm ptm18: ldisc open failed (-12), clearing slot 18 16:11:16 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5427, 0x0) 16:11:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002bbd7000000000000900000005000700110000004600950000000000050007000000000092097f"], 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4840) ioctl$KDGETMODE(0xffffffffffffffff, 0x4b3b, &(0x7f0000000280)) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r2, 0x5607) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100), 0xc000, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/key-users\x00', 0x0, 0x0) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r5, 0x4b3b, &(0x7f00000000c0)) r6 = dup2(r5, r5) ioctl$TCSETSW(r6, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r6, 0x5607) r7 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r7, 0x4b3b, &(0x7f0000000280)) r8 = dup2(r7, r7) ioctl$TCSETSW(r8, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r8, 0x5607) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b0000000", @ANYRES16=0x0, @ANYBLOB="10002dbd7000ffdbdf25010000000c00060002000000000000000c00040007000000000000000c00030003000000000000000c00060003000000000000004c00078008000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB='\b\x00*V', @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c00078008000100", @ANYRES32, @ANYBLOB="0c00078008000100", @ANYRES32, @ANYBLOB], 0xb0}, 0x1, 0x0, 0x0, 0x28040000}, 0x4000000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002bbd7000000000000900000005000700110000004600950000000000050007000000000092097f"], 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4840) (async) ioctl$KDGETMODE(0xffffffffffffffff, 0x4b3b, &(0x7f0000000280)) (async) dup2(0xffffffffffffffff, 0xffffffffffffffff) (async) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r2, 0x5607) (async) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100), 0xc000, 0x0) (async) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/key-users\x00', 0x0, 0x0) (async) syz_open_dev$tty20(0xc, 0x4, 0x0) (async) ioctl$KDGETMODE(r5, 0x4b3b, &(0x7f00000000c0)) (async) dup2(r5, r5) (async) ioctl$TCSETSW(r6, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r6, 0x5607) (async) syz_open_dev$tty20(0xc, 0x4, 0x0) (async) ioctl$KDGETMODE(r7, 0x4b3b, &(0x7f0000000280)) (async) dup2(r7, r7) (async) ioctl$TCSETSW(r8, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r8, 0x5607) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b0000000", @ANYRES16=0x0, @ANYBLOB="10002dbd7000ffdbdf25010000000c00060002000000000000000c00040007000000000000000c00030003000000000000000c00060003000000000000004c00078008000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB='\b\x00*V', @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="08000100000000000c00078008000100", @ANYRES32, @ANYBLOB="0c00078008000100", @ANYRES32, @ANYBLOB], 0xb0}, 0x1, 0x0, 0x0, 0x28040000}, 0x4000000) (async) 16:11:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x1000000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1121.641231][T29500] can0: slcan on ptm16. 16:11:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xf0ffffff, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:16 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) syz_io_uring_setup(0x0, &(0x7f0000001a80), &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000001b00), &(0x7f0000001b40)) faccessat(r0, &(0x7f0000000040)='./file0\x00', 0x153) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1, {0xffffffffffffffff, 0xee00}}, './file0/file0\x00'}) statx(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x1000, 0x440, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r4, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r4, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) r6 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r6, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r6, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r7, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) inotify_init() setxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000300)={{}, {0x1, 0x3}, [{0x2, 0x3, r2}, {0x2, 0x4, 0xffffffffffffffff}, {0x2, 0x0, 0xee01}, {0x2, 0x2, r3}], {}, [{}, {0x8, 0x6, r5}, {0x8, 0x7, r7}, {0x8, 0x1, 0xee00}, {0x8, 0x4, 0xee01}], {0x10, 0x1}, {0x20, 0x1}}, 0x6c, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r1, 0x5437, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) (async) syz_io_uring_setup(0x0, &(0x7f0000001a80), &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000001b00), &(0x7f0000001b40)) (async) faccessat(r0, &(0x7f0000000040)='./file0\x00', 0x153) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1, {0xffffffffffffffff, 0xee00}}, './file0/file0\x00'}) (async) statx(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x1000, 0x440, &(0x7f0000000200)) (async) open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) (async) openat$cgroup_procs(r4, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(r4, 0x0, 0x400, 0x20, &(0x7f000000bb00)) (async) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) (async) openat$cgroup_procs(r6, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(r6, 0x0, 0x400, 0x20, &(0x7f000000bb00)) (async) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r7, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) inotify_init() (async) setxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000300)={{}, {0x1, 0x3}, [{0x2, 0x3, r2}, {0x2, 0x4, 0xffffffffffffffff}, {0x2, 0x0, 0xee01}, {0x2, 0x2, r3}], {}, [{}, {0x8, 0x6, r5}, {0x8, 0x7, r7}, {0x8, 0x1, 0xee00}, {0x8, 0x4, 0xee01}], {0x10, 0x1}, {0x20, 0x1}}, 0x6c, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) [ 1121.697358][T29500] can0 (unregistered): slcan off ptm16. [ 1121.720827][T29515] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.5'. 16:11:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xfcffffff, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x2000000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1121.763767][T29520] can0: slcan on ptm0. 16:11:16 executing program 5: socketpair$nbd(0x1, 0x1, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000080), 0xffffffffffffffff) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240), 0x101200, 0x0) 16:11:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x3000000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xfffff000, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:16 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(0xffffffffffffffff, 0x0, 0x800, 0x80, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r3, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000000c0)=0x0) fstat(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x4) sched_setattr(r6, &(0x7f0000000380)={0x38, 0x0, 0x0, 0x10001, 0x1, 0xfffffffffffffffe, 0xb, 0x8, 0x8, 0x9}, 0x0) shmctl$IPC_SET(0x0, 0x1, &(0x7f00000001c0)={{0x0, 0xee01, r3, r4, r5, 0xa4, 0x6613}, 0x10000, 0x81, 0x8001, 0x40, r6, 0xffffffffffffffff, 0x8}) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r7, 0x400455c8, 0x4) ioctl$TIOCSTI(r7, 0x5437, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(r7, 0x40089416, 0x0) ioctl$TCGETS(r7, 0x5401, &(0x7f0000000100)) [ 1121.828564][T29520] can0 (unregistered): slcan off ptm0. 16:11:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x4000000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:18 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5428, 0x0) 16:11:18 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x5000000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:18 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xffffff7f, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:18 executing program 5: name_to_handle_at(0xffffffffffffffff, &(0x7f0000000040)='\x00', 0x0, 0x0, 0x1000) 16:11:18 executing program 2: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) syz_io_uring_setup(0x0, &(0x7f0000001a80), &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000001b00), &(0x7f0000001b40)) faccessat(r0, &(0x7f0000000040)='./file0\x00', 0x153) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1, {0xffffffffffffffff, 0xee00}}, './file0/file0\x00'}) statx(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x1000, 0x440, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r4, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r4, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) r6 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r6, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r6, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r7, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) inotify_init() setxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000300)={{}, {0x1, 0x3}, [{0x2, 0x3, r2}, {0x2, 0x4, 0xffffffffffffffff}, {0x2, 0x0, 0xee01}, {0x2, 0x2, r3}], {}, [{}, {0x8, 0x6, r5}, {0x8, 0x7, r7}, {0x8, 0x1, 0xee00}, {0x8, 0x4, 0xee01}], {0x10, 0x1}, {0x20, 0x1}}, 0x6c, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r1, 0x5437, 0x0) openat$bsg(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) (async) syz_io_uring_setup(0x0, &(0x7f0000001a80), &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000001b00), &(0x7f0000001b40)) (async) faccessat(r0, &(0x7f0000000040)='./file0\x00', 0x153) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1, {0xffffffffffffffff, 0xee00}}, './file0/file0\x00'}) (async) statx(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x1000, 0x440, &(0x7f0000000200)) (async) open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) (async) openat$cgroup_procs(r4, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(r4, 0x0, 0x400, 0x20, &(0x7f000000bb00)) (async) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) (async) openat$cgroup_procs(r6, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(r6, 0x0, 0x400, 0x20, &(0x7f000000bb00)) (async) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r7, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) inotify_init() (async) setxattr$system_posix_acl(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000300)={{}, {0x1, 0x3}, [{0x2, 0x3, r2}, {0x2, 0x4, 0xffffffffffffffff}, {0x2, 0x0, 0xee01}, {0x2, 0x2, r3}], {}, [{}, {0x8, 0x6, r5}, {0x8, 0x7, r7}, {0x8, 0x1, 0xee00}, {0x8, 0x4, 0xee01}], {0x10, 0x1}, {0x20, 0x1}}, 0x6c, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) [ 1123.716928][ T3656] Bluetooth: hci6: command 0x1003 tx timeout [ 1123.727227][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:11:18 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x6000000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:18 executing program 5: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x4, &(0x7f0000000000)=@framed={{}, [@jmp={0x3, 0x0, 0xc}]}, &(0x7f0000000040)='GPL\x00', 0x1, 0x86, &(0x7f0000000080)=""/134, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) [ 1123.767456][T29596] can0: slcan on ptm1. [ 1123.784208][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:18 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xffffff9e, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:18 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x7000000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:18 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xfffffff0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1123.847244][T29596] can0 (unregistered): slcan off ptm1. 16:11:18 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(0xffffffffffffffff, 0x0, 0x800, 0x80, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r3, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000000c0)=0x0) fstat(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x4) sched_setattr(r6, &(0x7f0000000380)={0x38, 0x0, 0x0, 0x10001, 0x1, 0xfffffffffffffffe, 0xb, 0x8, 0x8, 0x9}, 0x0) shmctl$IPC_SET(0x0, 0x1, &(0x7f00000001c0)={{0x0, 0xee01, r3, r4, r5, 0xa4, 0x6613}, 0x10000, 0x81, 0x8001, 0x40, r6, 0xffffffffffffffff, 0x8}) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r7, 0x400455c8, 0x4) ioctl$TIOCSTI(r7, 0x5437, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(r7, 0x40089416, 0x0) ioctl$TCGETS(r7, 0x5401, &(0x7f0000000100)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) (async) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(0xffffffffffffffff, 0x0, 0x800, 0x80, &(0x7f000000bb00)) (async) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r3, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000000c0)) (async) fstat(0xffffffffffffffff, &(0x7f0000000140)) (async) getpid() (async) sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x4) (async) sched_setattr(r6, &(0x7f0000000380)={0x38, 0x0, 0x0, 0x10001, 0x1, 0xfffffffffffffffe, 0xb, 0x8, 0x8, 0x9}, 0x0) (async) shmctl$IPC_SET(0x0, 0x1, &(0x7f00000001c0)={{0x0, 0xee01, r3, r4, r5, 0xa4, 0x6613}, 0x10000, 0x81, 0x8001, 0x40, r6, 0xffffffffffffffff, 0x8}) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r7, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r7, 0x5437, 0x0) (async) ioctl$BTRFS_IOC_WAIT_SYNC(r7, 0x40089416, 0x0) (async) ioctl$TCGETS(r7, 0x5401, &(0x7f0000000100)) (async) 16:11:18 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x18) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x81}}, './file0\x00'}) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1}) [ 1123.956880][ T3647] Bluetooth: hci7: command 0x1003 tx timeout [ 1123.959104][T19718] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1124.056959][ T3656] Bluetooth: hci7: sending frame failed (-49) [ 1124.063252][T19718] Bluetooth: hci7: Opcode 0x1003 failed: -49 16:11:20 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5441, 0x0) 16:11:20 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x9000000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:20 executing program 5: socketpair(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(r0, 0x0, 0x0) 16:11:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xfffffffc, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x18) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x81}}, './file0\x00'}) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1}) 16:11:20 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(0xffffffffffffffff, 0x0, 0x800, 0x80, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r3, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000000c0)=0x0) (async) fstat(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x4) (async) sched_setattr(r6, &(0x7f0000000380)={0x38, 0x0, 0x0, 0x10001, 0x1, 0xfffffffffffffffe, 0xb, 0x8, 0x8, 0x9}, 0x0) (async) shmctl$IPC_SET(0x0, 0x1, &(0x7f00000001c0)={{0x0, 0xee01, r3, r4, r5, 0xa4, 0x6613}, 0x10000, 0x81, 0x8001, 0x40, r6, 0xffffffffffffffff, 0x8}) (async) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r7, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r7, 0x5437, 0x0) ioctl$BTRFS_IOC_WAIT_SYNC(r7, 0x40089416, 0x0) ioctl$TCGETS(r7, 0x5401, &(0x7f0000000100)) 16:11:20 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xf000000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1125.796909][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1125.806897][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:11:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0xffffffff, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:20 executing program 5: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0}) 16:11:20 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) dup(r0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000280)) r2 = dup2(r1, r1) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r2, 0x5607) r3 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r3, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r3, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r4, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r3, 0x5608) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfff9) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r5, 0x400455c8, 0x4) ioctl$TIOCSTI(r5, 0x5437, 0x0) 16:11:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x18) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0, {0x81}}, './file0\x00'}) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1}) 16:11:20 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5450, 0x0) [ 1125.898981][ T3647] Bluetooth: hci6: sending frame failed (-49) [ 1125.905305][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1125.937872][T29701] binder: 29700:29701 ioctl c018620c 20000180 returned -22 16:11:20 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x3f000000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x2, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x3, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x4, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1126.003906][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x5, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:20 executing program 5: r0 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000700), 0x2) r1 = memfd_create(&(0x7f00000008c0)='\xb1X\x9b\xde\xda8\xe0\x8e\b\xac\x80\x14\xe8\xfb\x97/dev/udmabuf\x00', 0x0) ioctl$UDMABUF_CREATE(r0, 0x40187542, &(0x7f0000000780)={r1, 0x0, 0x0, 0x4000}) 16:11:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:11:20 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x7fffefb0}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1126.111958][ T5903] Bluetooth: hci7: Frame reassembly failed (-84) [ 1126.151682][T29730] can0: slcan on ptm2. [ 1126.178809][T29730] can0 (unregistered): slcan off ptm2. [ 1128.036937][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1128.037007][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:11:22 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) dup(r0) (async) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000280)) (async) r2 = dup2(r1, r1) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r2, 0x5607) (async) r3 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r3, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(r3, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r4, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) ioctl$VT_DISALLOCATE(r3, 0x5608) (async) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfff9) (async) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r5, 0x400455c8, 0x4) ioctl$TIOCSTI(r5, 0x5437, 0x0) 16:11:22 executing program 5: openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/fs/cgroup', 0x0, 0x0) 16:11:22 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x6, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) 16:11:22 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x8b0b0000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:22 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5451, 0x0) 16:11:22 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x7, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:22 executing program 5: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x8, 0x1, &(0x7f0000000040)=@raw=[@ldst], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) [ 1128.117069][T19716] Bluetooth: hci7: command 0x1003 tx timeout [ 1128.119112][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:11:22 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) dup(r0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000280)) r2 = dup2(r1, r1) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r2, 0x5607) r3 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r3, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(r3, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r4, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) ioctl$VT_DISALLOCATE(r3, 0x5608) (async) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfff9) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r5, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r5, 0x5437, 0x0) 16:11:22 executing program 5: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x2, &(0x7f0000000040)=@raw=[@ldst={0x0, 0x0, 0x2}, @exit], &(0x7f0000000080)='syzkaller\x00', 0x4, 0xa2, &(0x7f0000000100)=""/162, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) 16:11:22 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x9effffff}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:22 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x9, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1128.200472][T29779] can0: slcan on ptm0. [ 1128.210045][ T5904] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:22 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xa57a61b5}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:22 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x543181) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$BTRFS_IOC_SEND(r0, 0x40489426, &(0x7f0000000100)={{r0}, 0x7, &(0x7f00000000c0)=[0xffff, 0x10001, 0x5, 0x9, 0x5, 0xf2, 0x8000000000000001], 0x3, 0x1, 0x1}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:22 executing program 5: ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x400454d0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000009c0), 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000e40)={0xffffffffffffffff, 0x0, 0x0}, 0x10) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000a00)={'dvmrp0\x00', 0x2}) 16:11:22 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xf, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) [ 1128.277445][T29794] can0 (unregistered): slcan off ptm0. [ 1128.331708][ T5905] Bluetooth: hci7: Frame reassembly failed (-84) [ 1128.366498][T29815] can0: slcan on ptm2. [ 1128.447516][T29816] can0 (unregistered): slcan off ptm2. 16:11:24 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5452, 0x0) 16:11:24 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xb0efff7f}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:24 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x1a, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:24 executing program 5: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x12, 0x1, &(0x7f0000000040)=@raw=[@ldst], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) 16:11:24 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x15) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:11:24 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$sock(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000200)="f5", 0x1}], 0x1}, 0x0) recvmsg(r0, &(0x7f0000002100)={&(0x7f0000000d40)=@vsock={0x28, 0x0, 0x0, @local}, 0x80, &(0x7f0000001f80)=[{&(0x7f0000000dc0)=""/93, 0x5d}], 0x1, &(0x7f0000002000)=""/252, 0xfc}, 0x11c2) 16:11:24 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xf0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:24 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xb5617aa5}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1130.286870][T19716] Bluetooth: hci6: command 0x1003 tx timeout [ 1130.286906][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:11:24 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x543181) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) ioctl$BTRFS_IOC_SEND(r0, 0x40489426, &(0x7f0000000100)={{r0}, 0x7, &(0x7f00000000c0)=[0xffff, 0x10001, 0x5, 0x9, 0x5, 0xf2, 0x8000000000000001], 0x3, 0x1, 0x1}) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:24 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x15) ioctl$TIOCSTI(r0, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) syz_open_dev$tty20(0xc, 0x4, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x15) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) [ 1130.352545][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) [ 1130.356939][T19718] Bluetooth: hci7: command 0x1003 tx timeout [ 1130.359073][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1130.376531][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:25 executing program 5: syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001740)) 16:11:25 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xf0ffffff}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1130.407490][T29874] ptm ptm2: ldisc open failed (-12), clearing slot 2 16:11:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x15) ioctl$TIOCSTI(r0, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) syz_open_dev$tty20(0xc, 0x4, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x15) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) 16:11:26 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x300, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:26 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x543181) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$BTRFS_IOC_SEND(r0, 0x40489426, &(0x7f0000000100)={{r0}, 0x7, &(0x7f00000000c0)=[0xffff, 0x10001, 0x5, 0x9, 0x5, 0xf2, 0x8000000000000001], 0x3, 0x1, 0x1}) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:26 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x545d, 0x0) 16:11:26 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0x1, &(0x7f0000000000), &(0x7f0000000080)=0x4) 16:11:26 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xfdffffff}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:26 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x500, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:27 executing program 5: creat(&(0x7f00000000c0)='./file0\x00', 0x0) creat(&(0x7f0000000080)='./file0/file0\x00', 0x0) [ 1132.356944][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1132.357009][ T3656] Bluetooth: hci6: command 0x1003 tx timeout 16:11:27 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x600, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:27 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xfffff000}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:27 executing program 2: ioctl$USBDEVFS_DISCARDURB(0xffffffffffffffff, 0x550b, &(0x7f0000000040)=0x2) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000080)=@urb_type_interrupt={0x1, {0x6, 0x1}, 0x636, 0x47, &(0x7f0000000140)="888f24ee089efe3286e26601cd0e88d3eb364bcf29bd9eb45c1e3ff235a0502f8dc7d5fdc90e153e14dd1aa47eeee8f73a3a58dc529c775c4c9206631b03e5f3b4c92b082246786f82b88cee8fcd3ff6e26843532d3faea44ee2947f8c344667515629492e0d55a81bbc6bb6c1ceec685db36b686ae7d47ba772e3948fb0d471161dfaa162cd64a68acf61a735522eb02a005f624dd53fc8207c602d1393663b8800c8175008228f18c3dfbe4edbfd7c37659023325e672b9cc07b712f0a0d96e1bf2481153ebc7ce8d05b34d11ae825de31ff53ec6f7b14bd403c23536da87583e80a", 0xe3, 0x0, 0xe2b6, 0x0, 0x1000, 0x4, &(0x7f0000000240)="a380b61f4b592449614f92ed737777e1de5de8fead0efd85444667c997f888509bca12ef47693ff391a020d13da421e71ba0cce16f295e7a0d543ba02add747b103a21c367f1caaa7b4d49fb066162328d22cbaa04b09c9e6af488339b139edc653b3412e603a8e68b0aa8cdb6173def898cb7237a8eb259f320f8220d6c50e78ad895d1c6965302b460670ca03748add14e1d117492db43cf1e1eae7c997ce6e9b0d495c8576b42047249002f14bdd0253b416de9c9740f2d35336d6c5c08959107470a4e7afe964ca782324f8eb98d9c03f0c4b5c7605e126faeebd887c56898837a3987d7e8631226572a8a3959703911dec5e45f93f33f"}) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f0000000340)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x20b085, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r1, 0x5437, 0x0) preadv(r1, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/198, 0xc6}], 0x1, 0x418, 0xf3) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x15) 16:11:27 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x700, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:27 executing program 5: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0xc0, 0x80) [ 1132.417197][ T3656] Bluetooth: hci6: sending frame failed (-49) [ 1132.423818][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:11:27 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) process_vm_readv(0x0, &(0x7f00000000c0), 0x0, &(0x7f0000001200)=[{&(0x7f0000000100)=""/19, 0x13}, {&(0x7f0000000140)=""/156, 0x9c}, {&(0x7f0000000200)=""/4096, 0x1000}], 0x3, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r3, 0x5607) write$6lowpan_enable(r1, &(0x7f0000000000)='1', 0x1) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r4, 0x5437, 0x0) 16:11:27 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xffffff7f}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1132.469593][ T3656] Bluetooth: hci6: sending frame failed (-49) [ 1132.476147][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:11:27 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5460, 0x0) 16:11:27 executing program 2: ioctl$USBDEVFS_DISCARDURB(0xffffffffffffffff, 0x550b, &(0x7f0000000040)=0x2) (async) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000080)=@urb_type_interrupt={0x1, {0x6, 0x1}, 0x636, 0x47, &(0x7f0000000140)="888f24ee089efe3286e26601cd0e88d3eb364bcf29bd9eb45c1e3ff235a0502f8dc7d5fdc90e153e14dd1aa47eeee8f73a3a58dc529c775c4c9206631b03e5f3b4c92b082246786f82b88cee8fcd3ff6e26843532d3faea44ee2947f8c344667515629492e0d55a81bbc6bb6c1ceec685db36b686ae7d47ba772e3948fb0d471161dfaa162cd64a68acf61a735522eb02a005f624dd53fc8207c602d1393663b8800c8175008228f18c3dfbe4edbfd7c37659023325e672b9cc07b712f0a0d96e1bf2481153ebc7ce8d05b34d11ae825de31ff53ec6f7b14bd403c23536da87583e80a", 0xe3, 0x0, 0xe2b6, 0x0, 0x1000, 0x4, &(0x7f0000000240)="a380b61f4b592449614f92ed737777e1de5de8fead0efd85444667c997f888509bca12ef47693ff391a020d13da421e71ba0cce16f295e7a0d543ba02add747b103a21c367f1caaa7b4d49fb066162328d22cbaa04b09c9e6af488339b139edc653b3412e603a8e68b0aa8cdb6173def898cb7237a8eb259f320f8220d6c50e78ad895d1c6965302b460670ca03748add14e1d117492db43cf1e1eae7c997ce6e9b0d495c8576b42047249002f14bdd0253b416de9c9740f2d35336d6c5c08959107470a4e7afe964ca782324f8eb98d9c03f0c4b5c7605e126faeebd887c56898837a3987d7e8631226572a8a3959703911dec5e45f93f33f"}) (async) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f0000000340)) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x20b085, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) preadv(r1, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/198, 0xc6}], 0x1, 0x418, 0xf3) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x15) 16:11:27 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x900, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:27 executing program 5: semget$private(0x0, 0x2, 0x38) 16:11:27 executing program 5: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.log\x00', 0x2a41, 0x103) 16:11:27 executing program 2: ioctl$USBDEVFS_DISCARDURB(0xffffffffffffffff, 0x550b, &(0x7f0000000040)=0x2) (async) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000080)=@urb_type_interrupt={0x1, {0x6, 0x1}, 0x636, 0x47, &(0x7f0000000140)="888f24ee089efe3286e26601cd0e88d3eb364bcf29bd9eb45c1e3ff235a0502f8dc7d5fdc90e153e14dd1aa47eeee8f73a3a58dc529c775c4c9206631b03e5f3b4c92b082246786f82b88cee8fcd3ff6e26843532d3faea44ee2947f8c344667515629492e0d55a81bbc6bb6c1ceec685db36b686ae7d47ba772e3948fb0d471161dfaa162cd64a68acf61a735522eb02a005f624dd53fc8207c602d1393663b8800c8175008228f18c3dfbe4edbfd7c37659023325e672b9cc07b712f0a0d96e1bf2481153ebc7ce8d05b34d11ae825de31ff53ec6f7b14bd403c23536da87583e80a", 0xe3, 0x0, 0xe2b6, 0x0, 0x1000, 0x4, &(0x7f0000000240)="a380b61f4b592449614f92ed737777e1de5de8fead0efd85444667c997f888509bca12ef47693ff391a020d13da421e71ba0cce16f295e7a0d543ba02add747b103a21c367f1caaa7b4d49fb066162328d22cbaa04b09c9e6af488339b139edc653b3412e603a8e68b0aa8cdb6173def898cb7237a8eb259f320f8220d6c50e78ad895d1c6965302b460670ca03748add14e1d117492db43cf1e1eae7c997ce6e9b0d495c8576b42047249002f14bdd0253b416de9c9740f2d35336d6c5c08959107470a4e7afe964ca782324f8eb98d9c03f0c4b5c7605e126faeebd887c56898837a3987d7e8631226572a8a3959703911dec5e45f93f33f"}) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f0000000340)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x20b085, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) preadv(r1, &(0x7f00000004c0)=[{&(0x7f00000003c0)=""/198, 0xc6}], 0x1, 0x418, 0xf3) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000380)=0x15) [ 1132.530847][ T3656] Bluetooth: hci6: sending frame failed (-49) [ 1132.538249][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:11:27 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xb8b, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:27 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) process_vm_readv(0x0, &(0x7f00000000c0), 0x0, &(0x7f0000001200)=[{&(0x7f0000000100)=""/19, 0x13}, {&(0x7f0000000140)=""/156, 0x9c}, {&(0x7f0000000200)=""/4096, 0x1000}], 0x3, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) (async) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r3, 0x5607) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='1', 0x1) (async) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r4, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r4, 0x5437, 0x0) 16:11:27 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xffffff9e}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:27 executing program 5: open$dir(&(0x7f0000000000)='./file0\x00', 0x42040, 0x0) r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x40) [ 1132.593442][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x8, r0, 0x1}) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000040)={0x105, 0xfff, 0x6, 0x7ffd, 0xb, "73e59fd5bf9b00"}) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x2b) 16:11:27 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xb8d, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1132.667311][ T5905] Bluetooth: hci7: Frame reassembly failed (-84) [ 1132.686715][T29948] can0: slcan on ptm2. [ 1132.724864][ T5903] Bluetooth: hci8: Frame reassembly failed (-84) [ 1132.827763][T29958] can0 (unregistered): slcan off ptm2. 16:11:29 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x8933, 0x0) 16:11:29 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xfffffff0}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:29 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = dup(r0) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, 0x0, 0x0) 16:11:29 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xf00, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:29 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xfffffffd}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1134.596857][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1134.598418][T19716] Bluetooth: hci6: command 0x1003 tx timeout 16:11:29 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x1a00, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:29 executing program 5: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) dup(r0) [ 1134.646638][T19716] Bluetooth: hci6: sending frame failed (-49) [ 1134.653132][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1134.685501][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:11:29 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) process_vm_readv(0x0, &(0x7f00000000c0), 0x0, &(0x7f0000001200)=[{&(0x7f0000000100)=""/19, 0x13}, {&(0x7f0000000140)=""/156, 0x9c}, {&(0x7f0000000200)=""/4096, 0x1000}], 0x3, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) (async, rerun: 32) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) (rerun: 32) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) (async) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r3, 0x5607) (async, rerun: 64) write$6lowpan_enable(r1, &(0x7f0000000000)='1', 0x1) (async, rerun: 64) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r4, 0x5437, 0x0) 16:11:29 executing program 5: signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x8, 0x80800) 16:11:29 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0xffffffff}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1134.686843][ T3647] Bluetooth: hci7: command 0x1003 tx timeout 16:11:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x2) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x8, r0, 0x1}) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000040)={0x105, 0xfff, 0x6, 0x7ffd, 0xb, "73e59fd5bf9b00"}) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x2b) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x2) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x8, r0, 0x1}) (async) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000040)={0x105, 0xfff, 0x6, 0x7ffd, 0xb, "73e59fd5bf9b00"}) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x2b) (async) 16:11:29 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x400448c9, 0x0) 16:11:29 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x3f00, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:29 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x3}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:29 executing program 5: open$dir(&(0x7f0000000140)='./file0\x00', 0xc40, 0x0) fchmodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xa8) execveat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0) 16:11:29 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x4) ioctl$TIOCSTI(0xffffffffffffffff, 0x5437, 0x0) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000240)={0x20, 0x1, 0x5, 0x83, 0x10, "46819cec6447be86645dec9a3c042ee16bfe8b"}) ioctl$BTRFS_IOC_SNAP_DESTROY(r0, 0x5000940f, &(0x7f0000000700)={{}, "cf43375057618b24e729ad567d914f42b594416de6ad3007264e9d213a217bbf0300ea7595afac093c29f7f898ed4377a74072f196f0abd1d265d2e005dd7c15372e83028131a6bab0d72d10c7a04a19cbd2084a40b22096ebfabcf94a49ba91763fcaaf1811d7dd31d3b8816f595d5aba4bb06b7f5f6a22caa58deb8c19aa6634753af89f0e6e71a4de4f0304177ad5e237be46ac4629a27cb3455fc9cabaf655133c9935500cfa4b45e2c4db8b95f0f25682fd749d26284ae8eb3a6114ab8ac6120cd9d2c1cac58652d5cd720910f3e7cc854001bb500c9cc3397115a11b464e43fcf52f94aaa9cff0cd96d9ab55331f32d8c21687a895fab879704fa4425b1860dc623e0948ef5b8a75040d584d51991f01129441648eeabc79676efaf080428924b60d008afced87df95fae8f6d193769b7a264c5e186e28fbf3cf81a1b68458ec962a7d15d17f2a64c731d92c99bca735cab08d019873f182257c5bc1f162f3545f15de14dce19d2aea0cf6373a193d1742f945210367f6d1c879a07a391725b3f4443cd52e7157f006f91c468663d4b521da29394bb33e0ddae465404bfd5080846fb23184761cab8b167f6d407560b993b93f225043f7e8044fc3ada342c6d6093c4fab6de86e65bf20f6cb2753bd5450ef25eddcdc65dba20712270a270a11fa4b2a16ce4d125f33071e2cf250831c70ed4ec6f388081eae62d0caab01f589f746277975081e746c4399c5b45bb3eb542f67552f32cd237ef5f6a263484310ea1ba7eee154f8c75346472c02f3a51a017dc7a6308849ec1c7dcad37ac8eb240cbdf59ed14b99dbdf423a32d33b66290da481dd7805a174d23de994fbdcf3f78d2b3cb2e8c2214800b7cb9d7685a4613b0d46e63a2a7fbf640c88b53a3a04b3acf2a64f5e2d5eef69b5bd172179891749e4f00da8934437f6e476317eb4e7d7365280e4ea22e14fd57a2e7f0c1e069ac13790481d7e3216f6d4d110e4803f0fd2a5901c5423fb78585dac1d67eef3325569a67175127659f2d9cb5d009d8eb5f35f5d9691bb2b69dfb982e80a42e650bd4175cd9382927229fec21582068d1c52c0f94811396acdf939f7c1bc0284f2fd946c50c45df359d680ee248bc7678dbd15fa2ddc81089b958806ea892fce8412a66cb38aa48e6adcf5628e7a45f09b4a952770762156dfc6c7d3fef2ada0ae3a93658a9889c4092a8385964b3318c96716ed7139027aa6812a8a3a2d1ade068ccf90ca9da53b88b7fba74ce000a95b6f3b9742d3c10a14b94c025a49b0d57edaf851bebd862852beeb57739b7a652042c6f9c18dd2f70c68cf110fee25eab188c4531958dca507cb303c1fe2ff7366b0a04c6d2abba81d23ed0b0b2a2297820917c793834af5c4f2f8d8e5348da1e777913ed5e3cd027d530e1f51c0d452b08f1d99a94ad0c9054d45facde55ac36ac07073f943b02e1e89a86b028ae2c021d591e34a8b09216f1cbce79b0383d98d2f4c3fd93832c2b37acd4c1678491cb87ce203d709415daaa2a7af11119440c8d03dbd3a019d04c171fb2154dffd626188985b1bf97e3f044297927fffe83797f4620ddb93b7fe314cc44839f1ff1e6df9cf6c1da30625f89c78cdee83702bc82233bd721f956c8fcefe27aa3f861aabd936e1c8cb1cae269284207d2235d5e23bcf97220a56610894f91d2aaf02a373c5c3a472c62f47c94951640cece11d78ddc5763cdb7924a6be96ceb3a58661ae73f7868698a97a0d29aba245462fd54374b06625c0e23a5f7aaf0ffa5ebea5ebcc679fe6682704f962ca409e06a7ab8902100284cb2b1f9f807bc406ebecf485a251b8907876c724f25bb95083caf292c665ae376e878279ccc9da4e89f6b62ef6d6beb4ecaf8cb48c452a4cb307ff1017da78959235aa3c64248fba53f7e5fe0a450a50bd94102ebf3310a35b6d1ab42282e06d54644c393e3a584f8184db352b61b2d1398610d5b23be8d401598cdb82f3fc489eaba1ba80a262571d51f43e6e8ee74717adff4984308da2ef2f22654001a757e922fc75ee6582132bc3e30f75a1592faccf608c8c198f695dc8cb0b8ab235de7540d5c8f4d48c9127cae7a9476d8f13e21701dba166e2afb34ee2d0e90b3a5948a2be345a2c05ecf61cadaf3cc66e24ace934f84ad123aa75c4dfe7b2c6282db95f346dc973d92ec3f059344d562a5a607132ebd0bd9ba7065e52a525eebee34b2093ea11fe66e4721a4cfca98df93282634b7472a5ae0fdc2bdd2ec034aba181ef2ddfc3ac97ea2106b78f2db183c3655c3bf8825ef275141762a66e7d3e4e00ebb299d72b369b851b8eef4605cc6c7676d368f625d55cd35a110b826b3beb03fc3a8ba2fe51611e1d1108be86ca068afb56446230b373ec5e1ac47b2bc9e8e51b6f7144a5856c9f5191abfd9b1ca1d629273e0c81e482fc625ad871837dece6aa00ad51d55381687c35c5daf6cfd8e49b397140c2c20f02539309dd05e0afa94ea6d0dac9102236cefabb07cbd40676f7c950b97aaa2821cbfee97fd3e8797a0ef2c9f167fbd3ad1937a4ab5738ef5c00297dbf2d80c510e06836f9c39305d38517f0819e70402d670dc69cac75568dc62ebc96b444ad13475dc1ac10b3ba14bdc2c524819f0dce8116aa95601b13c986e88fa9034a9d92cc8fb9a02f354fef85fbbc734765dd61099c04f7270eb7c4c80fa4f4907bb96578ad5555f53d3af4f8f0a031d0745e52898908e14020279a8fb1c7d0cc4b05681d2d29e3371b5c3c3538ba68f2eb076ad25d250a867c867cf54a2fa55548e0d9b906b32dde0971052362657865d06507d79886392454b673f77fb2e939aa54dbf557b7b8d73f6e848656ba14a219df61f7920198c44cf75da8982a00676bff5258333abcae23bd28726cb7b53b8ed5eb04db748bd9039448db9b7ee381d1599b7924c157e035ad3031c91d524bbfa790f88ab0a488d7751dd561b957644e238f1038f6d2d705bdf94bfa88e89ca03acac1f699871b3460a449b50c96472c14d1ad69c970be8ed473fdf4b10283310e8deb00dc10ca8a96c02170cb790eee6b3cb4afc2f3b60a5ad757b321a35b75edd4b27456e34f27bf9e3f6d6245e0e0518a30b84a3c8de2a217c76f747467b76c0b1fad5bda66fa80b9772dbb185a67ff1fcd78cca249d47d712f8e215bdcf0cefb67a94db8fa4b7fe7d98b588b4ec1a3c018e21af2740f57b2ae8222b13b9ac872edfe163e82ddc96adacbb8ebc816063e7cbc0d2d61ad3113cd1addcf86d40b51e30330d6d94ffae64fb1793899be8a3846dc4df708c5ea3f4888ec5436023ad5d03efeb826b91a4869a309df145bc1fb230267b5843880c4c3a53b82678685f289cb3fc2a6dd7cb4c29cb30392c4c106c9ab766d7094ae6e9612a774921ad92d09521420a8adead49c7bb3de824842eff622f9a0a4d05e1bd812f16aea4e1cd24a7b4c6e680d9820061349d6e70988353174206696093c7c610491e4e5eeaed3a0da4dab58a1ab28ff561977be054a399ad94d8b10b5e906b434a0027d38c909bbd270f3b100984581d483b2d7965646a9bdfe42f6353f78d879bd2900ad142d4920c45a129caae7637553eefc4003e6a016e14d59df19fea39434aad6cf81d89ba1c693a9e72a275dfdbf321866adc45896310edf4b551d49b42ade09ffc561d0cd16714cbe39e2bffb7126fe8bdd2f2d87f6d6f7953da19e24b8acf9f4bdb98d259a2c027b95295deda6a3ed66d8dd25c388ede56405ee217952ef9168b0c6e23d364f7005dd8a0a15f52946ebb55352cba9f45556de1c9db9cdff9e2ad93a79a6c7827819ed337c916956b90ede2c0a414e23742606e31b8efce57622d34a2bcbfc3b9af7ad86326d9bd810fac05c3c694a0c392c14a91cb1599da9cd92363a77e91716a6760b7680aeaff0e8757eb87ec527fe0bd8eff8a377df27c46a08ba00a04e69b5d37ee53abf9e09513744e5945d513db4b37257d7e9bba6694c2294fcf14848da98912c5ead8f12d6ef4e5168440f67265959b57e589b23e662156ea54f2b5a5f332ea9a14078a0adbfde44eabf8b81a371e864e1acacc1c7feca2e43c578b3c100176c570f80c3ff3239759b52fbd9338e63433abd2c77f8b8bce1559a613de04b54a09ab2ebae1ba0f6a32f353f155b442512f6692c2b80c185915184d0ae709e48c0a799e15b5f25fc3ce15b4bbbf9deb0d9b814d0dd3e0067f84a03f500f1dbc880ce918faa38299cf6a2386dd049664498dae22ef3ea28c9ae508af3ba2401b125d090dbe6ecbd895834188de774c14f1e68ea98fe0cbbbffa04ed2e34972cde0341795fe8b0f99b7ddb663757a6323483761ea58cb824d81f333fb5f2e8ddb3c9714fa8c0f0a3e6fbe18702fe31e04dc5cd612ac7dcdfaa20c15bf50fff6cdb2d39302f32792d0bd26de7456199d80ba767ca4025b4da09ff0945d2282c8bd45eb8d0a9ecc4ae9ee10f901f58cdbfa3aca002e65044d8ceda3c2efce2045bec60036dd59225bd105312647aad92fd9409ca79bceb747d70c4baa181fe4e3d0420831d67b809b0ee0d87277b65eb113d6c785492d61818b321d60d5dc751223b9d7f5c0137b61c252b8037e95906dffc42d2be22f75aff0bda2cf1a972add370598e032819a93d7b955745e04998419e6bf2cf2e05bf26372f1fb790a7d4a83ee088bea4a6dc39c601482762553a7a476cff27f081bcfb25677917012e052c65a21f4f2f9f4c146042693f78e20792fa65220ef9765326dd5ee5f99ea8743d56ce737c51133d5a9729e6e85a01e7ef647ea51858f49c82e80b73bb51fb3417bd466705d4925df9c09d5d5b8286db9ee3ac4773761238e6429bd358d8f9f05eeb02592f14bc3f932a361e4c96233c5e106ab99f91bcf53a2cb6a23ebedae0c0a6354a431969ab53c25a844523256f37a2e5cd30de2fb6d4de31d300da3c65037e957cf9179208528e4f74d2e79156b466755babd4faf072fe7bc5e274c9a55b8096f4be6c3d9751a33b106c0605b7d3e667c2bb2fa8db2fcfcc1927f350e8e0014604d42b8e2bbb63188b6b7289858581f7f5599be2a7443110043d28533003fb16fd8fd228aa58f1c7a0e6e74b9549c540844d431ac816c2b1cc5df99de3b8b7caf5fdf4e533dc7f127672e0126ac45bbfb90b7b5ecffd549b16141df12ec5f2a6f8040108ee38ffc372aa13f72e699b34640c928cb73518f4dd134d6b648f6854fcf03467b61fe22423d5560ad93e23b96384f7f19beab3ec92145c968f178c4a9be9d10aea000d999de89f58b2eb670d008b69ce44b452cba0566d4fb143955ab5761da3dd55b6eec2f258a7fc09af1e9762495c6bd72dca7e70b4ecec421469e3313ef9b800c510e0408f07c639654b10b0a9e1bb08165ddd916a5542bbf46a842a743959c93c57f3958cdf61264c7a9a97aa43a7dedd3926e933c3acc0230153f69051ffcd6fb148ee972e332c45cdd520872d28b6331db94959951f05a25444ac67ec5843ac19f7aca691de8223aa9a2403b30c6a0c9fc9071ab5bba9a5e37d5db2579796fe9dc37869576c7632f2cee885bd03149f79da74d91824930cba8394abdfa01877823355f555fd5ef58b62f566878e947ec71dc17ecb47300c9735b598354b33139ad4ed164386f4953163f3dd6d8dd20b8054efe3d4706f31ce13d41ec6c70552b02622dc49ee94f0ddcd2c89568a20f189469bec4906e80b094eac1f88ef950d4c171494f14afdadce0974ed3333e4b6684f9f1a6fc76d6f"}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x3}, 0x3) r2 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r2, &(0x7f0000000180)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e21, 0x0, @private1}}, 0x24) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000400)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r2, 0x0, &(0x7f00000006c0)={0x0, 0xfffffffffffffe15, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x10}}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, r0, &(0x7f00000000c0)={0x40002, 0x2, 0x2}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x23456}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/kcm\x00') ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:11:29 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x18}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1134.766899][ T3656] Bluetooth: hci8: command 0x1003 tx timeout [ 1134.767085][T19718] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1134.795324][T30022] netlink: 52 bytes leftover after parsing attributes in process `syz-executor.1'. 16:11:29 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x8b0b, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1134.812509][ T9631] Bluetooth: hci6: Frame reassembly failed (-84) [ 1134.834240][T30031] netlink: 'syz-executor.1': attribute type 54 has an invalid length. [ 1134.849979][ T3656] Bluetooth: hci7: sending frame failed (-49) [ 1134.856200][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -49 16:11:29 executing program 5: open$dir(&(0x7f0000000000)='./file0\x00', 0xc0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x200, 0x44) 16:11:29 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x34}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1134.886720][T30032] can0: slcan on ptm2. 16:11:29 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x8d0b, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:29 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, &(0x7f0000000000)='0', 0xfffffd2c) (async, rerun: 32) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) (rerun: 32) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x4) ioctl$TIOCSTI(0xffffffffffffffff, 0x5437, 0x0) (async, rerun: 32) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000240)={0x20, 0x1, 0x5, 0x83, 0x10, "46819cec6447be86645dec9a3c042ee16bfe8b"}) (async, rerun: 32) ioctl$BTRFS_IOC_SNAP_DESTROY(r0, 0x5000940f, &(0x7f0000000700)={{}, "cf43375057618b24e729ad567d914f42b594416de6ad3007264e9d213a217bbf0300ea7595afac093c29f7f898ed4377a74072f196f0abd1d265d2e005dd7c15372e83028131a6bab0d72d10c7a04a19cbd2084a40b22096ebfabcf94a49ba91763fcaaf1811d7dd31d3b8816f595d5aba4bb06b7f5f6a22caa58deb8c19aa6634753af89f0e6e71a4de4f0304177ad5e237be46ac4629a27cb3455fc9cabaf655133c9935500cfa4b45e2c4db8b95f0f25682fd749d26284ae8eb3a6114ab8ac6120cd9d2c1cac58652d5cd720910f3e7cc854001bb500c9cc3397115a11b464e43fcf52f94aaa9cff0cd96d9ab55331f32d8c21687a895fab879704fa4425b1860dc623e0948ef5b8a75040d584d51991f01129441648eeabc79676efaf080428924b60d008afced87df95fae8f6d193769b7a264c5e186e28fbf3cf81a1b68458ec962a7d15d17f2a64c731d92c99bca735cab08d019873f182257c5bc1f162f3545f15de14dce19d2aea0cf6373a193d1742f945210367f6d1c879a07a391725b3f4443cd52e7157f006f91c468663d4b521da29394bb33e0ddae465404bfd5080846fb23184761cab8b167f6d407560b993b93f225043f7e8044fc3ada342c6d6093c4fab6de86e65bf20f6cb2753bd5450ef25eddcdc65dba20712270a270a11fa4b2a16ce4d125f33071e2cf250831c70ed4ec6f388081eae62d0caab01f589f746277975081e746c4399c5b45bb3eb542f67552f32cd237ef5f6a263484310ea1ba7eee154f8c75346472c02f3a51a017dc7a6308849ec1c7dcad37ac8eb240cbdf59ed14b99dbdf423a32d33b66290da481dd7805a174d23de994fbdcf3f78d2b3cb2e8c2214800b7cb9d7685a4613b0d46e63a2a7fbf640c88b53a3a04b3acf2a64f5e2d5eef69b5bd172179891749e4f00da8934437f6e476317eb4e7d7365280e4ea22e14fd57a2e7f0c1e069ac13790481d7e3216f6d4d110e4803f0fd2a5901c5423fb78585dac1d67eef3325569a67175127659f2d9cb5d009d8eb5f35f5d9691bb2b69dfb982e80a42e650bd4175cd9382927229fec21582068d1c52c0f94811396acdf939f7c1bc0284f2fd946c50c45df359d680ee248bc7678dbd15fa2ddc81089b958806ea892fce8412a66cb38aa48e6adcf5628e7a45f09b4a952770762156dfc6c7d3fef2ada0ae3a93658a9889c4092a8385964b3318c96716ed7139027aa6812a8a3a2d1ade068ccf90ca9da53b88b7fba74ce000a95b6f3b9742d3c10a14b94c025a49b0d57edaf851bebd862852beeb57739b7a652042c6f9c18dd2f70c68cf110fee25eab188c4531958dca507cb303c1fe2ff7366b0a04c6d2abba81d23ed0b0b2a2297820917c793834af5c4f2f8d8e5348da1e777913ed5e3cd027d530e1f51c0d452b08f1d99a94ad0c9054d45facde55ac36ac07073f943b02e1e89a86b028ae2c021d591e34a8b09216f1cbce79b0383d98d2f4c3fd93832c2b37acd4c1678491cb87ce203d709415daaa2a7af11119440c8d03dbd3a019d04c171fb2154dffd626188985b1bf97e3f044297927fffe83797f4620ddb93b7fe314cc44839f1ff1e6df9cf6c1da30625f89c78cdee83702bc82233bd721f956c8fcefe27aa3f861aabd936e1c8cb1cae269284207d2235d5e23bcf97220a56610894f91d2aaf02a373c5c3a472c62f47c94951640cece11d78ddc5763cdb7924a6be96ceb3a58661ae73f7868698a97a0d29aba245462fd54374b06625c0e23a5f7aaf0ffa5ebea5ebcc679fe6682704f962ca409e06a7ab8902100284cb2b1f9f807bc406ebecf485a251b8907876c724f25bb95083caf292c665ae376e878279ccc9da4e89f6b62ef6d6beb4ecaf8cb48c452a4cb307ff1017da78959235aa3c64248fba53f7e5fe0a450a50bd94102ebf3310a35b6d1ab42282e06d54644c393e3a584f8184db352b61b2d1398610d5b23be8d401598cdb82f3fc489eaba1ba80a262571d51f43e6e8ee74717adff4984308da2ef2f22654001a757e922fc75ee6582132bc3e30f75a1592faccf608c8c198f695dc8cb0b8ab235de7540d5c8f4d48c9127cae7a9476d8f13e21701dba166e2afb34ee2d0e90b3a5948a2be345a2c05ecf61cadaf3cc66e24ace934f84ad123aa75c4dfe7b2c6282db95f346dc973d92ec3f059344d562a5a607132ebd0bd9ba7065e52a525eebee34b2093ea11fe66e4721a4cfca98df93282634b7472a5ae0fdc2bdd2ec034aba181ef2ddfc3ac97ea2106b78f2db183c3655c3bf8825ef275141762a66e7d3e4e00ebb299d72b369b851b8eef4605cc6c7676d368f625d55cd35a110b826b3beb03fc3a8ba2fe51611e1d1108be86ca068afb56446230b373ec5e1ac47b2bc9e8e51b6f7144a5856c9f5191abfd9b1ca1d629273e0c81e482fc625ad871837dece6aa00ad51d55381687c35c5daf6cfd8e49b397140c2c20f02539309dd05e0afa94ea6d0dac9102236cefabb07cbd40676f7c950b97aaa2821cbfee97fd3e8797a0ef2c9f167fbd3ad1937a4ab5738ef5c00297dbf2d80c510e06836f9c39305d38517f0819e70402d670dc69cac75568dc62ebc96b444ad13475dc1ac10b3ba14bdc2c524819f0dce8116aa95601b13c986e88fa9034a9d92cc8fb9a02f354fef85fbbc734765dd61099c04f7270eb7c4c80fa4f4907bb96578ad5555f53d3af4f8f0a031d0745e52898908e14020279a8fb1c7d0cc4b05681d2d29e3371b5c3c3538ba68f2eb076ad25d250a867c867cf54a2fa55548e0d9b906b32dde0971052362657865d06507d79886392454b673f77fb2e939aa54dbf557b7b8d73f6e848656ba14a219df61f7920198c44cf75da8982a00676bff5258333abcae23bd28726cb7b53b8ed5eb04db748bd9039448db9b7ee381d1599b7924c157e035ad3031c91d524bbfa790f88ab0a488d7751dd561b957644e238f1038f6d2d705bdf94bfa88e89ca03acac1f699871b3460a449b50c96472c14d1ad69c970be8ed473fdf4b10283310e8deb00dc10ca8a96c02170cb790eee6b3cb4afc2f3b60a5ad757b321a35b75edd4b27456e34f27bf9e3f6d6245e0e0518a30b84a3c8de2a217c76f747467b76c0b1fad5bda66fa80b9772dbb185a67ff1fcd78cca249d47d712f8e215bdcf0cefb67a94db8fa4b7fe7d98b588b4ec1a3c018e21af2740f57b2ae8222b13b9ac872edfe163e82ddc96adacbb8ebc816063e7cbc0d2d61ad3113cd1addcf86d40b51e30330d6d94ffae64fb1793899be8a3846dc4df708c5ea3f4888ec5436023ad5d03efeb826b91a4869a309df145bc1fb230267b5843880c4c3a53b82678685f289cb3fc2a6dd7cb4c29cb30392c4c106c9ab766d7094ae6e9612a774921ad92d09521420a8adead49c7bb3de824842eff622f9a0a4d05e1bd812f16aea4e1cd24a7b4c6e680d9820061349d6e70988353174206696093c7c610491e4e5eeaed3a0da4dab58a1ab28ff561977be054a399ad94d8b10b5e906b434a0027d38c909bbd270f3b100984581d483b2d7965646a9bdfe42f6353f78d879bd2900ad142d4920c45a129caae7637553eefc4003e6a016e14d59df19fea39434aad6cf81d89ba1c693a9e72a275dfdbf321866adc45896310edf4b551d49b42ade09ffc561d0cd16714cbe39e2bffb7126fe8bdd2f2d87f6d6f7953da19e24b8acf9f4bdb98d259a2c027b95295deda6a3ed66d8dd25c388ede56405ee217952ef9168b0c6e23d364f7005dd8a0a15f52946ebb55352cba9f45556de1c9db9cdff9e2ad93a79a6c7827819ed337c916956b90ede2c0a414e23742606e31b8efce57622d34a2bcbfc3b9af7ad86326d9bd810fac05c3c694a0c392c14a91cb1599da9cd92363a77e91716a6760b7680aeaff0e8757eb87ec527fe0bd8eff8a377df27c46a08ba00a04e69b5d37ee53abf9e09513744e5945d513db4b37257d7e9bba6694c2294fcf14848da98912c5ead8f12d6ef4e5168440f67265959b57e589b23e662156ea54f2b5a5f332ea9a14078a0adbfde44eabf8b81a371e864e1acacc1c7feca2e43c578b3c100176c570f80c3ff3239759b52fbd9338e63433abd2c77f8b8bce1559a613de04b54a09ab2ebae1ba0f6a32f353f155b442512f6692c2b80c185915184d0ae709e48c0a799e15b5f25fc3ce15b4bbbf9deb0d9b814d0dd3e0067f84a03f500f1dbc880ce918faa38299cf6a2386dd049664498dae22ef3ea28c9ae508af3ba2401b125d090dbe6ecbd895834188de774c14f1e68ea98fe0cbbbffa04ed2e34972cde0341795fe8b0f99b7ddb663757a6323483761ea58cb824d81f333fb5f2e8ddb3c9714fa8c0f0a3e6fbe18702fe31e04dc5cd612ac7dcdfaa20c15bf50fff6cdb2d39302f32792d0bd26de7456199d80ba767ca4025b4da09ff0945d2282c8bd45eb8d0a9ecc4ae9ee10f901f58cdbfa3aca002e65044d8ceda3c2efce2045bec60036dd59225bd105312647aad92fd9409ca79bceb747d70c4baa181fe4e3d0420831d67b809b0ee0d87277b65eb113d6c785492d61818b321d60d5dc751223b9d7f5c0137b61c252b8037e95906dffc42d2be22f75aff0bda2cf1a972add370598e032819a93d7b955745e04998419e6bf2cf2e05bf26372f1fb790a7d4a83ee088bea4a6dc39c601482762553a7a476cff27f081bcfb25677917012e052c65a21f4f2f9f4c146042693f78e20792fa65220ef9765326dd5ee5f99ea8743d56ce737c51133d5a9729e6e85a01e7ef647ea51858f49c82e80b73bb51fb3417bd466705d4925df9c09d5d5b8286db9ee3ac4773761238e6429bd358d8f9f05eeb02592f14bc3f932a361e4c96233c5e106ab99f91bcf53a2cb6a23ebedae0c0a6354a431969ab53c25a844523256f37a2e5cd30de2fb6d4de31d300da3c65037e957cf9179208528e4f74d2e79156b466755babd4faf072fe7bc5e274c9a55b8096f4be6c3d9751a33b106c0605b7d3e667c2bb2fa8db2fcfcc1927f350e8e0014604d42b8e2bbb63188b6b7289858581f7f5599be2a7443110043d28533003fb16fd8fd228aa58f1c7a0e6e74b9549c540844d431ac816c2b1cc5df99de3b8b7caf5fdf4e533dc7f127672e0126ac45bbfb90b7b5ecffd549b16141df12ec5f2a6f8040108ee38ffc372aa13f72e699b34640c928cb73518f4dd134d6b648f6854fcf03467b61fe22423d5560ad93e23b96384f7f19beab3ec92145c968f178c4a9be9d10aea000d999de89f58b2eb670d008b69ce44b452cba0566d4fb143955ab5761da3dd55b6eec2f258a7fc09af1e9762495c6bd72dca7e70b4ecec421469e3313ef9b800c510e0408f07c639654b10b0a9e1bb08165ddd916a5542bbf46a842a743959c93c57f3958cdf61264c7a9a97aa43a7dedd3926e933c3acc0230153f69051ffcd6fb148ee972e332c45cdd520872d28b6331db94959951f05a25444ac67ec5843ac19f7aca691de8223aa9a2403b30c6a0c9fc9071ab5bba9a5e37d5db2579796fe9dc37869576c7632f2cee885bd03149f79da74d91824930cba8394abdfa01877823355f555fd5ef58b62f566878e947ec71dc17ecb47300c9735b598354b33139ad4ed164386f4953163f3dd6d8dd20b8054efe3d4706f31ce13d41ec6c70552b02622dc49ee94f0ddcd2c89568a20f189469bec4906e80b094eac1f88ef950d4c171494f14afdadce0974ed3333e4b6684f9f1a6fc76d6f"}) (async, rerun: 64) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 64) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x3}, 0x3) (async) r2 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r2, &(0x7f0000000180)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e21, 0x0, @private1}}, 0x24) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000400)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r2, 0x0, &(0x7f00000006c0)={0x0, 0xfffffffffffffe15, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x10}}, 0x0) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, r0, &(0x7f00000000c0)={0x40002, 0x2, 0x2}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x23456}, 0x0) (async) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/kcm\x00') (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) [ 1134.920585][T30038] netlink: 'syz-executor.1': attribute type 54 has an invalid length. [ 1135.019820][T30043] can0 (unregistered): slcan off ptm2. [ 1135.028189][T30053] ptm ptm1: ldisc open failed (-12), clearing slot 1 [ 1136.836845][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1136.836865][ T3656] Bluetooth: hci6: command 0x1003 tx timeout 16:11:31 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_mreqsrc(r0, 0x0, 0x0, 0x0, 0x0) 16:11:31 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0x2) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f00000000c0)={0x8, r0, 0x1}) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000040)={0x105, 0xfff, 0x6, 0x7ffd, 0xb, "73e59fd5bf9b00"}) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000140)=0x2b) 16:11:31 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x38}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:31 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xf000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:31 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x400448dd, 0x0) 16:11:31 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, &(0x7f0000000000)='0', 0xfffffd2c) (async) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(0xffffffffffffffff, 0x5437, 0x0) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000240)={0x20, 0x1, 0x5, 0x83, 0x10, "46819cec6447be86645dec9a3c042ee16bfe8b"}) ioctl$BTRFS_IOC_SNAP_DESTROY(r0, 0x5000940f, &(0x7f0000000700)={{}, "cf43375057618b24e729ad567d914f42b594416de6ad3007264e9d213a217bbf0300ea7595afac093c29f7f898ed4377a74072f196f0abd1d265d2e005dd7c15372e83028131a6bab0d72d10c7a04a19cbd2084a40b22096ebfabcf94a49ba91763fcaaf1811d7dd31d3b8816f595d5aba4bb06b7f5f6a22caa58deb8c19aa6634753af89f0e6e71a4de4f0304177ad5e237be46ac4629a27cb3455fc9cabaf655133c9935500cfa4b45e2c4db8b95f0f25682fd749d26284ae8eb3a6114ab8ac6120cd9d2c1cac58652d5cd720910f3e7cc854001bb500c9cc3397115a11b464e43fcf52f94aaa9cff0cd96d9ab55331f32d8c21687a895fab879704fa4425b1860dc623e0948ef5b8a75040d584d51991f01129441648eeabc79676efaf080428924b60d008afced87df95fae8f6d193769b7a264c5e186e28fbf3cf81a1b68458ec962a7d15d17f2a64c731d92c99bca735cab08d019873f182257c5bc1f162f3545f15de14dce19d2aea0cf6373a193d1742f945210367f6d1c879a07a391725b3f4443cd52e7157f006f91c468663d4b521da29394bb33e0ddae465404bfd5080846fb23184761cab8b167f6d407560b993b93f225043f7e8044fc3ada342c6d6093c4fab6de86e65bf20f6cb2753bd5450ef25eddcdc65dba20712270a270a11fa4b2a16ce4d125f33071e2cf250831c70ed4ec6f388081eae62d0caab01f589f746277975081e746c4399c5b45bb3eb542f67552f32cd237ef5f6a263484310ea1ba7eee154f8c75346472c02f3a51a017dc7a6308849ec1c7dcad37ac8eb240cbdf59ed14b99dbdf423a32d33b66290da481dd7805a174d23de994fbdcf3f78d2b3cb2e8c2214800b7cb9d7685a4613b0d46e63a2a7fbf640c88b53a3a04b3acf2a64f5e2d5eef69b5bd172179891749e4f00da8934437f6e476317eb4e7d7365280e4ea22e14fd57a2e7f0c1e069ac13790481d7e3216f6d4d110e4803f0fd2a5901c5423fb78585dac1d67eef3325569a67175127659f2d9cb5d009d8eb5f35f5d9691bb2b69dfb982e80a42e650bd4175cd9382927229fec21582068d1c52c0f94811396acdf939f7c1bc0284f2fd946c50c45df359d680ee248bc7678dbd15fa2ddc81089b958806ea892fce8412a66cb38aa48e6adcf5628e7a45f09b4a952770762156dfc6c7d3fef2ada0ae3a93658a9889c4092a8385964b3318c96716ed7139027aa6812a8a3a2d1ade068ccf90ca9da53b88b7fba74ce000a95b6f3b9742d3c10a14b94c025a49b0d57edaf851bebd862852beeb57739b7a652042c6f9c18dd2f70c68cf110fee25eab188c4531958dca507cb303c1fe2ff7366b0a04c6d2abba81d23ed0b0b2a2297820917c793834af5c4f2f8d8e5348da1e777913ed5e3cd027d530e1f51c0d452b08f1d99a94ad0c9054d45facde55ac36ac07073f943b02e1e89a86b028ae2c021d591e34a8b09216f1cbce79b0383d98d2f4c3fd93832c2b37acd4c1678491cb87ce203d709415daaa2a7af11119440c8d03dbd3a019d04c171fb2154dffd626188985b1bf97e3f044297927fffe83797f4620ddb93b7fe314cc44839f1ff1e6df9cf6c1da30625f89c78cdee83702bc82233bd721f956c8fcefe27aa3f861aabd936e1c8cb1cae269284207d2235d5e23bcf97220a56610894f91d2aaf02a373c5c3a472c62f47c94951640cece11d78ddc5763cdb7924a6be96ceb3a58661ae73f7868698a97a0d29aba245462fd54374b06625c0e23a5f7aaf0ffa5ebea5ebcc679fe6682704f962ca409e06a7ab8902100284cb2b1f9f807bc406ebecf485a251b8907876c724f25bb95083caf292c665ae376e878279ccc9da4e89f6b62ef6d6beb4ecaf8cb48c452a4cb307ff1017da78959235aa3c64248fba53f7e5fe0a450a50bd94102ebf3310a35b6d1ab42282e06d54644c393e3a584f8184db352b61b2d1398610d5b23be8d401598cdb82f3fc489eaba1ba80a262571d51f43e6e8ee74717adff4984308da2ef2f22654001a757e922fc75ee6582132bc3e30f75a1592faccf608c8c198f695dc8cb0b8ab235de7540d5c8f4d48c9127cae7a9476d8f13e21701dba166e2afb34ee2d0e90b3a5948a2be345a2c05ecf61cadaf3cc66e24ace934f84ad123aa75c4dfe7b2c6282db95f346dc973d92ec3f059344d562a5a607132ebd0bd9ba7065e52a525eebee34b2093ea11fe66e4721a4cfca98df93282634b7472a5ae0fdc2bdd2ec034aba181ef2ddfc3ac97ea2106b78f2db183c3655c3bf8825ef275141762a66e7d3e4e00ebb299d72b369b851b8eef4605cc6c7676d368f625d55cd35a110b826b3beb03fc3a8ba2fe51611e1d1108be86ca068afb56446230b373ec5e1ac47b2bc9e8e51b6f7144a5856c9f5191abfd9b1ca1d629273e0c81e482fc625ad871837dece6aa00ad51d55381687c35c5daf6cfd8e49b397140c2c20f02539309dd05e0afa94ea6d0dac9102236cefabb07cbd40676f7c950b97aaa2821cbfee97fd3e8797a0ef2c9f167fbd3ad1937a4ab5738ef5c00297dbf2d80c510e06836f9c39305d38517f0819e70402d670dc69cac75568dc62ebc96b444ad13475dc1ac10b3ba14bdc2c524819f0dce8116aa95601b13c986e88fa9034a9d92cc8fb9a02f354fef85fbbc734765dd61099c04f7270eb7c4c80fa4f4907bb96578ad5555f53d3af4f8f0a031d0745e52898908e14020279a8fb1c7d0cc4b05681d2d29e3371b5c3c3538ba68f2eb076ad25d250a867c867cf54a2fa55548e0d9b906b32dde0971052362657865d06507d79886392454b673f77fb2e939aa54dbf557b7b8d73f6e848656ba14a219df61f7920198c44cf75da8982a00676bff5258333abcae23bd28726cb7b53b8ed5eb04db748bd9039448db9b7ee381d1599b7924c157e035ad3031c91d524bbfa790f88ab0a488d7751dd561b957644e238f1038f6d2d705bdf94bfa88e89ca03acac1f699871b3460a449b50c96472c14d1ad69c970be8ed473fdf4b10283310e8deb00dc10ca8a96c02170cb790eee6b3cb4afc2f3b60a5ad757b321a35b75edd4b27456e34f27bf9e3f6d6245e0e0518a30b84a3c8de2a217c76f747467b76c0b1fad5bda66fa80b9772dbb185a67ff1fcd78cca249d47d712f8e215bdcf0cefb67a94db8fa4b7fe7d98b588b4ec1a3c018e21af2740f57b2ae8222b13b9ac872edfe163e82ddc96adacbb8ebc816063e7cbc0d2d61ad3113cd1addcf86d40b51e30330d6d94ffae64fb1793899be8a3846dc4df708c5ea3f4888ec5436023ad5d03efeb826b91a4869a309df145bc1fb230267b5843880c4c3a53b82678685f289cb3fc2a6dd7cb4c29cb30392c4c106c9ab766d7094ae6e9612a774921ad92d09521420a8adead49c7bb3de824842eff622f9a0a4d05e1bd812f16aea4e1cd24a7b4c6e680d9820061349d6e70988353174206696093c7c610491e4e5eeaed3a0da4dab58a1ab28ff561977be054a399ad94d8b10b5e906b434a0027d38c909bbd270f3b100984581d483b2d7965646a9bdfe42f6353f78d879bd2900ad142d4920c45a129caae7637553eefc4003e6a016e14d59df19fea39434aad6cf81d89ba1c693a9e72a275dfdbf321866adc45896310edf4b551d49b42ade09ffc561d0cd16714cbe39e2bffb7126fe8bdd2f2d87f6d6f7953da19e24b8acf9f4bdb98d259a2c027b95295deda6a3ed66d8dd25c388ede56405ee217952ef9168b0c6e23d364f7005dd8a0a15f52946ebb55352cba9f45556de1c9db9cdff9e2ad93a79a6c7827819ed337c916956b90ede2c0a414e23742606e31b8efce57622d34a2bcbfc3b9af7ad86326d9bd810fac05c3c694a0c392c14a91cb1599da9cd92363a77e91716a6760b7680aeaff0e8757eb87ec527fe0bd8eff8a377df27c46a08ba00a04e69b5d37ee53abf9e09513744e5945d513db4b37257d7e9bba6694c2294fcf14848da98912c5ead8f12d6ef4e5168440f67265959b57e589b23e662156ea54f2b5a5f332ea9a14078a0adbfde44eabf8b81a371e864e1acacc1c7feca2e43c578b3c100176c570f80c3ff3239759b52fbd9338e63433abd2c77f8b8bce1559a613de04b54a09ab2ebae1ba0f6a32f353f155b442512f6692c2b80c185915184d0ae709e48c0a799e15b5f25fc3ce15b4bbbf9deb0d9b814d0dd3e0067f84a03f500f1dbc880ce918faa38299cf6a2386dd049664498dae22ef3ea28c9ae508af3ba2401b125d090dbe6ecbd895834188de774c14f1e68ea98fe0cbbbffa04ed2e34972cde0341795fe8b0f99b7ddb663757a6323483761ea58cb824d81f333fb5f2e8ddb3c9714fa8c0f0a3e6fbe18702fe31e04dc5cd612ac7dcdfaa20c15bf50fff6cdb2d39302f32792d0bd26de7456199d80ba767ca4025b4da09ff0945d2282c8bd45eb8d0a9ecc4ae9ee10f901f58cdbfa3aca002e65044d8ceda3c2efce2045bec60036dd59225bd105312647aad92fd9409ca79bceb747d70c4baa181fe4e3d0420831d67b809b0ee0d87277b65eb113d6c785492d61818b321d60d5dc751223b9d7f5c0137b61c252b8037e95906dffc42d2be22f75aff0bda2cf1a972add370598e032819a93d7b955745e04998419e6bf2cf2e05bf26372f1fb790a7d4a83ee088bea4a6dc39c601482762553a7a476cff27f081bcfb25677917012e052c65a21f4f2f9f4c146042693f78e20792fa65220ef9765326dd5ee5f99ea8743d56ce737c51133d5a9729e6e85a01e7ef647ea51858f49c82e80b73bb51fb3417bd466705d4925df9c09d5d5b8286db9ee3ac4773761238e6429bd358d8f9f05eeb02592f14bc3f932a361e4c96233c5e106ab99f91bcf53a2cb6a23ebedae0c0a6354a431969ab53c25a844523256f37a2e5cd30de2fb6d4de31d300da3c65037e957cf9179208528e4f74d2e79156b466755babd4faf072fe7bc5e274c9a55b8096f4be6c3d9751a33b106c0605b7d3e667c2bb2fa8db2fcfcc1927f350e8e0014604d42b8e2bbb63188b6b7289858581f7f5599be2a7443110043d28533003fb16fd8fd228aa58f1c7a0e6e74b9549c540844d431ac816c2b1cc5df99de3b8b7caf5fdf4e533dc7f127672e0126ac45bbfb90b7b5ecffd549b16141df12ec5f2a6f8040108ee38ffc372aa13f72e699b34640c928cb73518f4dd134d6b648f6854fcf03467b61fe22423d5560ad93e23b96384f7f19beab3ec92145c968f178c4a9be9d10aea000d999de89f58b2eb670d008b69ce44b452cba0566d4fb143955ab5761da3dd55b6eec2f258a7fc09af1e9762495c6bd72dca7e70b4ecec421469e3313ef9b800c510e0408f07c639654b10b0a9e1bb08165ddd916a5542bbf46a842a743959c93c57f3958cdf61264c7a9a97aa43a7dedd3926e933c3acc0230153f69051ffcd6fb148ee972e332c45cdd520872d28b6331db94959951f05a25444ac67ec5843ac19f7aca691de8223aa9a2403b30c6a0c9fc9071ab5bba9a5e37d5db2579796fe9dc37869576c7632f2cee885bd03149f79da74d91824930cba8394abdfa01877823355f555fd5ef58b62f566878e947ec71dc17ecb47300c9735b598354b33139ad4ed164386f4953163f3dd6d8dd20b8054efe3d4706f31ce13d41ec6c70552b02622dc49ee94f0ddcd2c89568a20f189469bec4906e80b094eac1f88ef950d4c171494f14afdadce0974ed3333e4b6684f9f1a6fc76d6f"}) (async, rerun: 32) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 32) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) (async, rerun: 64) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x3}, 0x3) (async, rerun: 64) r2 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r2, &(0x7f0000000180)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e21, 0x0, @private1}}, 0x24) (async) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000400)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r2, 0x0, &(0x7f00000006c0)={0x0, 0xfffffffffffffe15, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x10}}, 0x0) (async, rerun: 64) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000140)=@IORING_OP_OPENAT2={0x1c, 0x3, 0x0, r0, &(0x7f00000000c0)={0x40002, 0x2, 0x2}, &(0x7f0000000100)='./file0\x00', 0x18, 0x0, 0x23456}, 0x0) (async, rerun: 64) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='net/kcm\x00') ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:11:31 executing program 5: openat$pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x18000, 0x0) [ 1136.996883][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1136.998568][T19718] Bluetooth: hci7: command 0x1003 tx timeout 16:11:31 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x30000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:31 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x101743) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$TCGETS(r1, 0x5401, &(0x7f0000000100)) ioctl$KDADDIO(r3, 0x400455c8, 0x4) ioctl$TIOCSTI(r3, 0x5437, 0x0) 16:11:31 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xf0ffff, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:31 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0) [ 1137.042340][T30100] netlink: 52 bytes leftover after parsing attributes in process `syz-executor.1'. [ 1137.072826][T19718] Bluetooth: hci6: sending frame failed (-49) [ 1137.079321][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:11:31 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x38}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:31 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x1000000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1137.103319][T30116] can0: slcan on ptm1. [ 1137.112387][ T3656] Bluetooth: hci8: sending frame failed (-49) [ 1137.118624][T19718] Bluetooth: hci8: Opcode 0x1003 failed: -49 [ 1137.374214][T24123] IPv6: ADDRCONF(NETDEV_CHANGE): can0: link becomes ready [ 1139.156875][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1139.157119][T19718] Bluetooth: hci7: command 0x1003 tx timeout 16:11:33 executing program 5: r0 = epoll_create1(0x0) dup(r0) 16:11:33 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x400454ca, 0x0) 16:11:33 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x2000000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:33 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x101743) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$TCGETS(r1, 0x5401, &(0x7f0000000100)) ioctl$KDADDIO(r3, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) 16:11:33 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:33 executing program 5: r0 = creat(&(0x7f0000000840)='./file0\x00', 0x0) ioctl$RNDADDENTROPY(r0, 0x40085203, 0x0) 16:11:33 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = syz_open_pts(r0, 0x229800) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) syz_io_uring_setup(0x884, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d3000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x3}, 0x3) r4 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r4, &(0x7f0000000180)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e21, 0x0, @private1}}, 0x24) syz_io_uring_submit(r2, r3, &(0x7f0000000400)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r4, 0x0, &(0x7f00000006c0)={0x0, 0xfffffffffffffe15, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x10}}, 0x0) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000240)=0x10) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f00000000c0)=@IORING_OP_STATX={0x15, 0x4, 0x0, r5, &(0x7f0000000140), &(0x7f0000000040)='./file0\x00', 0x10, 0x800, 0x1, {0x0, r6}}, 0x831) 16:11:33 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x2}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:33 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x3000000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1139.217037][T30117] can0 (unregistered): slcan off ptm1. [ 1139.255046][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:33 executing program 5: pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x0) r1 = creat(&(0x7f0000000840)='./file0\x00', 0x0) r2 = dup3(r1, r0, 0x0) dup(r2) [ 1139.289476][T30168] can0: slcan on ptm2. 16:11:33 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x4000000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:33 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x3}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:33 executing program 5: r0 = creat(&(0x7f0000000840)='./file0\x00', 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') dup3(r0, r1, 0x0) [ 1139.350661][T30168] can0 (unregistered): slcan off ptm2. 16:11:35 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x40049409, 0x0) 16:11:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x5000000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:35 executing program 5: openat$thread_pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x10000, 0x0) 16:11:35 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x4}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:35 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x101743) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$TCGETS(r1, 0x5401, &(0x7f0000000100)) (async) ioctl$KDADDIO(r3, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) 16:11:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = syz_open_pts(r0, 0x229800) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) syz_io_uring_setup(0x884, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d3000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x3}, 0x3) r4 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r4, &(0x7f0000000180)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e21, 0x0, @private1}}, 0x24) (async, rerun: 64) syz_io_uring_submit(r2, r3, &(0x7f0000000400)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r4, 0x0, &(0x7f00000006c0)={0x0, 0xfffffffffffffe15, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x10}}, 0x0) (async, rerun: 64) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000240)=0x10) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f00000000c0)=@IORING_OP_STATX={0x15, 0x4, 0x0, r5, &(0x7f0000000140), &(0x7f0000000040)='./file0\x00', 0x10, 0x800, 0x1, {0x0, r6}}, 0x831) [ 1141.316934][T19718] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1141.317023][ T3656] Bluetooth: hci7: command 0x1003 tx timeout [ 1141.323233][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1141.329277][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:11:35 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:36 executing program 5: openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0xc0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200840, 0x1) [ 1141.374513][T30243] can0: slcan on ptm0. 16:11:36 executing program 5: openat$incfs(0xffffffffffffff9c, &(0x7f0000000000)='.pending_reads\x00', 0x2041, 0x2) 16:11:36 executing program 5: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48003, 0x0) [ 1141.431418][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) [ 1141.454617][T19718] Bluetooth: hci7: sending frame failed (-49) [ 1141.461495][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -49 16:11:36 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x6000000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:36 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = syz_open_pts(r0, 0x229800) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) syz_io_uring_setup(0x884, &(0x7f0000000080), &(0x7f0000ee7000/0x2000)=nil, &(0x7f00006d3000/0x4000)=nil, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) (async) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x40, &(0x7f0000000140)=0x307e, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_CLOSE={0x13, 0x3}, 0x3) r4 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r4, &(0x7f0000000180)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e21, 0x0, @private1}}, 0x24) (async, rerun: 32) syz_io_uring_submit(r2, r3, &(0x7f0000000400)=@IORING_OP_SENDMSG={0x9, 0x0, 0x0, r4, 0x0, &(0x7f00000006c0)={0x0, 0xfffffffffffffe15, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x10}}, 0x0) (async, rerun: 32) r5 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000240)=0x10) (async) r6 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, r3, &(0x7f00000000c0)=@IORING_OP_STATX={0x15, 0x4, 0x0, r5, &(0x7f0000000140), &(0x7f0000000040)='./file0\x00', 0x10, 0x800, 0x1, {0x0, r6}}, 0x831) [ 1141.477189][T30242] can0 (unregistered): slcan off ptm0. 16:11:36 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x40086602, 0x0) 16:11:36 executing program 5: r0 = creat(&(0x7f0000000840)='./file0\x00', 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, 0x0) 16:11:36 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x6}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:36 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x7000000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:36 executing program 5: pipe2(&(0x7f0000000300)={0xffffffffffffffff}, 0x0) fchownat(r0, &(0x7f0000002100)='\x00', 0xee00, 0x0, 0x1000) [ 1141.575450][T30275] can0: slcan on ptm0. [ 1141.580106][ T5905] Bluetooth: hci7: Frame reassembly failed (-84) [ 1141.659597][T30276] can0 (unregistered): slcan off ptm0. 16:11:38 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) r2 = signalfd4(r1, &(0x7f0000000240)={[0x67]}, 0x8, 0x800) recvfrom$rxrpc(r2, &(0x7f0000000300)=""/185, 0xb9, 0x40000001, &(0x7f0000000280)=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e21, 0xe73c, @empty, 0x3}}, 0x24) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) r4 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r4, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r4, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r4, 0x5608) write$6lowpan_enable(r4, &(0x7f0000000000)='1', 0x1) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xf) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f0000000180)={0x0, 0x1, r1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f00000003c0)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r3, 0xc02064c3, &(0x7f0000000200)={&(0x7f00000001c0)=[r7, 0x0, 0x0, r9, 0x0, r8], 0x0, 0x6, 0x2}) ioctl$KDADDIO(r6, 0x400455c8, 0x4) ioctl$TIOCSTI(r6, 0x5437, 0x0) 16:11:38 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x7}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:38 executing program 5: r0 = socket$can_j1939(0x1d, 0x2, 0x7) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000080)={0x1d, r2, 0x0, {}, 0xfe}, 0x18) bind$can_j1939(r1, &(0x7f00000000c0)={0x1d, r2}, 0x18) 16:11:38 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x9000000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x13) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$TIOCL_SELLOADLUT(r0, 0x541c, &(0x7f0000000000)={0x5, 0x1, 0x7, 0x3, 0x8}) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r3, 0x5607) r4 = socket$xdp(0x2c, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r3, 0xc0189379, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r4, @ANYBLOB="00000300000000002e2f66696c653000"]) 16:11:38 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x9}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1143.476899][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1143.476949][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:11:38 executing program 5: r0 = syz_clone(0xc88aa00, &(0x7f0000000000)="d0", 0x1, &(0x7f0000000100), &(0x7f0000000140), 0x0) getresuid(&(0x7f0000000280), 0x0, &(0x7f0000000300)) getpgid(r0) msgctl$IPC_SET(0x0, 0x1, &(0x7f00000004c0)={{0x3, 0x0, 0x0, 0x0, 0xee00, 0x85, 0x8}, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x100}) futex_waitv(&(0x7f0000000b00)=[{0x0, 0x0, 0x82}, {0x0, &(0x7f0000000780), 0x80}, {0x0, &(0x7f0000000840)}, {0x8001, &(0x7f0000000880)=0x6}, {0x80000000, &(0x7f00000008c0), 0x4}, {0x0, &(0x7f0000000900)=0x65a}, {0x0, 0x0, 0x2}, {0x0, &(0x7f00000009c0)=0x1, 0x80}, {0x89ebda6, 0x0}, {0x7fff, &(0x7f0000000a40)}], 0xa, 0x0, 0x0, 0x1) r1 = msgget$private(0x0, 0x0) msgctl$MSG_STAT_ANY(r1, 0xd, 0x0) syz_clone(0x8001000, &(0x7f0000000d40), 0x0, &(0x7f0000000e40), &(0x7f0000000e80), &(0x7f0000000ec0)) [ 1143.523179][T19718] Bluetooth: hci6: sending frame failed (-49) [ 1143.529691][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1143.590364][T19718] Bluetooth: hci6: sending frame failed (-49) [ 1143.596532][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:11:38 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x40186366, 0x0) 16:11:38 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xf000000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x13) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$TIOCL_SELLOADLUT(r0, 0x541c, &(0x7f0000000000)={0x5, 0x1, 0x7, 0x3, 0x8}) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) (async) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r3, 0x5607) r4 = socket$xdp(0x2c, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r3, 0xc0189379, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r4, @ANYBLOB="00000300000000002e2f66696c653000"]) 16:11:38 executing program 5: r0 = syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)) 16:11:38 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0xf}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:38 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) r2 = signalfd4(r1, &(0x7f0000000240)={[0x67]}, 0x8, 0x800) recvfrom$rxrpc(r2, &(0x7f0000000300)=""/185, 0xb9, 0x40000001, &(0x7f0000000280)=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e21, 0xe73c, @empty, 0x3}}, 0x24) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) r4 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r4, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r4, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r4, 0x5608) (async) write$6lowpan_enable(r4, &(0x7f0000000000)='1', 0x1) (async) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xf) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r3}) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f0000000180)={0x0, 0x1, r1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f00000003c0)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r3, 0xc02064c3, &(0x7f0000000200)={&(0x7f00000001c0)=[r7, 0x0, 0x0, r9, 0x0, r8], 0x0, 0x6, 0x2}) (async) ioctl$KDADDIO(r6, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r6, 0x5437, 0x0) 16:11:38 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x1a000000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:38 executing program 5: syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) msgctl$IPC_SET(0x0, 0x1, 0x0) [ 1143.636875][ T3647] Bluetooth: hci7: command 0x1003 tx timeout [ 1143.636926][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1143.675073][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:38 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0x3}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:38 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0x18}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:38 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x3f000000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1143.730463][ T5903] Bluetooth: hci7: Frame reassembly failed (-84) [ 1143.746988][T30357] netlink: 44 bytes leftover after parsing attributes in process `syz-executor.1'. 16:11:38 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) r2 = signalfd4(r1, &(0x7f0000000240)={[0x67]}, 0x8, 0x800) recvfrom$rxrpc(r2, &(0x7f0000000300)=""/185, 0xb9, 0x40000001, &(0x7f0000000280)=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e21, 0xe73c, @empty, 0x3}}, 0x24) (async, rerun: 64) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000000c0), 0x800, 0x0) (async, rerun: 64) r4 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r4, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async, rerun: 64) statx(r4, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (rerun: 64) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) ioctl$VT_DISALLOCATE(r4, 0x5608) write$6lowpan_enable(r4, &(0x7f0000000000)='1', 0x1) (async, rerun: 64) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 64) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xf) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f0000000140)={0x0, 0x1, r3}) (async) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r1, 0xc01064c2, &(0x7f0000000180)={0x0, 0x1, r1}) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r4, 0xc01064c2, &(0x7f00000003c0)={0x0, 0x1, r3}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r3, 0xc02064c3, &(0x7f0000000200)={&(0x7f00000001c0)=[r7, 0x0, 0x0, r9, 0x0, r8], 0x0, 0x6, 0x2}) ioctl$KDADDIO(r6, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r6, 0x5437, 0x0) [ 1143.800086][T30362] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1145.716884][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1145.716895][ T3656] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:11:40 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x401c5820, 0x0) 16:11:40 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x8b0b0000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:40 executing program 5: msgctl$IPC_INFO(0x0, 0x3, &(0x7f0000000280)=""/41) 16:11:40 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0x28}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:40 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0xfffffffffffffffe, 0x161101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) getresuid(&(0x7f0000000140)=0x0, &(0x7f0000000180), &(0x7f00000001c0)) r4 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r4, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r4, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x802004, &(0x7f0000000200)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@allow_other}, {@allow_other}, {@blksize}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x2}}, {@allow_other}, {@blksize={'blksize', 0x3d, 0xc00}}, {@blksize={'blksize', 0x3d, 0x1200}}, {@max_read={'max_read', 0x3d, 0x4cd0ae9c}}], [{@appraise}, {@fowner_gt={'fowner>', 0xee01}}, {@obj_role}, {@appraise_type}, {@context={'context', 0x3d, 'sysadm_u'}}, {@permit_directio}]}}) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async, rerun: 64) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x13) (rerun: 64) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) ioctl$TIOCL_SELLOADLUT(r0, 0x541c, &(0x7f0000000000)={0x5, 0x1, 0x7, 0x3, 0x8}) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) (async) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r3, 0x5607) (async, rerun: 32) r4 = socket$xdp(0x2c, 0x3, 0x0) (rerun: 32) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r3, 0xc0189379, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r4, @ANYBLOB="00000300000000002e2f66696c653000"]) 16:11:40 executing program 5: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0x401870cb, 0x0) [ 1145.796952][ T3656] Bluetooth: hci7: command 0x1003 tx timeout [ 1145.796975][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:11:40 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0x2c}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:40 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x8d0b0000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1145.842132][T30377] netlink: 'syz-executor.1': attribute type 5 has an invalid length. [ 1145.858646][ T3656] Bluetooth: hci7: sending frame failed (-49) [ 1145.864814][T19718] Bluetooth: hci7: Opcode 0x1003 failed: -49 [ 1145.872874][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) fcntl$setsig(r0, 0xa, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x9) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) ioctl$TIOCGDEV(r2, 0x80045432, &(0x7f0000000040)) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:11:40 executing program 5: r0 = syz_clone(0xc88aa00, &(0x7f0000000000)="d02a6bd59ae461d5fc1a11d779d468dc24eb2f985b2418a89e6736cf65d928ca2cc0ca85dfa0300cab9e73716cc06b6f18cbc76e5543544a58dc516c3f2a60ac3be1dcb9380a96478998dc2e5aaccf4837c48fbfd56c383d3c1f5e91b98d88cd44064e552010836b34b210a126bf9145f43b9ee73f064c3b73e0cff0364ffa5cb0b33dd735d27c10cffc3312acc6c50529f80c80306a52c8c76c62e1fa1a6a811ac7756bf89b0f5fe8a5e44eea821e1e72f797ef3fc5f60a96063ca3c272a781f4f939a18aa5562c47f75f3c595f0ab9eeb1709c9f04898267728a93d9571ae71d49cba7ed7c4e716ca49d5ff0", 0xed, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)="b73afc92ca9e512f5637a4282048fb0a975c21dbaa21590f3c2d1e7483263d75648689b6119d40d1f59b95916773be1ee31b72148e48fac6ed7af337fcca443bdff50f73345ca66e83c4686d7d032f441f150ea6de7fa6962b3f02f5a3edf3203265b9b01f56f4de81adffc6e0ba2193179221a907f1157a902be3210378c6428be3d84e658d05075fd867efb1fd7a42b11feb08b0538527adff156f51b55ca171bee6e3976029025eec96f8f0fed08b9ee1abbc0ef9f210101089983acf478e766547913f8b5feddee1e09ef0f11254febe998b91f55be4fd8d7447c63d4570d68c1552d5169ce597275dbf0eaa9068340c9d04ead8482fb1f122c0a8c375") r1 = msgget$private(0x0, 0x188) r2 = getegid() getresuid(&(0x7f0000000280), &(0x7f00000002c0)=0x0, &(0x7f0000000300)) r4 = getpgid(r0) r5 = syz_clone(0x401000, &(0x7f0000000340)="fa8167a204a6512c72b63a51a5584c49f5040bec2f3891c86b83095b102c7979cb99d35ecac842b1066340530930d694ed2a761b8c97385aaac97d2b20f90631b898664127c35f4b744ee4f94a1850a2ca9d11657ed596e49676cbfd743e708e05a072e4e52db13c3ec5e6c705d62bd434dd6ea476f083480b5f9263a413cff743ed22c537a29ce96576f0cdb244aa10ac0c8c41c28bea35087c3fa6e431537c560c7408680193b6d7023fe2b4b3109ba26ca6285e29", 0xb6, &(0x7f0000000400), &(0x7f0000000440), &(0x7f0000000480)="b32c57ddded805b205") msgctl$IPC_SET(r1, 0x1, &(0x7f00000004c0)={{0x3, 0x0, r2, r3, 0xee00, 0x85, 0x8}, 0x0, 0x0, 0x8, 0xffff, 0x1, 0x100, 0x80, 0x4, 0x9a8, 0x80, r4, r5}) ptrace$peeksig(0x4209, r0, &(0x7f0000000540)={0x7fffffff, 0x0, 0x2}, &(0x7f0000000580)=[{}, {}]) msgctl$MSG_STAT_ANY(r1, 0xd, &(0x7f0000000680)=""/114) futex_waitv(&(0x7f0000000b00)=[{0xffff, &(0x7f0000000700)=0x800, 0x2}, {0x5, &(0x7f0000000740)=0xb11, 0x82}, {0x7, &(0x7f0000000780)=0x5f, 0x80}, {0x1, &(0x7f00000007c0)=0x1f, 0x82}, {0x4, &(0x7f0000000800)=0x7, 0x2}, {0x6, &(0x7f0000000840)=0x9, 0x2}, {0x8001, &(0x7f0000000880)=0x6}, {0x80000000, &(0x7f00000008c0)=0xff, 0x4}, {0x40, &(0x7f0000000900)=0x65a, 0x2}, {0x4, &(0x7f0000000940)=0xcf, 0x2}, {0x2, &(0x7f0000000980)=0x5, 0x2}, {0x1399, &(0x7f00000009c0)=0x1, 0x80}, {0x89ebda6, &(0x7f0000000a00), 0x82}, {0x7fff, &(0x7f0000000a40)=0x1000, 0x82}, {0x80000000, &(0x7f0000000a80)=0x9, 0x2}, {0xa1fa, &(0x7f0000000ac0)=0x71ca, 0x82}], 0x10, 0x0, &(0x7f0000000c80)={0x0, 0x3938700}, 0x1) r6 = msgget$private(0x0, 0x410) msgctl$MSG_STAT_ANY(r6, 0xd, &(0x7f0000000cc0)=""/85) syz_clone(0x8001000, &(0x7f0000000d40)="adf38c2d9e8fa66a8fb4f6105f262ffa544914c4417b6da395e72fe0054424b4743598207ec7b4e74ca8a76efb2e5b0e9e8091d8d0c2bd8accfdc541ec857bf569e1c9531d38a1d8e633689b7f6a23c1715460bfbbbb39720c0aab1917eb93d72a55f47d04e4f60eb5cc791ccf020f652058abaac5311f3699c64897300a766016d5d0d9e293cbfa3e18362a990a686de67b7f8ea9d4f1160c45b169a58249bab31a328af3fe2a2f35dd4b515f1b3be039b6b8a798e65fa2e884f75da7e297d6b9bbebbddf7e9dad2e4ff0f881d7bfcd77de50deee306b616e02cd0bf8c004e5dea0b9b9383ae9fc49fd", 0xea, &(0x7f0000000e40), &(0x7f0000000e80), &(0x7f0000000ec0)="455e68b462b53e5dc7149965d8708d2f2e15e9c819e17f3ec6ece6a9ee0070fe1ef9d3c8801d30df1ae611bb4fce8dca9172c200b7e42bf752221842e8a7f2aac600011f7381a1512185d3ec2aba6775224bcb8167093bdb4361abb52b436b34b9d7a3f89fe12c20f898937628961fc639585321c4ce6784d68767f37e3916664708a9ce15e0bfbee87bd3224f2b94ab8beb0cf834d6879298f27ea2a199ac") 16:11:40 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x3}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1145.908418][ T3656] Bluetooth: hci7: sending frame failed (-49) [ 1145.914809][T19718] Bluetooth: hci7: Opcode 0x1003 failed: -49 [ 1145.935262][T30389] netlink: 'syz-executor.1': attribute type 5 has an invalid length. 16:11:40 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x4020940d, 0x0) 16:11:40 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x9effffff, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:40 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x18}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1145.965331][T30395] netlink: 'syz-executor.1': attribute type 3 has an invalid length. 16:11:40 executing program 5: futex_waitv(&(0x7f0000000b00)=[{0x0, &(0x7f0000000700), 0x2}], 0x1, 0x0, &(0x7f0000000c80)={0x0, 0x3938700}, 0x0) [ 1146.013054][T30400] netlink: 'syz-executor.1': attribute type 24 has an invalid length. 16:11:42 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0xfffffffffffffffe, 0x161101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) getresuid(&(0x7f0000000140)=0x0, &(0x7f0000000180), &(0x7f00000001c0)) (async) r4 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r4, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r4, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x802004, &(0x7f0000000200)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@allow_other}, {@allow_other}, {@blksize}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x2}}, {@allow_other}, {@blksize={'blksize', 0x3d, 0xc00}}, {@blksize={'blksize', 0x3d, 0x1200}}, {@max_read={'max_read', 0x3d, 0x4cd0ae9c}}], [{@appraise}, {@fowner_gt={'fowner>', 0xee01}}, {@obj_role}, {@appraise_type}, {@context={'context', 0x3d, 'sysadm_u'}}, {@permit_directio}]}}) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:42 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xf0ffffff, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:42 executing program 5: futex_waitv(&(0x7f0000000b00)=[{0x0, 0x0, 0x2}], 0x1, 0x0, &(0x7f0000000c80)={0x0, 0x3938700}, 0x1) 16:11:42 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x34}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1147.877127][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1147.883512][ T3647] Bluetooth: hci6: command tx timeout [ 1147.908887][T30411] netlink: 'syz-executor.1': attribute type 52 has an invalid length. 16:11:42 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x38}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1147.922695][T30414] ptm ptm0: ldisc open failed (-12), clearing slot 0 16:11:42 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) fcntl$setsig(r0, 0xa, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x9) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) ioctl$TIOCGDEV(r2, 0x80045432, &(0x7f0000000040)) ioctl$TIOCSTI(r0, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) fcntl$setsig(r0, 0xa, 0x2) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x9) (async) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) (async) ioctl$TIOCGDEV(r2, 0x80045432, &(0x7f0000000040)) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) 16:11:42 executing program 5: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@enum={0x1}]}, {0x0, [0x5f]}}, &(0x7f0000000100)=""/235, 0x27, 0xeb, 0x1}, 0x20) 16:11:42 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xfcffffff, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:42 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async, rerun: 64) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0xfffffffffffffffe, 0x161101) (rerun: 64) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) getresuid(&(0x7f0000000140)=0x0, &(0x7f0000000180), &(0x7f00000001c0)) (async) r4 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r4, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r4, 0x0, 0x400, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r4, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r5, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x802004, &(0x7f0000000200)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xc000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@allow_other}, {@allow_other}, {@blksize}, {@allow_other}, {@max_read={'max_read', 0x3d, 0x2}}, {@allow_other}, {@blksize={'blksize', 0x3d, 0xc00}}, {@blksize={'blksize', 0x3d, 0x1200}}, {@max_read={'max_read', 0x3d, 0x4cd0ae9c}}], [{@appraise}, {@fowner_gt={'fowner>', 0xee01}}, {@obj_role}, {@appraise_type}, {@context={'context', 0x3d, 'sysadm_u'}}, {@permit_directio}]}}) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:42 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x2}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:42 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x80045432, 0x0) 16:11:42 executing program 5: msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000ac0)={{0x1, 0x0, 0xffffffffffffffff}}) 16:11:42 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xfffff000, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1148.036885][ T3647] Bluetooth: hci8: command 0x1003 tx timeout [ 1148.046893][ T3656] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1148.049155][T19716] Bluetooth: hci7: command 0x1003 tx timeout [ 1148.053119][T19718] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:11:42 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x3}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:42 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xffffff7f, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:42 executing program 5: r0 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0x401070ca, 0x0) [ 1148.129571][ T3656] Bluetooth: hci6: sending frame failed (-49) [ 1148.135842][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:11:42 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000005c0), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8}, {0x8}]}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_TIMEOUT={0xc}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x2}]}, 0x4c}}, 0x0) 16:11:42 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) fcntl$setsig(r0, 0xa, 0x2) (async, rerun: 32) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x9) (async, rerun: 32) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) ioctl$TIOCGDEV(r2, 0x80045432, &(0x7f0000000040)) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) [ 1148.174793][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) [ 1148.196466][T30450] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1148.210991][T30450] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. 16:11:42 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x4}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:42 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x1c1101) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x2) r0 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) dup(r0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x81) ioctl$TIOCSTI(0xffffffffffffffff, 0x5437, 0x0) 16:11:42 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xffffff9e, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1148.226129][ T5904] Bluetooth: hci7: Frame reassembly failed (-84) 16:11:42 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x5}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1148.274373][ T5904] Bluetooth: hci8: Frame reassembly failed (-84) 16:11:44 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x80045440, 0x0) 16:11:44 executing program 5: r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x24) 16:11:44 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xfffffff0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:44 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x6}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:44 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x7}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:44 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r0, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000a40)={0x14, 0x0, 0x1}, 0x14}}, 0x0) 16:11:44 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xfffffffc, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1150.196832][ T3647] Bluetooth: hci6: command 0x1003 tx timeout [ 1150.196844][T19718] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:11:44 executing program 5: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8983, 0x0) 16:11:44 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x1c1101) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x2) (async) r0 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) dup(r0) (async) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x4) (async, rerun: 64) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 64) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x81) (async) ioctl$TIOCSTI(0xffffffffffffffff, 0x5437, 0x0) 16:11:44 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x9}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:44 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0xffffffff, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$KDSETKEYCODE(r0, 0x4b4d, &(0x7f0000000000)={0x4, 0x4}) [ 1150.276893][T19716] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1150.276895][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1150.276945][T19716] Bluetooth: hci8: command tx timeout [ 1150.283066][ T3656] Bluetooth: hci7: command tx timeout [ 1150.351128][ T3656] Bluetooth: hci6: sending frame failed (-49) [ 1150.357319][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1150.362007][T30484] can0: slcan on ptm1. 16:11:45 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x80086301, 0x0) 16:11:45 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xf}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:45 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x5}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:45 executing program 5: pipe(&(0x7f0000000100)={0xffffffffffffffff}) ioctl$sock_inet6_tcp_SIOCINQ(r0, 0x5421, 0x0) 16:11:45 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x7}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:45 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xf0}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:45 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000005c0), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, 0x0, 0x1, [{0x8}, {0x8}]}, @NBD_ATTR_SIZE_BYTES={0xc}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2}, @NBD_ATTR_CLIENT_FLAGS={0xc}]}, 0x4c}}, 0x0) [ 1150.431279][T30488] ptm ptm23: ldisc open failed (-12), clearing slot 23 [ 1150.468881][T30484] can0 (unregistered): slcan off ptm1. 16:11:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) ioctl$KDSETKEYCODE(r0, 0x4b4d, &(0x7f0000000000)={0x4, 0x4}) 16:11:45 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x1c1101) (async) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x2) (async) r0 = openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) dup(r0) (async) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x81) (async) ioctl$TIOCSTI(0xffffffffffffffff, 0x5437, 0x0) 16:11:45 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x300}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1150.521643][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) [ 1150.533432][T30511] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1150.560824][T30516] can0: slcan on ptm1. [ 1150.565679][T19718] Bluetooth: hci7: sending frame failed (-49) 16:11:45 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_tcp_TLS_RX(r0, 0x29, 0x2, 0x0, 0x300) 16:11:45 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x8}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1150.571860][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -49 [ 1150.580148][T30511] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. [ 1150.677176][T30519] can0 (unregistered): slcan off ptm1. 16:11:47 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x80086601, 0x0) 16:11:47 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x500}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:47 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x12c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x760}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x800000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x297}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x200}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xfffe}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x5dde4e8722f63e24}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x10000}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x757}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7fffffff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x9}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7fff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x802}, 0x404c8c6) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:47 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x22}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:47 executing program 5: r0 = syz_open_dev$ndb(&(0x7f0000001740), 0x0, 0x0) ioctl$NBD_SET_BLKSIZE(r0, 0xc0101282, 0x0) 16:11:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$KDSETKEYCODE(r0, 0x4b4d, &(0x7f0000000000)={0x4, 0x4}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) ioctl$KDSETKEYCODE(r0, 0x4b4d, &(0x7f0000000000)={0x4, 0x4}) (async) 16:11:47 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r1) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x38, r2, 0x117, 0x0, 0x0, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xa17f}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x20}]}, 0x38}}, 0x0) [ 1152.596873][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1152.596899][ T3656] Bluetooth: hci6: command 0x1003 tx timeout 16:11:47 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:47 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x2}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:47 executing program 5: futex(&(0x7f0000000180), 0x3, 0x0, 0x0, &(0x7f0000000280), 0x0) 16:11:47 executing program 5: r0 = getpgrp(0x0) sched_rr_get_interval(r0, &(0x7f0000000280)) 16:11:47 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x600}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1152.694733][T30571] can0: slcan on ptm0. [ 1152.701651][ T3734] Bluetooth: hci7: Frame reassembly failed (-84) [ 1152.798584][T30588] can0 (unregistered): slcan off ptm0. 16:11:49 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x801c581f, 0x0) 16:11:49 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x3}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1154.676907][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1154.686895][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:11:49 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x12c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x760}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x800000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x297}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x200}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xfffe}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x5dde4e8722f63e24}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x10000}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x757}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7fffffff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x9}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7fff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x802}, 0x404c8c6) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x12c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x760}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x800000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x297}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x200}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xfffe}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x5dde4e8722f63e24}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x10000}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x757}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7fffffff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x9}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7fff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x802}, 0x404c8c6) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) 16:11:49 executing program 5: clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) futex(&(0x7f00000001c0)=0x1, 0x6, 0x0, &(0x7f0000000200)={r0, r1+60000000}, 0x0, 0x0) 16:11:49 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x700}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:49 executing program 2: read(0xffffffffffffffff, &(0x7f0000000040)=""/37, 0x25) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x525006, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000040), 0x10) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000507000004000000000000000000", @ANYRES32=r4, @ANYBLOB="00000000000000004b581dfc8f280012000c1f01ed9aa9cf3bc99610822dbca27a337bfb97767a188c10a1adeb72eaded5991a7028583b9989bdffc1448b91a29770e3cf60769aac1b3923e2f338211fb9f7c1079f3ef8bce055e2bc63327605fd3ee3e49bd54bd502748278ff136ab37548d81d35c8d1068ac089963b4dfaa803ff33fe9e999bf4"], 0x48}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000980)=@deltclass={0x460, 0x29, 0x100, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff1, 0xfff3}, {0xc, 0x4}, {0x10, 0xf}}, [@tclass_kind_options=@c_taprio={0xb}, @tclass_kind_options=@c_sfq={0x8}, @TCA_RATE={0x6, 0x5, {0xb2, 0x5d}}, @tclass_kind_options=@c_cbs={0x8}, @tclass_kind_options=@c_cbq={{0x8}, {0x408, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0xe3, 0x81, 0xfff, 0x8, 0x33, 0x5e, 0x7ff, 0x1000, 0x458, 0x100, 0x6, 0x8, 0xffff, 0x7fff, 0x8000, 0x295, 0x1, 0x100, 0xfff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89bd, 0x2, 0x4, 0x7fff, 0x5, 0x1, 0x6, 0x80000001, 0x2, 0xffff, 0xfc9, 0x7, 0xfffffffe, 0x0, 0x1000, 0x4, 0x3, 0x3, 0x200, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x1, 0x7fffffff, 0x1, 0x1, 0x0, 0x73d, 0x4, 0x8, 0xff, 0x9, 0xffffffff, 0xea9, 0x6, 0x1, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, 0x40, 0x9, 0x7, 0x2, 0x9, 0xfffffff9, 0x4, 0x3, 0x3, 0x44, 0x7fffffff, 0x9, 0x10000, 0x1000, 0x8eb, 0x70, 0x8, 0x5, 0x15, 0xffff, 0xfffffff9, 0x7, 0x8, 0x2, 0x81, 0x2, 0x2, 0x8000, 0x5, 0x5b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffe01]}]}}, @TCA_RATE={0x6, 0x5, {0x5, 0xbb}}]}, 0x460}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000002c0)={'gre0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="86705f76746930b644b11c037d059200", @ANYRES32=r4, @ANYBLOB="780000000000000000000000450000140000000000009078ffffffffe0000002"]}) r6 = fsmount(0xffffffffffffffff, 0x0, 0x7a) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000340)={'syztnl0\x00', &(0x7f00000003c0)={'tunl0\x00', r5, 0x20, 0x20, 0x3ff, 0x759d, {{0x9, 0x4, 0x3, 0x30, 0x24, 0x64, 0x0, 0x65, 0x2f, 0x0, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@noop, @timestamp={0x44, 0xc, 0xd1, 0x0, 0x3, [0xfffffff8, 0x400]}]}}}}}) bind$can_raw(r1, &(0x7f0000000000)={0x1d, r4}, 0x10) sendmsg$xdp(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x2c, 0xb, r4, 0x2c}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000180)="fcdd5d6f53d4926cdb331caac3e668f473735ec88d425f52bc3cb8a715c1af4369a863ae4e0338c56252260b90a3df7ab02cdbc40601a2ae", 0x38}], 0x1, 0x0, 0x0, 0x14}, 0xcffd3e31aa48d3a0) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000000)=0x5) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r7, 0x5437, 0x0) 16:11:49 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x4}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1154.726233][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) [ 1154.756943][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1154.757588][T19718] Bluetooth: hci7: command 0x1003 tx timeout 16:11:49 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x900}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:49 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x5}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:49 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xb8b}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:49 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_PMKSA(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {{0x15}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @random="76b74b8d40b6"}]}, 0x28}}, 0x0) [ 1154.793350][T30647] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.2'. 16:11:49 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x6}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1154.870704][T30647] mkiss: ax0: crc mode is auto. [ 1154.928488][T30647] can0: slcan on ptm1. [ 1154.967247][T30647] can0 (unregistered): slcan off ptm1. 16:11:51 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0xc0045878, 0x0) 16:11:51 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xf00}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1156.756905][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1156.758063][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1156.794998][ T9631] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:51 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x12c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x760}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x800000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x297}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x200}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xfffe}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x5dde4e8722f63e24}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x10000}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x757}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7fffffff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x9}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7fff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x802}, 0x404c8c6) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x12c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x760}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x800000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x297}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x200}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xfffe}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x5dde4e8722f63e24}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x10000}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x4}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x757}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7fffffff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x9}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7fff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x802}, 0x404c8c6) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) 16:11:51 executing program 5: getresgid(&(0x7f0000000b80), 0x0, 0x0) 16:11:51 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x7}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:51 executing program 2: read(0xffffffffffffffff, &(0x7f0000000040)=""/37, 0x25) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x525006, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000040), 0x10) (async) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000507000004000000000000000000", @ANYRES32=r4, @ANYBLOB="00000000000000004b581dfc8f280012000c1f01ed9aa9cf3bc99610822dbca27a337bfb97767a188c10a1adeb72eaded5991a7028583b9989bdffc1448b91a29770e3cf60769aac1b3923e2f338211fb9f7c1079f3ef8bce055e2bc63327605fd3ee3e49bd54bd502748278ff136ab37548d81d35c8d1068ac089963b4dfaa803ff33fe9e999bf4"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000980)=@deltclass={0x460, 0x29, 0x100, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff1, 0xfff3}, {0xc, 0x4}, {0x10, 0xf}}, [@tclass_kind_options=@c_taprio={0xb}, @tclass_kind_options=@c_sfq={0x8}, @TCA_RATE={0x6, 0x5, {0xb2, 0x5d}}, @tclass_kind_options=@c_cbs={0x8}, @tclass_kind_options=@c_cbq={{0x8}, {0x408, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0xe3, 0x81, 0xfff, 0x8, 0x33, 0x5e, 0x7ff, 0x1000, 0x458, 0x100, 0x6, 0x8, 0xffff, 0x7fff, 0x8000, 0x295, 0x1, 0x100, 0xfff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89bd, 0x2, 0x4, 0x7fff, 0x5, 0x1, 0x6, 0x80000001, 0x2, 0xffff, 0xfc9, 0x7, 0xfffffffe, 0x0, 0x1000, 0x4, 0x3, 0x3, 0x200, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x1, 0x7fffffff, 0x1, 0x1, 0x0, 0x73d, 0x4, 0x8, 0xff, 0x9, 0xffffffff, 0xea9, 0x6, 0x1, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, 0x40, 0x9, 0x7, 0x2, 0x9, 0xfffffff9, 0x4, 0x3, 0x3, 0x44, 0x7fffffff, 0x9, 0x10000, 0x1000, 0x8eb, 0x70, 0x8, 0x5, 0x15, 0xffff, 0xfffffff9, 0x7, 0x8, 0x2, 0x81, 0x2, 0x2, 0x8000, 0x5, 0x5b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffe01]}]}}, @TCA_RATE={0x6, 0x5, {0x5, 0xbb}}]}, 0x460}}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000002c0)={'gre0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="86705f76746930b644b11c037d059200", @ANYRES32=r4, @ANYBLOB="780000000000000000000000450000140000000000009078ffffffffe0000002"]}) (async) r6 = fsmount(0xffffffffffffffff, 0x0, 0x7a) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000340)={'syztnl0\x00', &(0x7f00000003c0)={'tunl0\x00', r5, 0x20, 0x20, 0x3ff, 0x759d, {{0x9, 0x4, 0x3, 0x30, 0x24, 0x64, 0x0, 0x65, 0x2f, 0x0, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@noop, @timestamp={0x44, 0xc, 0xd1, 0x0, 0x3, [0xfffffff8, 0x400]}]}}}}}) (async) bind$can_raw(r1, &(0x7f0000000000)={0x1d, r4}, 0x10) (async, rerun: 32) sendmsg$xdp(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x2c, 0xb, r4, 0x2c}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000180)="fcdd5d6f53d4926cdb331caac3e668f473735ec88d425f52bc3cb8a715c1af4369a863ae4e0338c56252260b90a3df7ab02cdbc40601a2ae", 0x38}], 0x1, 0x0, 0x0, 0x14}, 0xcffd3e31aa48d3a0) (async, rerun: 32) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000000)=0x5) (async) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r7, 0x5437, 0x0) 16:11:51 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x3f00}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:51 executing program 5: socketpair(0x1d, 0x0, 0x400, &(0x7f0000000200)) 16:11:51 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x8b0b}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:51 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x9}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1156.916911][T19718] Bluetooth: hci7: command 0x1003 tx timeout [ 1156.926952][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1156.956344][T30682] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.2'. 16:11:51 executing program 5: timer_settime(0x0, 0x0, &(0x7f0000000080), &(0x7f00000000c0)) 16:11:51 executing program 2: read(0xffffffffffffffff, &(0x7f0000000040)=""/37, 0x25) (async) r0 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x525006, 0x0) (async) r1 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r1, &(0x7f0000000040), 0x10) (async) setsockopt$CAN_RAW_FILTER(r1, 0x65, 0x1, 0x0, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r3) (async) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="4800000010000507000004000000000000000000", @ANYRES32=r4, @ANYBLOB="00000000000000004b581dfc8f280012000c1f01ed9aa9cf3bc99610822dbca27a337bfb97767a188c10a1adeb72eaded5991a7028583b9989bdffc1448b91a29770e3cf60769aac1b3923e2f338211fb9f7c1079f3ef8bce055e2bc63327605fd3ee3e49bd54bd502748278ff136ab37548d81d35c8d1068ac089963b4dfaa803ff33fe9e999bf4"], 0x48}}, 0x0) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000980)=@deltclass={0x460, 0x29, 0x100, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xfff1, 0xfff3}, {0xc, 0x4}, {0x10, 0xf}}, [@tclass_kind_options=@c_taprio={0xb}, @tclass_kind_options=@c_sfq={0x8}, @TCA_RATE={0x6, 0x5, {0xb2, 0x5d}}, @tclass_kind_options=@c_cbs={0x8}, @tclass_kind_options=@c_cbq={{0x8}, {0x408, 0x2, [@TCA_CBQ_RTAB={0x404, 0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0xe3, 0x81, 0xfff, 0x8, 0x33, 0x5e, 0x7ff, 0x1000, 0x458, 0x100, 0x6, 0x8, 0xffff, 0x7fff, 0x8000, 0x295, 0x1, 0x100, 0xfff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89bd, 0x2, 0x4, 0x7fff, 0x5, 0x1, 0x6, 0x80000001, 0x2, 0xffff, 0xfc9, 0x7, 0xfffffffe, 0x0, 0x1000, 0x4, 0x3, 0x3, 0x200, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x1, 0x7fffffff, 0x1, 0x1, 0x0, 0x73d, 0x4, 0x8, 0xff, 0x9, 0xffffffff, 0xea9, 0x6, 0x1, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, 0x40, 0x9, 0x7, 0x2, 0x9, 0xfffffff9, 0x4, 0x3, 0x3, 0x44, 0x7fffffff, 0x9, 0x10000, 0x1000, 0x8eb, 0x70, 0x8, 0x5, 0x15, 0xffff, 0xfffffff9, 0x7, 0x8, 0x2, 0x81, 0x2, 0x2, 0x8000, 0x5, 0x5b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffe01]}]}}, @TCA_RATE={0x6, 0x5, {0x5, 0xbb}}]}, 0x460}}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f00000002c0)={'gre0\x00', &(0x7f0000000240)=ANY=[@ANYBLOB="86705f76746930b644b11c037d059200", @ANYRES32=r4, @ANYBLOB="780000000000000000000000450000140000000000009078ffffffffe0000002"]}) (async) r6 = fsmount(0xffffffffffffffff, 0x0, 0x7a) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000340)={'syztnl0\x00', &(0x7f00000003c0)={'tunl0\x00', r5, 0x20, 0x20, 0x3ff, 0x759d, {{0x9, 0x4, 0x3, 0x30, 0x24, 0x64, 0x0, 0x65, 0x2f, 0x0, @remote, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@noop, @timestamp={0x44, 0xc, 0xd1, 0x0, 0x3, [0xfffffff8, 0x400]}]}}}}}) (async) bind$can_raw(r1, &(0x7f0000000000)={0x1d, r4}, 0x10) sendmsg$xdp(r0, &(0x7f0000000200)={&(0x7f0000000140)={0x2c, 0xb, r4, 0x2c}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000180)="fcdd5d6f53d4926cdb331caac3e668f473735ec88d425f52bc3cb8a715c1af4369a863ae4e0338c56252260b90a3df7ab02cdbc40601a2ae", 0x38}], 0x1, 0x0, 0x0, 0x14}, 0xcffd3e31aa48d3a0) (async) r7 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000000)=0x5) ioctl$TIOCSETD(r7, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r7, 0x5437, 0x0) [ 1157.030003][ T3734] Bluetooth: hci7: Frame reassembly failed (-84) 16:11:53 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0xc0045878, 0x0) 16:11:53 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0xf}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1158.836877][ T3647] Bluetooth: hci6: command 0x1003 tx timeout [ 1158.836916][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1158.873251][ T5904] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:53 executing program 5: waitid(0x0, 0xffffffffffffffff, &(0x7f0000000080), 0x2, &(0x7f0000000100)) 16:11:53 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xf000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x111400, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xc280, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) 16:11:53 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r0, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(0xffffffffffffffff, 0x0, 0x400, 0x80, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f7b643d650a34b3007e3459111e103b0b1cd613c59e7520d403f1c87b74ff1727e70001467d0c55aba9ee040508ca2b5704e5b7f8dac6274bc96e69a442c4a70c00229351293548fb933182d6c44f363702f8f739cdb10e7d1bf5a4a662309c967036de35dacbe8c3f5644da4b2c47c4d34af21150db3178c88a7e5f83330b1dc92240d777c66a7435b0ada23c48857e7bd93eed410ec1f9393cff3c29bceda163049836b6c4dffffffffffff26f93981c2e2df9caba1b1d08f8bdeeae87ba3c748def59cbfcb4f7ecbd41d8d", @ANYRESDEC=r1, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r0, 0x5608) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000000c0)=0x0) write$P9_RGETLOCK(r0, &(0x7f0000000100)={0x1e, 0x37, 0x2, {0x0, 0x7b, 0x2, r2}}, 0x1e) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) r3 = openat$cgroup_ro(r0, &(0x7f0000000180)='cpuacct.usage_user\x00', 0x0, 0x0) statx(r3, &(0x7f00000001c0)='./file0/file0\x00', 0x2000, 0x40, &(0x7f0000000300)) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_clone(0x40800, &(0x7f0000000400)="9ad1c9067edf88c653f4c6233c6192881bb1b4755b4d980839177a992164dea3bec0dbb299ca55d29148b11095c0232f50b0c880acaec16d74df0c31d083fc07ad0c4bf3ebc8696002224af12bb76992844419c50d8cffd0f1991aaddd307e56e899f2c4e1a076d214d0f1de55d42e2a48fac88be3fabb37253ade4ca49a000cb270972da50c05125cf4884ce9ca8482626a4bdaa1892a13d3083373d964627d70034755f56c0a4003992e8571207e82f0d0c2", 0xb3, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000004c0)="196fc7e9e3f40a024a034cc12bb0fa2d063fae7cabe9a47d161a0293680308f9dc2a5111dd31c422b8f3616be27abf70fcee49839580d843ceb2e06d4e6832e0471ac113b2866e1cd600ce192b7361df40f360863ee4da92a7238876b99fb046e4b2d6b037dbba7912596a787ed1b1ec92e0eb4f974fd7cd664f72663176ef0c5af13b84a08066a4a8f59b6f46817b690a0597b2e766f2adaa0c8e858647cb500c35ae79f58f46d2cff40946d0fd65ae9064420b6ace23f119b105b0acb9eaee2f06cd070c21c006635fbf19b1c900a21662f891fe9b8e0656fc19") ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r4, 0x5437, 0x0) r5 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY(r5, 0x5000940f, &(0x7f0000000e00)={{r0}, "3bcb4a476300c8c6382b463b274167947c8c9e80470d8aeeb4f9e89eb99598287ff4f8eb6ef5a2dc3de021e8227c9e5750f2da996582e656e138bd39495fdad873b157586100c4b7eeaded90640d6028acdf2228a4289c7f4a944fc0d07e0381648ce909bacb5459737d1e2e50cef88c8efc2be5a92748084ba84d76a0731d364cd462e7c80f8e4b461004e2b51130299e3e95817dd594c62d086ce0536a1ffaa7eee53d18bbba5065e317096b8c261fc758ad5ef203c2b2abf059f87e5e25e68c9e901499ffa1c75ff2f30b2fed42e744039adbfc201376efdc6f0c9a52b945f9c3a337621c9774ff6523c4f7549bd4e31c44ee0e0931ce24431847fe955cb96578f8386195908a2dd03f934a33a0ec77a32dd854c213111ce9385bc44a00641774e77f72c7e8d3e130c84af55f64218e597287a19c510afb2b6662e0534e656665cac2677985859f116feb24ff1bec38eff6f7debe051d87515d1a920e01c6cd9b475cc87f4b4783f2adf57a800bd38da08c5a5a4dff767cea257fb5aeee5e45033d1f5fb385893b6a6668c2df490c68c3ab3b9089ee2227d4a0d873af14695c67d68d0cdf44445e470798ea905e1fb035c94e36489975ea385d3e1c5641494d70b0c91d82de4294cca280d842d908bda559010794ef36a8122beca3a9c1cd91b65334caf8238bb06082ea585ff49a4dc3216c671dc76b1eb2f5fb49c1ac78b09be70982a87fe04d15041e11665f7fb9c264681db17e588e2506dee03be7385afd19aad4c2cbe05b92614d990d2347a67a05b616981fb96518ef3c9bac804b066e314873636b0e91e8615cf699ed906284c38d0ff186c4f64e0ce3979a2457b783375af8a6853e48cd8d855bf9a27e526b1c8e69526e00416c90668a13a88ac8858bfb50fc293d569ed247fc54063e511f9da3a2450a66c2f8a3b0c79cb8bdbebf1b0c3c5440ddcf146405e6d4d8c1497e8f7bb6a95e8fd8ae07d716ee12c3ab993f83198ba20df20867ad0c15e3d04578555af1668b2aebe14243f4f57825dd208d221196e03647adf5e0fdd4d3600c2737d0095ebf51931d40d555785a9c8833013a28226d2c4f35bb60876fe174d05efada0d445a2ad1a70e837d374deb1e4ad7fe67be78de4b823036cc22222b3bf5d816cae839bbbccb9ffc9f52531d0a4ab267d2ad0c1e1f88dce691368064684a5c4051a5329052a92f5ff1525252095abd2423a07cb39536e2571638879bfbe55c8c1d0cb8a227812951cf5b5db9f239eb8e5552264f310ab686c6ef3536e43a0d2d98a2072568bd00b39a4bb96da41ce2051c28cbaa7831e4c7afe389f1acb4b7facb4171c82f2d2ff713e89aa55d90db57fb01f1e18186a3825722c29f6337f49ad019011ff718881c5cfb7328d38398b40e77efc694524a05223d02e1e9885c1dabffb9070be786698f123d2fc7e2b444af4ea21e989bb52b65b3970ad251813783c1975764ac73d7b7c8b92fe48128185ceb87eef67327e6c556400a91784cdf9357f521f0766ed4df8defb4e28e29a20fee73ea1b3eb5f85c93eda1e02cb71a8499192bd1148325a83eaf31ff5054dee8d0867fa657c741c651d20c156dc3dad5a2f90bd99c14c292fe70e1981490314ee8ec143489cfc35ff3a30434f7f00127740b8b6720465133463b3ba41582819103b1980dca19f64c87db1bf267a9f1f7a2edc1f885147b62d43b4174e40eafa1507fba96bcb38af1b666ec10791f44aa6902324e12ed2e95ffad8a24ef324597fa5658bdca5f8571633ac54870263bfa19deb2bf370212a1dbfac1a105959872ecdc891c70ed6c3d67d487ad575e6aed0ddd7bcca072cc19777642a411d59bc325ce8a60cc5a80ed9a98fea839db1a7ee71573d039b61cdb3e7c1e2b1e9a5d75748e3ccfe6566ca8b2eefcdb195f3301ce3f07075c130b70b62f75d4e166df3cf2c568608d740b958ab27f90fa2a612242fa5726b4da4579133cf057ed6c2b994e81448d09d2e0e4b429acd6712a5a1988a3a9dfd3856e15b310ad4ee75fc3ae34932b144407d788b3aaa3860055d426c39304423d2a0b499fdae476af8bcd92735682f7dadc2bb4ea703626d1702cbb59f2a73cc00e83e64f705826fb087596d0b9333c0498b31dcb3591c5321ccae79f1fbf15be7df9d02ad0dfe12a754263c5c357e3a3ffb2f52bcca77559ff60dae3b50bb74c680054d70d311888af596cdeef5e026f22caeedc16da7998aca6b5c545c6a2e8e9b77c61c36c8240eee9926eaeaac51a3ed95add2065a6873c465c2f7b9924554fe67fe6e1b5df8f5d0e81a3ecd8a3bd8879be07c001c75619e9a0d44a2a15d4642bd44eb99601b912874caa31f1ca4e9aa09bb91ecd68a3cc00838f7072bbfcddb16ed4690b3b001339498d72bfe795cbe1020254f1da0502e45cc75f653f9869af1637e5aaf3dadf3ea4ad423a5b0a7ff05c1babef523a8a61708b7f2f1e0c9c6e2925cb094ab602bf14a86d26300b836d768954a55016fd2feaa25c20538256cbfa5807daa748b3adce99372d8a2fb4ca81ac46c3468b1c6ce55086bbdcf81f6286306c418c8409a0b05a9e4bc86ad759b7bac31eaa37cd59c36f103d71ef9eb8c99c663bc9acdd43a10c1d0290016d5a1ab7260cdda87be80270206de2c82de0b4559ec26a3c20ae3239b8980911c18c4e536d8f0c3dfa4b1c5f1fb9781589a2f0354964139df2dd0f6f5eaaf7705552c66c4d61cfdcd3906f621d022a816b75df17d849ec0300427411cc3f58126986645cd044259a33140889957a1cfba03b97327829d340e43fd62230bff2b4a3ff3ac8b775a41d3b02819f0469ee364ff803990b03dcbf6524aff1d00c38f0ed812353d1a27a75111b48b8514dfab57a99218737a28cafd9ab637dcd70655b5ade7fa5fb8ddafc1cda70629d7a6bb43afd695b91bd73d259aee03bd37e96b824d34cf7679212fdb0c5faa301da0cd6edbda92713ea1ab3ac632a7ca24d420aa2bb83ff2d2c6de577c5e3c0cb32c00efb3e85eb96083652ebdfadc6c70410e17a230b80fd141b6a9dfa92e8456fe4711216645c858518bb9767290cbe21299bdf787e0710c3fdbf44a7a254360093e027d1b38ad9d0a2bdc665ff1d0de21d695ac553007d7ed128495d71f0aaf094a7f8e96c4612afd483a9b5b8f5623837a4755f4358334080ec2a8513214d459457e0774ef35eb82eb7a588acb290cfb888d7eab2226774a6a9c0e8b31f638b0916a25b558c5f0da38eaf5ba8ba7739e2c5977c9b767811a88f943673c2e30d08ce0a7016654fef68ba3ac087b39cf884eaa49718154be4f7fe33c93a5f6af18a32264df81800b14914bdc56e68c932e690446347fdcc630117e29606879df6d098d69d148ad9d4752193455e1bee556275d87ceacbafdc9353bfd1303481a3fd3044015477c18999250a4e5430340dd9bbcbcad1287a30bde5155bd63a4a2f10c754a914e543d970db03e5b4bf57c701013b4289d996b6781ea6c9d61f8aefaa4a4a0e1bf2c2e7bbf1d77c962989b4025634473dd9d61fedcfcec614d8aeda4ec14666958cbc47dd73c939f571cc45b6e9a9a6e49b552e95024814ebc9b5bb5023feb6028a6b5378a6eb35f97f5ebb9d739c07b825d185a8d6a3b7e43d35933582012fae14a04b528cce6b59a482d5c2acce4539cddaf40da4bcbc608b1d8b2ed3e3a830241828a35d22e3ba0a6ca3e278b44aa1caba7a275b2f057dbfb5c3e7602965ea7f9f5913dac34614d3f702512a7755421018b4d191fb03a8fb95590a9c7342d87b8922aeec029f0c03b2175c210390f8bb0ad3874aea05f1560b40e3c67974f1e41294e36a4940d778878d39b382d8a84211b1bfe7a1e6a57ff218d5fd3fc02e1fe1cd0964fd538f9e249bd0256d558f1807de5158eb6964dc996e26156c98a3c25feedb8436f8d2d2f9d7762d3ac46da550ba07211b6c8e2c715f25ddbb5c31bd6bf7ec5c684731f8acd225abe952b77f093c7cc1045d25a470f363965c084dcad5a508518c5cac46766d38aae24487e25420387c12e18ca7ea172ca2231c38978609acb22c686ef05bd51305be95ca9799bed16445d6031e9575ba85d409d601d75d09d6b6d8c0f4f998897fddc5db639147e9a7113609f7e100d15c9b8ebb92ff806e0c5282b744f41944af338b57245f8020e2b63cff77f43d4a836ffca8f86d54e8440f586dbb88f2d1272ac172be4813abc6004fc7756f57250f519663821786d2522dff0294d5548eae792a8cddfc7520c8352e88114221cb1427c1cd50a1a0035ca7409a98e9722af1df3dc01df21cd4f0df0c331d020a9fcad74faab17ec0950b07cf2be6f3736061204436c774e41592253e67bce7571c6fb904447967c52d533e9b87af59734998dd9ae224e9c274d718a1345b21c42e7e1077d14329329302b6085358eca001d54908b88ec61b0cf4c6183224acabf912bcc12036eb1165bd993f5662da33e9578c8c2fa8868034ac8d9b16f5882e1b8aae8bda7bafe3d4b7126bdb8bcda3ac9fa1d55c96870d242bc8b20ed4cf23ed275764b06f4c03de43c671476b1bd7b5fecd10c6637394b017498c18237f7052fa8c154011185bee6f0c1523bf78c1829d6593a67b37e918cd56d5fb97eedff101f152a51600ab62236842313a299e43cfa51f7cd82428ebee629896a5d9cd39a366d122d3b2d5861e31b785baaa3bbe22a37f91bb623da837f2ac4e1efec970a0224e6417947d4913e6b5dc8c58b87c8ac5481d4b57b91e19bda377201d7f88b531815c4213c447abd0eb732e3398f268437e1c21fe3154ae6e4534c4b8127ebc327ac62485b277743cf811def6d157e3647340297267d36a1bbfe4c6553eca4560da57044d8ed2c1083ae28c63c0d8fdcf356e2e9ce860e7999f12c5a3f945d0bcda6ce29f33bf519337a369aae329acbc22fb492e1e672319c98fdde1d65c8a08a4119ec17c6a67ef0a8111bb08ef2fc06878d1590103ffa5160d04bf4a1d1e2c2026a6fca5f56b500d1af0b1328e258d48770597208d186068b926787421b2cb4e18ea2d0c6dfa47d0531f98aaf46364d88f6ae65d9b876df82df412d04b0fb80602a9423590d537f44124728d78eacaae2c608db5467e416ec71ead23cda34b9399beec5b15c55a573c6192477167f3f29e4f5ee7b527b703087638d263c9b8ed2f9be2943c5b7d9a2b273719739e0168413a089b459db2a3b4f835124110e8a8eda7eea0bb1105a26e3d399fd6a7df42fe41c7c266ea623d950451913fe975a079986130ea17efecf8fe65a4cf8fd9746832feac278669c55b4f15a4f5e56ddd58e65b93dc0063702c6a10ca2de916374c971ef529f70206000a40d7939dbb9ae427b52eb8166b80a1dba86ceabff388b6adb321d0be1d5ee2ea139e59e6893db8c4087564538aa7d4d5fd2d72efc391b18b7edd24b7875ff3d28feaa58178a5eaa7c5d5cca89d91b7a6b5956eb0a35f8139925b03e6ab338b2f04638e693c70c42c0befd9afc073a9f0bcf0f372c3c86bbee7d749775df1fd152eccebd83816c55025e506e6df3cbeb3b1f7f406494aa992d98bcb2e08ccb82af1a8ba95ed6580d6b852af2b538f300cb1b29c065905f445600cba79b57cc28cbdc25507293c8512060f6d36d5d66bc89c43fa826792c277c9b6de595c24b1b011e36002099f98eee57521647e7aa451216c885a59ae06cb4e2efdf7bf483781a8da108dc36e3c9a26f0b73231e59263cb19d462d329c9800f151652b57d4645d4ee"}) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f00000005c0)={0x6, 0x8, 0x0, 0x8000}) 16:11:53 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x1a}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:53 executing program 5: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0xffffffff054) creat(&(0x7f0000000240)='./file0\x00', 0x0) 16:11:53 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1159.076890][ T3647] Bluetooth: hci7: command 0x1003 tx timeout [ 1159.076924][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:11:53 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x34000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1159.136443][ T3734] Bluetooth: hci8: Frame reassembly failed (-84) [ 1159.145661][T19718] Bluetooth: hci7: sending frame failed (-49) [ 1159.152353][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -49 16:11:53 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x400300}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:53 executing program 5: getpgid(0x0) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0), 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = syz_clone(0x8040000, &(0x7f0000000b80), 0x0, 0x0, 0x0, &(0x7f0000000cc0)="95") ptrace$getregset(0x4204, r0, 0x0, 0x0) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(0xffffffffffffffff, 0x0, 0x0) [ 1159.172558][ T28] audit: type=1800 audit(1665850313.757:198): pid=30729 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=1181 res=0 errno=0 [ 1159.210386][ T28] audit: type=1804 audit(1665850313.757:199): pid=30729 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.5" name="/root/syzkaller-testdir534553302/syzkaller.wt631a/1647/file0" dev="sda1" ino=1181 res=1 errno=0 [ 1159.237827][ T28] audit: type=1804 audit(1665850313.757:200): pid=30729 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.5" name="/root/syzkaller-testdir534553302/syzkaller.wt631a/1647/file0" dev="sda1" ino=1181 res=1 errno=0 16:11:55 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0xc0189436, 0x0) 16:11:55 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xf0ffff}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:55 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x2}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:55 executing program 5: getpgid(0x0) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0), 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = syz_clone(0x8040000, &(0x7f0000000b80), 0x0, 0x0, 0x0, &(0x7f0000000cc0)="95") ptrace$getregset(0x4204, r0, 0x0, 0x0) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(0xffffffffffffffff, 0x0, 0x0) [ 1160.916936][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1160.957717][ T5904] Bluetooth: hci6: Frame reassembly failed (-84) [ 1160.965421][ T5904] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x111400, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xc280, 0x0) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) 16:11:55 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r0, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(0xffffffffffffffff, 0x0, 0x400, 0x80, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f7b643d650a34b3007e3459111e103b0b1cd613c59e7520d403f1c87b74ff1727e70001467d0c55aba9ee040508ca2b5704e5b7f8dac6274bc96e69a442c4a70c00229351293548fb933182d6c44f363702f8f739cdb10e7d1bf5a4a662309c967036de35dacbe8c3f5644da4b2c47c4d34af21150db3178c88a7e5f83330b1dc92240d777c66a7435b0ada23c48857e7bd93eed410ec1f9393cff3c29bceda163049836b6c4dffffffffffff26f93981c2e2df9caba1b1d08f8bdeeae87ba3c748def59cbfcb4f7ecbd41d8d", @ANYRESDEC=r1, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r0, 0x5608) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000000c0)=0x0) write$P9_RGETLOCK(r0, &(0x7f0000000100)={0x1e, 0x37, 0x2, {0x0, 0x7b, 0x2, r2}}, 0x1e) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) r3 = openat$cgroup_ro(r0, &(0x7f0000000180)='cpuacct.usage_user\x00', 0x0, 0x0) statx(r3, &(0x7f00000001c0)='./file0/file0\x00', 0x2000, 0x40, &(0x7f0000000300)) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_clone(0x40800, &(0x7f0000000400)="9ad1c9067edf88c653f4c6233c6192881bb1b4755b4d980839177a992164dea3bec0dbb299ca55d29148b11095c0232f50b0c880acaec16d74df0c31d083fc07ad0c4bf3ebc8696002224af12bb76992844419c50d8cffd0f1991aaddd307e56e899f2c4e1a076d214d0f1de55d42e2a48fac88be3fabb37253ade4ca49a000cb270972da50c05125cf4884ce9ca8482626a4bdaa1892a13d3083373d964627d70034755f56c0a4003992e8571207e82f0d0c2", 0xb3, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000004c0)="196fc7e9e3f40a024a034cc12bb0fa2d063fae7cabe9a47d161a0293680308f9dc2a5111dd31c422b8f3616be27abf70fcee49839580d843ceb2e06d4e6832e0471ac113b2866e1cd600ce192b7361df40f360863ee4da92a7238876b99fb046e4b2d6b037dbba7912596a787ed1b1ec92e0eb4f974fd7cd664f72663176ef0c5af13b84a08066a4a8f59b6f46817b690a0597b2e766f2adaa0c8e858647cb500c35ae79f58f46d2cff40946d0fd65ae9064420b6ace23f119b105b0acb9eaee2f06cd070c21c006635fbf19b1c900a21662f891fe9b8e0656fc19") ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r4, 0x5437, 0x0) r5 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY(r5, 0x5000940f, &(0x7f0000000e00)={{r0}, "3bcb4a476300c8c6382b463b274167947c8c9e80470d8aeeb4f9e89eb99598287ff4f8eb6ef5a2dc3de021e8227c9e5750f2da996582e656e138bd39495fdad873b157586100c4b7eeaded90640d6028acdf2228a4289c7f4a944fc0d07e0381648ce909bacb5459737d1e2e50cef88c8efc2be5a92748084ba84d76a0731d364cd462e7c80f8e4b461004e2b51130299e3e95817dd594c62d086ce0536a1ffaa7eee53d18bbba5065e317096b8c261fc758ad5ef203c2b2abf059f87e5e25e68c9e901499ffa1c75ff2f30b2fed42e744039adbfc201376efdc6f0c9a52b945f9c3a337621c9774ff6523c4f7549bd4e31c44ee0e0931ce24431847fe955cb96578f8386195908a2dd03f934a33a0ec77a32dd854c213111ce9385bc44a00641774e77f72c7e8d3e130c84af55f64218e597287a19c510afb2b6662e0534e656665cac2677985859f116feb24ff1bec38eff6f7debe051d87515d1a920e01c6cd9b475cc87f4b4783f2adf57a800bd38da08c5a5a4dff767cea257fb5aeee5e45033d1f5fb385893b6a6668c2df490c68c3ab3b9089ee2227d4a0d873af14695c67d68d0cdf44445e470798ea905e1fb035c94e36489975ea385d3e1c5641494d70b0c91d82de4294cca280d842d908bda559010794ef36a8122beca3a9c1cd91b65334caf8238bb06082ea585ff49a4dc3216c671dc76b1eb2f5fb49c1ac78b09be70982a87fe04d15041e11665f7fb9c264681db17e588e2506dee03be7385afd19aad4c2cbe05b92614d990d2347a67a05b616981fb96518ef3c9bac804b066e314873636b0e91e8615cf699ed906284c38d0ff186c4f64e0ce3979a2457b783375af8a6853e48cd8d855bf9a27e526b1c8e69526e00416c90668a13a88ac8858bfb50fc293d569ed247fc54063e511f9da3a2450a66c2f8a3b0c79cb8bdbebf1b0c3c5440ddcf146405e6d4d8c1497e8f7bb6a95e8fd8ae07d716ee12c3ab993f83198ba20df20867ad0c15e3d04578555af1668b2aebe14243f4f57825dd208d221196e03647adf5e0fdd4d3600c2737d0095ebf51931d40d555785a9c8833013a28226d2c4f35bb60876fe174d05efada0d445a2ad1a70e837d374deb1e4ad7fe67be78de4b823036cc22222b3bf5d816cae839bbbccb9ffc9f52531d0a4ab267d2ad0c1e1f88dce691368064684a5c4051a5329052a92f5ff1525252095abd2423a07cb39536e2571638879bfbe55c8c1d0cb8a227812951cf5b5db9f239eb8e5552264f310ab686c6ef3536e43a0d2d98a2072568bd00b39a4bb96da41ce2051c28cbaa7831e4c7afe389f1acb4b7facb4171c82f2d2ff713e89aa55d90db57fb01f1e18186a3825722c29f6337f49ad019011ff718881c5cfb7328d38398b40e77efc694524a05223d02e1e9885c1dabffb9070be786698f123d2fc7e2b444af4ea21e989bb52b65b3970ad251813783c1975764ac73d7b7c8b92fe48128185ceb87eef67327e6c556400a91784cdf9357f521f0766ed4df8defb4e28e29a20fee73ea1b3eb5f85c93eda1e02cb71a8499192bd1148325a83eaf31ff5054dee8d0867fa657c741c651d20c156dc3dad5a2f90bd99c14c292fe70e1981490314ee8ec143489cfc35ff3a30434f7f00127740b8b6720465133463b3ba41582819103b1980dca19f64c87db1bf267a9f1f7a2edc1f885147b62d43b4174e40eafa1507fba96bcb38af1b666ec10791f44aa6902324e12ed2e95ffad8a24ef324597fa5658bdca5f8571633ac54870263bfa19deb2bf370212a1dbfac1a105959872ecdc891c70ed6c3d67d487ad575e6aed0ddd7bcca072cc19777642a411d59bc325ce8a60cc5a80ed9a98fea839db1a7ee71573d039b61cdb3e7c1e2b1e9a5d75748e3ccfe6566ca8b2eefcdb195f3301ce3f07075c130b70b62f75d4e166df3cf2c568608d740b958ab27f90fa2a612242fa5726b4da4579133cf057ed6c2b994e81448d09d2e0e4b429acd6712a5a1988a3a9dfd3856e15b310ad4ee75fc3ae34932b144407d788b3aaa3860055d426c39304423d2a0b499fdae476af8bcd92735682f7dadc2bb4ea703626d1702cbb59f2a73cc00e83e64f705826fb087596d0b9333c0498b31dcb3591c5321ccae79f1fbf15be7df9d02ad0dfe12a754263c5c357e3a3ffb2f52bcca77559ff60dae3b50bb74c680054d70d311888af596cdeef5e026f22caeedc16da7998aca6b5c545c6a2e8e9b77c61c36c8240eee9926eaeaac51a3ed95add2065a6873c465c2f7b9924554fe67fe6e1b5df8f5d0e81a3ecd8a3bd8879be07c001c75619e9a0d44a2a15d4642bd44eb99601b912874caa31f1ca4e9aa09bb91ecd68a3cc00838f7072bbfcddb16ed4690b3b001339498d72bfe795cbe1020254f1da0502e45cc75f653f9869af1637e5aaf3dadf3ea4ad423a5b0a7ff05c1babef523a8a61708b7f2f1e0c9c6e2925cb094ab602bf14a86d26300b836d768954a55016fd2feaa25c20538256cbfa5807daa748b3adce99372d8a2fb4ca81ac46c3468b1c6ce55086bbdcf81f6286306c418c8409a0b05a9e4bc86ad759b7bac31eaa37cd59c36f103d71ef9eb8c99c663bc9acdd43a10c1d0290016d5a1ab7260cdda87be80270206de2c82de0b4559ec26a3c20ae3239b8980911c18c4e536d8f0c3dfa4b1c5f1fb9781589a2f0354964139df2dd0f6f5eaaf7705552c66c4d61cfdcd3906f621d022a816b75df17d849ec0300427411cc3f58126986645cd044259a33140889957a1cfba03b97327829d340e43fd62230bff2b4a3ff3ac8b775a41d3b02819f0469ee364ff803990b03dcbf6524aff1d00c38f0ed812353d1a27a75111b48b8514dfab57a99218737a28cafd9ab637dcd70655b5ade7fa5fb8ddafc1cda70629d7a6bb43afd695b91bd73d259aee03bd37e96b824d34cf7679212fdb0c5faa301da0cd6edbda92713ea1ab3ac632a7ca24d420aa2bb83ff2d2c6de577c5e3c0cb32c00efb3e85eb96083652ebdfadc6c70410e17a230b80fd141b6a9dfa92e8456fe4711216645c858518bb9767290cbe21299bdf787e0710c3fdbf44a7a254360093e027d1b38ad9d0a2bdc665ff1d0de21d695ac553007d7ed128495d71f0aaf094a7f8e96c4612afd483a9b5b8f5623837a4755f4358334080ec2a8513214d459457e0774ef35eb82eb7a588acb290cfb888d7eab2226774a6a9c0e8b31f638b0916a25b558c5f0da38eaf5ba8ba7739e2c5977c9b767811a88f943673c2e30d08ce0a7016654fef68ba3ac087b39cf884eaa49718154be4f7fe33c93a5f6af18a32264df81800b14914bdc56e68c932e690446347fdcc630117e29606879df6d098d69d148ad9d4752193455e1bee556275d87ceacbafdc9353bfd1303481a3fd3044015477c18999250a4e5430340dd9bbcbcad1287a30bde5155bd63a4a2f10c754a914e543d970db03e5b4bf57c701013b4289d996b6781ea6c9d61f8aefaa4a4a0e1bf2c2e7bbf1d77c962989b4025634473dd9d61fedcfcec614d8aeda4ec14666958cbc47dd73c939f571cc45b6e9a9a6e49b552e95024814ebc9b5bb5023feb6028a6b5378a6eb35f97f5ebb9d739c07b825d185a8d6a3b7e43d35933582012fae14a04b528cce6b59a482d5c2acce4539cddaf40da4bcbc608b1d8b2ed3e3a830241828a35d22e3ba0a6ca3e278b44aa1caba7a275b2f057dbfb5c3e7602965ea7f9f5913dac34614d3f702512a7755421018b4d191fb03a8fb95590a9c7342d87b8922aeec029f0c03b2175c210390f8bb0ad3874aea05f1560b40e3c67974f1e41294e36a4940d778878d39b382d8a84211b1bfe7a1e6a57ff218d5fd3fc02e1fe1cd0964fd538f9e249bd0256d558f1807de5158eb6964dc996e26156c98a3c25feedb8436f8d2d2f9d7762d3ac46da550ba07211b6c8e2c715f25ddbb5c31bd6bf7ec5c684731f8acd225abe952b77f093c7cc1045d25a470f363965c084dcad5a508518c5cac46766d38aae24487e25420387c12e18ca7ea172ca2231c38978609acb22c686ef05bd51305be95ca9799bed16445d6031e9575ba85d409d601d75d09d6b6d8c0f4f998897fddc5db639147e9a7113609f7e100d15c9b8ebb92ff806e0c5282b744f41944af338b57245f8020e2b63cff77f43d4a836ffca8f86d54e8440f586dbb88f2d1272ac172be4813abc6004fc7756f57250f519663821786d2522dff0294d5548eae792a8cddfc7520c8352e88114221cb1427c1cd50a1a0035ca7409a98e9722af1df3dc01df21cd4f0df0c331d020a9fcad74faab17ec0950b07cf2be6f3736061204436c774e41592253e67bce7571c6fb904447967c52d533e9b87af59734998dd9ae224e9c274d718a1345b21c42e7e1077d14329329302b6085358eca001d54908b88ec61b0cf4c6183224acabf912bcc12036eb1165bd993f5662da33e9578c8c2fa8868034ac8d9b16f5882e1b8aae8bda7bafe3d4b7126bdb8bcda3ac9fa1d55c96870d242bc8b20ed4cf23ed275764b06f4c03de43c671476b1bd7b5fecd10c6637394b017498c18237f7052fa8c154011185bee6f0c1523bf78c1829d6593a67b37e918cd56d5fb97eedff101f152a51600ab62236842313a299e43cfa51f7cd82428ebee629896a5d9cd39a366d122d3b2d5861e31b785baaa3bbe22a37f91bb623da837f2ac4e1efec970a0224e6417947d4913e6b5dc8c58b87c8ac5481d4b57b91e19bda377201d7f88b531815c4213c447abd0eb732e3398f268437e1c21fe3154ae6e4534c4b8127ebc327ac62485b277743cf811def6d157e3647340297267d36a1bbfe4c6553eca4560da57044d8ed2c1083ae28c63c0d8fdcf356e2e9ce860e7999f12c5a3f945d0bcda6ce29f33bf519337a369aae329acbc22fb492e1e672319c98fdde1d65c8a08a4119ec17c6a67ef0a8111bb08ef2fc06878d1590103ffa5160d04bf4a1d1e2c2026a6fca5f56b500d1af0b1328e258d48770597208d186068b926787421b2cb4e18ea2d0c6dfa47d0531f98aaf46364d88f6ae65d9b876df82df412d04b0fb80602a9423590d537f44124728d78eacaae2c608db5467e416ec71ead23cda34b9399beec5b15c55a573c6192477167f3f29e4f5ee7b527b703087638d263c9b8ed2f9be2943c5b7d9a2b273719739e0168413a089b459db2a3b4f835124110e8a8eda7eea0bb1105a26e3d399fd6a7df42fe41c7c266ea623d950451913fe975a079986130ea17efecf8fe65a4cf8fd9746832feac278669c55b4f15a4f5e56ddd58e65b93dc0063702c6a10ca2de916374c971ef529f70206000a40d7939dbb9ae427b52eb8166b80a1dba86ceabff388b6adb321d0be1d5ee2ea139e59e6893db8c4087564538aa7d4d5fd2d72efc391b18b7edd24b7875ff3d28feaa58178a5eaa7c5d5cca89d91b7a6b5956eb0a35f8139925b03e6ab338b2f04638e693c70c42c0befd9afc073a9f0bcf0f372c3c86bbee7d749775df1fd152eccebd83816c55025e506e6df3cbeb3b1f7f406494aa992d98bcb2e08ccb82af1a8ba95ed6580d6b852af2b538f300cb1b29c065905f445600cba79b57cc28cbdc25507293c8512060f6d36d5d66bc89c43fa826792c277c9b6de595c24b1b011e36002099f98eee57521647e7aa451216c885a59ae06cb4e2efdf7bf483781a8da108dc36e3c9a26f0b73231e59263cb19d462d329c9800f151652b57d4645d4ee"}) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f00000005c0)={0x6, 0x8, 0x0, 0x8000}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x60) (async) openat$cgroup_procs(r0, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(0xffffffffffffffff, 0x0, 0x400, 0x80, &(0x7f0000000600)) (async) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f7b643d650a34b3007e3459111e103b0b1cd613c59e7520d403f1c87b74ff1727e70001467d0c55aba9ee040508ca2b5704e5b7f8dac6274bc96e69a442c4a70c00229351293548fb933182d6c44f363702f8f739cdb10e7d1bf5a4a662309c967036de35dacbe8c3f5644da4b2c47c4d34af21150db3178c88a7e5f83330b1dc92240d777c66a7435b0ada23c48857e7bd93eed410ec1f9393cff3c29bceda163049836b6c4dffffffffffff26f93981c2e2df9caba1b1d08f8bdeeae87ba3c748def59cbfcb4f7ecbd41d8d", @ANYRESDEC=r1, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) (async) ioctl$VT_DISALLOCATE(r0, 0x5608) (async) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000000c0)) (async) write$P9_RGETLOCK(r0, &(0x7f0000000100)={0x1e, 0x37, 0x2, {0x0, 0x7b, 0x2, r2}}, 0x1e) (async) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$cgroup_ro(r0, &(0x7f0000000180)='cpuacct.usage_user\x00', 0x0, 0x0) (async) statx(r3, &(0x7f00000001c0)='./file0/file0\x00', 0x2000, 0x40, &(0x7f0000000300)) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) syz_clone(0x40800, &(0x7f0000000400)="9ad1c9067edf88c653f4c6233c6192881bb1b4755b4d980839177a992164dea3bec0dbb299ca55d29148b11095c0232f50b0c880acaec16d74df0c31d083fc07ad0c4bf3ebc8696002224af12bb76992844419c50d8cffd0f1991aaddd307e56e899f2c4e1a076d214d0f1de55d42e2a48fac88be3fabb37253ade4ca49a000cb270972da50c05125cf4884ce9ca8482626a4bdaa1892a13d3083373d964627d70034755f56c0a4003992e8571207e82f0d0c2", 0xb3, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000004c0)="196fc7e9e3f40a024a034cc12bb0fa2d063fae7cabe9a47d161a0293680308f9dc2a5111dd31c422b8f3616be27abf70fcee49839580d843ceb2e06d4e6832e0471ac113b2866e1cd600ce192b7361df40f360863ee4da92a7238876b99fb046e4b2d6b037dbba7912596a787ed1b1ec92e0eb4f974fd7cd664f72663176ef0c5af13b84a08066a4a8f59b6f46817b690a0597b2e766f2adaa0c8e858647cb500c35ae79f58f46d2cff40946d0fd65ae9064420b6ace23f119b105b0acb9eaee2f06cd070c21c006635fbf19b1c900a21662f891fe9b8e0656fc19") (async) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r4, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r4, 0x5437, 0x0) (async) openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) (async) ioctl$BTRFS_IOC_SNAP_DESTROY(r5, 0x5000940f, &(0x7f0000000e00)={{r0}, "3bcb4a476300c8c6382b463b274167947c8c9e80470d8aeeb4f9e89eb99598287ff4f8eb6ef5a2dc3de021e8227c9e5750f2da996582e656e138bd39495fdad873b157586100c4b7eeaded90640d6028acdf2228a4289c7f4a944fc0d07e0381648ce909bacb5459737d1e2e50cef88c8efc2be5a92748084ba84d76a0731d364cd462e7c80f8e4b461004e2b51130299e3e95817dd594c62d086ce0536a1ffaa7eee53d18bbba5065e317096b8c261fc758ad5ef203c2b2abf059f87e5e25e68c9e901499ffa1c75ff2f30b2fed42e744039adbfc201376efdc6f0c9a52b945f9c3a337621c9774ff6523c4f7549bd4e31c44ee0e0931ce24431847fe955cb96578f8386195908a2dd03f934a33a0ec77a32dd854c213111ce9385bc44a00641774e77f72c7e8d3e130c84af55f64218e597287a19c510afb2b6662e0534e656665cac2677985859f116feb24ff1bec38eff6f7debe051d87515d1a920e01c6cd9b475cc87f4b4783f2adf57a800bd38da08c5a5a4dff767cea257fb5aeee5e45033d1f5fb385893b6a6668c2df490c68c3ab3b9089ee2227d4a0d873af14695c67d68d0cdf44445e470798ea905e1fb035c94e36489975ea385d3e1c5641494d70b0c91d82de4294cca280d842d908bda559010794ef36a8122beca3a9c1cd91b65334caf8238bb06082ea585ff49a4dc3216c671dc76b1eb2f5fb49c1ac78b09be70982a87fe04d15041e11665f7fb9c264681db17e588e2506dee03be7385afd19aad4c2cbe05b92614d990d2347a67a05b616981fb96518ef3c9bac804b066e314873636b0e91e8615cf699ed906284c38d0ff186c4f64e0ce3979a2457b783375af8a6853e48cd8d855bf9a27e526b1c8e69526e00416c90668a13a88ac8858bfb50fc293d569ed247fc54063e511f9da3a2450a66c2f8a3b0c79cb8bdbebf1b0c3c5440ddcf146405e6d4d8c1497e8f7bb6a95e8fd8ae07d716ee12c3ab993f83198ba20df20867ad0c15e3d04578555af1668b2aebe14243f4f57825dd208d221196e03647adf5e0fdd4d3600c2737d0095ebf51931d40d555785a9c8833013a28226d2c4f35bb60876fe174d05efada0d445a2ad1a70e837d374deb1e4ad7fe67be78de4b823036cc22222b3bf5d816cae839bbbccb9ffc9f52531d0a4ab267d2ad0c1e1f88dce691368064684a5c4051a5329052a92f5ff1525252095abd2423a07cb39536e2571638879bfbe55c8c1d0cb8a227812951cf5b5db9f239eb8e5552264f310ab686c6ef3536e43a0d2d98a2072568bd00b39a4bb96da41ce2051c28cbaa7831e4c7afe389f1acb4b7facb4171c82f2d2ff713e89aa55d90db57fb01f1e18186a3825722c29f6337f49ad019011ff718881c5cfb7328d38398b40e77efc694524a05223d02e1e9885c1dabffb9070be786698f123d2fc7e2b444af4ea21e989bb52b65b3970ad251813783c1975764ac73d7b7c8b92fe48128185ceb87eef67327e6c556400a91784cdf9357f521f0766ed4df8defb4e28e29a20fee73ea1b3eb5f85c93eda1e02cb71a8499192bd1148325a83eaf31ff5054dee8d0867fa657c741c651d20c156dc3dad5a2f90bd99c14c292fe70e1981490314ee8ec143489cfc35ff3a30434f7f00127740b8b6720465133463b3ba41582819103b1980dca19f64c87db1bf267a9f1f7a2edc1f885147b62d43b4174e40eafa1507fba96bcb38af1b666ec10791f44aa6902324e12ed2e95ffad8a24ef324597fa5658bdca5f8571633ac54870263bfa19deb2bf370212a1dbfac1a105959872ecdc891c70ed6c3d67d487ad575e6aed0ddd7bcca072cc19777642a411d59bc325ce8a60cc5a80ed9a98fea839db1a7ee71573d039b61cdb3e7c1e2b1e9a5d75748e3ccfe6566ca8b2eefcdb195f3301ce3f07075c130b70b62f75d4e166df3cf2c568608d740b958ab27f90fa2a612242fa5726b4da4579133cf057ed6c2b994e81448d09d2e0e4b429acd6712a5a1988a3a9dfd3856e15b310ad4ee75fc3ae34932b144407d788b3aaa3860055d426c39304423d2a0b499fdae476af8bcd92735682f7dadc2bb4ea703626d1702cbb59f2a73cc00e83e64f705826fb087596d0b9333c0498b31dcb3591c5321ccae79f1fbf15be7df9d02ad0dfe12a754263c5c357e3a3ffb2f52bcca77559ff60dae3b50bb74c680054d70d311888af596cdeef5e026f22caeedc16da7998aca6b5c545c6a2e8e9b77c61c36c8240eee9926eaeaac51a3ed95add2065a6873c465c2f7b9924554fe67fe6e1b5df8f5d0e81a3ecd8a3bd8879be07c001c75619e9a0d44a2a15d4642bd44eb99601b912874caa31f1ca4e9aa09bb91ecd68a3cc00838f7072bbfcddb16ed4690b3b001339498d72bfe795cbe1020254f1da0502e45cc75f653f9869af1637e5aaf3dadf3ea4ad423a5b0a7ff05c1babef523a8a61708b7f2f1e0c9c6e2925cb094ab602bf14a86d26300b836d768954a55016fd2feaa25c20538256cbfa5807daa748b3adce99372d8a2fb4ca81ac46c3468b1c6ce55086bbdcf81f6286306c418c8409a0b05a9e4bc86ad759b7bac31eaa37cd59c36f103d71ef9eb8c99c663bc9acdd43a10c1d0290016d5a1ab7260cdda87be80270206de2c82de0b4559ec26a3c20ae3239b8980911c18c4e536d8f0c3dfa4b1c5f1fb9781589a2f0354964139df2dd0f6f5eaaf7705552c66c4d61cfdcd3906f621d022a816b75df17d849ec0300427411cc3f58126986645cd044259a33140889957a1cfba03b97327829d340e43fd62230bff2b4a3ff3ac8b775a41d3b02819f0469ee364ff803990b03dcbf6524aff1d00c38f0ed812353d1a27a75111b48b8514dfab57a99218737a28cafd9ab637dcd70655b5ade7fa5fb8ddafc1cda70629d7a6bb43afd695b91bd73d259aee03bd37e96b824d34cf7679212fdb0c5faa301da0cd6edbda92713ea1ab3ac632a7ca24d420aa2bb83ff2d2c6de577c5e3c0cb32c00efb3e85eb96083652ebdfadc6c70410e17a230b80fd141b6a9dfa92e8456fe4711216645c858518bb9767290cbe21299bdf787e0710c3fdbf44a7a254360093e027d1b38ad9d0a2bdc665ff1d0de21d695ac553007d7ed128495d71f0aaf094a7f8e96c4612afd483a9b5b8f5623837a4755f4358334080ec2a8513214d459457e0774ef35eb82eb7a588acb290cfb888d7eab2226774a6a9c0e8b31f638b0916a25b558c5f0da38eaf5ba8ba7739e2c5977c9b767811a88f943673c2e30d08ce0a7016654fef68ba3ac087b39cf884eaa49718154be4f7fe33c93a5f6af18a32264df81800b14914bdc56e68c932e690446347fdcc630117e29606879df6d098d69d148ad9d4752193455e1bee556275d87ceacbafdc9353bfd1303481a3fd3044015477c18999250a4e5430340dd9bbcbcad1287a30bde5155bd63a4a2f10c754a914e543d970db03e5b4bf57c701013b4289d996b6781ea6c9d61f8aefaa4a4a0e1bf2c2e7bbf1d77c962989b4025634473dd9d61fedcfcec614d8aeda4ec14666958cbc47dd73c939f571cc45b6e9a9a6e49b552e95024814ebc9b5bb5023feb6028a6b5378a6eb35f97f5ebb9d739c07b825d185a8d6a3b7e43d35933582012fae14a04b528cce6b59a482d5c2acce4539cddaf40da4bcbc608b1d8b2ed3e3a830241828a35d22e3ba0a6ca3e278b44aa1caba7a275b2f057dbfb5c3e7602965ea7f9f5913dac34614d3f702512a7755421018b4d191fb03a8fb95590a9c7342d87b8922aeec029f0c03b2175c210390f8bb0ad3874aea05f1560b40e3c67974f1e41294e36a4940d778878d39b382d8a84211b1bfe7a1e6a57ff218d5fd3fc02e1fe1cd0964fd538f9e249bd0256d558f1807de5158eb6964dc996e26156c98a3c25feedb8436f8d2d2f9d7762d3ac46da550ba07211b6c8e2c715f25ddbb5c31bd6bf7ec5c684731f8acd225abe952b77f093c7cc1045d25a470f363965c084dcad5a508518c5cac46766d38aae24487e25420387c12e18ca7ea172ca2231c38978609acb22c686ef05bd51305be95ca9799bed16445d6031e9575ba85d409d601d75d09d6b6d8c0f4f998897fddc5db639147e9a7113609f7e100d15c9b8ebb92ff806e0c5282b744f41944af338b57245f8020e2b63cff77f43d4a836ffca8f86d54e8440f586dbb88f2d1272ac172be4813abc6004fc7756f57250f519663821786d2522dff0294d5548eae792a8cddfc7520c8352e88114221cb1427c1cd50a1a0035ca7409a98e9722af1df3dc01df21cd4f0df0c331d020a9fcad74faab17ec0950b07cf2be6f3736061204436c774e41592253e67bce7571c6fb904447967c52d533e9b87af59734998dd9ae224e9c274d718a1345b21c42e7e1077d14329329302b6085358eca001d54908b88ec61b0cf4c6183224acabf912bcc12036eb1165bd993f5662da33e9578c8c2fa8868034ac8d9b16f5882e1b8aae8bda7bafe3d4b7126bdb8bcda3ac9fa1d55c96870d242bc8b20ed4cf23ed275764b06f4c03de43c671476b1bd7b5fecd10c6637394b017498c18237f7052fa8c154011185bee6f0c1523bf78c1829d6593a67b37e918cd56d5fb97eedff101f152a51600ab62236842313a299e43cfa51f7cd82428ebee629896a5d9cd39a366d122d3b2d5861e31b785baaa3bbe22a37f91bb623da837f2ac4e1efec970a0224e6417947d4913e6b5dc8c58b87c8ac5481d4b57b91e19bda377201d7f88b531815c4213c447abd0eb732e3398f268437e1c21fe3154ae6e4534c4b8127ebc327ac62485b277743cf811def6d157e3647340297267d36a1bbfe4c6553eca4560da57044d8ed2c1083ae28c63c0d8fdcf356e2e9ce860e7999f12c5a3f945d0bcda6ce29f33bf519337a369aae329acbc22fb492e1e672319c98fdde1d65c8a08a4119ec17c6a67ef0a8111bb08ef2fc06878d1590103ffa5160d04bf4a1d1e2c2026a6fca5f56b500d1af0b1328e258d48770597208d186068b926787421b2cb4e18ea2d0c6dfa47d0531f98aaf46364d88f6ae65d9b876df82df412d04b0fb80602a9423590d537f44124728d78eacaae2c608db5467e416ec71ead23cda34b9399beec5b15c55a573c6192477167f3f29e4f5ee7b527b703087638d263c9b8ed2f9be2943c5b7d9a2b273719739e0168413a089b459db2a3b4f835124110e8a8eda7eea0bb1105a26e3d399fd6a7df42fe41c7c266ea623d950451913fe975a079986130ea17efecf8fe65a4cf8fd9746832feac278669c55b4f15a4f5e56ddd58e65b93dc0063702c6a10ca2de916374c971ef529f70206000a40d7939dbb9ae427b52eb8166b80a1dba86ceabff388b6adb321d0be1d5ee2ea139e59e6893db8c4087564538aa7d4d5fd2d72efc391b18b7edd24b7875ff3d28feaa58178a5eaa7c5d5cca89d91b7a6b5956eb0a35f8139925b03e6ab338b2f04638e693c70c42c0befd9afc073a9f0bcf0f372c3c86bbee7d749775df1fd152eccebd83816c55025e506e6df3cbeb3b1f7f406494aa992d98bcb2e08ccb82af1a8ba95ed6580d6b852af2b538f300cb1b29c065905f445600cba79b57cc28cbdc25507293c8512060f6d36d5d66bc89c43fa826792c277c9b6de595c24b1b011e36002099f98eee57521647e7aa451216c885a59ae06cb4e2efdf7bf483781a8da108dc36e3c9a26f0b73231e59263cb19d462d329c9800f151652b57d4645d4ee"}) (async) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f00000005c0)={0x6, 0x8, 0x0, 0x8000}) (async) 16:11:55 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x1000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:55 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x3}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:55 executing program 5: getpgid(0x0) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0), 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = syz_clone(0x8040000, &(0x7f0000000b80), 0x0, 0x0, 0x0, &(0x7f0000000cc0)="95") ptrace$getregset(0x4204, r0, 0x0, 0x0) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(0xffffffffffffffff, 0x0, 0x0) 16:11:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x111400, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xc280, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) ioctl$TCXONC(r1, 0x540a, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x111400, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xc280, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) ioctl$TCXONC(r1, 0x540a, 0x0) (async) 16:11:55 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x4}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1161.158938][ T3647] Bluetooth: hci8: command 0x1003 tx timeout [ 1161.163739][ T3656] Bluetooth: hci8: Opcode 0x1003 failed: -110 16:11:55 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x2000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1161.228937][ T5904] Bluetooth: hci7: Frame reassembly failed (-84) [ 1161.249969][T19718] Bluetooth: hci8: sending frame failed (-49) [ 1161.256180][ T3647] Bluetooth: hci8: Opcode 0x1003 failed: -49 16:11:57 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0xc020660b, 0x0) 16:11:57 executing program 5: getpgid(0x0) syz_clone(0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0), 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = syz_clone(0x8040000, &(0x7f0000000b80), 0x0, 0x0, 0x0, &(0x7f0000000cc0)="95") ptrace$getregset(0x4204, r0, 0x0, 0x0) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(0xffffffffffffffff, 0x0, 0x0) 16:11:57 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x5}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:57 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x3000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x4000011) ioctl$TIOCSTI(r0, 0x5437, 0x0) [ 1162.996922][ T3647] Bluetooth: hci6: command 0x1003 tx timeout [ 1162.997709][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1163.067183][ T3647] Bluetooth: hci6: sending frame failed (-49) [ 1163.073406][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:11:57 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r0, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(0xffffffffffffffff, 0x0, 0x400, 0x80, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38a0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f7b643d650a34b3007e3459111e103b0b1cd613c59e7520d403f1c87b74ff1727e70001467d0c55aba9ee040508ca2b5704e5b7f8dac6274bc96e69a442c4a70c00229351293548fb933182d6c44f363702f8f739cdb10e7d1bf5a4a662309c967036de35dacbe8c3f5644da4b2c47c4d34af21150db3178c88a7e5f83330b1dc92240d777c66a7435b0ada23c48857e7bd93eed410ec1f9393cff3c29bceda163049836b6c4dffffffffffff26f93981c2e2df9caba1b1d08f8bdeeae87ba3c748def59cbfcb4f7ecbd41d8d", @ANYRESDEC=r1, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r0, 0x5608) (async) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000000c0)=0x0) write$P9_RGETLOCK(r0, &(0x7f0000000100)={0x1e, 0x37, 0x2, {0x0, 0x7b, 0x2, r2}}, 0x1e) (async) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) (async) r3 = openat$cgroup_ro(r0, &(0x7f0000000180)='cpuacct.usage_user\x00', 0x0, 0x0) statx(r3, &(0x7f00000001c0)='./file0/file0\x00', 0x2000, 0x40, &(0x7f0000000300)) (async) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_clone(0x40800, &(0x7f0000000400)="9ad1c9067edf88c653f4c6233c6192881bb1b4755b4d980839177a992164dea3bec0dbb299ca55d29148b11095c0232f50b0c880acaec16d74df0c31d083fc07ad0c4bf3ebc8696002224af12bb76992844419c50d8cffd0f1991aaddd307e56e899f2c4e1a076d214d0f1de55d42e2a48fac88be3fabb37253ade4ca49a000cb270972da50c05125cf4884ce9ca8482626a4bdaa1892a13d3083373d964627d70034755f56c0a4003992e8571207e82f0d0c2", 0xb3, &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000004c0)="196fc7e9e3f40a024a034cc12bb0fa2d063fae7cabe9a47d161a0293680308f9dc2a5111dd31c422b8f3616be27abf70fcee49839580d843ceb2e06d4e6832e0471ac113b2866e1cd600ce192b7361df40f360863ee4da92a7238876b99fb046e4b2d6b037dbba7912596a787ed1b1ec92e0eb4f974fd7cd664f72663176ef0c5af13b84a08066a4a8f59b6f46817b690a0597b2e766f2adaa0c8e858647cb500c35ae79f58f46d2cff40946d0fd65ae9064420b6ace23f119b105b0acb9eaee2f06cd070c21c006635fbf19b1c900a21662f891fe9b8e0656fc19") (async) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x4) ioctl$TIOCSTI(r4, 0x5437, 0x0) (async) r5 = openat$apparmor_task_exec(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY(r5, 0x5000940f, &(0x7f0000000e00)={{r0}, "3bcb4a476300c8c6382b463b274167947c8c9e80470d8aeeb4f9e89eb99598287ff4f8eb6ef5a2dc3de021e8227c9e5750f2da996582e656e138bd39495fdad873b157586100c4b7eeaded90640d6028acdf2228a4289c7f4a944fc0d07e0381648ce909bacb5459737d1e2e50cef88c8efc2be5a92748084ba84d76a0731d364cd462e7c80f8e4b461004e2b51130299e3e95817dd594c62d086ce0536a1ffaa7eee53d18bbba5065e317096b8c261fc758ad5ef203c2b2abf059f87e5e25e68c9e901499ffa1c75ff2f30b2fed42e744039adbfc201376efdc6f0c9a52b945f9c3a337621c9774ff6523c4f7549bd4e31c44ee0e0931ce24431847fe955cb96578f8386195908a2dd03f934a33a0ec77a32dd854c213111ce9385bc44a00641774e77f72c7e8d3e130c84af55f64218e597287a19c510afb2b6662e0534e656665cac2677985859f116feb24ff1bec38eff6f7debe051d87515d1a920e01c6cd9b475cc87f4b4783f2adf57a800bd38da08c5a5a4dff767cea257fb5aeee5e45033d1f5fb385893b6a6668c2df490c68c3ab3b9089ee2227d4a0d873af14695c67d68d0cdf44445e470798ea905e1fb035c94e36489975ea385d3e1c5641494d70b0c91d82de4294cca280d842d908bda559010794ef36a8122beca3a9c1cd91b65334caf8238bb06082ea585ff49a4dc3216c671dc76b1eb2f5fb49c1ac78b09be70982a87fe04d15041e11665f7fb9c264681db17e588e2506dee03be7385afd19aad4c2cbe05b92614d990d2347a67a05b616981fb96518ef3c9bac804b066e314873636b0e91e8615cf699ed906284c38d0ff186c4f64e0ce3979a2457b783375af8a6853e48cd8d855bf9a27e526b1c8e69526e00416c90668a13a88ac8858bfb50fc293d569ed247fc54063e511f9da3a2450a66c2f8a3b0c79cb8bdbebf1b0c3c5440ddcf146405e6d4d8c1497e8f7bb6a95e8fd8ae07d716ee12c3ab993f83198ba20df20867ad0c15e3d04578555af1668b2aebe14243f4f57825dd208d221196e03647adf5e0fdd4d3600c2737d0095ebf51931d40d555785a9c8833013a28226d2c4f35bb60876fe174d05efada0d445a2ad1a70e837d374deb1e4ad7fe67be78de4b823036cc22222b3bf5d816cae839bbbccb9ffc9f52531d0a4ab267d2ad0c1e1f88dce691368064684a5c4051a5329052a92f5ff1525252095abd2423a07cb39536e2571638879bfbe55c8c1d0cb8a227812951cf5b5db9f239eb8e5552264f310ab686c6ef3536e43a0d2d98a2072568bd00b39a4bb96da41ce2051c28cbaa7831e4c7afe389f1acb4b7facb4171c82f2d2ff713e89aa55d90db57fb01f1e18186a3825722c29f6337f49ad019011ff718881c5cfb7328d38398b40e77efc694524a05223d02e1e9885c1dabffb9070be786698f123d2fc7e2b444af4ea21e989bb52b65b3970ad251813783c1975764ac73d7b7c8b92fe48128185ceb87eef67327e6c556400a91784cdf9357f521f0766ed4df8defb4e28e29a20fee73ea1b3eb5f85c93eda1e02cb71a8499192bd1148325a83eaf31ff5054dee8d0867fa657c741c651d20c156dc3dad5a2f90bd99c14c292fe70e1981490314ee8ec143489cfc35ff3a30434f7f00127740b8b6720465133463b3ba41582819103b1980dca19f64c87db1bf267a9f1f7a2edc1f885147b62d43b4174e40eafa1507fba96bcb38af1b666ec10791f44aa6902324e12ed2e95ffad8a24ef324597fa5658bdca5f8571633ac54870263bfa19deb2bf370212a1dbfac1a105959872ecdc891c70ed6c3d67d487ad575e6aed0ddd7bcca072cc19777642a411d59bc325ce8a60cc5a80ed9a98fea839db1a7ee71573d039b61cdb3e7c1e2b1e9a5d75748e3ccfe6566ca8b2eefcdb195f3301ce3f07075c130b70b62f75d4e166df3cf2c568608d740b958ab27f90fa2a612242fa5726b4da4579133cf057ed6c2b994e81448d09d2e0e4b429acd6712a5a1988a3a9dfd3856e15b310ad4ee75fc3ae34932b144407d788b3aaa3860055d426c39304423d2a0b499fdae476af8bcd92735682f7dadc2bb4ea703626d1702cbb59f2a73cc00e83e64f705826fb087596d0b9333c0498b31dcb3591c5321ccae79f1fbf15be7df9d02ad0dfe12a754263c5c357e3a3ffb2f52bcca77559ff60dae3b50bb74c680054d70d311888af596cdeef5e026f22caeedc16da7998aca6b5c545c6a2e8e9b77c61c36c8240eee9926eaeaac51a3ed95add2065a6873c465c2f7b9924554fe67fe6e1b5df8f5d0e81a3ecd8a3bd8879be07c001c75619e9a0d44a2a15d4642bd44eb99601b912874caa31f1ca4e9aa09bb91ecd68a3cc00838f7072bbfcddb16ed4690b3b001339498d72bfe795cbe1020254f1da0502e45cc75f653f9869af1637e5aaf3dadf3ea4ad423a5b0a7ff05c1babef523a8a61708b7f2f1e0c9c6e2925cb094ab602bf14a86d26300b836d768954a55016fd2feaa25c20538256cbfa5807daa748b3adce99372d8a2fb4ca81ac46c3468b1c6ce55086bbdcf81f6286306c418c8409a0b05a9e4bc86ad759b7bac31eaa37cd59c36f103d71ef9eb8c99c663bc9acdd43a10c1d0290016d5a1ab7260cdda87be80270206de2c82de0b4559ec26a3c20ae3239b8980911c18c4e536d8f0c3dfa4b1c5f1fb9781589a2f0354964139df2dd0f6f5eaaf7705552c66c4d61cfdcd3906f621d022a816b75df17d849ec0300427411cc3f58126986645cd044259a33140889957a1cfba03b97327829d340e43fd62230bff2b4a3ff3ac8b775a41d3b02819f0469ee364ff803990b03dcbf6524aff1d00c38f0ed812353d1a27a75111b48b8514dfab57a99218737a28cafd9ab637dcd70655b5ade7fa5fb8ddafc1cda70629d7a6bb43afd695b91bd73d259aee03bd37e96b824d34cf7679212fdb0c5faa301da0cd6edbda92713ea1ab3ac632a7ca24d420aa2bb83ff2d2c6de577c5e3c0cb32c00efb3e85eb96083652ebdfadc6c70410e17a230b80fd141b6a9dfa92e8456fe4711216645c858518bb9767290cbe21299bdf787e0710c3fdbf44a7a254360093e027d1b38ad9d0a2bdc665ff1d0de21d695ac553007d7ed128495d71f0aaf094a7f8e96c4612afd483a9b5b8f5623837a4755f4358334080ec2a8513214d459457e0774ef35eb82eb7a588acb290cfb888d7eab2226774a6a9c0e8b31f638b0916a25b558c5f0da38eaf5ba8ba7739e2c5977c9b767811a88f943673c2e30d08ce0a7016654fef68ba3ac087b39cf884eaa49718154be4f7fe33c93a5f6af18a32264df81800b14914bdc56e68c932e690446347fdcc630117e29606879df6d098d69d148ad9d4752193455e1bee556275d87ceacbafdc9353bfd1303481a3fd3044015477c18999250a4e5430340dd9bbcbcad1287a30bde5155bd63a4a2f10c754a914e543d970db03e5b4bf57c701013b4289d996b6781ea6c9d61f8aefaa4a4a0e1bf2c2e7bbf1d77c962989b4025634473dd9d61fedcfcec614d8aeda4ec14666958cbc47dd73c939f571cc45b6e9a9a6e49b552e95024814ebc9b5bb5023feb6028a6b5378a6eb35f97f5ebb9d739c07b825d185a8d6a3b7e43d35933582012fae14a04b528cce6b59a482d5c2acce4539cddaf40da4bcbc608b1d8b2ed3e3a830241828a35d22e3ba0a6ca3e278b44aa1caba7a275b2f057dbfb5c3e7602965ea7f9f5913dac34614d3f702512a7755421018b4d191fb03a8fb95590a9c7342d87b8922aeec029f0c03b2175c210390f8bb0ad3874aea05f1560b40e3c67974f1e41294e36a4940d778878d39b382d8a84211b1bfe7a1e6a57ff218d5fd3fc02e1fe1cd0964fd538f9e249bd0256d558f1807de5158eb6964dc996e26156c98a3c25feedb8436f8d2d2f9d7762d3ac46da550ba07211b6c8e2c715f25ddbb5c31bd6bf7ec5c684731f8acd225abe952b77f093c7cc1045d25a470f363965c084dcad5a508518c5cac46766d38aae24487e25420387c12e18ca7ea172ca2231c38978609acb22c686ef05bd51305be95ca9799bed16445d6031e9575ba85d409d601d75d09d6b6d8c0f4f998897fddc5db639147e9a7113609f7e100d15c9b8ebb92ff806e0c5282b744f41944af338b57245f8020e2b63cff77f43d4a836ffca8f86d54e8440f586dbb88f2d1272ac172be4813abc6004fc7756f57250f519663821786d2522dff0294d5548eae792a8cddfc7520c8352e88114221cb1427c1cd50a1a0035ca7409a98e9722af1df3dc01df21cd4f0df0c331d020a9fcad74faab17ec0950b07cf2be6f3736061204436c774e41592253e67bce7571c6fb904447967c52d533e9b87af59734998dd9ae224e9c274d718a1345b21c42e7e1077d14329329302b6085358eca001d54908b88ec61b0cf4c6183224acabf912bcc12036eb1165bd993f5662da33e9578c8c2fa8868034ac8d9b16f5882e1b8aae8bda7bafe3d4b7126bdb8bcda3ac9fa1d55c96870d242bc8b20ed4cf23ed275764b06f4c03de43c671476b1bd7b5fecd10c6637394b017498c18237f7052fa8c154011185bee6f0c1523bf78c1829d6593a67b37e918cd56d5fb97eedff101f152a51600ab62236842313a299e43cfa51f7cd82428ebee629896a5d9cd39a366d122d3b2d5861e31b785baaa3bbe22a37f91bb623da837f2ac4e1efec970a0224e6417947d4913e6b5dc8c58b87c8ac5481d4b57b91e19bda377201d7f88b531815c4213c447abd0eb732e3398f268437e1c21fe3154ae6e4534c4b8127ebc327ac62485b277743cf811def6d157e3647340297267d36a1bbfe4c6553eca4560da57044d8ed2c1083ae28c63c0d8fdcf356e2e9ce860e7999f12c5a3f945d0bcda6ce29f33bf519337a369aae329acbc22fb492e1e672319c98fdde1d65c8a08a4119ec17c6a67ef0a8111bb08ef2fc06878d1590103ffa5160d04bf4a1d1e2c2026a6fca5f56b500d1af0b1328e258d48770597208d186068b926787421b2cb4e18ea2d0c6dfa47d0531f98aaf46364d88f6ae65d9b876df82df412d04b0fb80602a9423590d537f44124728d78eacaae2c608db5467e416ec71ead23cda34b9399beec5b15c55a573c6192477167f3f29e4f5ee7b527b703087638d263c9b8ed2f9be2943c5b7d9a2b273719739e0168413a089b459db2a3b4f835124110e8a8eda7eea0bb1105a26e3d399fd6a7df42fe41c7c266ea623d950451913fe975a079986130ea17efecf8fe65a4cf8fd9746832feac278669c55b4f15a4f5e56ddd58e65b93dc0063702c6a10ca2de916374c971ef529f70206000a40d7939dbb9ae427b52eb8166b80a1dba86ceabff388b6adb321d0be1d5ee2ea139e59e6893db8c4087564538aa7d4d5fd2d72efc391b18b7edd24b7875ff3d28feaa58178a5eaa7c5d5cca89d91b7a6b5956eb0a35f8139925b03e6ab338b2f04638e693c70c42c0befd9afc073a9f0bcf0f372c3c86bbee7d749775df1fd152eccebd83816c55025e506e6df3cbeb3b1f7f406494aa992d98bcb2e08ccb82af1a8ba95ed6580d6b852af2b538f300cb1b29c065905f445600cba79b57cc28cbdc25507293c8512060f6d36d5d66bc89c43fa826792c277c9b6de595c24b1b011e36002099f98eee57521647e7aa451216c885a59ae06cb4e2efdf7bf483781a8da108dc36e3c9a26f0b73231e59263cb19d462d329c9800f151652b57d4645d4ee"}) (async) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f00000005c0)={0x6, 0x8, 0x0, 0x8000}) 16:11:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x4000011) ioctl$TIOCSTI(r0, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x4000011) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) 16:11:57 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x4000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:57 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x6}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:11:57 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x114}, 0x14}}, 0x0) 16:11:57 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r3, 0x5607) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r5, 0x400455c8, 0x4) ioctl$TIOCSTI(r5, 0x5437, 0x0) ioctl$TIOCSSOFTCAR(r5, 0x541a, &(0x7f00000002c0)=0xf35b) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r4, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x9}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$TIOCSTI(r1, 0x5437, 0x0) [ 1163.236880][T19716] Bluetooth: hci7: command 0x1003 tx timeout [ 1163.237466][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:11:57 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x7}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1163.277986][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) [ 1163.311512][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) 16:11:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x4000011) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:11:57 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x5000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:57 executing program 5: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2a0140, 0x0) sendmsg$NL80211_CMD_ADD_TX_TS(r0, 0x0, 0x0) 16:11:57 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x13) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:11:57 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x9}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1163.324308][ T9631] Bluetooth: hci7: Frame reassembly failed (-84) 16:11:57 executing program 5: setrlimit(0x0, &(0x7f0000000180)) 16:11:57 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x6000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:58 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x7000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:11:58 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x6}, 0x48) 16:11:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000000)={"ad01ed36f282736f07890829209b1df3714b57cbb052d7879ae31b58f3546052", 0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat2(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x101400, 0x118, 0x4}, 0x18) ioctl$TCFLSH(r2, 0x540b, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={r2, 0x58, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r4 = syz_open_dev$audion(&(0x7f0000000640), 0x1, 0x74060) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x11, 0x9, &(0x7f00000007c0)=ANY=[@ANYBLOB="180000000600000000000000050000e784000600cd00000018400021f8ffffff00000000000000008520000003002d4ca546dbc097000018400000f8ffffff00000000040000009500000000000000"], &(0x7f0000000440)='GPL\x00', 0x7, 0xdb, &(0x7f0000000480)=""/219, 0x0, 0x9, '\x00', r3, 0x0, r4, 0x8, &(0x7f0000000680)={0x8, 0x3}, 0x8, 0x10, &(0x7f00000006c0)={0x2, 0x10, 0xf466, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000700)=[r2, r2]}, 0x80) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f00000000c0)) r5 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r5, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r5, 0x0, 0x6000, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38e0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r6, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r5, 0x5608) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, &(0x7f0000000180)={""/32, 0x0, 0x0, 0x1, 0x0, &(0x7f00000001c0)=[{}]}) fchmod(r1, 0xc6) ioctl$TIOCSTI(r0, 0x5437, 0x0) [ 1163.440540][ T5905] Bluetooth: hci8: Frame reassembly failed (-84) [ 1165.316939][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1165.318954][ T3656] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:12:00 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async, rerun: 64) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 64) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) (async, rerun: 32) r3 = dup2(r2, r2) (rerun: 32) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r3, 0x5607) (async, rerun: 32) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r0) (async, rerun: 32) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r5, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r5, 0x5437, 0x0) ioctl$TIOCSSOFTCAR(r5, 0x541a, &(0x7f00000002c0)=0xf35b) (async, rerun: 64) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r4, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x9}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async, rerun: 64) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:12:00 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0xf}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:00 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x9000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:00 executing program 5: r0 = getpgid(0x0) process_vm_readv(r0, &(0x7f0000000340)=[{&(0x7f00000000c0)=""/165, 0xa5}, {&(0x7f0000000180)=""/127, 0x7f}, {&(0x7f0000000200)=""/238, 0xee}], 0x3, &(0x7f0000000740)=[{&(0x7f00000003c0)=""/107, 0x6b}, {&(0x7f0000000440)=""/227, 0xe3}, {&(0x7f0000000540)=""/162, 0xa2}, {&(0x7f0000000600)=""/226, 0xe2}], 0x4, 0x0) 16:12:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000000)={"ad01ed36f282736f07890829209b1df3714b57cbb052d7879ae31b58f3546052", 0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = openat2(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x101400, 0x118, 0x4}, 0x18) ioctl$TCFLSH(r2, 0x540b, 0x0) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={r2, 0x58, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r4 = syz_open_dev$audion(&(0x7f0000000640), 0x1, 0x74060) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x11, 0x9, &(0x7f00000007c0)=ANY=[@ANYBLOB="180000000600000000000000050000e784000600cd00000018400021f8ffffff00000000000000008520000003002d4ca546dbc097000018400000f8ffffff00000000040000009500000000000000"], &(0x7f0000000440)='GPL\x00', 0x7, 0xdb, &(0x7f0000000480)=""/219, 0x0, 0x9, '\x00', r3, 0x0, r4, 0x8, &(0x7f0000000680)={0x8, 0x3}, 0x8, 0x10, &(0x7f00000006c0)={0x2, 0x10, 0xf466, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000700)=[r2, r2]}, 0x80) (async) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f00000000c0)) (async, rerun: 64) r5 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) (rerun: 64) openat$cgroup_procs(r5, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(r5, 0x0, 0x6000, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38e0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r6, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r5, 0x5608) (async) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, &(0x7f0000000180)={""/32, 0x0, 0x0, 0x1, 0x0, &(0x7f00000001c0)=[{}]}) (async, rerun: 32) fchmod(r1, 0xc6) (async, rerun: 32) ioctl$TIOCSTI(r0, 0x5437, 0x0) [ 1165.396886][ T3656] Bluetooth: hci7: command 0x1003 tx timeout [ 1165.396890][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:12:00 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x1a}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:00 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x0, 0x0, 0x7f}, 0x48) 16:12:00 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xf000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:00 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x13) ioctl$TIOCSTI(r2, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x13) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) 16:12:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000000)={"ad01ed36f282736f07890829209b1df3714b57cbb052d7879ae31b58f3546052", 0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = openat2(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x101400, 0x118, 0x4}, 0x18) ioctl$TCFLSH(r2, 0x540b, 0x0) (async) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={r2, 0x58, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) (async) r4 = syz_open_dev$audion(&(0x7f0000000640), 0x1, 0x74060) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x11, 0x9, &(0x7f00000007c0)=ANY=[@ANYBLOB="180000000600000000000000050000e784000600cd00000018400021f8ffffff00000000000000008520000003002d4ca546dbc097000018400000f8ffffff00000000040000009500000000000000"], &(0x7f0000000440)='GPL\x00', 0x7, 0xdb, &(0x7f0000000480)=""/219, 0x0, 0x9, '\x00', r3, 0x0, r4, 0x8, &(0x7f0000000680)={0x8, 0x3}, 0x8, 0x10, &(0x7f00000006c0)={0x2, 0x10, 0xf466, 0x6}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000700)=[r2, r2]}, 0x80) (async) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(0xffffffffffffffff, 0xc01064c1, &(0x7f00000000c0)) (async) r5 = open(&(0x7f0000000540)='./file0\x00', 0x0, 0x60) openat$cgroup_procs(r5, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(r5, 0x0, 0x6000, 0x20, &(0x7f000000bb00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000c40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB="2c726f6f746d757365725f69643d000003000000000000000000000043b38e0f96cb7f8eaf71591e914d64745f82d8ea9b9ccdd72a84f83f", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=r6, @ANYBLOB=',default_permissions,blksize=0x0000000000001000,allow_other,allow_other,default_permissions,default_permissions,max_read=0x0000000000000000,pcr=00000000000000000050,dont_hash,dont_hash,subj_role=^++,hash,dont_measure,permit_directio,defcontext=unconfined_u,\x00']) ioctl$VT_DISALLOCATE(r5, 0x5608) ioctl$SYNC_IOC_FILE_INFO(r5, 0xc0383e04, &(0x7f0000000180)={""/32, 0x0, 0x0, 0x1, 0x0, &(0x7f00000001c0)=[{}]}) fchmod(r1, 0xc6) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:12:00 executing program 5: syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000680), r0) [ 1165.476929][T19716] Bluetooth: hci8: Opcode 0x1003 failed: -110 16:12:00 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x3f000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:00 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) (async, rerun: 64) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async, rerun: 64) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) r2 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r2, 0x4b3b, &(0x7f0000000280)) (async) r3 = dup2(r2, r2) ioctl$TCSETSW(r3, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r3, 0x5607) (async) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r5, 0x400455c8, 0x4) ioctl$TIOCSTI(r5, 0x5437, 0x0) (async) ioctl$TIOCSSOFTCAR(r5, 0x541a, &(0x7f00000002c0)=0xf35b) (async, rerun: 32) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r4, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x9}, @BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x0) (async, rerun: 32) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:12:00 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0xf0}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:00 executing program 5: sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x0) [ 1165.522846][T30840] ptm ptm2: ldisc open failed (-12), clearing slot 2 16:12:00 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x300}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0xaa4000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TCFLSH(r0, 0x540b, 0x1) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:12:00 executing program 5: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$BINDER_CTL_ADD(r0, 0xc1086201, 0x0) 16:12:00 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x7fffefb0}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1165.612836][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) [ 1165.623202][ T9631] Bluetooth: hci7: Frame reassembly failed (-84) 16:12:00 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5}, 0x48) [ 1165.654051][ T3638] Bluetooth: hci8: sending frame failed (-49) [ 1165.660621][ T3656] Bluetooth: hci8: Opcode 0x1003 failed: -49 16:12:02 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x13) ioctl$TIOCSTI(r2, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f00000000c0)=0x13) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) 16:12:02 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x500}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:02 executing program 5: r0 = getpgid(0x0) process_vm_readv(r0, &(0x7f0000001080)=[{&(0x7f0000000ec0)=""/88, 0x58}], 0x1, &(0x7f00000011c0)=[{&(0x7f00000010c0)=""/234, 0xea}], 0x1, 0x0) 16:12:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0xaa4000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TCFLSH(r0, 0x540b, 0x1) ioctl$TIOCSTI(r0, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0xaa4000, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TCFLSH(r0, 0x540b, 0x1) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) 16:12:02 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x8b0b0000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:02 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4) ioctl$TIOCSTI(r0, 0x5437, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) r3 = dup(r1) write$6lowpan_enable(r3, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x145140, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x9) ioctl$TIOCSTI(r4, 0x5437, 0x0) [ 1167.636945][ T3656] Bluetooth: hci7: command 0x1003 tx timeout [ 1167.637041][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1167.643089][ T3656] Bluetooth: hci6: command 0x1003 tx timeout [ 1167.645381][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:12:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0xaa4000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TCFLSH(r0, 0x540b, 0x1) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:12:02 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x600}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:02 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000000200)=""/132) ioctl$TIOCMIWAIT(r0, 0x545c, 0x0) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:12:02 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x9effffff}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:02 executing program 5: socket$pptp(0x18, 0x1, 0x2) bind$pptp(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 16:12:02 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x700}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1167.757081][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) [ 1167.816726][ T3734] Bluetooth: hci7: Frame reassembly failed (-84) [ 1167.892722][ T3734] Bluetooth: hci9: Frame reassembly failed (-84) [ 1169.796877][T19718] Bluetooth: hci6: command 0x1003 tx timeout [ 1169.796915][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:12:04 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000080), 0x10001, 0x40e941) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:12:04 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x900}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:04 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000000200)=""/132) (async) ioctl$TIOCMIWAIT(r0, 0x545c, 0x0) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:12:04 executing program 5: syz_open_dev$ptys(0xc, 0x3, 0x1) syz_io_uring_setup(0x192b, &(0x7f0000000180), &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000080), &(0x7f0000000200)) 16:12:04 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xa57a61b5}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1169.876907][ T3638] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1169.876914][T19716] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1169.876970][ T3638] Bluetooth: hci8: command tx timeout [ 1169.883056][T19716] Bluetooth: hci7: command tx timeout 16:12:04 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000000200)=""/132) ioctl$TIOCMIWAIT(r0, 0x545c, 0x0) ioctl$TIOCSTI(r0, 0x5437, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000000200)=""/132) (async) ioctl$TIOCMIWAIT(r0, 0x545c, 0x0) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) 16:12:04 executing program 5: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) write$UHID_CREATE(r0, 0x0, 0x0) 16:12:04 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0xb8b}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:04 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4) ioctl$TIOCSTI(r0, 0x5437, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) r3 = dup(r1) write$6lowpan_enable(r3, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x145140, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x9) ioctl$TIOCSTI(r4, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r0, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) dup(r1) (async) write$6lowpan_enable(r3, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x145140, 0x0) (async) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r4, 0x400455c8, 0x9) (async) ioctl$TIOCSTI(r4, 0x5437, 0x0) (async) 16:12:04 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xb0efff7f}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:04 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001480), 0xffffffffffffffff) sendmsg$NL80211_CMD_TDLS_MGMT(r0, &(0x7f0000001640)={0x0, 0x0, &(0x7f0000001600)={&(0x7f00000014c0)={0x1c, r1, 0x109, 0x0, 0x0, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x6, 0x2a, [@random]}]}, 0x1c}}, 0x0) 16:12:04 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x3ff, 0x3, 0x6, 0x3, 0x6, "9fd5d8127d7bcaa2d63c6f58e8feaea457804f"}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) ioctl$TIOCSTI(r0, 0x5437, 0x0) [ 1169.956464][T19716] Bluetooth: hci6: sending frame failed (-49) [ 1169.962654][ T3638] Bluetooth: hci9: command 0x1003 tx timeout [ 1169.967097][ T3656] Bluetooth: hci9: Opcode 0x1003 failed: -110 [ 1169.970867][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:12:04 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000080), 0x10001, 0x40e941) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:12:04 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xb5617aa5}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:04 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0xb8d}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:04 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r0, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14}, 0x14}}, 0x0) 16:12:04 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000080), 0x10001, 0x40e941) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000080), 0x10001, 0x40e941) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) [ 1170.060568][ T3656] Bluetooth: hci6: sending frame failed (-49) [ 1170.067018][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:12:04 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0xf00}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:04 executing program 5: openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r0, 0x89fb, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000180)={@remote, @initdev={0xac, 0x1e, 0x20, 0x0}, 0x400b, 0xc}}) 16:12:04 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xf0ffffff}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1170.101923][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) [ 1170.132445][T30975] can0: slcan on ptm1. [ 1170.184581][ T3638] Bluetooth: hci9: sending frame failed (-49) [ 1170.192208][T30975] can0 (unregistered): slcan off ptm1. [ 1170.194028][ T3657] Bluetooth: hci9: Opcode 0x1003 failed: -49 [ 1172.116928][ T3656] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1172.116928][ T3657] Bluetooth: hci6: command 0x1003 tx timeout [ 1172.116989][ T3656] Bluetooth: hci7: command 0x1003 tx timeout [ 1172.123303][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:12:06 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r0, 0x400455c8, 0x4) (async, rerun: 32) ioctl$TIOCSTI(r0, 0x5437, 0x0) (rerun: 32) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) (async) r3 = dup(r1) write$6lowpan_enable(r3, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x145140, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x9) (async) ioctl$TIOCSTI(r4, 0x5437, 0x0) 16:12:06 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x1a00}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:06 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) bind$unix(r1, &(0x7f0000000240)=@abs={0x1}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000002e00)=[{{0x0, 0x0, &(0x7f0000002ec0)=[{&(0x7f0000000440)=""/107, 0x6b}], 0x1}}], 0x1, 0x0, 0x0) 16:12:06 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xfdffffff}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:06 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:12:06 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async, rerun: 32) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x3ff, 0x3, 0x6, 0x3, 0x6, "9fd5d8127d7bcaa2d63c6f58e8feaea457804f"}) (async, rerun: 32) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:12:06 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x3f00}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1172.196843][ T3647] Bluetooth: hci8: command 0x1003 tx timeout [ 1172.196858][T19716] Bluetooth: hci8: Opcode 0x1003 failed: -110 16:12:06 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xfffff000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:06 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000280)) r2 = dup2(r1, r1) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r2, 0x5607) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000140)=@filter={'filter\x00', 0xe, 0x1, 0x246, [0x0, 0x200002c0, 0x200002f0, 0x20000320], 0x0, &(0x7f0000000100), &(0x7f00000002c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{0x3, 0x40, 0x3, 'veth0_macvtap\x00', 'veth1_to_batadv\x00', 'batadv_slave_1\x00', 'dvmrp0\x00', @random="d7a98732bf31", [0x0, 0xff, 0x0, 0x0, 0xff], @broadcast, [0x0, 0x0, 0x0, 0xff, 0xff], 0xe6, 0x17e, 0x1b6, [@ip6={{'ip6\x00', 0x0, 0x50}, {{@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @loopback, [0xff000000, 0xffffff00, 0xff, 0xffffffff], [0xff, 0x0, 0x0, 0xffffffff], 0x15, 0x88, 0x42, 0x8, 0x4e20, 0x4e20, 0x0, 0x4e20}}}], [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x8, 0x7f, {0x6}}}}, @common=@log={'log\x00', 0x28, {{0x4, "5479dc7c3da7a884eed0aa0f79f3c5d7668c8a7745e5362683bf0deb6ca4", 0x1}}}], @common=@dnat={'dnat\x00', 0x10, {{@broadcast, 0x7fffffffffffffff}}}}]}]}, 0x2be) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x4) ioctl$TIOCSTI(r3, 0x5437, 0x0) 16:12:06 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x8b0b}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1172.285835][ T5905] Bluetooth: hci6: Frame reassembly failed (-84) 16:12:06 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0x8d0b}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:06 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xffffff7f}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:07 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0xf000}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1172.391483][ T3734] Bluetooth: hci8: Frame reassembly failed (-84) 16:12:07 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {0x9, 0x0, 0xffff}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:07 executing program 5: openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0), 0x4240, 0x0) 16:12:07 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x3}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1173.071423][T31028] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. 16:12:08 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000840)={&(0x7f0000000700), 0xc, &(0x7f0000000800)={&(0x7f0000000780)={0x1c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}}, 0x0) 16:12:08 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xffffff9e}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:08 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x5}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:08 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async, rerun: 32) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 32) socket$inet6_tcp(0xa, 0x1, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) [ 1174.356916][ T3638] Bluetooth: hci7: command 0x1003 tx timeout [ 1174.356916][ T3656] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1174.356980][ T3656] Bluetooth: hci6: command 0x1003 tx timeout [ 1174.366893][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:12:09 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local}}) 16:12:09 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x3ff, 0x3, 0x6, 0x3, 0x6, "9fd5d8127d7bcaa2d63c6f58e8feaea457804f"}) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TIOCOUTQ(r2, 0x5411, &(0x7f0000000140)) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:12:09 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xfffffff0}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:09 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x9}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:09 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000280)) (async) r2 = dup2(r1, r1) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r2, 0x5607) (async) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000140)=@filter={'filter\x00', 0xe, 0x1, 0x246, [0x0, 0x200002c0, 0x200002f0, 0x20000320], 0x0, &(0x7f0000000100), &(0x7f00000002c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{0x3, 0x40, 0x3, 'veth0_macvtap\x00', 'veth1_to_batadv\x00', 'batadv_slave_1\x00', 'dvmrp0\x00', @random="d7a98732bf31", [0x0, 0xff, 0x0, 0x0, 0xff], @broadcast, [0x0, 0x0, 0x0, 0xff, 0xff], 0xe6, 0x17e, 0x1b6, [@ip6={{'ip6\x00', 0x0, 0x50}, {{@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @loopback, [0xff000000, 0xffffff00, 0xff, 0xffffffff], [0xff, 0x0, 0x0, 0xffffffff], 0x15, 0x88, 0x42, 0x8, 0x4e20, 0x4e20, 0x0, 0x4e20}}}], [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x8, 0x7f, {0x6}}}}, @common=@log={'log\x00', 0x28, {{0x4, "5479dc7c3da7a884eed0aa0f79f3c5d7668c8a7745e5362683bf0deb6ca4", 0x1}}}], @common=@dnat={'dnat\x00', 0x10, {{@broadcast, 0x7fffffffffffffff}}}}]}]}, 0x2be) (async) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) [ 1174.399350][T31035] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1174.436933][ T3647] Bluetooth: hci8: Opcode 0x1003 failed: -110 [ 1174.443462][ T3647] Bluetooth: hci8: command tx timeout 16:12:09 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xfffffffd}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:09 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000780)={0x28, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x28}}, 0x0) 16:12:09 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x18}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1174.481799][ T5903] Bluetooth: hci6: Frame reassembly failed (-84) [ 1174.505998][T31053] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1174.515119][T31053] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1174.515930][T31039] ptm ptm24: ldisc open failed (-12), clearing slot 24 16:12:09 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x25}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:09 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x7ffffffff000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1174.551616][T31060] netlink: 'syz-executor.3': attribute type 1 has an invalid length. [ 1174.566721][T31055] ptm ptm25: ldisc open failed (-12), clearing slot 25 16:12:09 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async, rerun: 64) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (rerun: 64) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async, rerun: 32) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 32) socket$inet6_tcp(0xa, 0x1, 0x0) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:12:09 executing program 5: r0 = gettid() process_vm_readv(r0, &(0x7f0000000a40)=[{&(0x7f0000000740)=""/244, 0xf4}, {0x0}], 0x2, &(0x7f0000000bc0)=[{&(0x7f0000000a80)=""/178, 0xb2}, {0x0}], 0x2, 0x0) 16:12:09 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000280)) r2 = dup2(r1, r1) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) ioctl$VT_WAITACTIVE(r2, 0x5607) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000140)=@filter={'filter\x00', 0xe, 0x1, 0x246, [0x0, 0x200002c0, 0x200002f0, 0x20000320], 0x0, &(0x7f0000000100), &(0x7f00000002c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{0x3, 0x40, 0x3, 'veth0_macvtap\x00', 'veth1_to_batadv\x00', 'batadv_slave_1\x00', 'dvmrp0\x00', @random="d7a98732bf31", [0x0, 0xff, 0x0, 0x0, 0xff], @broadcast, [0x0, 0x0, 0x0, 0xff, 0xff], 0xe6, 0x17e, 0x1b6, [@ip6={{'ip6\x00', 0x0, 0x50}, {{@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @loopback, [0xff000000, 0xffffff00, 0xff, 0xffffffff], [0xff, 0x0, 0x0, 0xffffffff], 0x15, 0x88, 0x42, 0x8, 0x4e20, 0x4e20, 0x0, 0x4e20}}}], [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x8, 0x7f, {0x6}}}}, @common=@log={'log\x00', 0x28, {{0x4, "5479dc7c3da7a884eed0aa0f79f3c5d7668c8a7745e5362683bf0deb6ca4", 0x1}}}], @common=@dnat={'dnat\x00', 0x10, {{@broadcast, 0x7fffffffffffffff}}}}]}]}, 0x2be) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x4) ioctl$TIOCSTI(r3, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) dup(0xffffffffffffffff) (async) write$6lowpan_enable(r0, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) syz_open_dev$tty20(0xc, 0x4, 0x0) (async) ioctl$KDGETMODE(r1, 0x4b3b, &(0x7f0000000280)) (async) dup2(r1, r1) (async) ioctl$TCSETSW(r2, 0x5403, &(0x7f0000000000)={0x0, 0xff, 0x0, 0x0, 0x0, "b6209f90800d414b87a7c20e921a1bbe239d5a"}) (async) ioctl$VT_WAITACTIVE(r2, 0x5607) (async) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000140)=@filter={'filter\x00', 0xe, 0x1, 0x246, [0x0, 0x200002c0, 0x200002f0, 0x20000320], 0x0, &(0x7f0000000100), &(0x7f00000002c0)=[{0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{0x3, 0x40, 0x3, 'veth0_macvtap\x00', 'veth1_to_batadv\x00', 'batadv_slave_1\x00', 'dvmrp0\x00', @random="d7a98732bf31", [0x0, 0xff, 0x0, 0x0, 0xff], @broadcast, [0x0, 0x0, 0x0, 0xff, 0xff], 0xe6, 0x17e, 0x1b6, [@ip6={{'ip6\x00', 0x0, 0x50}, {{@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @loopback, [0xff000000, 0xffffff00, 0xff, 0xffffffff], [0xff, 0x0, 0x0, 0xffffffff], 0x15, 0x88, 0x42, 0x8, 0x4e20, 0x4e20, 0x0, 0x4e20}}}], [@common=@RATEEST={'RATEEST\x00', 0x20, {{'syz1\x00', 0x8, 0x7f, {0x6}}}}, @common=@log={'log\x00', 0x28, {{0x4, "5479dc7c3da7a884eed0aa0f79f3c5d7668c8a7745e5362683bf0deb6ca4", 0x1}}}], @common=@dnat={'dnat\x00', 0x10, {{@broadcast, 0x7fffffffffffffff}}}}]}]}, 0x2be) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r3, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) (async) [ 1174.594304][T31065] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. [ 1174.662506][ T3734] Bluetooth: hci7: Frame reassembly failed (-84) 16:12:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) 16:12:11 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x2}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:11 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x40030000000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:11 executing program 5: syz_io_uring_setup(0x0, &(0x7f0000001540), &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000015c0), &(0x7f0000001600)) 16:12:11 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x42e4, 0xe8f8, 0x1, &(0x7f0000000140)={[0xfe41]}, 0x8) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) sched_setattr(r2, &(0x7f0000000380)={0x38, 0x0, 0x0, 0x10001, 0x1, 0xfffffffffffffffe, 0xb, 0x8, 0x8, 0x9}, 0x0) ptrace$peekuser(0x3, r2, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x4) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) r4 = open(&(0x7f0000000100)='./file0\x00', 0x250001, 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000180), 0x6aa200, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r5, 0x400455c8, 0x4) ioctl$TIOCSTI(r5, 0x5437, 0x0) ioctl$KDADDIO(r4, 0x400455c8, 0x100000001) ioctl$TIOCSTI(r3, 0x5437, 0x0) [ 1176.516879][ T3656] Bluetooth: hci6: command 0x1003 tx timeout [ 1176.517925][ T1236] ieee802154 phy0 wpan0: encryption failed: -22 [ 1176.522980][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1176.529944][ T1236] ieee802154 phy1 wpan1: encryption failed: -22 16:12:11 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(0xffffffffffffffff, &(0x7f00000020c0)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000640)=""/208, 0xd0}, {&(0x7f0000000740)=""/72, 0x48}, {&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f00000007c0)=""/227, 0xe3}, {0x0}, {0x0}], 0x6, &(0x7f0000000440)=""/46, 0x2e}}, {{&(0x7f0000001b00)=@ll, 0x80, &(0x7f0000001f80)=[{&(0x7f0000001b80)=""/100, 0x64}, {&(0x7f0000001c00)=""/223, 0xdf}, {0x0}, {&(0x7f0000000a40)=""/14, 0xe}, {0x0}, {0x0}], 0x6, &(0x7f0000002000)=""/158, 0x9e}, 0x1}], 0x2, 0x0, &(0x7f0000002140)) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={0x0, r2}, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDPRL(0xffffffffffffffff, 0x89f5, &(0x7f0000000340)={'sit0\x00', 0x0}) open(&(0x7f0000000040)='./file0/file0\x00', 0x181000, 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x125) fcntl$setstatus(r3, 0x4, 0x46802) open(&(0x7f0000000180)='./file1\x00', 0x100, 0x41) io_setup(0x100000000000c333, &(0x7f0000000140)=0x0) io_submit(r4, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 16:12:11 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xf0ffffff7f0000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:11 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x5}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:11 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xf0ffffffffffff}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:11 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) r2 = accept$ax25(r0, &(0x7f0000000100)={{0x3, @default}, [@default, @netrom, @null, @remote, @netrom, @netrom, @default]}, &(0x7f0000000180)=0x48) sendmsg(r2, &(0x7f00000006c0)={&(0x7f00000001c0)=@qipcrtr={0x2a, 0x0, 0x7ffe}, 0x80, &(0x7f0000000540)=[{&(0x7f00000002c0)="eb5a5f224515950e81d718329e71804f24922930541be20836d495c55d535eb0c5d149939201ecaac9b2f0072d354935fbb90fc647fe5c1770449987ecb8f053a3c3283c15f82a1125667605ca647e3d342dd7b3e3901623934544a8b114ed24fc79", 0x62}, {&(0x7f0000000340)="2a7c9bb291cc2007cc0122f6cb9d4611e4d93cb594509753c205ed995cbc26f610d207099564137efe19be8007fb4beba33ed1277c85f05c01b52b8ad705b9fd563a0a3c4e1fc88d971c293dcb844a32e96ca9cf45d756d9f7168d760318c6e4f72de559b99728a4b24a37a2910a4ac41635ac335c832ea2a1a1ddbb8b66571b480f6bf9874a8e0346d0486d0a4fb91177f9fd0ecc92e82ad0f970c73516afd1e4aab19a1b2fb806b7941e5ba5ea8c4139e4a2bf07b3f05958efa0684cabe34cb2b192943d9748ba66f6f0", 0xcb}, {&(0x7f0000000440)="a0e3c3ddcf318bd302ded7bd7cf52c6e4cb0fbf69f224628248f883e6378d4a055df62187c53d918d64cc705e6a90e7eef5debe493faaa38bd5d269854b24dbbe99680910729384aa528419ca1c5cd96c5dff50288cce86b6e39dfca30e1ae71335a76ff2c6dec0308e7df5018a4a0225269b9b9e8a2f678c633cc669a400f1b1b6b3f47498f467b3c62821374dc3e38b312257ad215246b0763b7672c8e6816020f267795d0b68e0fbd8bbb1390546e4bf7cc376f0543c03f3f74299e0400c1b1", 0xc1}], 0x3, &(0x7f0000000580)=[{0x108, 0x115, 0x6, "7d83437ee9de86888611781f5153b87eb3a2bbd1366e7f4ffca85fceda6fcfb07f33699408ac96a59e74ff189ad73833ecc884541ab66d59ddc898fc43d9fe60821fc3365778e1821c9c4094dd13facf38fde7cb0d7aac452b21a74814eb29bed7f7e56a75719a546c0bb747cc172a79d33fd20a40f31a678f709610bbd65d25fce14dea832a5bb9193f77da7277985bd594ddc43c0c73cd656f57272a336ef409ea862b85882493e4f2ce6c661d84457b5405e280dc4d2de69e2adb20f06214a599e645e8dafadb5b67820863a409407a844a98eb61306765bbbfca68a400884a8f0c13e22e802a34c90d0dd74a3c1a8ca059"}], 0x108}, 0x40090) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) [ 1176.658600][T31091] can0: slcan on ptm2. [ 1176.676863][ T3647] Bluetooth: hci7: command 0x1003 tx timeout [ 1176.682949][T19716] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:12:11 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x100000000000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1176.736245][ T5903] Bluetooth: hci7: Frame reassembly failed (-84) [ 1176.768954][T31091] can0 (unregistered): slcan off ptm2. 16:12:11 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x6}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) 16:12:11 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x200000000000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:11 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x300000000000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:11 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x7}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1176.853443][T31112] netlink: 'syz-executor.3': attribute type 6 has an invalid length. [ 1176.875131][T31114] can0: slcan on ptm2. [ 1176.954932][T31122] netlink: 'syz-executor.3': attribute type 7 has an invalid length. [ 1177.027382][T31117] can0 (unregistered): slcan off ptm2. 16:12:13 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async, rerun: 32) io_uring_enter(0xffffffffffffffff, 0x42e4, 0xe8f8, 0x1, &(0x7f0000000140)={[0xfe41]}, 0x8) (async, rerun: 32) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) (async) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) sched_setattr(r2, &(0x7f0000000380)={0x38, 0x0, 0x0, 0x10001, 0x1, 0xfffffffffffffffe, 0xb, 0x8, 0x8, 0x9}, 0x0) (async) ptrace$peekuser(0x3, r2, 0x0) (async, rerun: 64) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (rerun: 64) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x4) (async) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) (async) r4 = open(&(0x7f0000000100)='./file0\x00', 0x250001, 0x0) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000180), 0x6aa200, 0x0) (async, rerun: 32) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (rerun: 32) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r5, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r5, 0x5437, 0x0) (async) ioctl$KDADDIO(r4, 0x400455c8, 0x100000001) ioctl$TIOCSTI(r3, 0x5437, 0x0) 16:12:13 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x400000000000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:13 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:13 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r0, 0x5437, 0x0) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) ioctl$TIOCSTI(r0, 0x5437, 0x0) (async) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) (async) 16:12:13 executing program 5: sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x1, 0x5, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="a40000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000007400128009000100766c616e000000006400028006000100000000000c0002000e0000000a0000004c0003800c000100ffffffff090000000c0001007f000000020000000c0001000200000000000015a7b5fd9ec27e4e00030000200c00010009000000fc0200000c00010004000000faffffff08000500", @ANYRES32=r2, @ANYBLOB='\b\x00\n\x00'], 0xa4}}, 0x0) 16:12:13 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) r2 = accept$ax25(r0, &(0x7f0000000100)={{0x3, @default}, [@default, @netrom, @null, @remote, @netrom, @netrom, @default]}, &(0x7f0000000180)=0x48) sendmsg(r2, &(0x7f00000006c0)={&(0x7f00000001c0)=@qipcrtr={0x2a, 0x0, 0x7ffe}, 0x80, &(0x7f0000000540)=[{&(0x7f00000002c0)="eb5a5f224515950e81d718329e71804f24922930541be20836d495c55d535eb0c5d149939201ecaac9b2f0072d354935fbb90fc647fe5c1770449987ecb8f053a3c3283c15f82a1125667605ca647e3d342dd7b3e3901623934544a8b114ed24fc79", 0x62}, {&(0x7f0000000340)="2a7c9bb291cc2007cc0122f6cb9d4611e4d93cb594509753c205ed995cbc26f610d207099564137efe19be8007fb4beba33ed1277c85f05c01b52b8ad705b9fd563a0a3c4e1fc88d971c293dcb844a32e96ca9cf45d756d9f7168d760318c6e4f72de559b99728a4b24a37a2910a4ac41635ac335c832ea2a1a1ddbb8b66571b480f6bf9874a8e0346d0486d0a4fb91177f9fd0ecc92e82ad0f970c73516afd1e4aab19a1b2fb806b7941e5ba5ea8c4139e4a2bf07b3f05958efa0684cabe34cb2b192943d9748ba66f6f0", 0xcb}, {&(0x7f0000000440)="a0e3c3ddcf318bd302ded7bd7cf52c6e4cb0fbf69f224628248f883e6378d4a055df62187c53d918d64cc705e6a90e7eef5debe493faaa38bd5d269854b24dbbe99680910729384aa528419ca1c5cd96c5dff50288cce86b6e39dfca30e1ae71335a76ff2c6dec0308e7df5018a4a0225269b9b9e8a2f678c633cc669a400f1b1b6b3f47498f467b3c62821374dc3e38b312257ad215246b0763b7672c8e6816020f267795d0b68e0fbd8bbb1390546e4bf7cc376f0543c03f3f74299e0400c1b1", 0xc1}], 0x3, &(0x7f0000000580)=[{0x108, 0x115, 0x6, "7d83437ee9de86888611781f5153b87eb3a2bbd1366e7f4ffca85fceda6fcfb07f33699408ac96a59e74ff189ad73833ecc884541ab66d59ddc898fc43d9fe60821fc3365778e1821c9c4094dd13facf38fde7cb0d7aac452b21a74814eb29bed7f7e56a75719a546c0bb747cc172a79d33fd20a40f31a678f709610bbd65d25fce14dea832a5bb9193f77da7277985bd594ddc43c0c73cd656f57272a336ef409ea862b85882493e4f2ce6c661d84457b5405e280dc4d2de69e2adb20f06214a599e645e8dafadb5b67820863a409407a844a98eb61306765bbbfca68a400884a8f0c13e22e802a34c90d0dd74a3c1a8ca059"}], 0x108}, 0x40090) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) [ 1178.756927][ T3656] Bluetooth: hci7: command 0x1003 tx timeout [ 1178.756942][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1178.763209][ T3656] Bluetooth: hci6: command 0x1003 tx timeout [ 1178.769328][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 16:12:13 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x500000000000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1178.815388][T31166] netlink: 'syz-executor.3': attribute type 8 has an invalid length. [ 1178.824754][T31168] can0: slcan on ptm0. [ 1178.824807][T31175] netlink: 36 bytes leftover after parsing attributes in process `syz-executor.5'. 16:12:13 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x600000000000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:13 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x42e4, 0xe8f8, 0x1, &(0x7f0000000140)={[0xfe41]}, 0x8) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) sched_setattr(r2, &(0x7f0000000380)={0x38, 0x0, 0x0, 0x10001, 0x1, 0xfffffffffffffffe, 0xb, 0x8, 0x8, 0x9}, 0x0) ptrace$peekuser(0x3, r2, 0x0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x4) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) r4 = open(&(0x7f0000000100)='./file0\x00', 0x250001, 0x0) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000180), 0x6aa200, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r5, 0x400455c8, 0x4) ioctl$TIOCSTI(r5, 0x5437, 0x0) ioctl$KDADDIO(r4, 0x400455c8, 0x100000001) ioctl$TIOCSTI(r3, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) io_uring_enter(0xffffffffffffffff, 0x42e4, 0xe8f8, 0x1, &(0x7f0000000140)={[0xfe41]}, 0x8) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) dup(r0) (async) getpid() (async) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) (async) sched_setattr(r2, &(0x7f0000000380)={0x38, 0x0, 0x0, 0x10001, 0x1, 0xfffffffffffffffe, 0xb, 0x8, 0x8, 0x9}, 0x0) (async) ptrace$peekuser(0x3, r2, 0x0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x4) (async) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) (async) open(&(0x7f0000000100)='./file0\x00', 0x250001, 0x0) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000180), 0x6aa200, 0x0) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r5, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r5, 0x5437, 0x0) (async) ioctl$KDADDIO(r4, 0x400455c8, 0x100000001) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) (async) 16:12:13 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000080)={'ip6_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @mcast2, @ipv4={'\x00', '\xff\xff', @multicast1}}}) [ 1178.858378][ T3647] Bluetooth: hci6: sending frame failed (-49) [ 1178.864634][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:12:13 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x9}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:13 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x700000000000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:13 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) [ 1178.900971][T31185] ptm ptm2: ldisc open failed (-12), clearing slot 2 [ 1178.908278][T31168] can0 (unregistered): slcan off ptm0. 16:12:13 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) r2 = accept$ax25(r0, &(0x7f0000000100)={{0x3, @default}, [@default, @netrom, @null, @remote, @netrom, @netrom, @default]}, &(0x7f0000000180)=0x48) sendmsg(r2, &(0x7f00000006c0)={&(0x7f00000001c0)=@qipcrtr={0x2a, 0x0, 0x7ffe}, 0x80, &(0x7f0000000540)=[{&(0x7f00000002c0)="eb5a5f224515950e81d718329e71804f24922930541be20836d495c55d535eb0c5d149939201ecaac9b2f0072d354935fbb90fc647fe5c1770449987ecb8f053a3c3283c15f82a1125667605ca647e3d342dd7b3e3901623934544a8b114ed24fc79", 0x62}, {&(0x7f0000000340)="2a7c9bb291cc2007cc0122f6cb9d4611e4d93cb594509753c205ed995cbc26f610d207099564137efe19be8007fb4beba33ed1277c85f05c01b52b8ad705b9fd563a0a3c4e1fc88d971c293dcb844a32e96ca9cf45d756d9f7168d760318c6e4f72de559b99728a4b24a37a2910a4ac41635ac335c832ea2a1a1ddbb8b66571b480f6bf9874a8e0346d0486d0a4fb91177f9fd0ecc92e82ad0f970c73516afd1e4aab19a1b2fb806b7941e5ba5ea8c4139e4a2bf07b3f05958efa0684cabe34cb2b192943d9748ba66f6f0", 0xcb}, {&(0x7f0000000440)="a0e3c3ddcf318bd302ded7bd7cf52c6e4cb0fbf69f224628248f883e6378d4a055df62187c53d918d64cc705e6a90e7eef5debe493faaa38bd5d269854b24dbbe99680910729384aa528419ca1c5cd96c5dff50288cce86b6e39dfca30e1ae71335a76ff2c6dec0308e7df5018a4a0225269b9b9e8a2f678c633cc669a400f1b1b6b3f47498f467b3c62821374dc3e38b312257ad215246b0763b7672c8e6816020f267795d0b68e0fbd8bbb1390546e4bf7cc376f0543c03f3f74299e0400c1b1", 0xc1}], 0x3, &(0x7f0000000580)=[{0x108, 0x115, 0x6, "7d83437ee9de86888611781f5153b87eb3a2bbd1366e7f4ffca85fceda6fcfb07f33699408ac96a59e74ff189ad73833ecc884541ab66d59ddc898fc43d9fe60821fc3365778e1821c9c4094dd13facf38fde7cb0d7aac452b21a74814eb29bed7f7e56a75719a546c0bb747cc172a79d33fd20a40f31a678f709610bbd65d25fce14dea832a5bb9193f77da7277985bd594ddc43c0c73cd656f57272a336ef409ea862b85882493e4f2ce6c661d84457b5405e280dc4d2de69e2adb20f06214a599e645e8dafadb5b67820863a409407a844a98eb61306765bbbfca68a400884a8f0c13e22e802a34c90d0dd74a3c1a8ca059"}], 0x108}, 0x40090) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) dup(0xffffffffffffffff) (async) write$6lowpan_enable(r0, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) accept$ax25(r0, &(0x7f0000000100)={{0x3, @default}, [@default, @netrom, @null, @remote, @netrom, @netrom, @default]}, &(0x7f0000000180)=0x48) (async) sendmsg(r2, &(0x7f00000006c0)={&(0x7f00000001c0)=@qipcrtr={0x2a, 0x0, 0x7ffe}, 0x80, &(0x7f0000000540)=[{&(0x7f00000002c0)="eb5a5f224515950e81d718329e71804f24922930541be20836d495c55d535eb0c5d149939201ecaac9b2f0072d354935fbb90fc647fe5c1770449987ecb8f053a3c3283c15f82a1125667605ca647e3d342dd7b3e3901623934544a8b114ed24fc79", 0x62}, {&(0x7f0000000340)="2a7c9bb291cc2007cc0122f6cb9d4611e4d93cb594509753c205ed995cbc26f610d207099564137efe19be8007fb4beba33ed1277c85f05c01b52b8ad705b9fd563a0a3c4e1fc88d971c293dcb844a32e96ca9cf45d756d9f7168d760318c6e4f72de559b99728a4b24a37a2910a4ac41635ac335c832ea2a1a1ddbb8b66571b480f6bf9874a8e0346d0486d0a4fb91177f9fd0ecc92e82ad0f970c73516afd1e4aab19a1b2fb806b7941e5ba5ea8c4139e4a2bf07b3f05958efa0684cabe34cb2b192943d9748ba66f6f0", 0xcb}, {&(0x7f0000000440)="a0e3c3ddcf318bd302ded7bd7cf52c6e4cb0fbf69f224628248f883e6378d4a055df62187c53d918d64cc705e6a90e7eef5debe493faaa38bd5d269854b24dbbe99680910729384aa528419ca1c5cd96c5dff50288cce86b6e39dfca30e1ae71335a76ff2c6dec0308e7df5018a4a0225269b9b9e8a2f678c633cc669a400f1b1b6b3f47498f467b3c62821374dc3e38b312257ad215246b0763b7672c8e6816020f267795d0b68e0fbd8bbb1390546e4bf7cc376f0543c03f3f74299e0400c1b1", 0xc1}], 0x3, &(0x7f0000000580)=[{0x108, 0x115, 0x6, "7d83437ee9de86888611781f5153b87eb3a2bbd1366e7f4ffca85fceda6fcfb07f33699408ac96a59e74ff189ad73833ecc884541ab66d59ddc898fc43d9fe60821fc3365778e1821c9c4094dd13facf38fde7cb0d7aac452b21a74814eb29bed7f7e56a75719a546c0bb747cc172a79d33fd20a40f31a678f709610bbd65d25fce14dea832a5bb9193f77da7277985bd594ddc43c0c73cd656f57272a336ef409ea862b85882493e4f2ce6c661d84457b5405e280dc4d2de69e2adb20f06214a599e645e8dafadb5b67820863a409407a844a98eb61306765bbbfca68a400884a8f0c13e22e802a34c90d0dd74a3c1a8ca059"}], 0x108}, 0x40090) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) 16:12:13 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$FIONREAD(r0, 0x541b, 0x0) 16:12:13 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$KDADDIO(0xffffffffffffffff, 0x4b34, 0x6) ioctl$TIOCSTI(r1, 0x5437, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) ioctl$TIOCSTI(r2, 0x5437, 0x0) ioctl$TIOCSTI(r2, 0x5437, 0x0) [ 1178.979672][T31197] netlink: 'syz-executor.3': attribute type 9 has an invalid length. 16:12:13 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0xa}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1179.033255][ T3734] Bluetooth: hci6: Frame reassembly failed (-84) 16:12:13 executing program 5: syz_open_dev$evdev(&(0x7f00000003c0), 0x0, 0x40200) 16:12:13 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0xb}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:13 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x900000000000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1179.080750][T31207] netlink: 'syz-executor.3': attribute type 10 has an invalid length. [ 1179.116411][ T3656] Bluetooth: hci7: sending frame failed (-49) [ 1179.122781][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -49 [ 1179.138887][T31230] can0: slcan on ptm3. [ 1179.146871][ T3656] Bluetooth: hci7: sending frame failed (-49) [ 1179.153068][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -49 [ 1179.201054][ T3734] Bluetooth: hci7: Frame reassembly failed (-84) [ 1179.896927][ T27] IPv6: ADDRCONF(NETDEV_CHANGE): can0: link becomes ready [ 1179.998518][T31229] can0 (unregistered): slcan off ptm3. 16:12:15 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:12:15 executing program 5: syz_open_dev$vcsn(&(0x7f00000000c0), 0x0, 0x200) 16:12:15 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000e22f55010000", @ANYRES32=r1, @ANYBLOB="02000000030000002e2f66696c653000"]) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0xe) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='net_dev_xmit\x00', r2}, 0x10) 16:12:15 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xf00000000000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:15 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x10}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:15 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000e22f55010000", @ANYRES32=r1, @ANYBLOB="02000000030000002e2f66696c653000"]) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0xe) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='net_dev_xmit\x00', r2}, 0x10) 16:12:15 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={&(0x7f0000000080)={0x14}, 0x14}, 0xd}, 0x0) [ 1181.076876][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1181.114370][T31345] netlink: 'syz-executor.3': attribute type 16 has an invalid length. [ 1181.141754][ T3656] Bluetooth: hci6: sending frame failed (-49) [ 1181.148271][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:12:15 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$KDADDIO(0xffffffffffffffff, 0x4b34, 0x6) (async, rerun: 32) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async, rerun: 32) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:12:15 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x3f00000000000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:15 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x11}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:15 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000e22f55010000", @ANYRES32=r1, @ANYBLOB="02000000030000002e2f66696c653000"]) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0xe) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='net_dev_xmit\x00', r2}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) dup(0xffffffffffffffff) (async) write$6lowpan_enable(r0, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_FAIL(r0, 0xc0189377, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000e22f55010000", @ANYRES32=r1, @ANYBLOB="02000000030000002e2f66696c653000"]) (async) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0xe) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='net_dev_xmit\x00', r2}, 0x10) (async) 16:12:15 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)) pselect6(0x40, &(0x7f0000000080)={0x9}, 0x0, 0x0, 0x0, 0x0) 16:12:15 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async, rerun: 64) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async, rerun: 64) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) (async, rerun: 64) ioctl$KDADDIO(r0, 0x400455c8, 0x4) (async, rerun: 64) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:12:15 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1d}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1181.246975][T19716] Bluetooth: hci7: command 0x1003 tx timeout [ 1181.246983][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1181.281446][T31364] netlink: 'syz-executor.3': attribute type 17 has an invalid length. [ 1181.286383][T31367] can0: slcan on ptm0. 16:12:15 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r0, 0x400455c8, 0x4) ioctl$TIOCSTI(r0, 0x5437, 0x0) 16:12:15 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x8b0b000000000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:15 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000000180)={0x81, {{0xa, 0x4e24, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}}}, 0x88) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) fcntl$lock(r1, 0x26, &(0x7f0000000140)={0x1, 0x1, 0x4, 0x8, 0xffffffffffffffff}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x4) r4 = openat$incfs(r0, &(0x7f0000000100)='.log\x00', 0xa280, 0x120) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="60040000290000012dbd7000fddbdf2504000000", @ANYRES32=0x0, @ANYBLOB="f1fff3ff0c00040010000f000b00010074617072696f0000080001007366710006000500b25d000008000100636273000800010063627100080402000404060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000001000000e300000081000000ff0f000008000000337b29990f92a1944cb25f3262ffdab0de0000005e000000ff0700000010000058040000000100000600000008000000ffff0000ff7f000000800000950200000100000000010000ff0f000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bd8900000200000004000000ff7f00000500000001000000060000000100008002000000ffff0000c90f000007000000feffffff000000000010000004000000030000000300000000020000010001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff07000001000000ffffff7f0100000001000000000000003d0700000400000008000000ff00000009000000ffffffffa90e00000600000001000000ff0f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000040000004000000009000000070000000200000009000000f9ffffff04000000030000000300000044000000ffffff7f090000000000010000100000eb08000070000000080000000500000015000000ffff0000f9ffffff07000000080000000200000081000000020000000200000000800000050000005b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001feffff0000000000000000000000000000000000000000000000008992899dcaab9fcc68d2783d70c7283444bc0a4918686483b0b4213344bb013a249a7ec4bc7e0634d6a5f0a9f8000f05eee295e5ce82146f9a0d873e21918d1fcee9ae2574fab0a99d7e15ef23e1ba0ba0312f34d100492299109c216115ceab81f7e1698eb67c99910eb71a9f09cdab6ab50d9f4865cbf807e4b1f8fdd06e7ccc0d908e054e"], 0x460}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'gre0\x00', &(0x7f0000000240)={'ip_vti0\x00', 0x0, 0x7800, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @multicast2}}}}) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)=@bridge_setlink={0xb0, 0x13, 0x8, 0x70bd2c, 0x25dfdbfc, {0x7, 0x0, 0x0, 0x0, 0x8000, 0x50000}, [@IFLA_EVENT={0x8}, @IFLA_EVENT={0x8}, @IFLA_IFALIASn={0x4}, @IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x5}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_ENCAP_LIMIT={0x5, 0xb, 0x2}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x2}, @IFLA_GRE_IKEY={0x8, 0x4, 0x40}]}}}, @IFLA_GROUP={0x8, 0x1b, 0x5}, @IFLA_XDP={0x34, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x4}, @IFLA_XDP_FD={0x8, 0x1, r2}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x4}, @IFLA_XDP_EXPECTED_FD={0x8, 0x8, r2}, @IFLA_XDP_FD={0x8, 0x1, r0}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x11}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x5}, 0x40010) close(r4) ioctl$TIOCSTI(r3, 0x5437, 0x0) 16:12:15 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x9effffff00000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x25}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1181.385834][ T5903] Bluetooth: hci6: Frame reassembly failed (-84) [ 1181.411080][ T3656] Bluetooth: hci7: sending frame failed (-49) [ 1181.417972][T19716] Bluetooth: hci7: Opcode 0x1003 failed: -49 16:12:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x11) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async, rerun: 32) ioctl$KDADDIO(0xffffffffffffffff, 0x4b34, 0x6) (async, rerun: 32) ioctl$TIOCSTI(r1, 0x5437, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r2, 0x5437, 0x0) ioctl$TIOCSTI(r2, 0x5437, 0x0) 16:12:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xa57a61b500000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xb0efff7f00000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1181.437189][T31363] can0 (unregistered): slcan off ptm0. [ 1181.474800][T31403] can0: slcan on ptm0. [ 1181.503149][ T3734] Bluetooth: hci7: Frame reassembly failed (-84) [ 1181.576932][T31410] can0 (unregistered): slcan off ptm0. 16:12:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:16 executing program 5: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) fsetxattr$system_posix_acl(r0, 0x0, 0x0, 0x0, 0x0) 16:12:16 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xf0ffffff00000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:18 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = open(&(0x7f0000000540)='./file0\x00', 0x400041, 0x40) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r2, 0x0, 0x400, 0x20, &(0x7f000000bb00)) ioctl$VT_DISALLOCATE(r2, 0x5608) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000240), 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r2, 0xc0045520, &(0x7f00000000c0)=0x2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, &(0x7f0000000100)={0x5, 0x9}) utime(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x3, 0x3}) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='xprt_reserve\x00', r1}, 0x10) ioctl$FS_IOC_GETFSMAP(r4, 0xc0c0583b, &(0x7f0000000800)={0x0, 0x0, 0x8, 0x0, '\x00', [{0x40, 0x8, 0x7, 0x7fffffffffffffff, 0x5, 0x800}, {0x7, 0xb13a, 0x0, 0x6, 0x6, 0x9}], ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) ioctl$KDADDIO(r3, 0x400455c8, 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) r5 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$setown(r5, 0x8, 0xffffffffffffffff) 16:12:18 executing program 5: r0 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000080), 0x24, 0x0) [ 1183.396881][ T3656] Bluetooth: hci6: command 0x1003 tx timeout [ 1183.406815][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1183.489299][ T3656] Bluetooth: hci6: sending frame failed (-49) [ 1183.495715][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -49 16:12:18 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) (async) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000000180)={0x81, {{0xa, 0x4e24, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}}}, 0x88) (async) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) fcntl$lock(r1, 0x26, &(0x7f0000000140)={0x1, 0x1, 0x4, 0x8, 0xffffffffffffffff}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r3, 0x400455c8, 0x4) r4 = openat$incfs(r0, &(0x7f0000000100)='.log\x00', 0xa280, 0x120) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="60040000290000012dbd7000fddbdf2504000000", @ANYRES32=0x0, @ANYBLOB="f1fff3ff0c00040010000f000b00010074617072696f0000080001007366710006000500b25d000008000100636273000800010063627100080402000404060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000001000000e300000081000000ff0f000008000000337b29990f92a1944cb25f3262ffdab0de0000005e000000ff0700000010000058040000000100000600000008000000ffff0000ff7f000000800000950200000100000000010000ff0f000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bd8900000200000004000000ff7f00000500000001000000060000000100008002000000ffff0000c90f000007000000feffffff000000000010000004000000030000000300000000020000010001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff07000001000000ffffff7f0100000001000000000000003d0700000400000008000000ff00000009000000ffffffffa90e00000600000001000000ff0f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000040000004000000009000000070000000200000009000000f9ffffff04000000030000000300000044000000ffffff7f090000000000010000100000eb08000070000000080000000500000015000000ffff0000f9ffffff07000000080000000200000081000000020000000200000000800000050000005b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001feffff0000000000000000000000000000000000000000000000008992899dcaab9fcc68d2783d70c7283444bc0a4918686483b0b4213344bb013a249a7ec4bc7e0634d6a5f0a9f8000f05eee295e5ce82146f9a0d873e21918d1fcee9ae2574fab0a99d7e15ef23e1ba0ba0312f34d100492299109c216115ceab81f7e1698eb67c99910eb71a9f09cdab6ab50d9f4865cbf807e4b1f8fdd06e7ccc0d908e054e"], 0x460}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'gre0\x00', &(0x7f0000000240)={'ip_vti0\x00', 0x0, 0x7800, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @multicast2}}}}) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)=@bridge_setlink={0xb0, 0x13, 0x8, 0x70bd2c, 0x25dfdbfc, {0x7, 0x0, 0x0, 0x0, 0x8000, 0x50000}, [@IFLA_EVENT={0x8}, @IFLA_EVENT={0x8}, @IFLA_IFALIASn={0x4}, @IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x5}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_ENCAP_LIMIT={0x5, 0xb, 0x2}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x2}, @IFLA_GRE_IKEY={0x8, 0x4, 0x40}]}}}, @IFLA_GROUP={0x8, 0x1b, 0x5}, @IFLA_XDP={0x34, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x4}, @IFLA_XDP_FD={0x8, 0x1, r2}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x4}, @IFLA_XDP_EXPECTED_FD={0x8, 0x8, r2}, @IFLA_XDP_FD={0x8, 0x1, r0}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x11}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x5}, 0x40010) (async) close(r4) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) 16:12:18 executing program 2: r0 = epoll_create(0xc4) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r0, &(0x7f0000000000)={0x10}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) ioctl$TIOCSTI(r1, 0x5437, 0x0) 16:12:18 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x3}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:18 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xfdffffff00000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:18 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x0, 0x109, 0x2, 0x180}, 0x48) 16:12:18 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x4}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:18 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xffffff7f00000000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) [ 1183.556874][T19716] Bluetooth: hci7: Opcode 0x1003 failed: -110 16:12:18 executing program 5: openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x121040, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) 16:12:18 executing program 5: openat$udambuf(0xffffffffffffff9c, &(0x7f0000000140), 0x2) 16:12:18 executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) r2 = open(&(0x7f0000000540)='./file0\x00', 0x400041, 0x40) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) statx(r2, 0x0, 0x400, 0x20, &(0x7f000000bb00)) ioctl$VT_DISALLOCATE(r2, 0x5608) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000240), 0x2, 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r2, 0xc0045520, &(0x7f00000000c0)=0x2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, &(0x7f0000000100)={0x5, 0x9}) utime(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x3, 0x3}) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='xprt_reserve\x00', r1}, 0x10) ioctl$FS_IOC_GETFSMAP(r4, 0xc0c0583b, &(0x7f0000000800)={0x0, 0x0, 0x8, 0x0, '\x00', [{0x40, 0x8, 0x7, 0x7fffffffffffffff, 0x5, 0x800}, {0x7, 0xb13a, 0x0, 0x6, 0x6, 0x9}], ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) ioctl$KDADDIO(r3, 0x400455c8, 0x4) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) r5 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$setown(r5, 0x8, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) (async) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) (async) dup(r0) (async) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) (async) open(&(0x7f0000000540)='./file0\x00', 0x400041, 0x40) (async) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) (async) statx(r2, 0x0, 0x400, 0x20, &(0x7f000000bb00)) (async) ioctl$VT_DISALLOCATE(r2, 0x5608) (async) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000240), 0x2, 0x0) (async) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r2, 0xc0045520, &(0x7f00000000c0)=0x2) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$KDSETKEYCODE(0xffffffffffffffff, 0x4b4d, &(0x7f0000000100)={0x5, 0x9}) (async) utime(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x3, 0x3}) (async) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='xprt_reserve\x00', r1}, 0x10) (async) ioctl$FS_IOC_GETFSMAP(r4, 0xc0c0583b, &(0x7f0000000800)={0x0, 0x0, 0x8, 0x0, '\x00', [{0x40, 0x8, 0x7, 0x7fffffffffffffff, 0x5, 0x800}, {0x7, 0xb13a, 0x0, 0x6, 0x6, 0x9}], ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) (async) ioctl$KDADDIO(r3, 0x400455c8, 0x4) (async) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) (async) open(&(0x7f0000000280)='.\x00', 0x0, 0x0) (async) fcntl$setown(r5, 0x8, 0xffffffffffffffff) (async) 16:12:18 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x5}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:18 executing program 5: madvise(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0) [ 1183.621882][T31470] can0: slcan on ptm1. [ 1183.641952][ T9631] Bluetooth: hci6: Frame reassembly failed (-84) [ 1183.728151][T31470] can0 (unregistered): slcan off ptm1. [ 1183.748583][ T9631] Bluetooth: hci7: Frame reassembly failed (-84) 16:12:20 executing program 5: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000000380)={{0x1, 0x1, 0x18}, './file1\x00'}) 16:12:20 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)={0x50, r4, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xfffffffffffff000}}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x50}, 0x4, 0x700000000000700}, 0x0) 16:12:20 executing program 2: r0 = epoll_create(0xc4) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r0, &(0x7f0000000000)={0x10}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x11) (async, rerun: 32) ioctl$TIOCSTI(r1, 0x5437, 0x0) (rerun: 32) 16:12:20 executing program 4: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = dup(0xffffffffffffffff) write$6lowpan_enable(r0, 0x0, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000000180)={0x81, {{0xa, 0x4e24, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}}}, 0x88) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x4) ioctl$TIOCSTI(r1, 0x5437, 0x0) fcntl$lock(r1, 0x26, &(0x7f0000000140)={0x1, 0x1, 0x4, 0x8, 0xffffffffffffffff}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x4) r4 = openat$incfs(r0, &(0x7f0000000100)='.log\x00', 0xa280, 0x120) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="60040000290000012dbd7000fddbdf2504000000", @ANYRES32=0x0, @ANYBLOB="f1fff3ff0c00040010000f000b00010074617072696f0000080001007366710006000500b25d000008000100636273000800010063627100080402000404060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000001000000e300000081000000ff0f000008000000337b29990f92a1944cb25f3262ffdab0de0000005e000000ff0700000010000058040000000100000600000008000000ffff0000ff7f000000800000950200000100000000010000ff0f000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bd8900000200000004000000ff7f00000500000001000000060000000100008002000000ffff0000c90f000007000000feffffff000000000010000004000000030000000300000000020000010001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff07000001000000ffffff7f0100000001000000000000003d0700000400000008000000ff00000009000000ffffffffa90e00000600000001000000ff0f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000040000004000000009000000070000000200000009000000f9ffffff04000000030000000300000044000000ffffff7f090000000000010000100000eb08000070000000080000000500000015000000ffff0000f9ffffff07000000080000000200000081000000020000000200000000800000050000005b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001feffff0000000000000000000000000000000000000000000000008992899dcaab9fcc68d2783d70c7283444bc0a4918686483b0b4213344bb013a249a7ec4bc7e0634d6a5f0a9f8000f05eee295e5ce82146f9a0d873e21918d1fcee9ae2574fab0a99d7e15ef23e1ba0ba0312f34d100492299109c216115ceab81f7e1698eb67c99910eb71a9f09cdab6ab50d9f4865cbf807e4b1f8fdd06e7ccc0d908e054e"], 0x460}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'gre0\x00', &(0x7f0000000240)={'ip_vti0\x00', 0x0, 0x7800, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @multicast2}}}}) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)=@bridge_setlink={0xb0, 0x13, 0x8, 0x70bd2c, 0x25dfdbfc, {0x7, 0x0, 0x0, 0x0, 0x8000, 0x50000}, [@IFLA_EVENT={0x8}, @IFLA_EVENT={0x8}, @IFLA_IFALIASn={0x4}, @IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x5}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_ENCAP_LIMIT={0x5, 0xb, 0x2}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x2}, @IFLA_GRE_IKEY={0x8, 0x4, 0x40}]}}}, @IFLA_GROUP={0x8, 0x1b, 0x5}, @IFLA_XDP={0x34, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x4}, @IFLA_XDP_FD={0x8, 0x1, r2}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x4}, @IFLA_XDP_EXPECTED_FD={0x8, 0x8, r2}, @IFLA_XDP_FD={0x8, 0x1, r0}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x11}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x5}, 0x40010) close(r4) ioctl$TIOCSTI(r3, 0x5437, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) dup(0xffffffffffffffff) (async) write$6lowpan_enable(r0, 0x0, 0x0) (async) setsockopt$inet6_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x29, 0x2d, &(0x7f0000000180)={0x81, {{0xa, 0x4e24, 0x6, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}}}, 0x88) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r1, 0x400455c8, 0x4) (async) ioctl$TIOCSTI(r1, 0x5437, 0x0) (async) fcntl$lock(r1, 0x26, &(0x7f0000000140)={0x1, 0x1, 0x4, 0x8, 0xffffffffffffffff}) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) (async) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) (async) ioctl$KDADDIO(r3, 0x400455c8, 0x4) (async) openat$incfs(r0, &(0x7f0000000100)='.log\x00', 0xa280, 0x120) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=ANY=[@ANYBLOB="60040000290000012dbd7000fddbdf2504000000", @ANYRES32=0x0, @ANYBLOB="f1fff3ff0c00040010000f000b00010074617072696f0000080001007366710006000500b25d000008000100636273000800010063627100080402000404060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000001000000e300000081000000ff0f000008000000337b29990f92a1944cb25f3262ffdab0de0000005e000000ff0700000010000058040000000100000600000008000000ffff0000ff7f000000800000950200000100000000010000ff0f000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bd8900000200000004000000ff7f00000500000001000000060000000100008002000000ffff0000c90f000007000000feffffff000000000010000004000000030000000300000000020000010001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff07000001000000ffffff7f0100000001000000000000003d0700000400000008000000ff00000009000000ffffffffa90e00000600000001000000ff0f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000040000004000000009000000070000000200000009000000f9ffffff04000000030000000300000044000000ffffff7f090000000000010000100000eb08000070000000080000000500000015000000ffff0000f9ffffff07000000080000000200000081000000020000000200000000800000050000005b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001feffff0000000000000000000000000000000000000000000000008992899dcaab9fcc68d2783d70c7283444bc0a4918686483b0b4213344bb013a249a7ec4bc7e0634d6a5f0a9f8000f05eee295e5ce82146f9a0d873e21918d1fcee9ae2574fab0a99d7e15ef23e1ba0ba0312f34d100492299109c216115ceab81f7e1698eb67c99910eb71a9f09cdab6ab50d9f4865cbf807e4b1f8fdd06e7ccc0d908e054e"], 0x460}}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'gre0\x00', &(0x7f0000000240)={'ip_vti0\x00', 0x0, 0x7800, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @multicast2}}}}) (async) bind$can_raw(0xffffffffffffffff, &(0x7f0000000000), 0x10) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)=@bridge_setlink={0xb0, 0x13, 0x8, 0x70bd2c, 0x25dfdbfc, {0x7, 0x0, 0x0, 0x0, 0x8000, 0x50000}, [@IFLA_EVENT={0x8}, @IFLA_EVENT={0x8}, @IFLA_IFALIASn={0x4}, @IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x5}, @IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e20}, @IFLA_GRE_ENCAP_LIMIT={0x5, 0xb, 0x2}, @IFLA_GRE_FLAGS={0x8, 0xd, 0x2}, @IFLA_GRE_IKEY={0x8, 0x4, 0x40}]}}}, @IFLA_GROUP={0x8, 0x1b, 0x5}, @IFLA_XDP={0x34, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x4}, @IFLA_XDP_FD={0x8, 0x1, r2}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x4}, @IFLA_XDP_EXPECTED_FD={0x8, 0x8, r2}, @IFLA_XDP_FD={0x8, 0x1, r0}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x11}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x5}, 0x40010) (async) close(r4) (async) ioctl$TIOCSTI(r3, 0x5437, 0x0) (async) 16:12:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x6}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x7}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) 16:12:20 executing program 5: bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x1, 0x0, 0x0, 0x0, 0x11a9}, 0x48) 16:12:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x2c, r1, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x9}, @NL802154_ATTR_CHANNEL={0x5}, @NL802154_ATTR_PAGE={0x5, 0x7, 0x4}]}, 0x2c}}, 0x0) [ 1185.726959][ T3656] Bluetooth: hci6: command 0x1003 tx timeout [ 1185.728070][T19716] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1185.763555][T31555] can0: slcan on ptm0. [ 1185.796887][ T3647] Bluetooth: hci7: Opcode 0x1003 failed: -110 [ 1185.803334][T19716] ================================================================== [ 1185.811409][T19716] BUG: KASAN: use-after-free in hci_cmd_timeout+0x239/0x250 [ 1185.818695][T19716] Read of size 8 at addr ffff88807f32c0d8 by task kworker/u5:0/19716 [ 1185.826754][T19716] [ 1185.829244][T19716] CPU: 0 PID: 19716 Comm: kworker/u5:0 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0 [ 1185.839219][T19716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 1185.849282][T19716] Workqueue: hci7 hci_cmd_timeout [ 1185.854336][T19716] Call Trace: [ 1185.857725][T19716] [ 1185.860905][T19716] dump_stack_lvl+0xcd/0x134 [ 1185.865512][T19716] print_report.cold+0x2ba/0x719 [ 1185.870443][T19716] ? hci_cmd_timeout+0x239/0x250 [ 1185.875376][T19716] kasan_report+0xb1/0x1e0 [ 1185.879794][T19716] ? calibrate_delay+0x1120/0x1120 [ 1185.884902][T19716] ? hci_cmd_timeout+0x239/0x250 [ 1185.889837][T19716] hci_cmd_timeout+0x239/0x250 [ 1185.894599][T19716] process_one_work+0x991/0x1610 [ 1185.899539][T19716] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 1185.904910][T19716] ? rwlock_bug.part.0+0x90/0x90 [ 1185.909865][T19716] worker_thread+0x665/0x1080 [ 1185.914541][T19716] ? process_one_work+0x1610/0x1610 [ 1185.919735][T19716] kthread+0x2e4/0x3a0 [ 1185.923793][T19716] ? kthread_complete_and_exit+0x40/0x40 [ 1185.929419][T19716] ret_from_fork+0x1f/0x30 [ 1185.933837][T19716] [ 1185.936843][T19716] [ 1185.939151][T19716] Allocated by task 3656: [ 1185.943461][T19716] kasan_save_stack+0x1e/0x40 [ 1185.948132][T19716] __kasan_slab_alloc+0x90/0xc0 [ 1185.952979][T19716] kmem_cache_alloc+0x267/0x3b0 [ 1185.957821][T19716] skb_clone+0x16e/0x3c0 [ 1185.962052][T19716] hci_cmd_work+0x191/0x570 [ 1185.966546][T19716] process_one_work+0x991/0x1610 [ 1185.971476][T19716] worker_thread+0x665/0x1080 [ 1185.976163][T19716] kthread+0x2e4/0x3a0 [ 1185.980241][T19716] ret_from_fork+0x1f/0x30 [ 1185.984651][T19716] [ 1185.986958][T19716] Freed by task 3647: [ 1185.990923][T19716] kasan_save_stack+0x1e/0x40 [ 1185.995612][T19716] kasan_set_track+0x21/0x30 [ 1186.000194][T19716] kasan_set_free_info+0x20/0x30 [ 1186.005153][T19716] ____kasan_slab_free+0x166/0x1c0 [ 1186.010255][T19716] slab_free_freelist_hook+0x8b/0x1c0 [ 1186.015640][T19716] kmem_cache_free+0xeb/0x5b0 [ 1186.020330][T19716] kfree_skbmem+0xef/0x1b0 [ 1186.024734][T19716] kfree_skb_reason+0x15b/0x410 [ 1186.029573][T19716] hci_dev_open_sync+0xbec/0x21a0 [ 1186.034594][T19716] hci_dev_do_open+0x2d/0x70 [ 1186.039172][T19716] hci_power_on+0xda/0x620 [ 1186.043583][T19716] process_one_work+0x991/0x1610 [ 1186.048686][T19716] worker_thread+0x665/0x1080 [ 1186.053357][T19716] kthread+0x2e4/0x3a0 [ 1186.057507][T19716] ret_from_fork+0x1f/0x30 [ 1186.062120][T19716] [ 1186.064437][T19716] The buggy address belongs to the object at ffff88807f32c000 [ 1186.064437][T19716] which belongs to the cache skbuff_head_cache of size 240 [ 1186.079888][T19716] The buggy address is located 216 bytes inside of [ 1186.079888][T19716] 240-byte region [ffff88807f32c000, ffff88807f32c0f0) [ 1186.093266][T19716] [ 1186.095575][T19716] The buggy address belongs to the physical page: [ 1186.101991][T19716] page:ffffea0001fccb00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f32c [ 1186.112221][T19716] memcg:ffff88801d4ce881 [ 1186.116465][T19716] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 1186.124006][T19716] raw: 00fff00000000200 dead000000000100 dead000000000122 ffff888012744500 [ 1186.132688][T19716] raw: 0000000000000000 00000000000c000c 00000001ffffffff ffff88801d4ce881 [ 1186.141346][T19716] page dumped because: kasan: bad access detected [ 1186.148112][T19716] page_owner tracks the page as allocated [ 1186.153986][T19716] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 3699, tgid 3699 (kworker/0:7), ts 351757543768, free_ts 351449569161 [ 1186.174074][T19716] get_page_from_freelist+0x109b/0x2ce0 [ 1186.180004][T19716] __alloc_pages+0x1c7/0x510 [ 1186.184621][T19716] alloc_pages+0x1a6/0x270 [ 1186.189034][T19716] allocate_slab+0x27e/0x3d0 [ 1186.193615][T19716] ___slab_alloc+0x84f/0xe80 [ 1186.198232][T19716] __slab_alloc.constprop.0+0x4d/0xa0 [ 1186.203598][T19716] kmem_cache_alloc_node+0x11d/0x3f0 [ 1186.209573][T19716] __alloc_skb+0x210/0x2f0 [ 1186.214169][T19716] nsim_dev_trap_report_work+0x2ad/0xc50 [ 1186.219807][T19716] process_one_work+0x991/0x1610 [ 1186.224740][T19716] worker_thread+0x665/0x1080 [ 1186.229669][T19716] kthread+0x2e4/0x3a0 [ 1186.233833][T19716] ret_from_fork+0x1f/0x30 [ 1186.238247][T19716] page last free stack trace: [ 1186.242904][T19716] free_pcp_prepare+0x5e4/0xd20 [ 1186.247780][T19716] free_unref_page_list+0x16f/0xb90 [ 1186.252977][T19716] release_pages+0xbd3/0x1400 [ 1186.257645][T19716] tlb_batch_pages_flush+0xa8/0x1a0 [ 1186.262842][T19716] tlb_finish_mmu+0x147/0x7e0 [ 1186.267532][T19716] exit_mmap+0x1d2/0x490 [ 1186.271784][T19716] __mmput+0x122/0x4b0 [ 1186.275934][T19716] mmput+0x56/0x60 [ 1186.279645][T19716] do_exit+0xa33/0x2a20 [ 1186.283786][T19716] do_group_exit+0xd0/0x2a0 [ 1186.288277][T19716] get_signal+0x21a1/0x2430 [ 1186.292772][T19716] arch_do_signal_or_restart+0x82/0x2300 [ 1186.298399][T19716] exit_to_user_mode_prepare+0x15f/0x250 [ 1186.304197][T19716] syscall_exit_to_user_mode+0x19/0x50 [ 1186.309673][T19716] do_syscall_64+0x42/0xb0 [ 1186.314083][T19716] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1186.320057][T19716] [ 1186.322365][T19716] Memory state around the buggy address: [ 1186.328066][T19716] ffff88807f32bf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1186.337164][T19716] ffff88807f32c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1186.345220][T19716] >ffff88807f32c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 1186.353267][T19716] ^ [ 1186.360184][T19716] ffff88807f32c100: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb [ 1186.368236][T19716] ffff88807f32c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1186.376285][T19716] ================================================================== [ 1186.404961][ T3656] Bluetooth: hci6: sending frame failed (-49) [ 1186.411515][ T3647] Bluetooth: hci6: Opcode 0x1003 failed: -49 [ 1186.412966][T19716] Kernel panic - not syncing: panic_on_warn set ... [ 1186.412977][T19716] CPU: 1 PID: 19716 Comm: kworker/u5:0 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0 [ 1186.412995][T19716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 [ 1186.413005][T19716] Workqueue: hci7 hci_cmd_timeout [ 1186.413028][T19716] Call Trace: [ 1186.413033][T19716] [ 1186.413039][T19716] dump_stack_lvl+0xcd/0x134 [ 1186.413057][T19716] panic+0x2c8/0x622 [ 1186.413080][T19716] ? panic_print_sys_info.part.0+0x10b/0x10b [ 1186.413105][T19716] ? preempt_schedule_common+0x59/0xc0 [ 1186.413128][T19716] ? preempt_schedule_thunk+0x16/0x18 [ 1186.413153][T19716] ? hci_cmd_timeout+0x239/0x250 [ 1186.413171][T19716] end_report.part.0+0x3f/0x7c [ 1186.413195][T19716] kasan_report.cold+0xa/0xf [ 1186.413209][T19716] ? calibrate_delay+0x1120/0x1120 [ 1186.413230][T19716] ? hci_cmd_timeout+0x239/0x250 [ 1186.413248][T19716] hci_cmd_timeout+0x239/0x250 [ 1186.413266][T19716] process_one_work+0x991/0x1610 [ 1186.413288][T19716] ? pwq_dec_nr_in_flight+0x2a0/0x2a0 [ 1186.413309][T19716] ? rwlock_bug.part.0+0x90/0x90 [ 1186.413328][T19716] worker_thread+0x665/0x1080 [ 1186.413350][T19716] ? process_one_work+0x1610/0x1610 [ 1186.413370][T19716] kthread+0x2e4/0x3a0 [ 1186.413385][T19716] ? kthread_complete_and_exit+0x40/0x40 [ 1186.413404][T19716] ret_from_fork+0x1f/0x30 [ 1186.413427][T19716] [ 1186.418229][T19716] Kernel Offset: disabled [ 1186.556149][T19716] Rebooting in 86400 seconds..