last executing test programs: 10.694135794s ago: executing program 2 (id=513): aio_waitcomplete(0x0, 0x0) r0 = socket(0x1c, 0x1, 0x0) open(0x0, 0x1, 0x0) open(0x0, 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaf788a33fb3f386dd60c3200000282b00feffffff000000000000000000000002ff"]) ioctl$KDGETMODE(r0, 0x40046676, 0x22e00000) 9.835944269s ago: executing program 2 (id=525): r0 = socket(0x2, 0x3, 0x0) setsockopt$sock_int(r0, 0xffff, 0x1001, &(0x7f0000000100)=0x20000, 0x4) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) connect$unix(r0, &(0x7f0000000000), 0x10) write(r0, &(0x7f0000000080)="04bdfa5d1d2873c63e3534825ba166e2fea9aec43050006123339a346f731573d8d508753f95b7688ad48b8cf6bbca325cebc37fc4e1dd543dbe2da6dd", 0xffea) 9.751674365s ago: executing program 2 (id=527): aio_waitcomplete(0x0, 0x0) r0 = socket(0x1c, 0x1, 0x0) sigaction(0xc, &(0x7f0000000200)={&(0x7f00000002c0)="f30f2dadad000000c4e1f55f9b00080000f08794a0e4553810c4e2e5bf51c63e263e660f380755b1c4e189c1a240490000c481fe700600660f3a41828bcf0000def3ec326de351365e5e9989999908", 0x35, {[0xfffff801, 0x50e5, 0xfdffffff]}}, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) lgetfh(0x0, 0x0) ioctl$KDGETMODE(r0, 0x40046676, 0x22e00000) 8.932428825s ago: executing program 2 (id=530): mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x0) setrlimit(0x6, &(0x7f0000000000)={0x10000000000b35d, 0x800000b35d}) mlockall(0x3) munlock(&(0x7f0000ffc000/0x3000)=nil, 0x3000) syz_emit_ethernet(0x9c, 0x0) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) 8.356632894s ago: executing program 2 (id=538): r0 = socket$inet6(0x1c, 0x1, 0x0) setsockopt(r0, 0x29, 0x40, &(0x7f0000000000)="60c6eabb", 0x4) bind$inet6(r0, &(0x7f0000000080)={0x1c, 0x1c, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local={0xac, 0x14, 0x0}}}, 0x1c) sendmsg$inet6_sctp(r0, &(0x7f0000000480)={&(0x7f00000000c0)=@in6={0x1c, 0x1c, 0x3, 0x8, @empty, 0xfffffff3}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x20184}, 0x80) r1 = socket(0x1c, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0x1c, 0x1c, 0x0, 0x1ff, @empty, 0x5}, 0x1c) 8.148462855s ago: executing program 2 (id=541): r0 = open$dir(&(0x7f00000001c0)='.\x00', 0x0, 0x2) symlinkat(&(0x7f0000000300)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r0, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') symlinkat(&(0x7f0000000480)='./file0\x00', r0, &(0x7f0000000180)='./file1\x00') freebsd11_mknod(&(0x7f0000000280)='./file0\x00', 0x672cda28f543e327, 0x3) unlink(&(0x7f0000000880)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') rename(&(0x7f0000000500)='./file1\x00', &(0x7f0000000f80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 3.640121501s ago: executing program 3 (id=579): openat$crypto(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r0 = freebsd12_shm_open(&(0x7f0000000000)='./file0\x00', 0x602, 0x0) ftruncate(r0, 0x80000001003864) write(r0, &(0x7f0000000500)="ac3c", 0x2) write(r0, &(0x7f0000000080)='\x00', 0x1) 3.591844379s ago: executing program 3 (id=580): mprotect(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0) poll(0x0, 0x0, 0x887e) extattr_set_file(&(0x7f0000000080)='./file1\x00', 0x3, 0x0, 0x0, 0x0) r0 = kqueue() kevent(r0, &(0x7f0000000040)=[{0xfffffffe, 0xfffffffffffffff9, 0x4009, 0x8, 0xe8c5, 0x40000000, [0x0, 0x88f]}], 0x1, 0x0, 0x0, 0x0) socket(0x1, 0x5, 0x0) 3.081562791s ago: executing program 1 (id=583): r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x40000400001803c1, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000006c0), 0xf0f75}], 0x1, 0x0) execve(0x0, 0x0, 0x0) mount(&(0x7f0000000000)='msdosfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f00000001c0)) ktrace(&(0x7f0000000000)='./file0\x00', 0x4, 0x1100, 0xffffffffffffffff) cpuset_setaffinity(0x3, 0x9, 0x5000000, 0xfffffffffffffeee, 0x0) 3.028292669s ago: executing program 0 (id=584): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200201, 0x0) aio_write(&(0x7f0000000340)={r0, 0x80000001, &(0x7f0000000300)="e2", 0x1, [0xfffffffe, 0xffffbfff], 0x0, 0x0, 0xf, {0x5, 0x7, 0x0}, {0x0, 0x0, @sival_int=0x4, @spare=[0x9, 0x6, 0x3a, 0x2, 0x100000000, 0xd24, 0x10000, 0x6b]}}) r1 = open(&(0x7f0000000480)='./file0\x00', 0x80400000000206, 0x0) mlockall(0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x20011, r1, 0x0) fdatasync(r0) 2.754305448s ago: executing program 0 (id=585): r0 = kqueue() kevent(r0, &(0x7f0000000040)=[{0x7, 0xfffffffffffffff9, 0x49, 0x8, 0xe8c5, 0x0, [0x0, 0x0, 0x4, 0x40]}], 0x1, 0x0, 0x0, 0x0) r1 = kqueue() kevent(r1, &(0x7f0000000040)=[{0xe, 0xfffffffffffffff9, 0x8009, 0x8, 0xe8c8, 0x0, [0x0, 0x2]}], 0x1, 0x0, 0x0, 0x0) execve(0x0, 0x0, 0x0) lio_listio(0x0, 0x0, 0x0, &(0x7f0000002c00)={0x1, 0x13, @sigval_int}) 2.741118884s ago: executing program 1 (id=586): r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f00000002c0)=@file={0xa, 0x1, './file1\x00'}, 0xa) listen(r0, 0x2) r1 = socket$unix(0x1, 0x5, 0x0) setgroups(0x0, 0x0) connect$unix(r1, &(0x7f0000000000)=@file={0xa, 0x1, './file1\x00'}, 0xa) 2.681797262s ago: executing program 1 (id=587): r0 = open$dir(&(0x7f0000000180)='.\x00', 0x0, 0x4) r1 = open$dir(&(0x7f0000000240)='./file0\x00', 0x40000400000002c2, 0x0) r2 = open$dir(&(0x7f0000000840)='./file1\x00', 0x40000400000002c2, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f00000006c0), 0x100000}], 0x1, 0x20000) copy_file_range(r2, 0x0, r1, 0x0, 0x9, 0x0) dup2(r0, r2) 2.677488406s ago: executing program 3 (id=588): r0 = open$dir(&(0x7f0000000840)='./file1\x00', 0x40000400000002c2, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000006c0), 0x100000}], 0x1, 0x20000) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x3, 0x410, 0xffffffffffffffff, 0x0) mlockall(0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x20011, 0xffffffffffffffff, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0) 2.581848775s ago: executing program 0 (id=589): open$dir(&(0x7f0000001240)='./file0\x00', 0x40000000ac5, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x4677) r0 = open(&(0x7f0000000480)='./file0\x00', 0x80400000000206, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x20011, r0, 0x0) mount(&(0x7f0000000200)='ufs\x00', &(0x7f00000000c0)='./file0\x00', 0x18000019, &(0x7f0000000140)) sync() 2.499613874s ago: executing program 0 (id=590): aio_suspend(0x0, 0x0, &(0x7f00000001c0)={0x0, 0x80000000}) aio_waitcomplete(0x0, 0x0) r0 = socket(0x1c, 0x1, 0x0) r1 = openat$crypto(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$CIOCGSESSION2(r1, 0xc030636a, &(0x7f0000000000)={0x0, 0x22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4d46b76a, [0x0, 0x10004, 0x7fff, 0x8]}) ioctl$KDGETMODE(r0, 0x40046676, 0x22e00000) 2.400388179s ago: executing program 1 (id=591): r0 = open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x0) ftruncate(r0, 0x3862) mount(0x0, 0x0, 0x0, &(0x7f00000000c0)="35bf33baee71d8a68674a31ee54818dcc65ff6c32c5eb531e6dbe2bc6236d3981e288786f2f9a8a3252db260f999f154315d5f8877175bd785ad4fa995422150afb39d83") setgroups(0x3e, &(0x7f0000000100)) r1 = getegid() lchown(&(0x7f0000000000)='./file0\x00', 0xee01, r1) truncate(&(0x7f0000000000)='./file0\x00', 0x1) 2.338834227s ago: executing program 3 (id=592): vfork() r0 = fork() wait4(r0, 0x0, 0x4, 0x0) ktimer_create(0x0, 0x0, &(0x7f0000000400)=0x0) ktimer_settime(r1, 0x0, &(0x7f0000000240)={{0x1, 0x2}, {0x0, 0x7}}, 0x0) rfork(0x1000) lio_listio(0x0, 0x0, 0x0, &(0x7f0000002c00)={0x1, 0x13, @sigval_int=0x5, @ke_flags=0x4078}) 281.759585ms ago: executing program 3 (id=593): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200201, 0x0) aio_write(&(0x7f0000000340)={r0, 0x80000001, &(0x7f0000000300)="e2", 0x1, [0xfffffffe, 0xffffbfff], 0x0, 0x0, 0xf, {0x5, 0x7, 0x0}, {0x0, 0x0, @sival_int=0x4, @spare=[0x9, 0x6, 0x3a, 0x2, 0x100000000, 0xd24, 0x10000, 0x6b]}}) r1 = open(&(0x7f0000000480)='./file0\x00', 0x80400000000206, 0x0) mlockall(0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x20011, r1, 0x0) fdatasync(r0) 280.648411ms ago: executing program 0 (id=594): r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x40000400001803c1, 0x0) pwritev(r0, &(0x7f0000000080)=[{&(0x7f00000006c0), 0xf0f75}], 0x1, 0x0) execve(0x0, 0x0, 0x0) mount(&(0x7f0000000000)='msdosfs\x00', &(0x7f0000000040)='./file0\x00', 0x0, &(0x7f00000001c0)) ktrace(&(0x7f0000000000)='./file0\x00', 0x4, 0x1100, 0xffffffffffffffff) cpuset_setaffinity(0x3, 0x9, 0x5000000, 0xfffffffffffffeee, 0x0) 280.520993ms ago: executing program 1 (id=595): r0 = open(&(0x7f00000002c0)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000340)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0) mkdirat(r0, &(0x7f0000000000)='./file0\x00', 0x0) mkdirat(r0, &(0x7f0000000440)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', 0x0) r1 = open(&(0x7f00000001c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', 0x0, 0xd2) fchownat(r1, &(0x7f00000003c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//../file0\x00', 0x0, 0x0, 0x0) rename(&(0x7f0000000100)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00', &(0x7f0000000180)='./file0\x00') 191.823245ms ago: executing program 1 (id=596): aio_waitcomplete(0x0, 0x0) r0 = socket(0x1c, 0x1, 0x0) sigaction(0xc, &(0x7f0000000200)={&(0x7f00000002c0)="f30f2dadad000000c4e1f55f9b00080000f08794a0e4553810c4e2e5bf51c63e263e660f380755b1c4e189c1a240490000c481fe700600660f3a41828bcf0000def3ec326de351365e5e9989999908", 0x35, {[0xfffff801, 0x50e5, 0xfdffffff]}}, 0x0) setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) lgetfh(0x0, 0x0) ioctl$KDGETMODE(r0, 0x40046676, 0x22e00000) 172.193µs ago: executing program 0 (id=597): mprotect(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0) poll(0x0, 0x0, 0x887e) extattr_set_file(&(0x7f0000000080)='./file1\x00', 0x3, 0x0, 0x0, 0x0) r0 = kqueue() kevent(r0, &(0x7f0000000040)=[{0xfffffffe, 0xfffffffffffffff9, 0x4009, 0x8, 0xe8c5, 0x40000000, [0x0, 0x88f]}], 0x1, 0x0, 0x0, 0x0) socket(0x1, 0x5, 0x0) 0s ago: executing program 3 (id=598): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x615, 0x0) ftruncate(r0, 0x107d2) r1 = socket(0x1c, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0x4, 0x1c, 0x3, 0x200, @empty, 0x6064}, 0x1c) connect$inet6(r1, &(0x7f0000000180)={0x1c, 0x1c, 0x3, 0x0, @empty, 0x5}, 0x1c) r2 = open$dir(&(0x7f0000000240)='./file0\x00', 0x10000, 0x5a) sendfile(r2, r1, 0x0, 0x0, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.84' (ED25519) to the list of known hosts. if_delmulti_locked: detaching ifnet instance 0xfffffe0058741c00 if_delmulti_locked: detaching ifnet instance 0xfffffe0058741c00 Expensive callout(9) function: 0xffffffff81a805a0(0xfffffe0077d8ea80) 0.005695220 s if_delmulti_locked: detaching ifnet instance 0xfffffe0058741c00 if_delmulti_locked: detaching ifnet instance 0xfffffe00077c3000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077c3000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077c3000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077c3400 if_delmulti_locked: detaching ifnet instance 0xfffffe00077c3000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077c3000 if_delmulti_locked: detaching ifnet instance 0xfffffe00077c3000 vnode_pager_putpages: zero-length write at 0 resid 2002 0xfffffe006eaf4dc0: type VREG state VSTATE_CONSTRUCTED op 0xffffffff83720f80 usecount 2, writecount 2, refcount 3 seqc users 0 hold count flags () flags (VIRF_PGREAD|VMP_LAZYLIST) v_object 0xfffffe0058b340f8 ref 1 pages 1 cleanbuf 1 dirtybuf 0 lock type ufs: EXCL by thread 0xfffffe0058b3b780 (pid 1120, syz-executor, tid 100419) nlink=1, effnlink=1, size=2002, extsize=0 generation=480d9e48, uid=0, gid=0, flags=0x4 ino 79, on dev gpt/rootfs Out of ktrace request objects. if_delmulti_locked: detaching ifnet instance 0xfffffe00077c4c00 if_delmulti_locked: detaching ifnet instance 0xfffffe00077c4c00 if_delmulti_locked: detaching ifnet instance 0xfffffe00077c4c00 if_delmulti_locked: detaching ifnet instance 0xfffffe0058741c00 if_delmulti_locked: detaching ifnet instance 0xfffffe00077c4c00 vnode_pager_putpages: zero-length write at 0 resid 8192 0xfffffe006ebd1898: type VREG state VSTATE_CONSTRUCTED op 0xffffffff83720f80 usecount 5, writecount 3, refcount 4 seqc users 0 hold count flags () flags (VIRF_PGREAD|VMP_LAZYLIST) v_object 0xfffffe0058b658b8 ref 1 pages 9 cleanbuf 2 dirtybuf 0 lock type ufs: EXCL by thread 0xfffffe0058b4a780 (pid 1419, syz-executor, tid 100802) nlink=1, effnlink=1, size=67538, extsize=0 generation=e8844420, uid=0, gid=0, flags=0x160000 ino 112, on dev gpt/rootfs SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) FreeBSD/amd64 (ci-freebsd-i386-1.us-central1-b.c.syzkaller.internal) (ttyu0) login: set $lines = 0 Password: Login incorrect login: show registers Password: Login incorrect login: ps Dec 26 09:00:50 ci-freebsd-i386-1 login[747]: 2 LOGIN FAILURES ON ttyu0 Password: Login incorrect login: show malloc Password: Login incorrect show all tcpcbs/bl