program: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) read$FUSE(r0, &(0x7f0000002240)={0x2020}, 0x2020) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000200)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0xff}]}) socketpair$unix(0x1, 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x420000008b}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) r3 = syz_clone(0x1000000, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0) migrate_pages(r3, 0x7, 0x0, &(0x7f0000000240)=0x8000000000000001) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) r6 = syz_open_dev$sg(&(0x7f0000001940), 0x0, 0x0) syz_mount_image$bcachefs(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x2200006, &(0x7f0000000000)=ANY=[], 0x9, 0x59b6, &(0x7f0000005b40)="$eJzs3X2QHGUZIPC3Z3azk918bAJIBNksgSiCmg1fhR+l0VO0AKlYWEq4KCxkg9EkpJIgEFCCBx4UYKGlpah/oIXUodGiClQiJfJxCacoxanUFVKnd+gfWsiREshRlude7U6/s7O90+nZmdl8wO9Xyfb0Oz1PP939Tk8/78zuBAAAAF4Tdt+wZe+5R33gV18YefnaD/1sw3WhrzzeXokL9KfTKw9UhuwfSTpdNP4z2y/edPX3/zJ4yft+eU/v917ZtebYtX94/2GXPPDps3be/q2HX5p737+fLYoe+9OJE/PJ80kIlZ/v+doXdz1+ZMygnPRvD2FBsvDhBUkmxNA/QwhrJmU54d6XT1k7Nr3u5p5J7fMzyzXb32cXbRCHpEraz7btveKk8Mf3rrr+N4t/9MPuHc9tn1gkqdT1pxDmXVT/+O60b8T+EXtb7I+x064MIfTWPe6MgryOazL/ZTnzR6fTWem0ryBOvH9JZr6UWS47P2ZOuh9C3bS3YH3tapRHO8sVmZOZz56M2pWXZ2xfkE5/mk5PnGb8cvyfhFISumrpr08m+kioO25JSMaPZaU2X6od25Buf2Y+ycyXMvPl7sx2ja837WjlJJncHpfLtMfLj660/dj6c3UD5+W0vz6dVtIn6itxPmRvVPVNuVHbrnExrz37yGV/KNWdgxq11w58ejD60ra+ZOGUx4w2EO/bteqWpeXVj+zuz8kjuSdJ4yctxd/26wVzPvmDmy7Pvq7X4l9USuOXWor/p7OfeOGCm777zdz4t8X45Zbin/xg7/NnP3rDktz9syfun66W4g8/+9itiw+/eEdu/nfE+JWW4q/Y+UTP3L0PPpSb/1DcP7Nbiv/MO8/8891P3f9cbvwQ4/e2FH/1zk1f6hnYe0Ju/Ifi/ulrrf+8uOP0pwcG/jqYF//JGH/uRPxS8/Hv2n77O+6cf/NZucd3Zdw//S3lf87xD1w/Z+/9x+SdO5M7OvXKCfDadFh6jXVjOj/dOjPv9Wu66uqFbwx2Va/55qT/53ZoHY2MrWfeDMYHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4LXpiJP+2wf/98f6n+9K53vSG8+UqtPYPiuEZHYIYcvW4c1b1228dPDTl12+eePw+sHhrYMjG7duvmrw1LcMbh7ZtH74qrF7h956SvVxC0NSnSbHTFn36OjoaKl/cltc3384fscfl57xt7+HMHTE7wa6cvNfdvuGOw9v8DMjWTH6ng2Xn/u7076Tbld/mld/Tl4hJ6//c/6/7vzKnr+cEMLQ6/aV12PPvPsXkxIab5iIkyr1hGpCPUlvwzxqWaf5xP3VtXbd+pGh4v1bztmO/3j1c/9ce+WX/1Xdv5Xc7Why/85eMbayf4+Ojl5TbThYj3vR/l5f+vqqc/7f16+J+cX9V0n397x0u+blbFdXznbd8JuHnvr5UTe9tD0Mdb24eOq6i7arO/SPx2q0RxqtN66hN1kwqb2SLh+PeHzcsq0bNi3bctW2t67bMHzpyKUjG9++/NTlpw+ddvppy8a3fFn72z871G1/XP8bm9z+/dOf5n92+0/jz+b6U1FeRf1hLK/i/VGfUd7zr/e8L3717bc/em61oaifx6Vr55N02jt2nJeH8f42pjuZuq8abVfRfgghDDbaDy+8dFY48n+su77oPFR/ZOp/ZiQrRh9f8o/vnPHtRe+qNuyX83x9Qi2e52tZT+Qzvr8q6fE4WPdvTyin29XXMK/ljz/afcvuv3+ult+sWeHK4a1bNy+v/pyTZjonObphXtnWuF2Lx3+WQ7pbQq2bNuivY7pDNb/u5PWTNyidZvdqX3pfX7Kw4XZlxft2rbplaXn1I7vz9nRyT3WNs8Pc6jR5Q86S6zMPLNcSbrT+Q7V/DHzw2/d97L6fnDqlf5xc/Vm0XUnOdv3oqbu++r0v/+eftLld5Ynt+uC7n+j/x//81NJqw6FyXqllneaT1J9XTg6h6Pm3ODTejtznX6nx9hQ9/7LrmVi+cbzBzHxfKLf0fD35wd7nz370hiW5z9c9zT5fr5k0Vy54vh4s/efAPb8mdZRkxegvbzxs+8PXrjyq2lDUr2tLN+rXpzRRf+Rs1y8ueHrgssH/9PvOnQ+//5Z7L/zD8IrPVxsOluNeSfdvJWf/1rKOdWf9/n3bJZetX1NtPwiuf38/t+H1bzotqH/iqWTLVds+M7x+/cjmLc1tV7Ovp3E92b3c6utpPLstLNiu0pTtmrkbzeyvZp9vMf81Le+vyc+3vpC09Lqw7dcL5nzyBzdd3j/lUemKLiql8Ustxf/T2U+8cMFN3/1mbvzbYvyuluIPP/vYrYsPv3hHbvw7kjR+paX4K3Y+0TN374MP5cYfivnPbin+M+888893P3X/c7nxQ4zf19r+f3HH6U8PDPw1N/6TSbqesWukEO59+ZS11fkkdKfPt5hH96S8QnY+ycyXMvPl+vlSday1toJykkxuj8ul7cfW5dLIx3Pa41VYZVF1+kqcD9kb+24/2JTqzv2N2ouuUwEAXu3i+//xGjS+/z+SXijljzTAhHbrsEU5cWMdNjGeM2vS/YvS+PHxcRxw4G1haGx63WD1Qn+645zx+ZAd54zrOeG4yTGaHeccW1H9OGfR+PuSzHzMqzpe3lVXh6am1jVdoYnx96nr2ff4e2bzi8fHB2+cktZg3bhV9vh1pyNm2XzD1Hy7xiLk9Y/suFj8PMfAvLByfH1N9o/s52jicch+jiau56jMibP5z9HET6BUG9rtHzHtffSP8ZSL39+YevzCPvbvxPFrHC17/KZxvCtjy8/0+7OH/rjhzL4fNnPjkt1p/EN7XPJgHzeM7XE7uqrt24vGEz+W096p8cR4uoh57Yl3zNpHUjPIeCLwahXr/3h6Hav/xy7A/29muaLr0OxVY4yX+zmhcuN8iuqOqZ/T623pdXz1zk1f6hnYe0Ludc5DzX7uZ9Okud6Cz/0U7celmfnC/ZgzQFNU72XXU7Tfs5/L6AtzG+338Wz2td/v2n77O+6cf/NZuft9ZfWFtHi/f3XS3NyC/a5eyIl/wOuFWQX1QmV/fI5h9EDXC22On+VEr42f1UqF/V6PpB982kc98rf5+fVI4ecbPprTPt16pHfKjdp2jZtSjxwgTdcj3fs3LwDg0BHr/9r7Z2n9/78yyxXVrSdm5mO83Lo15/okr279cDq9MrN8X/obFdO9bj7n+Aeun7P3/mNy65Y7mq1D/8ukuf7COrRh3VyYb6ybc+uIlZ35vHju+/C1Oqu9OjE3/1qd2F6dnhu/Vqe3V0fn7p9aHd3eOEBu/No4wKH9vthMj9fN9OdQDtj7eumvz7b4vl5hHX1eTvt06+i+KTdq2zWuzTq6Y1WtOhoAeK2K9X+8jIv1/6OZ5dq9bs+tCzp03Z79eyC1+E/ur7pypuu+ma5bZ7qun+lxiUO9Lp7pcaGZHSdTF6fzcYHK5A/SzHBd3DHqYgCAV7dY/89O5/Pr//bqk9z6rVafqM8bxlefHyT1+aE+/qX+fxW/L94x6n8AgFe3WP/HX3uMf//vv6bz2b9br07PiX/o1umjo6PXdqZOD+r03P7TdJ0+0+NsxgGMAxQzDgAA8OrSPV4pTf09+0+k0+zv2ef9Xv4FOcs3q2v8d+xDuHjr5pGRCy/ftGZ468iFGy9bM7Llwis2r9u6dWRjdbl268bcuiWtG7tDV7o/Gi+Xrdvmp38PYX7O30PILh/DHj1+Y+rfQ8iudnbB3xGYOH7N5Zt3/Er7WL5R/8g73nnxP56zfFQ7/pd86uQL1265cN3GdVvXDa9ft21k8nJjVWvvNL43M+6WnO/N3J6NMf41mZkfU5Sm//2dBXlM0TiP0pQ8utP9kff97EkmjwVpJgvyvv8gJ+9f/fevfPb40X/dHcLQEeU3TDfvySFXjP74/JEPb939u01j+Zf2mX9tyTSvou8rzS4ft6dr/WVbtp609rLLN2a/UbI1cTyjVJufofGM9OlfbnJ8YnVO+3THJ8pTbhycmh6fAABgkvj+f7yeje8ffjm9gIrtzdfp7X3OO7dOH2quTs9+L1lRnX5c5jo3bm+zdXqlzTo9m29Rnd5o+UZ1el7dnRf/oznLT1fz/aS9z3nk9pOLmusn2e8zKOon2eWn20+SNvtJdv1F/eSNmYGIvH6Sd9zz4n8kZ/k8zfeH9j6Xk9sfbmuuP7w5M1/UH7LLT7c/lNrsD9n1F/WHRss36g95xzcv/rk5yzdrcv8Y6xjj/WLkwisu2/yZuuVa6x8/buL7L0YbDSO0kN/Mfv9Hq5rPf2Z/P2vm85/Zz5XNfP7tfa4sN/8n2xsJaz7/mfo+yPby32/jtemHzSY+f1Zq+PmzonHcVTnt0x3HnTXlxsHJOC4cOLH+j2VwrP9vTqedfhuo9eukEA6O70mb2de5Q//35Gf2OubAvZ43/jy51/PJvJ4DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANKena9H4dPcNW/aee9QHfvWFkZev/dDPNlz3pqu//5fBS973y3t6v/fKrjXHrv3D+w+75IFPn7Xz9m89/NLc+/79bGHg/urkxHS2EkLyfBJC5ed7vvbFXY8fOdaWhBDKSf/2EBYkCx9ekGQiDP0zhLCmlufkO+99+ZS1Y9Prbu6Z1D4/EyS7XaGvHPOZlGe4snCLOARV0n62be8VJ4U/vnfV9b9Z/KMfdu94bvvEIkmlrj+FMO+i+sd3hxBmp//HxN62KD44na4MIfTWPe6MgryOazL/ZTnzR6fTWem0ryBOvH9JZr6UWS47H3Vnpr0F62tXXh6tLldkTmY+ezJqV16esX1BOv1pOj1xmvHL8X8SSknoqqW/PpnoI6HuuCUhGT+Wldp8qXZsQ7r9mfkkM1/KzJe7M9s1vt60o5WTZHJ7XC7THk/HXWn7sfXn6gbOy2l/fTqtpE/UV+J8yN6o6ptyo7Zd42Jee/aRy/5QqjsHNWqvHfj0YPSlbX3JwimPGW0g3rdr1S1Ly6sf2d2fk0dyT5LGT1qKv+3XC+Z88gc3Xb4oL/5FpTR+qaX4fzr7iRcuuOm738yNf1uMX24p/skP9j5/9qM3LMndP3vi/ulqKf7ws4/duvjwi3fk5n9HjF9pKf6KnU/0zN374EO5+Q/F/TO7pfjPvPPMP9/91P3P5cYPMX5vS/FX79z0pZ6BvSfkxn8o7p++1vrPiztOf3pg4K+DefGfjPHnthT/ru23v+PO+TeflXt8V8b9099S/HOOf+D6OXvvPybv3Jnc0alXToDXpsPSa6wb0/lW68x21dUL3xjsql7zzUn/z+3kijLG1jNvBuMDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPDq9NtrTv3E+e/5yKquJIQkZ5nRBuJ95VkrVgy2sN7hZx+7dfHhF++ob1vUQhwAAACgWKzDS7WWSlgUrkhmh6MbLh/HCI6Oc8nk9uwYwuyc9U4/TnXJUofilDsUp6ulON1T4nR3KJ9ZHYrT06E4lYI4ldBcnGw/mhyn1HQ+vR2K09ehOHM6FGduh+LM61Cc+R2K07/POM33wwUdirOwQ3EO61CcwzsU54gOxXldm3H60yWP7FA+2THl6fbDuemSR+XFGb9RLozTlZRrdzQaT4/rOabN9fQ1uZ7smP101zO7yfUcl3lcaZrrqTS5nje2uZ6kyfW8uc31lArWE/vtldn84nriXJP9/6oOxdnWoThXdyjONR2K87kOxfl8h+Jc22YcgGbF+n+i3usPPV3vCr3jZ5z07LJ9YvlY7y4e/zn19S7vhNSbnsHekGmfVRQvW6hn4i3OtBfmlx1AyMRbkmnvnhSvq1aP7CNepT7e0sydhdubHVDI5Hdipr2nKF52YAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZtBvrzn1E+e/5yOrQhLG/jU02kC8rzxrxYrBFta7a9UtS8urH9ld39bT1UIgAAAAoFCsw7trLZXQ07U89CSzJi1XSccBKul8ub86HZgXVo5Nk8HS+HxvsmCfj+tKH7ds64ZNy7Zcte2t6zYMXzpy6cjGty8/dfnpQ6edftqytevWjwxVf4bQUxAvhDA+/LDlqm2fGV6/fmTzlmpjNv9F6eMWpfNJ+riBt4Whsel1af4L89d3Zm8IoTRlfTN3o7kjCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP+fXbsNkesqHwB+7szszGSbNPunb9PQbIa8lPy1aBK3kmrpXhAstEnIUpDZ6lqCTbC4aUKblFjHNmBbE5RCSyBE8iUSi63FL32xRewLgUiNBtwYpC3aDyoorVbSEkFSRrIzd3ZmMpOZjCHZ1N/vw70zz3nOec65hMBzZwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALpyp8shEaXRsfDAKIeqQU2kjGUtn47h4tgJz24e/8vLWx3PDJ5c3xnKZvo4AAAAAdJH04QP1SD7kMumQDtdOf1scGgbCTN8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD875kqj0yURsfGL4tCiDrkVNpIxtLZOC72UfedD5797JvDw39tjBX6WAcAAADoLunDU/VIPhTCkjAQXduUl7wbWNAyvzUvWWdhj3mt7w465S3pMe/6HvP+v0veutp9RwAAAIBLX9L/Z+qRoZDLzOvY/3fr65O8RS156dq9n78VAAAAAP47Sf+fq0cKIZcp1Pv1Xvv9xS15yfxuv9sn85d1mN/t9/y1tbvf6QEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg0jFVHpkojY6Np6MQog45lTaSsXQ2jot91F31yuDfbz/06OLGWC7Tx0IAAABAV0kfPtN650MuMxgGwmXTff/wrfuf/9LzL46EEKptfjYbdmzYtu2+VdVrkrfyyKGB7x9+79tn5K2sXi/aAQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgPNmqjwyURodG58ThRB1yKm0kYyls3Fc7KPu25//4p+ePv7Su42xwhlZ6T5WBgAAAFolffhM758PhZAN2XD19LfGXv+0VMv8Tu8MZmTP11YBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAi+T+bz74jQ2TkxvvuwQ/ZGbHNi7ch+HLZ8U2evswp/YvbLbs5/x9yIcQZsE2+vowp+fki/wfEwAAcN4tClGonKNr1l/sXQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALPBVHlkojQ6Np6PQog65FTaSMbS2Tgu9lE3fvlobt7JV15rjBX6WAcAAADoLunDZ3r/fCiEgTAQrpr+1u6dwHT/P3QBNwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADMKlPlkYnS6Nj4vCiEqENOpY1kLJ2N42IfdZ/aue9zB+d/77bGWC7Tx0IAAABAV0kfnq1H8iGX+UTIhetq3yfrI/863fVH6eqXqP17gZl5W6u3k9XbYM/zyk37S/c8b1fLyTK101Tn5ZP1hqr3+rzimfOKDfMKoV6+2DQv7GmaNa/LPts9ewAAALhQkv4/V48MhVwm19Dn/rgpf6i3Pvfxv1yoAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs8ZUeWSiNDo2HkUhRB1yKm0kY+lsHPdT98Ff/9/cr/5k9/bG2Jx+FgIAAAC6Svrwmd4/HwphYbg8LJzu+8NQc36S94/SqYNP/vPPy0NYcfWx4UzH9X/59i2vtl5CSDUnpUKYX6sXdaj3q98++cDSyqmnQ1hxVfq6c63XvGRceaG0ce22w8e2nuXBAAAAwMdI0v8P1CNDIZe5t2P/n3Te59T/z39g58+urF1rHXnLjNRQrV6qQ70vLH32j8tW/+290/3/2ep9et/mg1c2FaxGWkRxZXTz9nXHbjyQSk5drZ9uqZ88ly9/691/b9rxxKlq/XzI1+ILMu3qn3ltMSeuTKb2jq/5aG+5uX6mw/kf/c1rx3+xYPeHp+t/sGiwXv/6s5z/7PUH73hsz037Dq1rrh9CKLar//6Ht4Vrfn/PI63nH2xZuPHJN15bRHHlyOITB1bvL9zcXD9qqZ88/58ef2rPj5747otJ/UItvnxJr/VTLfXf2HXFztcfXr+guX6qw/lfvfPN4S3F7/yu9fx3933+Z2547q63NsQPtQ4BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8vEyVRyZKo2PjqSiEqENOpY1kLJ2N42Ifdd+5/ej7d+7+4Q8aY4U2eek+1gYAAACaJX34TO+fD4WQDdkwON33v1DauHbb4WNbw1B1NKrdM5Nb7t/2yU1btt9790XaOQAAANCrpP/P1CNDIZdZGgZq/f/o5u3rjt14IJX0/6mk/990z+TGFaGe98auK3a+/vD6BfX3BCFM/1lA/nTeZ2bybr3l6NCJP3x9Wdu8VTN5RxafOLB6f+HmJC805q0M9fcTz9zw3F1vbYgfqu+vMe9TX9syWXs9kaw7eMdje27ad2hd/Ry1+2Bt3SRvMrV3fM1He8tJXrp2z9fODQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcaao8MlEaHRsP6RCiDjmVNpKxdDaOi33UXbP054/MPfnSwsZYLtPHQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP9hBw4EAAAAAID8XxuhqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqCvv1ExpXEccBfGY3abbZpE1awaiYplVR6sGiUEQvKirSghQ8VYpUW3sQBUFEqQdTacVSFS+C1UsRFdQoBQUbi6VVUvFf8eJBBYXqQSjFgDYUD0aSzGw3zzxjX1RQPx9YJjP73vf93pvJ7C4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP8qXR0D0+3RXQ9M3Hr+TR8/dvepR295974dlz7y2vdDW274aH/3y6fHtq7c9tWNy7ccvGfd6N4Xjvzc+/avx+cNfnimWZ26jRDiyRhC473xZx8f++TcqbEYQqjHvuEQ+uOyI/2xkLDmlxDC1lads99869RV26baHXu6Zo0vLYQU7ys067meGX2z6+W/pZHW2faJhy4P31y/cednK958o3PkxPCZQ2KjbT2FsGRz+/mdIYTF6TUlr7aBfHJqN4QQutvOu3qeui76k/VfUdK/ILWLUtucJye/v6rQrxWOK/azzkLbPc/1FqqsjqrHlcnbSk9hvLgZLVRZnXm8P7XvpHb1WebX8yuGWgwdrfLvjWfWSGibtxji9Fw2Wv1aa25Duv9CPxb6tUK/3lm4r+nrpoVWj3H2eD6uMJ634440vrJ9r57DbSXj56W2kf5RT+d+KP4x83nQ+v9pzp753Mt1jf9BLf+EWtseNNd4q/o0Gc001ozLfnfO5Iy1k23ye2Mbn7ykvun9o30ldcT9MeXH+fIn58rf/ml/zx2v735woCx/cy3l1yrlf7v+2I+3737x+dL8Z3J+vVL+lYe6T67/YNeq0ucznp9PR6X8O49/+NSKc+4aKa1/X85vVMq/bvRYV+/EocO5/kXF/DX5+SyulP/1tTd/9+oXB06UPp+Q87sr5W8avf/prsGJy0rzD+fn06y2fn4aWfvl4OAPQ2X5n+f83kr5rwzvvealpXvWlc7vhvx8+s4+f2oyLz64s2fiwIVle2fct9BPToD/t+XpO9YTqV/1d+ZCtf1eeG6oY+Y7X0969f6VFyqYus6SvzEfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgN3bggAQAAABA0P/X7QgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACApwIAAP//9no4VQ==") r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="6400000002060500000000000000000000000000120003006269746d61703a69702c6d616300000005000400000000000900020073797a3000000000180007800c000180080001400000000008000840000000100500ac319570010f9e49010082060000"], 0x64}}, 0x0) ioctl$SG_IO(r6, 0x2285, &(0x7f0000000740)={0x53, 0x0, 0xa, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000000)="a1f8a81b133d", 0x0, 0x0, 0x0, 0x0, 0x0}) io_uring_setup(0x5239, &(0x7f00000000c0)={0x0, 0xbe50, 0x1000, 0x3, 0x2e5}) r8 = socket(0x9, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendto$packet(r8, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x0, r9}, 0x14) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f00000001c0)={'ip_vti0\x00', &(0x7f0000000340)={'ip_vti0\x00', r9, 0x7800, 0x40, 0x6, 0x1, {{0x12, 0x4, 0x1, 0x2, 0x48, 0x66, 0x0, 0x0, 0x4, 0x0, @local, @multicast1, {[@noop, @timestamp_prespec={0x44, 0x24, 0x5e, 0x3, 0x8, [{@broadcast, 0x1a30}, {@loopback, 0x1}, {@rand_addr=0x64010102, 0xe}, {@dev={0xac, 0x14, 0x14, 0x2c}, 0x101}]}, @generic={0x88, 0xe, "a513c65e3f0009465d5b540c"}]}}}}}) setsockopt$inet6_int(r5, 0x29, 0x4b, 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r10 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r10, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000900), 0x111}}, 0x20) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r10, &(0x7f0000000940)={0x0, 0x1f, 0xfa00, {0x8000000000, &(0x7f00000002c0), 0x2}}, 0x20) [ 58.825230][ T24] audit: type=1326 audit(1732104263.844:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5324 comm="syz.0.0" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5d4357e819 code=0x0 [ 59.774469][ T5329] loop0: detected capacity change from 0 to 32768 [ 59.788131][ T5310] Bluetooth: hci0: command tx timeout [ 59.795294][ T5329] bcachefs (/dev/loop0): error reading default superblock: Unsupported superblock version 0.0: (unknown version) (min 0.9: (unknown version), max 1.13: inode_has_child_snapshots) [ 60.081651][ T5329] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names [ 60.087886][ T5329] bcachefs (loop0): recovering from clean shutdown, journal seq 10 [ 60.091349][ T5329] bcachefs (loop0): Doing compatible version upgrade from 1.7: mi_btree_bitmap to 1.13: inode_has_child_snapshots [ 60.091349][ T5329] running recovery passes: check_allocations,check_inodes [ 60.107782][ T5329] bcachefs (loop0): error validating btree node at btree inodes level 0/0 [ 60.107808][ T5329] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 7589ab5e0c11cc7a written 24 min_key POS_MIN durability: 1 ptr: 0:38:0 gen 0 [ 60.107820][ T5329] node offset 0/24 bset u64s 0: bset version 9 older than superblock version_min 24, shutting down [ 60.120956][ T5329] bcachefs (loop0): inconsistency detected - emergency read only at journal seq 10 [ 60.124455][ T5329] bcachefs (loop0): flagging btree inodes lost data [ 60.131126][ T5329] error reading btree root inodes l=0: btree_node_read_error, shutting down [ 60.134661][ T5329] bcachefs (loop0): bch2_fs_recovery(): error fsck_errors_not_fixed [ 60.137857][ T5329] bcachefs (loop0): bch2_fs_start(): error starting filesystem fsck_errors_not_fixed [ 60.141385][ T5329] bcachefs (loop0): shutting down [ 60.154441][ T5329] bcachefs (loop0): shutdown complete [ 60.158127][ T55] ================================================================== [ 60.161105][ T55] BUG: KASAN: slab-use-after-free in percpu_ref_put+0xda/0x250 [ 60.163882][ T55] Read of size 8 at addr ffff888051f640b0 by task kworker/u4:4/55 [ 60.166399][ T55] [ 60.167217][ T55] CPU: 0 UID: 0 PID: 55 Comm: kworker/u4:4 Not tainted 6.12.0-syzkaller-01782-gbf9aa14fc523 #0 [ 60.170719][ T55] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 60.174889][ T55] Workqueue: loop0 loop_rootcg_workfn [ 60.176994][ T55] Call Trace: [ 60.178294][ T55] [ 60.179327][ T55] dump_stack_lvl+0x241/0x360 [ 60.180995][ T55] ? __pfx_dump_stack_lvl+0x10/0x10 [ 60.182730][ T55] ? __pfx__printk+0x10/0x10 [ 60.184447][ T55] ? _printk+0xd5/0x120 [ 60.186113][ T55] ? __virt_addr_valid+0x183/0x530 [ 60.188134][ T55] ? __virt_addr_valid+0x183/0x530 [ 60.190123][ T55] print_report+0x169/0x550 [ 60.191852][ T55] ? __virt_addr_valid+0x183/0x530 [ 60.193714][ T55] ? __virt_addr_valid+0x183/0x530 [ 60.195724][ T55] ? __virt_addr_valid+0x45f/0x530 [ 60.197746][ T55] ? __phys_addr+0xba/0x170 [ 60.199489][ T55] ? percpu_ref_put+0xda/0x250 [ 60.201301][ T55] kasan_report+0x143/0x180 [ 60.202963][ T55] ? percpu_ref_put+0xda/0x250 [ 60.204811][ T55] ? percpu_ref_put+0x1f/0x250 [ 60.206711][ T55] percpu_ref_put+0xda/0x250 [ 60.208530][ T55] blk_update_request+0x5e5/0x1160 [ 60.210318][ T55] blk_mq_end_request+0x3e/0x70 [ 60.211982][ T55] loop_process_work+0x1bc8/0x21c0 [ 60.214033][ T55] ? __pfx_loop_process_work+0x10/0x10 [ 60.216100][ T55] ? register_lock_class+0x102/0x980 [ 60.218238][ T55] ? __pfx_register_lock_class+0x10/0x10 [ 60.220351][ T55] ? mark_lock+0x9a/0x360 [ 60.222007][ T55] ? debug_object_deactivate+0x2d5/0x390 [ 60.224155][ T55] ? do_raw_spin_unlock+0x58/0x8b0 [ 60.226207][ T55] ? __pfx_lock_acquire+0x10/0x10 [ 60.227832][ T55] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 60.230159][ T55] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 60.232599][ T55] ? process_scheduled_works+0x976/0x1850 [ 60.234955][ T55] process_scheduled_works+0xa63/0x1850 [ 60.237134][ T55] ? __pfx_process_scheduled_works+0x10/0x10 [ 60.239554][ T55] ? assign_work+0x364/0x3d0 [ 60.241383][ T55] worker_thread+0x870/0xd30 [ 60.243278][ T55] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 60.245570][ T55] ? __kthread_parkme+0x169/0x1d0 [ 60.247347][ T55] ? __pfx_worker_thread+0x10/0x10 [ 60.249261][ T55] kthread+0x2f0/0x390 [ 60.250713][ T55] ? __pfx_worker_thread+0x10/0x10 [ 60.252606][ T55] ? __pfx_kthread+0x10/0x10 [ 60.254347][ T55] ret_from_fork+0x4b/0x80 [ 60.256030][ T55] ? __pfx_kthread+0x10/0x10 [ 60.257740][ T55] ret_from_fork_asm+0x1a/0x30 [ 60.259300][ T55] [ 60.260300][ T55] [ 60.261191][ T55] Allocated by task 5329: [ 60.262827][ T55] kasan_save_track+0x3f/0x80 [ 60.264656][ T55] __kasan_kmalloc+0x98/0xb0 [ 60.266407][ T55] __kmalloc_cache_noprof+0x19c/0x2c0 [ 60.268378][ T55] __bch2_dev_alloc+0x57/0xa60 [ 60.270241][ T55] bch2_dev_alloc+0xd4/0x170 [ 60.271943][ T55] bch2_fs_open+0x2e3f/0x2f80 [ 60.273812][ T55] bch2_fs_get_tree+0x738/0x1710 [ 60.275767][ T55] vfs_get_tree+0x90/0x2b0 [ 60.277368][ T55] do_new_mount+0x2be/0xb40 [ 60.279085][ T55] __se_sys_mount+0x2d6/0x3c0 [ 60.280778][ T55] do_syscall_64+0xf3/0x230 [ 60.282506][ T55] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.284677][ T55] [ 60.285537][ T55] Freed by task 5329: [ 60.287089][ T55] kasan_save_track+0x3f/0x80 [ 60.288854][ T55] kasan_save_free_info+0x40/0x50 [ 60.290662][ T55] __kasan_slab_free+0x59/0x70 [ 60.292380][ T55] kfree+0x1a0/0x440 [ 60.293850][ T55] kobject_put+0x22f/0x480 [ 60.295500][ T55] bch2_fs_free+0x27b/0x3c0 [ 60.297184][ T55] bch2_fs_get_tree+0xd9f/0x1710 [ 60.299065][ T55] vfs_get_tree+0x90/0x2b0 [ 60.300633][ T55] do_new_mount+0x2be/0xb40 [ 60.302302][ T55] __se_sys_mount+0x2d6/0x3c0 [ 60.304061][ T55] do_syscall_64+0xf3/0x230 [ 60.305744][ T55] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 60.307909][ T55] [ 60.308809][ T55] The buggy address belongs to the object at ffff888051f64000 [ 60.308809][ T55] which belongs to the cache kmalloc-4k of size 4096 [ 60.313783][ T55] The buggy address is located 176 bytes inside of [ 60.313783][ T55] freed 4096-byte region [ffff888051f64000, ffff888051f65000) [ 60.318693][ T55] [ 60.319622][ T55] The buggy address belongs to the physical page: [ 60.321941][ T55] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x51f60 [ 60.325139][ T55] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 60.328241][ T55] anon flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 60.331124][ T55] page_type: f5(slab) [ 60.332587][ T55] raw: 04fff00000000040 ffff88801ac42140 0000000000000000 0000000000000001 [ 60.335821][ T55] raw: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 60.339095][ T55] head: 04fff00000000040 ffff88801ac42140 0000000000000000 0000000000000001 [ 60.342281][ T55] head: 0000000000000000 0000000000040004 00000001f5000000 0000000000000000 [ 60.345385][ T55] head: 04fff00000000003 ffffea000147d801 ffffffffffffffff 0000000000000000 [ 60.348623][ T55] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 60.351763][ T55] page dumped because: kasan: bad access detected [ 60.354172][ T55] page_owner tracks the page as allocated [ 60.356308][ T55] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4679, tgid 4679 (kworker/u5:1), ts 57013193534, free_ts 0 [ 60.363637][ T55] post_alloc_hook+0x1f3/0x230 [ 60.365353][ T55] get_page_from_freelist+0x3649/0x3790 [ 60.367335][ T55] __alloc_pages_noprof+0x292/0x710 [ 60.369338][ T55] alloc_pages_mpol_noprof+0x3e8/0x680 [ 60.371427][ T55] alloc_slab_page+0x6a/0x140 [ 60.373192][ T55] allocate_slab+0x5a/0x2f0 [ 60.374955][ T55] ___slab_alloc+0xcd1/0x14b0 [ 60.376702][ T55] __slab_alloc+0x58/0xa0 [ 60.378299][ T55] __kmalloc_cache_noprof+0x1d5/0x2c0 [ 60.380286][ T55] kobject_uevent_env+0x28b/0x8e0 [ 60.382189][ T55] device_add+0x63b/0xbf0 [ 60.383838][ T55] hci_conn_add_sysfs+0xe8/0x200 [ 60.385685][ T55] le_conn_complete_evt+0xc9f/0x12e0 [ 60.387643][ T55] hci_le_conn_complete_evt+0x18c/0x420 [ 60.389748][ T55] hci_event_packet+0xa55/0x1540 [ 60.391664][ T55] hci_rx_work+0x3e8/0xca0 [ 60.393362][ T55] page_owner free stack trace missing [ 60.395382][ T55] [ 60.396298][ T55] Memory state around the buggy address: [ 60.398413][ T55] ffff888051f63f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 60.401398][ T55] ffff888051f64000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.404321][ T55] >ffff888051f64080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.407305][ T55] ^ [ 60.409442][ T55] ffff888051f64100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.412587][ T55] ffff888051f64180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 60.415668][ T55] ================================================================== [ 60.588455][ T55] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 60.591338][ T55] CPU: 0 UID: 0 PID: 55 Comm: kworker/u4:4 Not tainted 6.12.0-syzkaller-01782-gbf9aa14fc523 #0 [ 60.595671][ T55] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 60.599864][ T55] Workqueue: loop0 loop_rootcg_workfn [ 60.602007][ T55] Call Trace: [ 60.603291][ T55] [ 60.604426][ T55] dump_stack_lvl+0x241/0x360 [ 60.606191][ T55] ? __pfx_dump_stack_lvl+0x10/0x10 [ 60.608081][ T55] ? __pfx__printk+0x10/0x10 [ 60.609835][ T55] ? preempt_schedule+0xe1/0xf0 [ 60.611656][ T55] ? vscnprintf+0x5d/0x90 [ 60.613242][ T55] panic+0x349/0x880 [ 60.614770][ T55] ? check_panic_on_warn+0x21/0xb0 [ 60.616758][ T55] ? __pfx_panic+0x10/0x10 [ 60.618481][ T55] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 60.620603][ T55] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 60.622986][ T55] ? print_report+0x502/0x550 [ 60.624646][ T55] check_panic_on_warn+0x86/0xb0 [ 60.626461][ T55] ? percpu_ref_put+0xda/0x250 [ 60.628229][ T55] end_report+0x77/0x160 [ 60.629778][ T55] kasan_report+0x154/0x180 [ 60.631565][ T55] ? percpu_ref_put+0xda/0x250 [ 60.633403][ T55] ? percpu_ref_put+0x1f/0x250 [ 60.635232][ T55] percpu_ref_put+0xda/0x250 [ 60.636976][ T55] blk_update_request+0x5e5/0x1160 [ 60.638923][ T55] blk_mq_end_request+0x3e/0x70 [ 60.640684][ T55] loop_process_work+0x1bc8/0x21c0 [ 60.642633][ T55] ? __pfx_loop_process_work+0x10/0x10 [ 60.644695][ T55] ? register_lock_class+0x102/0x980 [ 60.646713][ T55] ? __pfx_register_lock_class+0x10/0x10 [ 60.648841][ T55] ? mark_lock+0x9a/0x360 [ 60.650488][ T55] ? debug_object_deactivate+0x2d5/0x390 [ 60.652670][ T55] ? do_raw_spin_unlock+0x58/0x8b0 [ 60.654778][ T55] ? __pfx_lock_acquire+0x10/0x10 [ 60.656527][ T55] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 60.658858][ T55] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 60.661270][ T55] ? process_scheduled_works+0x976/0x1850 [ 60.663328][ T55] process_scheduled_works+0xa63/0x1850 [ 60.665460][ T55] ? __pfx_process_scheduled_works+0x10/0x10 [ 60.667661][ T55] ? assign_work+0x364/0x3d0 [ 60.669334][ T55] worker_thread+0x870/0xd30 [ 60.671078][ T55] ? _raw_spin_unlock_irqrestore+0xdd/0x140 [ 60.673174][ T55] ? __kthread_parkme+0x169/0x1d0 [ 60.675130][ T55] ? __pfx_worker_thread+0x10/0x10 [ 60.677044][ T55] kthread+0x2f0/0x390 [ 60.678581][ T55] ? __pfx_worker_thread+0x10/0x10 [ 60.680377][ T55] ? __pfx_kthread+0x10/0x10 [ 60.682148][ T55] ret_from_fork+0x4b/0x80 [ 60.683804][ T55] ? __pfx_kthread+0x10/0x10 [ 60.685736][ T55] ret_from_fork_asm+0x1a/0x30 [ 60.687504][ T55] [ 60.688918][ T55] Kernel Offset: disabled [ 60.690713][ T55] Rebooting in 86400 seconds..