last executing test programs: 503.048488ms ago: executing program 7 (id=8): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0xffff, 0x1022, &(0x7f00000000c0), &(0x7f0000000240)=0xc) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) r1 = open(&(0x7f0000000080)='./file0\x00', 0x80, 0x2a) r2 = open(&(0x7f0000000080)='./file0\x00', 0x80, 0x2a) rename(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0xffffffc4, 0x6, 0x2000007, 0x3, 0x80000004, 0xa, 0x82, 0x10, [{0x1000000, 0x4b22, 0x0, 0x71003}, {0xd8, 0x5, 0x8, 0xfffffff9}, {0x7, 0xfffffff6, 0x8, 0x6}, {0x2, 0x4000025, 0x3, 0xfffffffd}, {0xf, 0xf2b, 0x9, 0x2}, {0x7a, 0x1, 0x4000008, 0x95}, {0x83, 0x7c6, 0x9d29, 0x400006d}, {0x3, 0x803, 0x14, 0x2}, {0xfffdffff, 0x82, 0x4, 0xaf}, {0x5, 0x7ffffffe, 0xd1b, 0x88}, {0x1d2, 0x7, 0x2c, 0x4}, {0x4007fc, 0x9, 0x7fffffff, 0x80000000}, {0x81f, 0x2, 0xfffffffc, 0x1001}, {0x29a71713, 0xfffffffa, 0x6, 0x3}, {0x6, 0x3, 0x6}, {0x4, 0x2, 0x1, 0x7fbf}]}) truncate(&(0x7f00000000c0)='./file0\x00', 0x6001000004) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$VNDIOCSET(r2, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) ioctl$VNDIOCSET(r2, 0x80044403, &(0x7f00000001c0)={0x0, 0x80000000100007, 0x0}) r3 = open(&(0x7f00000000c0)='./file0\x00', 0x78e, 0x7) ioctl$VNDIOCSET(r1, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) ioctl$VNDIOCSET(r1, 0x80044403, &(0x7f00000001c0)={0x0, 0x80000000100007, 0x0}) write(r3, &(0x7f0000000700)="d92938a3", 0x4) setuid(0xee01) r4 = shmget$private(0x0, 0x2000, 0x175, &(0x7f0000412000/0x2000)=nil) shmctl$IPC_SET(r4, 0x1, &(0x7f0000000100)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x119, 0x400}, 0x4, 0x1, 0x0, 0x0, 0xfffd, 0xa, 0x9}) shmctl$IPC_RMID(r4, 0x0) sysctl$kern(&(0x7f00000000c0)={0x1, 0x50}, 0x3, &(0x7f0000000280)="00e0ae5b7e0d0000bc5a91501d94a3fec370829ee2155c1adde53710f0424577c49f454b1ec517045beab24398371d1d5494ee942535f1f4ba955b4b17941e49753ab2c147c3cbc319c4898bfc0419a3a1c3999b08e5b2c66b4cc31000ea6fbf8358fa27cb0c710a5c927c0da0ad8ae370c8834130920f2460c5c4000800003213e6ea7acf27db37ad7c1256c0d3885247874f8ceb7b852859a373d213e3ccbb5903145e35fb585b777285195158a472b2ce03aa8b1bd5228f9b82993fa93db80e2fdf0dca1e8da94873821a1acdeaa6330852e68dbab30ac32006ed3736dd3100f128000000000000000000000031da3ced93c51e50867858115138f64154f004eeb98dbc9e1639d3def7b55ea13afb90401d186ec7584b0b941a85c1dfcc4428ad6c4fc02cf966758e76a0a0e0f7e9c1ae618da7d52d6b21520ca48b291967a14b91523d0631d3809e0ba22d489266c5a38edb21d3b47308eda613e958b50b7da40e02fb706e02f551ee1a502770a047082c6c786e5ab20bcd4a3bbd4591d7e390965e7a64e9a7e4113fc4ee2690e5fda465daf67f4e7a8d7f040bc6e34ae1515f", &(0x7f0000000000)=0x71, 0x0, 0x37) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)) (async) getsockopt$sock_cred(r0, 0xffff, 0x1022, &(0x7f00000000c0), &(0x7f0000000240)=0xc) (async) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) (async) open(&(0x7f0000000080)='./file0\x00', 0x80, 0x2a) (async) open(&(0x7f0000000080)='./file0\x00', 0x80, 0x2a) (async) rename(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') (async) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0xffffffc4, 0x6, 0x2000007, 0x3, 0x80000004, 0xa, 0x82, 0x10, [{0x1000000, 0x4b22, 0x0, 0x71003}, {0xd8, 0x5, 0x8, 0xfffffff9}, {0x7, 0xfffffff6, 0x8, 0x6}, {0x2, 0x4000025, 0x3, 0xfffffffd}, {0xf, 0xf2b, 0x9, 0x2}, {0x7a, 0x1, 0x4000008, 0x95}, {0x83, 0x7c6, 0x9d29, 0x400006d}, {0x3, 0x803, 0x14, 0x2}, {0xfffdffff, 0x82, 0x4, 0xaf}, {0x5, 0x7ffffffe, 0xd1b, 0x88}, {0x1d2, 0x7, 0x2c, 0x4}, {0x4007fc, 0x9, 0x7fffffff, 0x80000000}, {0x81f, 0x2, 0xfffffffc, 0x1001}, {0x29a71713, 0xfffffffa, 0x6, 0x3}, {0x6, 0x3, 0x6}, {0x4, 0x2, 0x1, 0x7fbf}]}) (async) truncate(&(0x7f00000000c0)='./file0\x00', 0x6001000004) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) (async) ioctl$VNDIOCSET(r2, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) (async) ioctl$VNDIOCSET(r2, 0x80044403, &(0x7f00000001c0)={0x0, 0x80000000100007, 0x0}) (async) open(&(0x7f00000000c0)='./file0\x00', 0x78e, 0x7) (async) ioctl$VNDIOCSET(r1, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) (async) ioctl$VNDIOCSET(r1, 0x80044403, &(0x7f00000001c0)={0x0, 0x80000000100007, 0x0}) (async) write(r3, &(0x7f0000000700)="d92938a3", 0x4) (async) setuid(0xee01) (async) shmget$private(0x0, 0x2000, 0x175, &(0x7f0000412000/0x2000)=nil) (async) shmctl$IPC_SET(r4, 0x1, &(0x7f0000000100)={{0x0, 0x0, 0x0, 0x0, 0x0, 0x119, 0x400}, 0x4, 0x1, 0x0, 0x0, 0xfffd, 0xa, 0x9}) (async) shmctl$IPC_RMID(r4, 0x0) (async) sysctl$kern(&(0x7f00000000c0)={0x1, 0x50}, 0x3, &(0x7f0000000280)="00e0ae5b7e0d0000bc5a91501d94a3fec370829ee2155c1adde53710f0424577c49f454b1ec517045beab24398371d1d5494ee942535f1f4ba955b4b17941e49753ab2c147c3cbc319c4898bfc0419a3a1c3999b08e5b2c66b4cc31000ea6fbf8358fa27cb0c710a5c927c0da0ad8ae370c8834130920f2460c5c4000800003213e6ea7acf27db37ad7c1256c0d3885247874f8ceb7b852859a373d213e3ccbb5903145e35fb585b777285195158a472b2ce03aa8b1bd5228f9b82993fa93db80e2fdf0dca1e8da94873821a1acdeaa6330852e68dbab30ac32006ed3736dd3100f128000000000000000000000031da3ced93c51e50867858115138f64154f004eeb98dbc9e1639d3def7b55ea13afb90401d186ec7584b0b941a85c1dfcc4428ad6c4fc02cf966758e76a0a0e0f7e9c1ae618da7d52d6b21520ca48b291967a14b91523d0631d3809e0ba22d489266c5a38edb21d3b47308eda613e958b50b7da40e02fb706e02f551ee1a502770a047082c6c786e5ab20bcd4a3bbd4591d7e390965e7a64e9a7e4113fc4ee2690e5fda465daf67f4e7a8d7f040bc6e34ae1515f", &(0x7f0000000000)=0x71, 0x0, 0x37) (async) 462.250697ms ago: executing program 6 (id=7): syz_emit_ethernet(0xfe, &(0x7f0000000300)={@remote, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0xf0, 0x67, 0x0, 0x0, 0x11, 0x0, @broadcast, @local={0xac, 0x14, 0x0}}, @udp={{0x2, 0x3, 0x8}, {"7447b50350633f3f59ebec0c29fe782e4f7d9198d38a25971e6e76911264b4f9e29957bcff57c4a348b64f4dbed00adc82d80a7b1668379f6d172cb6952364686e7bd27b28eecf30c83d9bc2c469194aca4c884f657ad4b401d4a1111fe428e6792a21969a61b0816e13454959c314d361391ff093384077a86c51375f78a08ee51f984aeb4680b0303a46191b1ad0bb652bc13594a25b69ab027a83b4752452197eb1f8d43400de7d1fee90593be2c20e837066517584ab00a01710483c735232b0454247d0eab39464b997ba29ede6d9eb9918"}}}}}}) mknod(&(0x7f0000000000)='./file0\x00', 0x2100, 0x5f00) mknod(&(0x7f00000002c0)='./bus\x00', 0x2000, 0x412dff) r0 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) r1 = open(&(0x7f0000000080)='./file0\x00', 0x80, 0x2a) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x7, 0x1a, 0x2100007, 0x101, 0x80000001, 0x80000001, 0x10001, 0x10, [{0x0, 0x8, 0x4, 0x71000}, {0x8, 0x9, 0x8, 0xfffffff9}, {0x8, 0xf86, 0x0, 0x9}, {0x1, 0x800, 0x8007}, {0x401, 0x200726, 0x2800, 0x7}, {0x2, 0xa, 0x3, 0x99}, {0xce1, 0xffffffff, 0x4f8, 0x6d}, {0x6, 0x300, 0x54, 0x8}, {0x2, 0x82, 0x5, 0x9}, {0x4, 0x8001, 0xd1b, 0x88}, {0x1ce, 0x10001, 0x8001, 0x3}, {0x7ff, 0x9, 0x0, 0x9}, {0xb8c, 0x4, 0x8, 0x4}, {0x29a71717, 0x7f, 0x1, 0x6}, {0xc, 0x407, 0x5}, {0x8000, 0x1, 0x1002, 0x30004}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r2 = socket$inet(0x2, 0x2, 0x0) getsockopt(r2, 0x0, 0x9, 0x0, 0x0) ioctl$VNDIOCSET(r1, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) ioctl$VNDIOCSET(r1, 0x80044403, &(0x7f00000001c0)={0x0, 0xfffffffffffffffe, 0x0}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/104, 0x68}], 0x1, 0x0) r3 = openat$diskmap(0xffffffffffffff9c, &(0x7f0000000180), 0x80, 0x0) unveil(&(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='r\x00') r4 = socket(0x2, 0x1, 0x0) listen(r4, 0x0) select(0x40, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x0, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) connect$unix(r5, &(0x7f0000000080)=@file={0xb7, 0x0, './file0\x00'}, 0xa) ioctl$DIOCMAP(r3, 0xc0106477, &(0x7f00000000c0)={&(0x7f0000000140)='./file0\x00', r3}) close(r3) r6 = socket(0x18, 0x1, 0x0) getsockopt(r6, 0x6, 0x1, 0x0, 0x0) r7 = socket(0x2, 0x3, 0x11) getsockopt$sock_int(r7, 0xffff, 0x4, &(0x7f0000000040), &(0x7f0000000240)=0xfffffffffffffd58) shutdown(r7, 0x0) 381.249103ms ago: executing program 2 (id=3): sysctl$vm_swapencrypt(&(0x7f0000000040)={0x7, 0x2, 0x3}, 0x3, 0x0, 0x0, 0x0, 0x0) open(&(0x7f00000000c0)='./file0\x00', 0x615, 0x0) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) getresuid(&(0x7f0000000000), &(0x7f0000000080), 0x0) r0 = open(&(0x7f0000000180)='./file0\x00', 0x80000000000206, 0x1) futimens(r0, &(0x7f0000000000)=[{0x11d3, 0x9}, {0x8000000000000001, 0x2}]) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) r1 = open(&(0x7f0000000080)='./file0\x00', 0x80, 0x2a) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$VNDIOCSET(r1, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) ioctl$VNDIOCSET(r1, 0x80044403, &(0x7f00000001c0)={0x0, 0x80000000100007, 0x0}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) open$dir(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r2 = openat$pf(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$TIOCSETA(r2, 0x20004102, 0x0) sysctl$kern(&(0x7f0000000240)={0x1, 0x3e}, 0x2, &(0x7f00000002c0)="85fcbdd2b6a4d97997e95c99ec05ae8513793c0c86b97dd29150fab4d25350c13ba724820451fdc6d0b82f6bd60401fdc82769ac26b1d243657372328ac2f435bf0cb31c920a969872c4113a2ac443ebb9345b66", 0x0, 0x0, 0x0) 302.60027ms ago: executing program 3 (id=4): openat$pf(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x406}, 0x801) setsockopt(0xffffffffffffffff, 0x0, 0x7, 0x0, 0x0) r0 = socket(0x18, 0x1, 0x0) setsockopt(r0, 0x1000000029, 0x3e, &(0x7f0000000000), 0x0) r1 = openat$pf(0xffffffffffffff9c, &(0x7f00000002c0), 0x1, 0x0) r2 = kqueue() r3 = open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7959) writev(r3, &(0x7f00000004c0)=[{&(0x7f00000007c0)="7f4549b70cb7a21de87373791810aaa95d576a0ac7fca22709002987b881794ffa08bb11bafcdc202a2940aaae682605080088be73fd6c631e055d0000000000", 0x40}], 0x1) execve(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) syz_open_pts() ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000040)={0x80000000, 0xffff63de, 0x5, 0x2, 0x8, 0x3, 0x44, 0x10, [{0x1, 0x3, 0x1, 0x80000001}, {0x3, 0xffffffff, 0x6, 0xfff}, {0x1, 0x4bae, 0x3, 0x9}, {0x4, 0xe2, 0x0, 0x100}, {0x3, 0x2000007, 0x4, 0x84}, {0x7890, 0xfffb, 0x8, 0x2}, {0x4, 0x800, 0x3, 0xfffffffa}, {0x207, 0xffffffff, 0x28000, 0xffffe2e9}, {0xc, 0x7ffb, 0x6, 0x7fff}, {0xf, 0x1, 0x6, 0x8bfd}, {0x0, 0x0, 0x8, 0x6}, {0x10000, 0x0, 0x800000, 0xa6a}, {0x401, 0x4, 0x400009, 0xa1}, {0x3, 0x6e2, 0x2, 0x6f5fc48f}, {0x3, 0x101, 0x3, 0x9}, {0x9be2, 0x1, 0x2, 0x400}]}) kevent(r2, &(0x7f0000000140), 0x96, &(0x7f0000000540), 0xfffb4961, 0x0) ioctl$TIOCSETA(r1, 0xcd604404, &(0x7f0000000040)={0x10000000, 0x2, 0x87a, 0x2f, "2800180000020002000000000068ab5ade800600", 0x6, 0x2}) setrlimit(0x8, &(0x7f0000000980)={0x8, 0x54}) r4 = syz_open_pts() close(r4) r5 = syz_open_pts() ioctl$TIOCSETAF(r5, 0x802c7416, &(0x7f0000000100)={0x49789, 0xfffffffb, 0xfffffffe, 0x80a19f, "bb081aa9003721f7beae58be1b0000001d00", 0x4, 0x4}) writev(r4, &(0x7f0000000700)=[{&(0x7f0000000080)="34eb4cd59e8456ebc0881681c60e1cd9e0bf01b618b3cb934394c5951c1db0fd943a", 0xff99}], 0x1) syz_emit_ethernet(0x5e, &(0x7f0000000240)=ANY=[@ANYRES64=r2]) 268.737132ms ago: executing program 5 (id=6): r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x186) mmap(&(0x7f00003a0000/0x2000)=nil, 0x2000, 0x1, 0x2011, r0, 0x4) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x1, 0x1) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) mprotect(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1) r2 = socket(0x2, 0x1, 0x0) fcntl$dupfd(r2, 0x2, r2) r3 = openat$vmm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$VMM_IOC_WRITEREGS(r3, 0x82485608, &(0x7f0000000480)={0x1, 0xe07, 0x6c, {[0x4000000006, 0x1, 0xbffffffffffc, 0x209, 0x0, 0x2, 0x9, 0x6, 0xffffffffffff4f18, 0x200007b, 0x80000000000008, 0x39a, 0x4, 0x101, 0x2, 0xffffffffffffffe5, 0x80000001, 0x4], [0x7fff, 0x8001, 0x7, 0x6, 0x81, 0x7, 0x56f, 0x5, 0x1, 0x9], [0x8, 0x4, 0x100000001, 0xfffd, 0x8000, 0x6, 0x2], [0x8000000000000001, 0x18, 0x9, 0x9, 0x2a79, 0x2], [{0x2, 0x9, 0x2, 0xfffffffffffffffd}, {0x4, 0x8001, 0xff, 0x8}, {0x8, 0xa, 0x10000, 0x8000000000000001}, {0x2, 0x9, 0x1, 0x5}, {0x6, 0xffffff54, 0x8000}, {0x56a5, 0xfffffffc, 0x4, 0x1}, {0x1, 0x3, 0x20000009, 0xd}, {0x1, 0x41, 0x2008000, 0x1}], {0x9, 0xa19e, 0x2000000, 0x9}, {0x400, 0x9, 0x7f, 0x6}}}) r4 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_opts(r2, 0x0, 0x64, &(0x7f0000000180)="01a8b1bdc27fa716de69a23f0000e2edd562a02570a8c88c625991df21fb3137932789c7c1c9d84c7970186809c5dca60ae32cd37a8c5241fd7e6f5a68a94ff5f68f5b87e1fcd8fa03587ae9dfa1c0000f3449ec3b89265daf1d7f6e9a96bcf62bdf6d5096", 0x65) getsockopt(r4, 0x0, 0x6a, 0x0, 0x0) mknod(&(0x7f0000000000)='./bus\x00', 0x3a0914c44f7b202d, 0x504) close(r1) r5 = open(&(0x7f0000000040)='./bus\x00', 0x10005, 0x0) getsockopt$sock_cred(r2, 0xffff, 0x1022, &(0x7f0000000100)={0x0}, &(0x7f0000000240)=0xc) ktrace(&(0x7f0000000080)='./bus\x00', 0x0, 0x310e, r6) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD(r5, 0xc01064c1, 0x0) ioctl$TIOCEXCL(r5, 0x2000740d) open(&(0x7f0000000140)='./bus\x00', 0x80, 0x8) mmap(&(0x7f00000c3000/0x1000)=nil, 0x1000, 0x2, 0x3011, r2, 0x8000000000000004) mmap(&(0x7f00004bb000/0x1000)=nil, 0x1000, 0x1, 0x11, r0, 0x0) fsync(r1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 268.042998ms ago: executing program 4 (id=5): ioctl$FIONREAD(0xffffffffffffff9c, 0x4004667f, &(0x7f0000000000)) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffff9c, 0xc00c642d, &(0x7f0000000040)={0x10000, 0x3, 0xffffffffffffffff}) write(r0, &(0x7f0000000080)="c0cf617f053667ad42a2d41b371c16d74ad598ea85473474716cb75121ae04316ec7dff3be925b5478c4750697f90e6e242fe1275448bf2dff7e2ce965c3da1ffc1eb1ab668f8ce02ca894fee603708657d4ed203913bc9cf4ecdb7d9167d2e02194349867e9261d08decd4943c79ffe3cdae2cf280ae46dcd61d352ec664f42ad36b958b61b065f5af2f223beed30", 0x8f) lseek(r0, 0x1, 0x0) mknodat(r0, &(0x7f0000000140)='./file0\x00', 0x100, 0x7) ioctl$TIOCGFLAGS(r0, 0x4004745d, &(0x7f0000000180)) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000002c0)={&(0x7f00000001c0)=[0x0], &(0x7f0000000200)=[0x0], &(0x7f0000000240)=[0x0, 0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0], 0x1, 0x1, 0x2, 0x4, 0x3, 0x8, 0x4a4fdb4c, 0xcd}) ioctl$TIOCCLRVERAUTH(r0, 0x2000741d) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f0000000300)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r0, 0xc010640b, &(0x7f0000000340)={r2}) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000380), 0x800, 0x0) ppoll(&(0x7f00000003c0)=[{r1, 0x8}, {r3, 0x20}, {r1, 0x8}, {r1, 0x10}, {0xffffffffffffff9c, 0x20}, {r1, 0x100}], 0x6, &(0x7f0000000400)={0x5a0, 0x8000}, &(0x7f0000000440)={0xa}) execve(&(0x7f0000000480)='./file0\x00', &(0x7f0000000540)=[&(0x7f00000004c0)='\\)\x00', &(0x7f0000000500)='/dev/null\x00'], &(0x7f0000000740)=[&(0x7f0000000580)='/dev/null\x00', &(0x7f00000005c0)=',):@{%\x00', &(0x7f0000000600)='/dev/null\x00', &(0x7f0000000640)='/dev/null\x00', &(0x7f0000000680)='.\x00', &(0x7f00000006c0)='/dev/null\x00', &(0x7f0000000700)='}{%(\x00']) r4 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000780), 0x8000, 0x0) r5 = openat$wskbd(0xffffffffffffff9c, &(0x7f00000007c0), 0x8, 0x0) ioctl$WSKBDIO_GETBELL(r5, 0x40105704, &(0x7f0000000800)) ioctl$BIOCSRSIG(r4, 0x80044272, &(0x7f0000000840)=0x566) mquery(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x2, 0x0, r5, 0x1) r6 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000880), 0x200, 0x0) ioctl$BIOCSRTIMEOUT(r6, 0x8010426d, &(0x7f00000008c0)={0x9, 0x3}) ioctl$FIONREAD(r6, 0x4004667f, &(0x7f0000000900)) ioctl$LIOCSFD(r3, 0x80046c7f, &(0x7f0000000940)=r1) ioctl$WSKBDIO_GETBELL(r0, 0x40105704, &(0x7f0000000980)) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f0000000a00)={&(0x7f00000009c0)=[0x6, 0x8000, 0x4], 0x3, 0x4, 0x0, 0xffffffffffffffff}) ioctl$DIOCGETQUEUE(r3, 0xc148445f, &(0x7f0000000a40)={0xffff, 0x8, {'\x00', './file0\x00', './file0\x00', './file0\x00', {{0x200, 0x5}, {0x7, 0x8001}, 0x5}, {{0x4}, {0x3, 0x5d9}, 0x8}, {{0x1, 0x1}, {0x4, 0x8000}, 0x7}, {0x80000001, 0x4, 0x4, 0x73e}, 0x0, 0x7, 0x0, 0x800, 0x7}}) r8 = fcntl$dupfd(r5, 0xa, r7) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE(r0, 0xc01864c2, &(0x7f0000000bc0)={0x0, 0x6, r7, 0x0, 0x5}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000c40)={&(0x7f0000000c00)=[r9], 0x1}) ioctl$BIOCSFILDROP(r8, 0x80044279, &(0x7f0000000c80)=0x9) 267.710689ms ago: executing program 0 (id=1): r0 = socket(0x18, 0x2, 0x0) setsockopt(r0, 0x1000000000029, 0xb, &(0x7f0000003680)='\x00\x00\x00\x00', 0x4) (async) getsockopt(r0, 0x29, 0xa, 0x0, 0x0) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) ioctl$WSDISPLAYIO_GETEMULTYPE(r2, 0x80084904, &(0x7f0000000180)={0x400, './file0\x00'}) r3 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000040), 0x20, 0x0) ioctl$BIOCSETIF(r3, 0x8020426c, &(0x7f0000000080)={'tap', 0x0}) ioctl$WSDISPLAYIO_GVIDEO(r2, 0x40045744, &(0x7f0000000000)) (async) r4 = syz_open_pts() (async) syz_open_pts() ioctl$TIOCSETAF(r4, 0x802c7416, &(0x7f0000000000)={0x40978b, 0x10001, 0xfffffc01, 0xe9, "bb08000100f167d910508bc49d7323000000007e", 0x0, 0xffffffff}) ioctl$TIOCSETA(r4, 0x802c7414, &(0x7f0000000600)={0x6, 0x8, 0xfffffff9, 0x42c93b49, "ee10000000000000ee00", 0x5, 0xa60}) (async) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000440)="2e06b5a54fdc15d0e5ba5cd619e395d842161263a5bcf8d360b109113dd229c0dd47d6ff4f038bc8f40206bf8a1ef55ba04d8d4e4174e29e744d8606170795a2edaf3456112807f6d55fd9c3815257c10e07e8f0be3a7366f8123a42cb43f4302bf6b149e9b9bab6116b11b8ae693250f7fa8080cd8a2fc7c7e4ebf5c106c80fd386c7786c0421183de7b10dbde8040d96f51522423ca8e0f70989e1530cd2eaf7faaad41584384bf407ed7bed944e099fd18b59c86af22bb45fe92b05087191e530bc83a9e0975fc2a0f5988e9ae663b4fe25f69d661eb4ad0842a7be35dbe21e8911da844c7dce8d80f66713e13d96b30d5b4a13fb15282cf2a61a24880049b94a6e46bce752ff3230cd36789c42b37db904fd77060a84ca071839da23ef66bb45a18c9face3b3982d2edef1234405ec89e3ac812208780a2866cf52a8bbbe80b77e07f53d751ea0da7185414c403df8282d22a45b8a5ee7dc9b534106d98bb65aea3af32dea9a7a9881e7fdfbb46801408f1b94018abf7d5816d4e0344ab9dd8a6d43a2503180582f6d553e1a81fe4e8d68fafcd095560e83feda2fcd68d73fc71d7ff20511859f1b895d1a3f42970f1fb4dd61487901de9d5efcb92d63466e92bbe485aaf63988e255cbb607ac7ff9ee30732dd2482be6280b8946e32cf0ec48fc7c89e53c4aecb4af7af69e0dc04dd17405ce02898adf547f851e885964f836ec6b04d77f14d85025e415a01553d6b7e5dd946be3ea735515a624f74e2c09b863881e4412135ecbdd1f1ec73762d2b1bcb0f04f0bd1369f9c374d73fb9cc7465bbdb5e77078870423340ea32c9f49980888427f49eb9d4daf99a87d6d6e44aecd7dfeba2c6f1844b2b537d6de1ba1c8bd90f7ec014b4c84a9bfba26bb92b0d740de1e20c97ec18417a1f3d68fea076ad9aeb884efa6cedf35845dd4bc6eae82e37a2304c76ab6e7467f2d868e76df28b7dbba656b0998da5d54a00e706e8dc0699e961bfe8b6cef550c66eb7e5a40ef12896fb571be1d73d817d17e177f06c0679c784feb85129836c8724bf0c3e6026a3eb831c5335475950287c988059987f9198a074e7d92cdcf6c196d91f9368490b5d5f7033374c27b2aed8732fb84933a8fbe2bcaa68b68eea3400b5b022a2fae01ef3df9bf1ba0739b54faaa56ebe38c40fc6d1d99522c07af188a", 0x34e}], 0x1) (async, rerun: 64) r5 = socket(0x18, 0x1, 0x0) (rerun: 64) r6 = fcntl$dupfd(r5, 0x2, r5) close(r6) ioctl$KDSETRAD(r6, 0x20004b43) (async) umask(0x14) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r2, 0xc00864c0, &(0x7f00000000c0)) select(0x40, &(0x7f0000000180)={0x80000000, 0x44809e9d, 0xfffffffffbffffff, 0xfffffffefffffffd, 0x2000040000000002, 0x210, 0x9454, 0x9}, 0x0, 0x0, 0x0) mknod(&(0x7f00000001c0)='./file0\x00', 0x2000, 0x205b9a) r7 = kqueue() kevent(r7, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) (async) r8 = open(&(0x7f0000000200)='./file0\x00', 0x1, 0x0) ioctl$FIONBIO(r8, 0x82907003, &(0x7f0000000140)=0x1) mknod(&(0x7f0000000000)='./file1\x00', 0x2000, 0x285b9a) (async) mknod(&(0x7f00000000c0)='./bus\x00', 0x2000, 0xd02) r9 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) preadv(r9, &(0x7f0000000300), 0x0, 0x0) 87.179924ms ago: executing program 7 (id=9): syz_emit_ethernet(0x151, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd6036ea07011b3afffe8000000000000000000000000000aaff02000000000000000000000000000188"]) r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xfe, 0x0) (async) select(0x40, &(0x7f0000000180)={0x80000000, 0x44809e9d, 0xfffffffffbffffff, 0xfffffffefffffffd, 0x2000040000000002, 0x210, 0x9454, 0x9}, 0x0, 0x0, 0x0) (async) mknod(&(0x7f00000001c0)='./file0\x00', 0x2000, 0x205b9a) r1 = kqueue() kevent(r1, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) (async) r2 = open(&(0x7f0000000200)='./file0\x00', 0x1, 0x0) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) mknod(&(0x7f0000000000)='./file1\x00', 0x2000, 0x285b9a) r3 = open(&(0x7f0000000080)='./file1\x00', 0x40, 0x132) ioctl$FIONBIO(r3, 0xc0307004, &(0x7f0000000140)=0x1) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000140)={'tap', 0x0}) (async) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000280)={0x3, &(0x7f0000000000)=[{0x80, 0xf0, 0xff, 0x800008}, {0xa4, 0x10, 0x0, 0xfffffffe}, {0x6, 0x4, 0x7, 0xfffff802}]}) (async) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[]) (async) syz_emit_ethernet(0x33, &(0x7f0000000000)={@remote, @local, [], {@arp={0x806, @generic={0xf, 0x8130, 0x6, 0x1, 0x4, @remote, "87", @broadcast, "8bf5e930fc29d0d20822b435d7b14a43"}}}}) 86.861443ms ago: executing program 3 (id=10): sysctl$net_inet_ip(&(0x7f0000000200)={0x4, 0x2, 0x0, 0x19}, 0x4, 0x0, 0x0, &(0x7f00000002c0)='T.', 0x2) syz_emit_ethernet(0x10004, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa01000000880086dd60db8344ffb10608fe7fffffffffffffffffb8eddb00170800007d02de4b54af4e2209189078037fd95e035e63ee150000d1cbb09db8"]) 75.639283ms ago: executing program 1 (id=2): r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x200, 0x186) setrlimit(0x1, &(0x7f0000000000)={0xfffffffffffffffd, 0xffffffffffffffff}) r1 = open(&(0x7f0000000040)='./file0\x00', 0x18289, 0x110) write(r1, &(0x7f00000004c0)="b96abcf5ac7cffa09ea845315c0d853a14", 0xffffff1c) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x2010, r0, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) sendto$unix(r2, 0x0, 0x0, 0x408, &(0x7f00000001c0)=@abs={0x1}, 0x8) close(r2) mknod(&(0x7f0000000080)='./file0\x00', 0xe000, 0xac8) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) 57.972497ms ago: executing program 3 (id=11): ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) ioctl$FIONREAD(0xffffffffffffffff, 0x802069db, &(0x7f00000001c0)) r0 = openat$wsmouse(0xffffffffffffff9c, &(0x7f0000000080), 0x40, 0x0) ioctl$WSMOUSEIO_SETPARAMS(r0, 0x80105728, &(0x7f0000000000)={&(0x7f0000000280)=[{0x8}], 0x1}) fchdir(r0) 57.55305ms ago: executing program 3 (id=12): link(&(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="28000000ffff000001"], 0x28}, 0x0) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=""/54, 0x36}, 0x800) r2 = socket(0x2, 0x3, 0x2f) r3 = dup(r2) setsockopt$inet_opts(r3, 0x0, 0x22, &(0x7f0000000040)="fd0cc085", 0x4) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r4 = socket(0x2, 0x3, 0x0) r5 = socket(0x18, 0x1, 0x0) setsockopt$sock_int(r5, 0xffff, 0x1, &(0x7f0000000000)=0xffffc5db, 0x4) bind(r5, &(0x7f0000000040)=@in={0x2}, 0xc) r6 = dup(r3) dup2(r6, r4) connect$unix(r4, &(0x7f0000000000), 0x10) sendto$inet(r3, &(0x7f00000001c0)="5e1351d18b9da08c", 0x90, 0x0, 0x0, 0x0) 0s ago: executing program 6 (id=13): ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc2585601, &(0x7f0000000340)={0x10, 0x0, [{&(0x7f000005f000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil}, {&(0x7f00000a7000/0x2000)=nil, &(0x7f0000ffe000/0x1000)=nil}, {&(0x7f000008e000/0x11000)=nil, &(0x7f0000090000/0x1000)=nil}, {&(0x7f00000a7000/0x1000)=nil, &(0x7f000009a000/0x2000)=nil, 0x200000000000000}, {&(0x7f00000a3000/0x2000)=nil, &(0x7f000009e000/0x2000)=nil}, {&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x3}, {&(0x7f0000054000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil}, {&(0x7f000009d000/0x4000)=nil, &(0x7f000008e000/0x2000)=nil}, {&(0x7f0000ffa000/0x2000)=nil, &(0x7f000079c000/0x3000)=nil, 0x1}, {&(0x7f00002ef000/0x3000)=nil, &(0x7f000009d000/0x2000)=nil}, {&(0x7f00000a6000/0x3000)=nil, &(0x7f00003cf000/0x3000)=nil}, {&(0x7f00000a1000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil}, {&(0x7f0000ff9000/0x1000)=nil, &(0x7f000037d000/0x4000)=nil}, {&(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil}, {&(0x7f000009a000/0x4000)=nil, &(0x7f0000090000/0x2000)=nil, 0x2}, {&(0x7f000009e000/0x4000)=nil, &(0x7f000009a000/0x2000)=nil}], './file0\x00', 0x6}) syz_emit_ethernet(0x4a, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd606a990000143a29fe0000000000000000020000008000000000000000aa"]) syz_emit_ethernet(0x126f, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd609ded1a12390000c4a4e3434e58d025a6a8a81cf312b8befe8000000000000000000000000000aa00030000000000000101000101000401000401000103000000000100010200000000c7ab6f1eba08bf03d1805fce0ef2ab82f4a065245eccda108bec7cb23f632c993265a4cefeb77b1406d562a47d4b0054943553278b519ed107f62b5c352f8e68d83c1fd85b8e1083556d7fa2fc09a3e823fa940de6ef1b18ddb2a2dba0d2d9c1b44b20ed3a932a2c47f4f4d3e34ea1b67a607001a4541a87d5d347b5049b3444dc2b7abe3499079a5701e88493acb2eb1808e8b1f74311083f93341607915aa46325934e81b672d809cb6bc5f3d64480ba4db4432a67c2548e259fe7831f7c6dfe"]) (async) sysctl$kern(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)="55f8f5782087a072a82ec35f78d14780f518", 0x12) (async) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) r0 = socket(0x18, 0x3, 0x85) ioctl$FIONREAD(r0, 0xc1206949, &(0x7f00000001c0)) (async, rerun: 64) syz_emit_ethernet(0x76, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd606a990000403a2900000000000000000002000000800000fe8000000000000000000000000000aa02009078000000006006c33e00000001ff010000000000000000000000000001ff0200000000000000000000000000012b00"]) (rerun: 64) mknod(&(0x7f00000000c0)='./bus\x00', 0x2006, 0x4f4b) (async, rerun: 64) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) (rerun: 64) r1 = open(&(0x7f0000000080)='./file0\x00', 0x80, 0x2a) (async, rerun: 64) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x7ff, 0x17, 0x2100007, 0x101, 0x80000001, 0x80000001, 0x10001, 0x10, [{0x0, 0x8, 0x4, 0x71000}, {0x8, 0x9, 0x8, 0xfffffff9}, {0x8, 0xf86, 0x0, 0x9}, {0x1, 0x800, 0x8007}, {0x401, 0x200726, 0x2800, 0x7}, {0x2, 0xa, 0x3, 0x99}, {0xce1, 0xffffffff, 0x4f8, 0x6d}, {0x6, 0x300, 0x54, 0x8}, {0x2, 0x82, 0x5, 0x9}, {0x4, 0x8001, 0xd1b, 0x88}, {0x1ce, 0x10001, 0xc, 0x3}, {0x7ff, 0x9, 0x0, 0x9}, {0xb8c, 0x4, 0x8, 0x4}, {0x29a71717, 0x7f, 0x1, 0x6}, {0xc, 0x407, 0x5}, {0x8000, 0x1, 0x1002, 0x30004}]}) (rerun: 64) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$VNDIOCSET(r1, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) (async, rerun: 32) ioctl$VNDIOCSET(r1, 0x80044403, &(0x7f00000001c0)={0x0, 0xfffffffffffffffe, 0x0}) (async, rerun: 32) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) (async) r2 = socket(0x11, 0x3, 0x0) sendto$unix(r2, &(0x7f0000000100)="b10005010000009f2100070007000000331c13fecea10500fef96ecfc72fd3357ae30200004e3039d2d236acf20bf404be01000000f7c8cf5f882b297be1aa0500000051e2f0ad3ebbc257699a1f139b672f335c22db830c032bfa896443c32118210000720fd38bfb0000fd54c125191b1257aea8c500002002fbfe0c2300008abfba0900000008e37193f8343712051eeab71dc000266c05080000fca65361ba84913f0100"/177, 0xb1, 0x0, 0x0, 0x0) r3 = openat$pf(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) ioctl$TIOCSETA(r3, 0xc148445e, &(0x7f0000000300)={0x200032, 0x8, 0x0, 0x0, "97a2224ff1c14a06ebb178926cc9795a6b47c1d1", 0x1, 0xfffffffe}) r4 = socket(0x18, 0x1, 0x0) setsockopt(r4, 0x1000000029, 0x31, &(0x7f00000001c0)="ebff", 0x2) r5 = open$dir(&(0x7f0000000200)='./bus\x00', 0x0, 0x0) (async) r6 = open$dir(&(0x7f0000000040)='./bus\x00', 0x1, 0x0) ioctl$FIOASYNC(r5, 0xc2c04200, &(0x7f00000001c0)) (async, rerun: 64) ioctl$WSMOUSEIO_GETPARAMS(r6, 0x80105727, &(0x7f00000002c0)={&(0x7f0000000240)=[{0x22, 0x1}, {0x26}, {0x88, 0x80000000}, {0x100, 0x4}, {0x26, 0x5}, {0x20, 0x7f}, {0x1, 0x1}, {0x86, 0x3}], 0x8}) (async, rerun: 64) munmap(&(0x7f000000e000/0x400000)=nil, 0x400000) kernel console output (not intermixed with test programs): starting RPC daemons:. savecore: no core dump checking quotas: done. clearing /tmp kern.securelevel: 0 -> 1 creating runtime link editor directory cache. preserving editor files. starting network daemons: sshd. starting local daemons:. Wed Mar 25 19:57:56 PDT 2026 OpenBSD/amd64 (ci-openbsd-multicore-5.us-central1-b.c.syzkaller.internal) (tty00) Warning: Permanently added '10.128.0.189' (ED25519) to the list of known hosts. login: panic: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 955 Stopped at db_enter+0x25: addq $0x8,%rsp TID PID UID PRFLAGS PFLAGS CPU COMMAND 385424 70810 0 0x2 0x1 0 syz-executor db_enter() at db_enter+0x25 panic(ffffffff8344aac0) at panic+0x1e5 __assert(ffffffff8348ad45,ffffffff8349e607,3bb,ffffffff834c745c) at __assert+0x29 refcnt_finalize(ffff80003c41e4f8,ffffffff83442679) at refcnt_finalize+0x1db pppx_if_destroy(205b9a,ffff80003c41e4f0) at pppx_if_destroy+0x3d pppxclose(205b9a,2,2000,ffff80002a242540) at pppxclose+0xa0 spec_close(ffff80003bbd6f40) at spec_close+0x417 VOP_CLOSE(fffffd806c8b8a28,2,fffffd80097fd680,ffff80002a242540) at VOP_CLOSE+0x132 vn_closefile(fffffd806c869600,ffff80002a242540) at vn_closefile+0x12b fdrop(fffffd806c869600,ffff80002a242540) at fdrop+0x121 closef(fffffd806c869600,ffff80002a242540) at closef+0x192 fdfree(ffff80002a242540) at fdfree+0x116 exit1(ffff80002a242540,0,0,1) at exit1+0x576 sys_exit(ffff80002a242540,ffff80003bbd72b0,ffff80003bbd7200) at sys_exit+0x1a end trace frame: 0xffff80003bbd72a0, count: 0 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic *cpu1: kernel diagnostic assertion "refs != ~0" failed: file "/syzkaller/managers/multicore/kernel/sys/kern/kern_synch.c", line 955 ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff8344aac0) at panic+0x1e5 __assert(ffffffff8348ad45,ffffffff8349e607,3bb,ffffffff834c745c) at __assert+0x29 refcnt_finalize(ffff80003c41e4f8,ffffffff83442679) at refcnt_finalize+0x1db pppx_if_destroy(205b9a,ffff80003c41e4f0) at pppx_if_destroy+0x3d pppxclose(205b9a,2,2000,ffff80002a242540) at pppxclose+0xa0 spec_close(ffff80003bbd6f40) at spec_close+0x417 VOP_CLOSE(fffffd806c8b8a28,2,fffffd80097fd680,ffff80002a242540) at VOP_CLOSE+0x132 vn_closefile(fffffd806c869600,ffff80002a242540) at vn_closefile+0x12b fdrop(fffffd806c869600,ffff80002a242540) at fdrop+0x121 closef(fffffd806c869600,ffff80002a242540) at closef+0x192 fdfree(ffff80002a242540) at fdfree+0x116 exit1(ffff80002a242540,0,0,1) at exit1+0x576 sys_exit(ffff80002a242540,ffff80003bbd72b0,ffff80003bbd7200) at sys_exit+0x1a syscall(ffff80003bbd72b0) at syscall+0xb17 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7c5353e04480, count: -16 ddb{1}> show registers rdi 0 rsi 0x1 rbp 0xffff80003bbd6d10 rbx 0xffff8000299bee07 rdx 0 rcx 0xffff80002a242540 rax 0xffff8000299bdff0 r8 0x101010101010101 r9 0x8080808080808080 r10 0x61f20e771fb78464 r11 0x16593ca34913ffdb r12 0xffff8000299bec08 r13 0 r14 0 r15 0x1 rip 0xffffffff81e5aea5 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff80003bbd6d00 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor) tid=151464 pid=90372 tcnt=0 stat=onproc flags process=1008 proc=2000 runpri=32, usrpri=64, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0xffff80002a242540 scnt=-1 ecnt=1 forw=0xffffffffffffffff, list=0xffff80002a2427d8,0xffff80002a242a80 process=0xffff80003c3ec020 user=0xffff80003bbd2000, vmspace=0xfffffd806c926d70 estcpu=14, cpticks=3, pctcpu=0.2, user=0, sys=1, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 36753 385837 70810 0 2 0 syz-executor 36753 367312 70810 0 3 0x4000080 fsleep syz-executor 62502 368864 49059 0 2 0 syz-executor 62502 289354 49059 0 3 0x4000080 fsleep syz-executor 82644 475804 37182 0 2 0 syz-executor 82644 406934 37182 0 2 0x4000000 syz-executor 82644 366013 37182 0 3 0x4000000 fltagain2 syz-executor 82644 173732 37182 0 3 0x4000000 fltagain2 syz-executor 82644 19373 37182 0 2 0x4000000 syz-executor 36382 406983 97033 0 3 0x3000 suspend syz-executor 36382 437462 97033 0 3 0x4081000 smrbar syz-executor 14484 260419 90587 0 2 0 syz-executor 14484 265032 90587 0 2 0x4000000 syz-executor 14484 418327 90587 0 3 0x4000080 fsleep syz-executor 73132 484595 23155 0 2 0 syz-executor 73132 38826 23155 0 3 0x4000080 ttyopn syz-executor 73132 394089 23155 0 3 0x4000080 ttyopn syz-executor 73132 188325 23155 0 3 0x4000080 fsleep syz-executor 90965 225517 868 0 2 0 syz-executor 90965 133270 868 0 3 0x4000080 fsleep syz-executor 97033 345789 80282 0 3 0x82 nanoslp syz-executor 70810 385424 80282 0 7 0x3 syz-executor 23155 452653 80282 0 2 0xc82 syz-executor 90587 482649 80282 0 2 0xc82 syz-executor 49059 413016 80282 0 3 0x82 nanoslp syz-executor 868 280461 80282 0 2 0xc82 syz-executor 37182 141789 80282 0 2 0xc82 syz-executor 61998 189597 80282 0 2 0xc82 syz-executor 80282 237870 12978 0 3 0x82 kqread syz-executor 12978 208357 28147 0 3 0x10008a sigsusp ksh 28147 496733 92335 0 3 0x98 kqread sshd-session 92335 368145 20648 0 3 0x92 kqread sshd-session 90639 219353 1 0 3 0x100083 ttyin getty 20648 336613 1 0 3 0x88 kqread sshd 17317 106524 84136 74 3 0x1100092 bpf pflogd 84136 9730 1 0 3 0x80 sbwait pflogd 99910 420818 20878 73 3 0x1100090 kqread syslogd 20878 238133 1 0 3 0x100082 sbwait syslogd 86978 144376 1 0 3 0x100080 kqread resolvd 32200 2945 76582 77 3 0x100092 kqread dhcpleased 47561 329917 76582 77 3 0x100092 kqread dhcpleased 76582 360680 1 0 3 0x80 kqread dhcpleased 48680 180750 0 0 2 0x14200 smr 65456 18642 0 0 2 0x14200 zerothread 62526 411109 0 0 3 0x14200 aiodoned aiodoned 54141 433940 0 0 2 0x14e00 update 88910 333593 0 0 3 0x14200 cleaner cleaner 27636 451328 0 0 3 0x14200 reaper reaper 27134 284547 0 0 3 0x14200 pgdaemon pagedaemon 38524 8428 0 0 3 0x14200 bored viomb 70009 422299 0 0 3 0x40014200 acpi0 acpi0 79075 163067 0 0 3 0x40014200 idle1 34493 71856 0 0 3 0x14200 bored softnet1 12120 346328 0 0 3 0x14200 bored softnet0 67159 379308 0 0 3 0x14200 bored systqmp 4359 265910 0 0 3 0x14200 bored systq 42274 409668 0 0 3 0x14200 tmoslp softclockmp 86791 127654 0 0 3 0x40014200 tmoslp softclock 72570 468434 0 0 3 0x40014200 idle0 1 22696 0 0 3 0x82 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb{1}> show all locks Process 82644 (syz-executor) thread 0xffff80003bbd8550 (406934) exclusive rrwlock inode r = 0 (0xfffffd806c297568) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 rrw_enter+0xc6 #3 VOP_LOCK+0xbd #4 vn_lock+0xa4 #5 vn_write+0x18f #6 dofilewritev+0x2bd #7 sys_write+0xa2 #8 syscall+0xbd4 #9 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11068 12160K 12178K 166960K 12172 0 pcb 17 12K 12K 166960K 19 0 rtable 241 7K 7K 166960K 355 0 pf 37 18K 18K 166960K 51 0 ifaddr 45 7K 7K 166960K 47 0 ifgroup 60 2K 2K 166960K 60 0 sysctl 1 1K 9K 166960K 5 0 counters 74 37K 37K 166960K 74 0 ioctlops 0 0K 4K 166960K 1487 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1298 82K 82K 166960K 1374 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 1K 166960K 2 0 VM map 2 1K 1K 166960K 2 0 sem 2 0K 0K 166960K 2 0 dirhash 12 2K 2K 166960K 12 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 18 65K 89K 166960K 143 0 proc 70 115K 164K 166960K 555 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 1 0 in_multi 100 7K 7K 166960K 100 0 ether_multi 1 0K 0K 166960K 1 0 mrt 0 0K 0K 166960K 3 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 49 228K 228K 166960K 49 0 exec 0 0K 1K 166960K 380 0 fusefs mount 1 32K 32K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 264 171K 177K 166960K 3060 0 UVM aobj 3 2K 2K 166960K 4 0 pinsyscall 43 86K 102K 166960K 1280 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 NDP 13 0K 2K 166960K 29 0 temp 36 9074K 9138K 166960K 6017 0 kqueue 14 22K 26K 166960K 25 0 SYN cache 2 16K 16K 166960K 2 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 33 0 30 1 0 1 1 0 8 0 rtentry 176 112 0 1 6 0 6 6 0 8 0 unpcb 144 40 0 21 1 0 1 1 0 8 0 syncache 336 3 0 3 1 0 1 1 0 8 1 tcpcb 736 76 0 71 7 0 7 7 0 8 6 arp 136 18 0 0 1 0 1 1 0 8 0 inpcb 328 137 0 128 7 0 7 7 0 8 6 nd6 152 24 0 0 1 0 1 1 0 8 0 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1192 1 0 0 1 0 1 1 0 8 0 pppxif 1576 1 0 0 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfstitem 24 18 0 0 1 0 1 1 0 8 0 pfstkey 128 18 0 0 1 0 1 1 0 8 0 pfstate 448 18 0 0 2 0 2 2 0 8 0 pfrule 1360 22 0 17 2 1 1 2 0 8 0 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 458 0 0 29 0 29 29 0 8 0 art_table 40 459 0 0 5 0 5 5 0 8 0 art_node 32 112 0 11 1 0 1 1 0 8 0 shmpl 112 1 0 1 1 0 1 1 0 8 1 dirhash 1024 17 0 0 3 0 3 3 0 8 0 dino2pl 256 1587 0 115 93 0 93 93 0 8 0 ffsino 296 1587 0 115 114 0 114 114 0 8 0 nchpl 144 1792 0 76 64 0 64 64 0 8 0 vnodes 216 1682 0 0 94 0 94 94 0 8 0 namei 1024 5420 0 5419 2 0 2 2 0 8 1 percpumem 16 52 0 0 1 0 1 1 0 8 0 kstatmem 264 28 0 0 2 0 2 2 0 8 0 scxspl 216 6291 0 6290 4 1 3 3 1 8 2 plimitpl 152 29 0 11 1 0 1 1 0 8 0 sigapl 424 455 0 407 7 0 7 7 0 8 1 knotepl 120 57 0 0 2 0 2 2 0 8 0 kqueuepl 224 25 0 13 1 0 1 1 0 8 0 pipepl 344 122 0 95 3 0 3 3 0 8 0 fdescpl 528 439 0 407 3 0 3 3 0 8 0 filepl 160 1640 0 1409 13 0 13 13 0 8 2 lockfpl 104 10 0 6 1 0 1 1 0 8 0 lockfspl 48 7 0 3 1 0 1 1 0 8 0 sessionpl 144 22 0 13 1 0 1 1 0 8 0 pgrppl 48 30 0 13 1 0 1 1 0 8 0 ucredpl 104 78 0 65 1 0 1 1 0 8 0 zombiepl 144 409 0 407 1 0 1 1 0 8 0 processpl 1232 455 0 407 5 0 5 5 0 8 0 procpl 664 482 0 421 6 0 6 6 0 8 0 sockpl 752 210 0 179 11 0 11 11 0 8 6 mcl64k 65536 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 3 0 0 1 0 1 1 0 8 0 mcl4k 4096 115 0 0 15 0 15 15 0 8 0 mcl2k 2048 20 0 0 3 0 3 3 0 8 0 mtagpl 96 2 0 0 1 0 1 1 0 8 0 mbufpl 256 158 0 0 10 0 10 10 0 8 0 bufpl 280 2422 0 105 166 0 166 166 0 8 0 anonpl 32 5716 0 0 47 0 47 47 0 246 0 amapchunkpl 152 8902 0 8017 35 0 35 35 0 158 0 amappl16 200 2054 0 2039 5 1 4 5 0 8 3 amappl15 192 45 0 45 1 1 0 1 0 8 0 amappl14 184 459 0 458 1 0 1 1 0 8 0 amappl13 176 123 0 111 1 0 1 1 0 8 0 amappl12 168 687 0 656 2 0 2 2 0 8 0 amappl11 160 3 0 3 1 1 0 1 0 8 0 amappl10 152 66 0 52 1 0 1 1 0 8 0 amappl9 144 293 0 293 1 1 0 1 0 8 0 amappl8 136 153 0 151 1 0 1 1 0 8 0 amappl7 128 142 0 128 1 0 1 1 0 8 0 amappl6 120 161 0 160 1 0 1 1 0 8 0 amappl5 112 106 0 96 1 0 1 1 0 8 0 amappl4 104 289 0 270 1 0 1 1 0 8 0 amappl3 96 1503 0 1373 4 0 4 4 0 8 0 amappl2 88 519 0 457 2 0 2 2 0 8 0 amappl1 80 9412 0 8805 15 0 15 15 0 8 1 amappl 88 2349 0 2157 5 0 5 5 0 92 0 uvmvnodes 80 100 0 0 3 0 3 3 0 8 0 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 1 0 1 0 8 0 dma128 128 253 0 253 1 1 0 1 0 8 0 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 3 0 1 1 0 1 1 0 8 0 uaddrrnd 24 439 0 407 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 439 0 407 1 0 1 1 0 8 0 vmmpekpl 168 5419 0 5389 2 0 2 2 0 8 0 vmmpepl 168 36878 0 34904 88 0 88 88 0 357 2 vmsppl 488 438 0 407 5 0 5 5 0 8 0 rwobjpl 80 13969 0 12917 24 0 24 24 0 8 1 pdppl 4096 885 0 814 97 14 83 83 0 8 12 pvpl 32 12075 0 0 98 0 98 98 0 265 0 pmappl 256 438 0 407 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 273 0 17 8 0 8 8 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp x86_ipi_db(ffffffff83885ff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff839d0340) at __mp_lock+0x192 intr_handler(ffff80002a37bd90,ffff8000002a3480) at intr_handler+0xe9 Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f __sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 __mp_lock(ffffffff839d0340) at __mp_lock+0x1a3 ktrstruct(ffff8000fffefca0,ffffffff834b7143,ffff80002a37bfc0,10) at ktrstruct+0xdf sys_nanosleep(ffff8000fffefca0,ffff80002a37c100,ffff80002a37c050) at sys_nanosleep+0x108 syscall(ffff80002a37c100) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7a7f4f594910, count: 3 ddb{0}> trace x86_ipi_db(ffffffff83885ff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff839d0340) at __mp_lock+0x192 intr_handler(ffff80002a37bd90,ffff8000002a3480) at intr_handler+0xe9 Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f __sanitizer_cov_trace_pc() at __sanitizer_cov_trace_pc+0x33 __mp_lock(ffffffff839d0340) at __mp_lock+0x1a3 ktrstruct(ffff8000fffefca0,ffffffff834b7143,ffff80002a37bfc0,10) at ktrstruct+0xdf sys_nanosleep(ffff8000fffefca0,ffff80002a37c100,ffff80002a37c050) at sys_nanosleep+0x108 syscall(ffff80002a37c100) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7a7f4f594910, count: -12 ddb{0}> machine ddbcpu 1 Stopped at db_enter+0x25: addq $0x8,%rsp db_enter() at db_enter+0x25 panic(ffffffff8344aac0) at panic+0x1e5 __assert(ffffffff8348ad45,ffffffff8349e607,3bb,ffffffff834c745c) at __assert+0x29 refcnt_finalize(ffff80003c41e4f8,ffffffff83442679) at refcnt_finalize+0x1db pppx_if_destroy(205b9a,ffff80003c41e4f0) at pppx_if_destroy+0x3d pppxclose(205b9a,2,2000,ffff80002a242540) at pppxclose+0xa0 spec_close(ffff80003bbd6f40) at spec_close+0x417 VOP_CLOSE(fffffd806c8b8a28,2,fffffd80097fd680,ffff80002a242540) at VOP_CLOSE+0x132 vn_closefile(fffffd806c869600,ffff80002a242540) at vn_closefile+0x12b fdrop(fffffd806c869600,ffff80002a242540) at fdrop+0x121 closef(fffffd806c869600,ffff80002a242540) at closef+0x192 fdfree(ffff80002a242540) at fdfree+0x116 exit1(ffff80002a242540,0,0,1) at exit1+0x576 sys_exit(ffff80002a242540,ffff80003bbd72b0,ffff80003bbd7200) at sys_exit+0x1a end trace frame: 0xffff80003bbd72a0, count: 0 ddb{1}> trace db_enter() at db_enter+0x25 panic(ffffffff8344aac0) at panic+0x1e5 __assert(ffffffff8348ad45,ffffffff8349e607,3bb,ffffffff834c745c) at __assert+0x29 refcnt_finalize(ffff80003c41e4f8,ffffffff83442679) at refcnt_finalize+0x1db pppx_if_destroy(205b9a,ffff80003c41e4f0) at pppx_if_destroy+0x3d pppxclose(205b9a,2,2000,ffff80002a242540) at pppxclose+0xa0 spec_close(ffff80003bbd6f40) at spec_close+0x417 VOP_CLOSE(fffffd806c8b8a28,2,fffffd80097fd680,ffff80002a242540) at VOP_CLOSE+0x132 vn_closefile(fffffd806c869600,ffff80002a242540) at vn_closefile+0x12b fdrop(fffffd806c869600,ffff80002a242540) at fdrop+0x121 closef(fffffd806c869600,ffff80002a242540) at closef+0x192 fdfree(ffff80002a242540) at fdfree+0x116 exit1(ffff80002a242540,0,0,1) at exit1+0x576 sys_exit(ffff80002a242540,ffff80003bbd72b0,ffff80003bbd7200) at sys_exit+0x1a syscall(ffff80003bbd72b0) at syscall+0xb17 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7c5353e04480, count: -16