last executing test programs: 484.399673ms ago: executing program 0 (id=1): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000500)=""/239, 0xef}], 0x301, 0x0}, 0x40) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_RXTLS_ENABLE(r2, 0x6, 0x29, &(0x7f00000001c0)={&(0x7f0000000540)="01626104714b80000000e608dab7980ef8bcd3fc153b98ae76e5ae9d83a625dae7fdffffffffffffff460eeead9a637228e6e1f59707275b31681c019381ff7e435e8200586a180b1167f29f3a21d25df3617aaae7ae0000000000000d29a04ef66107714418a45cdd1fbd5ba833e4432bed550f295ad939872f5d7956d6986b24c13353edc490d82bd1c90f2248acdece10cbf87eb9737a9400"/165, &(0x7f00000002c0)="0000000033cbc89145d4f8323b0e80a5c4bf2831dcf4dabe7443942269db242b3c9acb5c09e42f7d442fc016b51dfd819c4af6f6272a19ddd4859f3b1d91c45d898e3095e4c029", 0x0, 0x19, 0xa5, 0x4, 0x1a, 0x2f, 0x0, 0x0, 0x3, '\x00\x00\x00\x00(\x00'}, 0x40) r3 = socket$inet6_udp(0x1c, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x53, &(0x7f0000000040)={0x2, {{0x1c, 0x1c, 0x0, 0xddc0, @remote={0xfe, 0x80, '\x00', 0x0}, 0x1ff}}, {{0x1c, 0x1c, 0x2, 0x4, @remote={0xfe, 0x80, '\x00', 0x0}, 0x6}}}, 0x108) writev(0xffffffffffffffff, 0x0, 0x0) execve(0x0, 0x0, 0x0) r4 = socket(0x1c, 0x1, 0x0) getsockopt$inet6_tcp_buf(r4, 0x6, 0x25, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_TXTLS_ENABLE(r5, 0x6, 0x27, &(0x7f0000000680)={&(0x7f0000000640)="00b2c06df480cfe19f0da47ac0235414", 0x0, &(0x7f0000000100)="78aff7916dc0", 0xb, 0x10, 0x0, 0x13, 0x6, 0x0, 0x3, 0x3, "6a0802e40094ffff"}, 0x40) listen(r5, 0xd) close(r0) writev(r1, 0x0, 0x0) r6 = socket(0x2, 0x4, 0x5) setsockopt$inet_tcp_int(r6, 0x6, 0x100, 0x0, 0x0) 229.662428ms ago: executing program 0 (id=5): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300), 0x1, 0x0) r0 = open$dir(&(0x7f0000000140)='./file0\x00', 0x200, 0x24) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x200201, 0x0) getsockopt$inet_mreq(r1, 0x0, 0xd, &(0x7f0000000100)={@loopback, @loopback}, &(0x7f0000000180)=0x8) aio_write(&(0x7f0000000240)={r1, 0x80000001, &(0x7f0000000040)="e2", 0x1, [0x0, 0x1ff], 0x0, 0x0, 0x0, {0x0, 0x7, 0x0}, {0x0, 0x0, @sival_int, @ke_flags=0x9fc040a3bd859cca}}) setsockopt$inet_tcp_TCP_TXTLS_ENABLE(0xffffffffffffffff, 0x6, 0x27, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000180), 0xb, 0x0, 0x0, 0x13, 0x0, 0x0, 0x3, 0x3, "6a0802e40094ffff"}, 0x40) r2 = open(&(0x7f0000000480)='./file0\x00', 0x80400000000206, 0x0) mlockall(0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0xe, 0x20011, r0, 0x0) r3 = open$dir(&(0x7f0000001240)='./file0\x00', 0x40000400000002c2, 0x0) socket$inet6_tcp(0x1c, 0x1, 0x0) copy_file_range(r3, 0x0, r2, &(0x7f0000000080)=0x2ffff, 0xf, 0x0) preadv(r0, &(0x7f0000000200)=[{&(0x7f0000001280)=""/4112, 0x1010}], 0x1, 0x3) preadv(r0, &(0x7f0000000880), 0x10000000000001d1, 0x200000000012) openat$evdev(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x5) openat$filemon(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0) r4 = kqueue() kevent(r4, &(0x7f0000000040)=[{0x0, 0xfffffffffffffff9, 0x8009, 0x8, 0xe8c5, 0x0, [0x0, 0x0, 0xa, 0x40000000000000]}], 0x1, 0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) access(0x0, 0x0) r5 = socket$inet6_icmp_raw(0x1c, 0x3, 0x3a) getsockopt$inet6_int(r5, 0x29, 0x3e, 0x0, &(0x7f0000000cc0)) kevent(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x0) setreuid(0xee00, 0xffffffffffffffff) procctl$PROC_REAP_KILL(0x0, 0x0, 0x6, &(0x7f0000000180)={0x7, 0x1, 0xffffffffffffffff, 0xfffffffc}) r6 = socket$inet(0x2, 0x3, 0x0) setsockopt$inet_mreqsrc(r6, 0x0, 0x46, &(0x7f0000000040)={@multicast1, @broadcast, @local={0xac, 0x14, 0x0}}, 0xc) setsockopt$inet_mreqsrc(r6, 0x0, 0x46, &(0x7f0000000140)={@multicast1, @multicast1, @local={0xac, 0x14, 0x0}}, 0xc) setsockopt$inet_mreqsrc(r6, 0x0, 0x47, &(0x7f0000000100)={@multicast1, @loopback}, 0xc) 124.297968ms ago: executing program 2 (id=3): kqueue() r0 = open(&(0x7f0000000080)='./file0\x00', 0x80000000000209, 0x0) r1 = open$dir(&(0x7f0000000100)='./file0\x00', 0x10000, 0x0) r2 = open$dir(&(0x7f00000016c0)='./file0\x00', 0x1, 0x0) pwritev(r2, &(0x7f0000000080)=[{&(0x7f00000006c0), 0x100000}], 0x1, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0xaa480) fork() setsockopt$inet6_int(r0, 0x29, 0x26, &(0x7f0000000000)=0x200, 0x4) syz_emit_ethernet(0xa0, &(0x7f00000007c0)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "000200", 0x6a, 0x6, 0x0, @rand_addr="0000000000000000000000000100", @local={0xfe, 0x80, '\x00', 0x0}, {[], @icmpv6=@ni={0x8c, 0x0, 0x0, 0xc4f, 0x9, 0x6, "e1cd0bae9738598792326509030a17db08ac862d4e33a3d5418545f20bb86d7e7fbed8420ac1b8f9a9ef4bd69af7b6783f890ee0d44127553decbad7056101de2b3423ea30291c96978b5745677aad755631686f3890d75e0441"}}}}}}) preadv(r1, &(0x7f0000001780)=[{&(0x7f0000000180)=""/184, 0x1b133353141e377d}], 0x10000000000000d1, 0x0) 45.576854ms ago: executing program 3 (id=4): open(&(0x7f0000000080)='./file0\x00', 0x80000000000209, 0x0) r0 = open$dir(&(0x7f0000000100)='./file0\x00', 0x10000, 0x0) r1 = open$dir(&(0x7f00000016c0)='./file0\x00', 0xa182fdacd32160a9, 0x0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f00000006c0), 0x100000}], 0x1, 0x0) r2 = fork() sigqueue(r2, 0xf, @sival_int=0x8000) mlock(&(0x7f0000ffd000/0x3000)=nil, 0x3000) syz_emit_ethernet(0xe, &(0x7f0000000040)={@local, @random="e56bc80d52f9", [], {@generic={0x88a8}}}) freebsd11_lstat(&(0x7f0000000300)='./file0\x00', 0x0) fork() munmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000) r3 = socket$inet6_udplite(0x1c, 0x2, 0x88) open$dir(0x0, 0x40000400000002c2, 0x0) bind$inet6(r3, &(0x7f0000001140)={0x1c, 0x1c, 0x3, 0x0, @mcast2}, 0x1c) connect$inet6(r3, &(0x7f0000000000)={0x1c, 0x1c, 0x1, 0x0, @rand_addr='\x00\x00\x00\x00\x00\x00\x00\x00 \x00', 0x8}, 0x1c) rfork(0x85000) shm_unlink(&(0x7f0000000000)='./file0\x00') preadv(r0, &(0x7f0000001780)=[{&(0x7f0000000180)=""/184, 0x1b133353141e377d}], 0x10000000000000d1, 0x0) 32.535466ms ago: executing program 1 (id=2): open$dir(&(0x7f00000001c0)='./file0\x00', 0x488200, 0x176) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x28, 0x0, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0xb) open$dir(&(0x7f0000000040)='./file0\x00', 0x200, 0xa) socket$inet6_icmp_raw(0x1c, 0x3, 0x3a) open$dir(&(0x7f0000001240)='./file0\x00', 0x40000400000002c2, 0x74) semop(0x0, 0x0, 0x0) kqueue() r0 = open(&(0x7f0000000480)='./file0\x00', 0x80000000000206, 0x0) ftruncate(r0, 0x3862) r1 = socket(0x1c, 0x1, 0x0) setsockopt$sock_int(r1, 0xffff, 0x1001, &(0x7f00000000c0)=0x101, 0x4) bind$inet6(r1, &(0x7f0000000140)={0x1c, 0x1c, 0x3, 0x0, @empty}, 0x1c) connect$inet6(r1, &(0x7f0000000180)={0x1c, 0x1c, 0x3, 0x0, @empty}, 0x1c) r2 = socket$inet_udplite(0x2, 0x2, 0x88) dup2(r1, r2) r3 = open$dir(&(0x7f0000000380)='./file0\x00', 0x2, 0x108) r4 = semget$private(0x0, 0x2, 0x3c0) __semctl$GETALL(r4, 0x0, 0x6, 0x0) sendfile(r3, r2, 0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200), 0x0, 0x0}, 0x0, 0x14) setreuid(0xee00, 0x0) fork() r5 = kqueue() kevent(r5, &(0x7f0000000040), 0x7fffffff, 0x0, 0xfffffffb, 0x0) mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x5) fork() kqueue() r6 = open(&(0x7f0000000480)='./file0\x00', 0x400000, 0x58) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x12, r6, 0xfffffffffffffffd) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) 0s ago: executing program 2 (id=6): freebsd11_mknod(&(0x7f00000000c0)='./file0\x00', 0x1000, 0x0) open$dir(&(0x7f0000000100)='./file0\x00', 0x8006, 0x0) r0 = socket(0x1c, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0x1c, 0x1c, 0x0, 0x0, @loopback}, 0x1c) r1 = socket(0x1c, 0x1, 0x0) r2 = socket$inet_icmp(0x2, 0x2, 0x1) getsockopt(r2, 0x1, 0x1, &(0x7f0000000180)=""/183, &(0x7f0000000240)=0xb7) setsockopt$sock_int(r1, 0xffff, 0x10000, &(0x7f0000000140)=0xb, 0x4) bind$inet6(r1, &(0x7f0000000000)={0x1c, 0x1c, 0x0, 0x0, @empty}, 0x1c) r3 = socket(0x1c, 0x1, 0x0) setsockopt$sock_int(r3, 0xffff, 0x10000, &(0x7f0000000080)=0xb, 0x4) bind$inet6(r3, &(0x7f0000000000)={0x1c, 0x1c, 0x0, 0x0, @empty}, 0x1c) r4 = openat$crypto(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$CIOCGSESSION2(r4, 0xc040636a, &(0x7f0000000040)={0x0, 0x1d, 0x0, 0x0, 0x1, &(0x7f00000002c0)='h', 0x400000, 0x8d800000, [0x0, 0x2]}) r5 = socket$inet6(0x1c, 0x1, 0x0) setsockopt(r5, 0x29, 0x40, &(0x7f0000000000)="60c6eabb", 0x4) bind$inet6(r5, &(0x7f0000000040)={0x1c, 0x1c, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x2}, 0x1c) r6 = socket$inet6_icmp_raw(0x1c, 0x3, 0x3a) cpuset_setaffinity(0x3, 0x6, 0x7, 0x0, 0xffffffffffffffff) setsockopt$inet6_IPV6_HOPOPTS(r6, 0x29, 0x31, &(0x7f0000000280)=ANY=[@ANYBLOB="1f0100000000000000021ab30001020000060000000000002363858e80cb4554f7a6bba65b185c8a"], 0x18) sendto$inet6(r6, &(0x7f0000002340)="d791f39c6bb4dcb7", 0x8, 0x20008, &(0x7f0000002380)={0x1c, 0x1c, 0x0, 0x5, @loopback}, 0x1c) ppoll(&(0x7f0000000040)=[{0xffffffffffffffff, 0x46}], 0x860, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.41' (ED25519) to the list of known hosts. SYZFAIL: SIGFPE Connection to 10.128.0.41 closed by remote host. FreeBSD/amd64 (ci-freebsd-main-6.us-central1-b.c.syzkaller.internal) (ttyu0) login: Warning! syz-executor[819] uses SF_SYNC sendfile(2) flag. Please follow up to https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=287348. To be removed in FreeBSD 16 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4e800 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4e800 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4d800 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4e800 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4d800 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4d800 FreeBSD/amd64 (ci-freebsd-main-6.us-central1-b.c.syzkaller.internal) (ttyu0) login: if_delmulti_locked: detaching ifnet instance 0xfffffe0058592000 if_delmulti_locked: detaching ifnet instance 0xfffffe0058592000 if_delmulti_locked: detaching ifnet instance 0xfffffe0058592000 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4e000 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4e000 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4e000 pid 760 (csh), jid 0, uid 0: exited on signal 8 (core dumped) pid 816 (dhclient), jid 0, uid 0: exited on signal 8 (core dumped) pid 743 (getty), jid 0, uid 0: exited on signal 8 (core dumped) pid 788 (sh), jid 0, uid 0: exited on signal 8 (core dumped) if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4e000 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4e000 pid 744 (getty), jid 0, uid 0: exited on signal 8 (core dumped) if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4e000 pid 337 (dhclient), jid 0, uid 0: exited on signal 8 (core dumped) if_delmulti_locked: detaching ifnet instance 0xfffffe0058592000 if_delmulti_locked: detaching ifnet instance 0xfffffe0058592000 if_delmulti_locked: detaching ifnet instance 0xfffffe0058592000 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4e800 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4e800 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4e800 pid 739 (getty), jid 0, uid 0: exited on signal 8 (core dumped) pid 735 (sh), jid 0, uid 0: exited on signal 8 (core dumped) pid 807 (dhclient), jid 0, uid 0: exited on signal 8 (core dumped) pid 741 (getty), jid 0, uid 0: exited on signal 8 (core dumped) if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4d800 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4d800 if_delmulti_locked: detaching ifnet instance 0xfffffe0057e4d800 pid 740 (getty), jid 0, uid 0: exited on signal 8 (core dumped) pid 334 (dhclient), jid 0, uid 0: exited on signal 8 (core dumped) pid 742 (getty), jid 0, uid 0: exited on signal 8 (core dumped) pid 745 (getty), jid 0, uid 0: exited on signal 8 (core dumped) pid 823 (getty), jid 0, uid 0: exited on signal 8 (core dumped) FreeBSD/amd64 (ci-freebsd-main-6.us-central1-b.c.syzkaller.internal) (ttyu0) login: show registers Password: Login incorrect login: ps Password: Login incorrect login: show malloc Password: Login incorrect login: show all tcpcbs/bl Password: