last executing test programs:

42.248865421s ago: executing program 4:
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000008000000000000001c2df6f270000000fad413ec50000000f00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='netlink_extack\x00', r0}, 0x10)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newtaction={0x50, 0x30, 0x1, 0x0, 0x0, {}, [{0x3c, 0x1, [@m_mpls={0x38, 0x1, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_MPLS_LABEL={0x8, 0x5, 0x3}]}, {0xfffffffffffffc82, 0x4}, {0xc}, {0xc}}}]}]}, 0x50}}, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0))
vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
open(0x0, 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)

42.091585836s ago: executing program 4:
socket$inet6_tcp(0xa, 0x1, 0x0)
r0 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x77359400}, {0x0, 0x989680}}, 0x0)
r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={<r2=>0xffffffffffffffff})
write$binfmt_script(r2, &(0x7f0000000340), 0xffffff46)
r3 = dup3(r2, r1, 0x0)
sendmsg$netlink(r1, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)=ANY=[], 0x10}], 0x1}, 0x0)
rt_sigreturn()
futex(&(0x7f0000000700)=0x2, 0x0, 0x2, &(0x7f0000000740)={0x0, 0x3938700}, 0x0, 0x0)
close(r3)
timer_settime(0x0, 0x0, &(0x7f0000000080)={{}, {0x0, 0x3938700}}, 0x0)
rt_sigreturn()
r4 = memfd_create(&(0x7f0000001080)='/dev/null\x00', 0x0)
r5 = memfd_create(&(0x7f0000000600)='\xc0\x87:*\x18\xc1k\xa7\x87[\xa0o84I\xaaK\xa5\xd3\v\x86\xca<\x7f\xfd6\x8d}\xd8\xf2G\xb8\xeae)\x90\x86\xe3\x96\b\xe0\xfa\xb1\xd8N\xb2W\xcb\x8d}3lm8\xa57\xc9\x00HO\x00\x00\x00\x00R\xfc\xcb%u3\xec\xde%\x9d\xe4\x1d\rD\x82S\x17?\xd6\xb1\x9aF\xe2\xba[\xc7QR\x9f\x81\x8b\xdc\xc7\xdc\xdem\xbe\x7f2\x11\x17\xd8\xda@4\x9f\xc5*T\x1e^\xf7o\xff\xff\xff\xffwI\x02\xf3\xe3\x8d.\xd1=\xcf\xbf\x81\xb5\x8d%K\x1d\xe7_\xde\x87\xdd\xc1\xf0\x91\x1a!\xa5\xd3\v\xc9\x95d\xe3*\xa9\xfa\x99\xae\xb8\x89>\xc9\xf2/\x13{\x1a\x7f\x00\x00\x00\x00+$\xedX\xb7KV\x90\xc3D-\xf3\x8c\x9a\x15\x9c\xf5\xb4O\x17@d\x81+\xf6\xe6+\xed\r\xd2\xb3\xaa\x9b\x7fC\'\xa2\xf6\x12\xa1\x15Punfo\x7f\x92G\x0e.\xce\xd8h\xb9p2\xccC\xbaH\xc4\xdc\xe2\xa1%)\x85\xc7O]\'9\x92\xad\xfbJ\x02\x1d\x91-\xc99\t&\xbdq\x06`T\xc8\x92\xaf\xad\x06\xdd\xaf\x84\xf4\"\x13\xcf\xe5\x93D\xad~F\xe5\x19\xaa\xaa\xb2\xb1\x03m\x82+\x06\x1bF^\xd3n\xc4F\xc1\xc08\x94\xe6\xe5\x1f\xa7\xf6\xcaA\x90T\xf1\x1b\xe6\xb9\xe7\xff\xc5H\x04\x93\xca\xad\x17UlY\x9a}\r4\xac\x93\xac\v2\xc6\xf9\xbe\xfeI\x8b\xd4/`\xab\x1e\xcf\x7f\b\x94\xfe2.{\xc1\xbe\x9bth~\xcb\xb9E\x10W\xed\xed51[z\xb6>\xd3\xe7Y*\xdb\xa7h\nt\xddP\n\xc5\xeb\xb1ux\x94@\x00\x00g\x02D9\x83\xa7\x97\xf4\xb25wL\x97\xfb\xb9\xccj\xb3\x96\xc1@\xee`{\x87\xa8]\x96\x9cjF^+\xcc1l\xcbmA,5\xc4J\xcab\xa6\x91\xa0\xeaU\x92\x01\x1f,\xfa\x10\"+\x01\x00\x91\xe9\x1cz\xd1f\x901\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00o\"\x85Np\xba\x0e<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8V\xe4\xa1C\x90\x17\xcc{\x9d\xf1\xbd\xb0\xca\x03\x96\x85h}\x8f\x1c)X\xc83rA\x90r\xb6\xba!;\x95\xaf\xe0\xcb\xec\xcd$\x02f\x8c4\x1aH\x8fC\xbfr\xd39\x92\x1fShu\x9e\b\xd4m\xa8\x16\xa6\xd5\xae\xcb\x03oFQ\"\xf7F\xb7\vp\xb6\xe5\x92\xe2O}.\x95A\x9bH\x8d\xa1\x80\x1b\x14u\xfdK\xce\xaf\x94i\xf1s\xf7\xb8Jq\xcb3=M\x84\x7f\x181/\x9bQ|4\xaf\xcf\r\xcfz Z\x19\xad_\x13\x99\xf7\xfdOD\xd3\x9d\x9d\xb8d5g\xf1\x84\xbd\xe5\xa2\xb3\xda\x82\x10n1\xed\xba\xe3\x96\x85\"\xb6\xa6n\xe7\xfd\xd4\a\x97\x85\x810/\xc4o\x11\xc8\x1b\xc0\f\xeec\xa4\x7f|P\x00\x00\x00\x000p\xaf\xfdk\xac\xcc\xac`\xc9\a<\xadIt\x9b\xeb\x8a\xfe\x9b\aO\xa5?h\xe1B\xa8C\x8e;/\xa8\x94\x1bs\xf0\xa9>\x9e\xff\xc9\xd2\x00h\xcb\xfb\xb6Y\xbfp\xd8\x90\x96\xec\x83N\x8bNnx\xb6\x16Y\xf8sU\xae\xa0\b\x8cLq\n\x1f\x99t\xb6\xffozu\xa0B(\xe9?\xcdA\xba\xa8\x13Qc\xda\x16?\xe8z\x8f\x862!\xbf\xa4\xb8\x9bC\xe9Od\xe8\xd32m\x06RX\x7f\xf7\xc2\n\x94\xe5P:l\xd9\xd5\xbd\rH6-\x8a\x12m\xff\xe9\xa0\r\tk\xda\xa4q(\xae\\\xb6\x14I\xf7\xe0z\xf1<cN\xb6p\xd5\rb\xfa\xdf\v\x00X9\xcd\xb2\xfaF\xb9\xaf\x88X\xbc', 0x0)
r6 = fcntl$dupfd(r5, 0x0, r4)
fallocate(r6, 0x0, 0x0, 0x8000007)
fcntl$getflags(r5, 0x40a)

41.883995937s ago: executing program 4:
r0 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'ipvlan0\x00', 0x2})
preadv2(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)
socketpair$unix(0x1, 0x0, 0x0, 0x0)
rt_sigreturn()
futex(&(0x7f0000000700)=0x2, 0x0, 0x2, &(0x7f0000000740)={0x0, 0x3938700}, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{}, {0x0, 0x3938700}}, 0x0)
rt_sigreturn()
mlockall(0x1)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
mlock2(&(0x7f0000ff6000/0x3000)=nil, 0x3000, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040))
open$dir(0x0, 0x0, 0x0)
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x0, 0x0, @thr={&(0x7f0000000140), 0x0}}, 0x0)

39.814879094s ago: executing program 3:
r0 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={<r1=>0xffffffffffffffff})
write$binfmt_script(r1, &(0x7f0000000200)={'#! ', '', [{0x20, '#!2'}, {0x20, '#! '}, {0x20, '/proc/sys/net/ipv4/tcp_congestion_control\x00'}, {}], 0xa, "8855d1bef46f70e481dbdabbfc3bcc3f005c1079e7344e4392717247b88b05708cd1663511237737ac00004c03fa9d00005380"}, 0xfffffe59)
sendmsg$unix(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f00000002c0)='c', 0x1}], 0x1}, 0x0)
rt_sigreturn()
poll(0x0, 0x0, 0x64)
recvmmsg(0xffffffffffffffff, &(0x7f0000000640)=[{{&(0x7f0000000240)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, 0x0, 0x0, 0x0, 0xffffffffffffffb1}}], 0x1, 0x0, 0x0)
rt_sigreturn()
timer_settime(0x0, 0x0, &(0x7f000006b000)={{}, {0x0, 0x3938700}}, 0x0)
mlockall(0x1)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
arch_prctl$ARCH_GET_XCOMP_GUEST_PERM(0x1003, 0x0)

39.643287701s ago: executing program 3:
r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000600)='ns/time_for_children\x00')
ioctl$BTRFS_IOC_INO_LOOKUP(r0, 0x5451, 0x0)
futex(&(0x7f0000000700)=0x2, 0x0, 0x2, &(0x7f0000000740)={0x0, 0x3938700}, 0x0, 0x0)
rt_sigreturn()
r1 = socket$inet(0x2, 0x1, 0x87fff)
socket$inet_icmp(0x2, 0x2, 0x1)
close(0xffffffffffffffff)
openat(0xffffffffffffffff, &(0x7f0000000080)='./file0/file0\x00', 0x141d40, 0x116)
socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
getsockname(r1, &(0x7f0000000240)=@pppol2tp={0x18, 0x1, {0x0, <r2=>0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x0)
fsync(r2)
syz_socket_connect_nvme_tcp()
sendto$inet_nvme_icreq_pdu(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
dup(0xffffffffffffffff)
gettid()
timer_settime(0x0, 0x0, &(0x7f000006b000)={{}, {0x0, 0x989680}}, 0x0)
socketpair$unix(0x1, 0x1, 0x0, 0x0)
write$binfmt_script(0xffffffffffffffff, &(0x7f0000000340), 0xffffff46)
sendmsg$unix(0xffffffffffffffff, 0x0, 0x0)
rt_sigreturn()
poll(0x0, 0x0, 0x64)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0)
dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
rt_sigreturn()
mlockall(0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x0, &(0x7f0000ffd000/0x1000)=nil)
mq_open(&(0x7f0000000000)='-$\x00', 0x0, 0x0, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)

39.463739739s ago: executing program 3:
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10)
r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0)
ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/78, 0x0})
ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000003380))
r2 = eventfd2(0x0, 0x0)
ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000001c0)={0x0, r2})
ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000240)={0x0, 0x0, 0x0, &(0x7f00000016c0)=""/175, 0x0})
ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000000)={0x0, r2})
ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0)=0x1)
ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000040)={@my=0x1})
r3 = socket$vsock_stream(0x28, 0x1, 0x0)
connect$vsock_stream(r3, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10)

38.464142621s ago: executing program 3:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xc534, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, {0x9}}}]}}]}}, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0)
recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095000000000000002d55710c64e30cd8655910b3eb2d1451a6bf4b04dc0af703f4c87963ba8fd1c024815f140290fb3f659193ae297fdcd50b6dc8d41dff00000000000000e272e53a081168e74d7189f0e655f66e08f0e108968d80ea3cac636a830bea16f1e27d5761f66d6e252599ca89adacf4e13a2013988c4222d7cf1ff84820012fd6f16b20de6f1ea6691dcee8e86fa2109aa7898fe15f2c973463c482db5da9926d158ee55592221796e273ccf22a8ce8dd3674739087015098b80e9842e82aa484b0247773b358f02338ba5950707984fb201d101bfd1f78b0ea4f397c22d94b5a34491cf3f671af9dacdf409cc1f8d960358d99d506f9966fc7f6294bd71f8671a68b43621c9444d8ffe5c0827fbb8725eeeb52f472cbc857d860dccc18268bcc9f25a53578f5d1264ca6618dfbdd5c68790793e9d58c4347be3177a4936d603565c373b97b3aab1f1e5db56c"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x22}, 0x44)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2}, 0x10)

36.593081569s ago: executing program 1:
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe4, 0x1}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='ext4_unlink_exit\x00', r2}, 0x10)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='ext4_unlink_exit\x00', r0}, 0x10)
unlink(&(0x7f0000000140)='./cgroup\x00')

36.283719216s ago: executing program 4:
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0xb}, 0x48)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'})
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xb, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x74, 0x101301)
ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000200))
ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8923, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r6 = fcntl$dupfd(0xffffffffffffffff, 0x0, r5)
ioctl$UI_ABS_SETUP(r6, 0x401c5504, 0x0)
r7 = socket$inet6(0xa, 0x0, 0x0)
setsockopt$inet6_int(r7, 0x29, 0x0, 0x0, 0x0)
r8 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r8, 0xaf01, 0x0)
eventfd(0x0)

36.282762066s ago: executing program 1:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000007c0)='./file0\x00', 0x480, &(0x7f00000000c0), 0x1, 0x765, &(0x7f0000000800)="$eJzs3c1rHOUfAPDvbJKmv7Q/E0HQegoIGijdmBpbBQ8VDyJYKOjZdtlsQ80mW7Kb0oSAFhG8CCoeBL307Eu9efXlqv+FB2mpmhYrHiQyu7PpNtltN22SRffzgWmf55nZPPPdZ2aeZ/cZdgLoW+PpP7mIQxHxQRIxmpUnETFUTw1GnGhsd2tttZguSayvv/ZbUt/m5tpqMVpekzqQZR6LiO/fjTic21pvdXllrlAulxaz/GRt/vxkdXnlyLn5wmxptrRwbGp6+ujxZ48f27lY//hp5eC1D19+6qsTf73z6JX3f0jiRBzM1rXGsVPGYzx7T4bSt/AOL+10ZT2W9HoHuC/pqTnQOMvjUIzGQD0FAPyXvRUR6wBAn0n0/wDQZ5rfA9xcWy02l95+I7G3rr8YEfsb8TfnNxtrBrM5u/31edCRm0k2M9KYzEwiYmwH6h+PiM++eeOLdIldmocEaOftSxFxZmx86/U/2XLPwnY93cU245vyrn+wd75Nxz/PtRv/5TbGP3HH+KdhuM25ez/uff7nru5ANR2l478XWu5tu9USf2ZsIMv9vz7mG0rOniuX0mvbQxExEUPDaX7qLnVM3Pj7Rqd1reO/3z968/O0/vT/21vkrg4O3/mamUKt8CAxt7p+KeLxwXbxJxvtn7Rp/7TsVJd1vPL8e592WpfGn8bbXLbGv7vWL0c82bb9b9/Rltz1/sTJ+uEw2Two2vj6509G2pUf2dT+6ZLW3/wssBfS9h+5e/xjSev9mtXt1/Hj5dHvOq27d/ztj/99yev19L6s7GKhVlucitiXvLq1/Ojt1zbzze3T+CeeaH/+bz7+11v2If1MeKbL+Aev/frl/ce/u9L4Z7bV/ttPXLk1N9Cp/u7af7qemshKurn+dbuDD/LeAQAAAAAAAAAAAAAAAAAAAAAAAEC3chFxMJJcfiOdy+XzjWd4PxIjuXKlWjt8trK0MBP1Z2WPxVCu+VOXoy2/hzqV/R5+M390U/6ZiHg4Ij4e/l89ny9WyjO9Dh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMgc6PP8/9ctwr/cOANg1+3u9AwDAntP/A0D/0f8DQP/R/wNA/9H/A0D/0f8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwy06dPJku63+urRbT/MyF5aW5yoUjM6XqXH5+qZgvVhbP52crldlyKV+szN/r75UrlfPTsbB0cbJWqtYmq8srp+crSwu10+fmC7Ol06WhPYkKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALanurwyVyiXS4sSEhISG4leX5kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/h3+CQAA///Q6StZ")
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9)
write$binfmt_elf32(r0, &(0x7f0000000f80)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38}, [{}]}, 0x58)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000007900)=@bridge_setlink={0x20}, 0x20}}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x5f}, [@ldst]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x39)

35.096883458s ago: executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', <r2=>0x0})
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x2c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @crypto_settings=[@NL80211_ATTR_CIPHER_SUITES_PAIRWISE={0x4}]]}, 0x2c}}, 0x0)

35.054817955s ago: executing program 4:
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'sit0\x00', 0x0})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f0000000100), 0x1c)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001c40)=@newtaction={0xf0, 0x30, 0x1, 0x0, 0x0, {}, [{0xdc, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c}]]}, {0x4}, {0xc}, {0xc}}}, @m_police={0x6c, 0x2, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x1}}]]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xf0}}, 0x0)

34.914730916s ago: executing program 1:
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xb, 0x7, 0x8, 0x8, 0x5}, 0x48)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000000)='kfree\x00', r1}, 0x10)
syz_mount_image$f2fs(&(0x7f0000000040), &(0x7f0000000080)='./file2\x00', 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='noacl,fastboot,nolazytime\x00\x00\x00\x00nc_mode=strict,\x00'], 0x1, 0x54f9, &(0x7f000000ab40)="$eJzs3E1rY9UbAPAn7XTe//Mv4sLdXBiEFiZh0nlBd6PO4At2KKMuXGmapCEzSW5p0rR25cKluPCbiIIrl34GF67diQvFnaDknlud+gJC08ZOfz+4ee45OXnuc8Iw8NxbEsCptZj9/GMlrsSFiJiPiMsRxXmlPAp3U3guIq5GxNwTR6Wc/33ibERcjIgrk+QpZ6V869Pr42u3f3jjp6++OXfm0mdffju7XQOz9nxE9DfT+U4/xbyT4qNyvjHuFrF/a1zG9Eb/cTnOU9xprxcZdhr76xpFvNlJ6/PN7eEkbvQazUnsdDeK+c1BuuBw3NnPU3zgUWOrGLfa60XsDvMidvZSXbt76f+2veEo5WmV+T4o0sdotB/TfHu3nfaz+biIzcGonE9581Z7dxLHZSwvF8281yrqWD/MN/3f9mZ3sL2bjdtbw24+yG7X6i/U6neq9a281R61b1Ub/dadW9lSpzdZVh21G/27nTzv9Nq1Zt5fzpY6zWa1Xs+W7rXXu41BVq/XbtZuVG8vl2fXs1cfvJP1WtnSJL7cHWyPur1htpFvZekTy9lK7eaLy9m1evbW6lq29vD+/dW1t9+79+6Dl1Zff6Vc9JeysqWVGysr1fqN6kp9+RTt/6Oy6CnuHw6lMusCAE4e/T8wC0fX/289jDj6/j/0/1Nxovrf097/H8H+4VD0/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp9Z3C5+/VpwspvGlcv5/5dQz5bgSEXMR8evfmI+zB3LOl3kW/mH9wp9q+LoSRYbJNc6Vx8WIuFsev/z/qL8FAAAAeHp98eHVT1K3nl4WZ10QxyndtJm7/P6U8lUiYmHx+yllm5u8PDulZMW/7zOxO6VsxQ2s81NKlm65nZlWtn9l/kA4/0SopDB3rOUAAADH4mAncLxdCAAAAMfp41kXwGxUYv9R5v6z4OIv7/94IHjhwAgAAAA4gSqzLgAAAAA4ckX/7/f/AAAA4OmWfv8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfmPnfm4TB6I4AD8bvLD/tGi1921lb1DGlrDHPUYUkCYogbSQBqiB3FJCBBEeB4WIRJE8thX0fZIZxoIfMwgO80YaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgS3fVenFz9fu6bc5u306e2QAAAADnbKv1on4yS/2vzf3vza2fTb+IiDIizq3dR/HpJHPU5FSvvL56MYbbiDrh8BmT5voSEX+a6+FH198CAAAAXK7NcjVPq/X0MBt6QPQpFW3Kb38z5RURUc3uM6WVh7xfmcLq3/c4/mdKqwtY00xhqeQ2zpX2LvXf/Vi1mz5ritSUb78/29wBAIAejU6aflchAAAA9Onf0ANgGEU8bWUetwInqWm29z6f9AAAAIAPqBh6AAAAAEDn6vW/8/8AAADgsqXz/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOjStlovNsvVvG3Obt9OntkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI/szzsKhEAYhMHe9Z3J3P+w0qCpqUkVCB9/YzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvPndX/5PTI0zydxrY+l5JFk7NbZOjb1z4+gP4+vXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcLE/LykQAkEQBXPG/076/oeVBD2DCBHQ8KiiFg0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABf9Ltf/k9MjTPJ3Glj6XgkWbtqbF019h40jh6Mt38DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcLFzP69xVHEAwN/M7GxtVVyj7CEiCh70Yrfb2tqbeFCCB/8EIaTbGrv1R5uDLUXIxZvknIvoUURQ4i3/Q84J5BJvOewhgmdlZmeSyQ9w/dGZTfL5wJv33WGY932zEPKd9xIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgNLo3YM4yQ6dcRwX5zb3Hi9k/daRPrO+sj2btSyO6kz6dHi5+iHqNpcIAAAA50dS1vchhJ10bS7r405e/6flNVnN/92z47is54/W/WVf1v5Z+/WX3Rf3B+qMx8luentxOLhyPJXWk5vldHvub69o5U8+f/eS5F9I/MHyC6M0f57RNxsb77Xz8EId2QIA/8blsi+C8vehrO83mRgA50arUniX9X/SaTYnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgDqMlsPTZRyFEGZbB3Fma+/xwkn9+sr2bNlurK6uVO+Z3SINIdxeHA6u1DiXaffg4aO788Ph4H79wSshhKZGf6eY/t2PJrg4hEaej+B/CuLiy56WfE5H0OAPJQAAzqS0aFldv5OuzWXnopkQ/vz+cP3/eiUOE9b/ux/f2KyOVa3/+7XNcPr1lu593nvw8NGbi/fm7wzuDD5962r/7f61m9ev3+zl70p63pgAAADw37SLVq3/45nj6/+XKnGYsP7/4tv+V9WxEvX/iQ4W/ZrOBAAA4Hx7/tU/fo9OOB+12+HL+aWl+/3xcf/z1fGxgVT/sQtFq9b/yUzTWQEAAAB1GC1Hh9b/b1XiMOH6/zM/vPRT9Z5JCOFisf5/eeGz4a36pjPV6vhz4qbnCAAAQLMuFq26/p/m+//j/S0PcQjhjdfGcfFvACeq/5P3v/6xOlZ1//+1+qY4leLu+HnkfTeEVrfpjAAAADjLnipaVuz/lq7NffLzpQ/b9v8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1O2vAAAA//+END5e")
mkdir(&(0x7f0000000400)='./file1\x00', 0x0)
mkdir(&(0x7f0000000040)='./file0\x00', 0x0)
syz_mount_image$fuse(0x0, &(0x7f0000000100)='./file0/file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})
chdir(&(0x7f0000000140)='./bus\x00')
lchown(&(0x7f0000000100)='./file0\x00', 0xffffffffffffffff, 0x0)

34.900199008s ago: executing program 3:
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0x1}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90)
r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0}, 0x90)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
r3 = socket$netlink(0x10, 0x3, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10)
r4 = socket$netlink(0x10, 0x3, 0xf)
bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc)
setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4)
setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000000), 0x4)
sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001100)=ANY=[@ANYBLOB="3400000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="000000a5a4000000140012800b000100627269646765"], 0x34}}, 0x0)

34.497427s ago: executing program 0:
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2500000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000580)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd609fbbb000006c00fc010000000000000000000000000000fe8000000000000000000000000000aa"], 0x0)

34.354530912s ago: executing program 0:
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000007c0)='./file0\x00', 0x480, &(0x7f00000000c0), 0x1, 0x765, &(0x7f0000000800)="$eJzs3c1rHOUfAPDvbJKmv7Q/E0HQegoIGijdmBpbBQ8VDyJYKOjZdtlsQ80mW7Kb0oSAFhG8CCoeBL307Eu9efXlqv+FB2mpmhYrHiQyu7PpNtltN22SRffzgWmf55nZPPPdZ2aeZ/cZdgLoW+PpP7mIQxHxQRIxmpUnETFUTw1GnGhsd2tttZguSayvv/ZbUt/m5tpqMVpekzqQZR6LiO/fjTic21pvdXllrlAulxaz/GRt/vxkdXnlyLn5wmxptrRwbGp6+ujxZ48f27lY//hp5eC1D19+6qsTf73z6JX3f0jiRBzM1rXGsVPGYzx7T4bSt/AOL+10ZT2W9HoHuC/pqTnQOMvjUIzGQD0FAPyXvRUR6wBAn0n0/wDQZ5rfA9xcWy02l95+I7G3rr8YEfsb8TfnNxtrBrM5u/31edCRm0k2M9KYzEwiYmwH6h+PiM++eeOLdIldmocEaOftSxFxZmx86/U/2XLPwnY93cU245vyrn+wd75Nxz/PtRv/5TbGP3HH+KdhuM25ez/uff7nru5ANR2l478XWu5tu9USf2ZsIMv9vz7mG0rOniuX0mvbQxExEUPDaX7qLnVM3Pj7Rqd1reO/3z968/O0/vT/21vkrg4O3/mamUKt8CAxt7p+KeLxwXbxJxvtn7Rp/7TsVJd1vPL8e592WpfGn8bbXLbGv7vWL0c82bb9b9/Rltz1/sTJ+uEw2Two2vj6509G2pUf2dT+6ZLW3/wssBfS9h+5e/xjSev9mtXt1/Hj5dHvOq27d/ztj/99yev19L6s7GKhVlucitiXvLq1/Ojt1zbzze3T+CeeaH/+bz7+11v2If1MeKbL+Aev/frl/ce/u9L4Z7bV/ttPXLk1N9Cp/u7af7qemshKurn+dbuDD/LeAQAAAAAAAAAAAAAAAAAAAAAAAEC3chFxMJJcfiOdy+XzjWd4PxIjuXKlWjt8trK0MBP1Z2WPxVCu+VOXoy2/hzqV/R5+M390U/6ZiHg4Ij4e/l89ny9WyjO9Dh4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMgc6PP8/9ctwr/cOANg1+3u9AwDAntP/A0D/0f8DQP/R/wNA/9H/A0D/0f8DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwy06dPJku63+urRbT/MyF5aW5yoUjM6XqXH5+qZgvVhbP52crldlyKV+szN/r75UrlfPTsbB0cbJWqtYmq8srp+crSwu10+fmC7Ol06WhPYkKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALanurwyVyiXS4sSEhISG4leX5kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/h3+CQAA///Q6StZ")
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.avg_queue_size\x00', 0x275a, 0x0)
write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9)
write$binfmt_elf32(r0, &(0x7f0000000f80)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38}, [{}]}, 0x58)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000007900)=@bridge_setlink={0x20}, 0x20}}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000080)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x5f}, [@ldst]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x39)

33.84554774s ago: executing program 1:
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0xb}, 0x48)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'})
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xb, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0x74, 0x101301)
ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000200))
ioctl$USBDEVFS_IOCTL(r4, 0xc0105512, &(0x7f0000000040)=@usbdevfs_connect)
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8923, 0x0)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0)
r6 = fcntl$dupfd(0xffffffffffffffff, 0x0, r5)
ioctl$UI_ABS_SETUP(r6, 0x401c5504, 0x0)
r7 = socket$inet6(0xa, 0x0, 0x0)
setsockopt$inet6_int(r7, 0x29, 0x0, 0x0, 0x0)
r8 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r8, 0xaf01, 0x0)
eventfd(0x0)

33.793597528s ago: executing program 0:
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
pipe2$9p(&(0x7f0000000240)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15)
r2 = dup(r1)
write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18)
write$FUSE_DIRENTPLUS(r2, &(0x7f0000000440)=ANY=[@ANYBLOB="b0"], 0xb0)
write$FUSE_INIT(r2, &(0x7f0000000380)={0x50}, 0x50)
write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2])
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f60000178500000043"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000100)='kmem_cache_free\x00', r4}, 0x10)
mkdir(&(0x7f00000000c0)='./bus\x00', 0x0)
mkdir(&(0x7f0000000440)='./file1\x00', 0x0)
mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000500)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]})

33.529492378s ago: executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0xc9d7, 0x9, 0x1}, 0x48)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0, <r1=>0xffffffffffffffff}, 0x0, &(0x7f00000005c0)}, 0x20)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000650000000800000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10)
write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4c"], 0x15)
write$FUSE_BMAP(0xffffffffffffffff, &(0x7f0000000000)={0x18}, 0x18)
fchmodat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x0)

33.45333343s ago: executing program 0:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000280)={'vlan0\x00', @random="010000201000"})

32.244685945s ago: executing program 2:
openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYRESOCT=0x0], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x10)
bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x0, 0x4, 0xfff, 0x7}, 0x48)
syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), 0xffffffffffffffff)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000400007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='sched_switch\x00', r5}, 0x10)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000d, 0x10, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)

31.256506497s ago: executing program 2:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x0, 0x0)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r3, 0x541b, &(0x7f0000000040)={<r4=>0xffffffffffffffff})
write(0xffffffffffffffff, 0x0, 0x0)
vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
dup(0xffffffffffffffff)
r5 = socket(0x28, 0x1, 0x0)
connect$vsock_stream(r5, &(0x7f0000000300)={0x28, 0x0, 0x0, @my=0x1}, 0x10)
connect$vsock_stream(r5, 0x0, 0x0)
ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f00000000c0)=ANY=[@ANYBLOB="820000"])
close_range(r4, 0xffffffffffffffff, 0x0)

30.149123517s ago: executing program 2:
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020756c2500000000002000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sys_enter\x00', r0}, 0x21)
link(0x0, 0x0)

30.101187734s ago: executing program 2:
syz_mount_image$ext4(0x0, &(0x7f0000000140)='./file0\x00', 0x2000000, 0x0, 0x0, 0x0, &(0x7f0000000000))
pipe2$9p(&(0x7f0000000240)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065ffff018400110800395032303030"], 0x15)
r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10)
r4 = dup(r1)
write$FUSE_BMAP(r4, &(0x7f0000000080)={0x18}, 0x18)
write$FUSE_NOTIFY_RETRIEVE(r4, &(0x7f00000000c0)={0x14c}, 0x137)
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1])
lchown(&(0x7f0000000180)='./file0\x00', 0x0, 0x0)
r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0, 0x0)
getdents64(r5, 0x0, 0x0)

30.029626075s ago: executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x6, 0x4, 0x7fe2, 0x1}, 0x48)
r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000004000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000f00000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10)
sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @loopback}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x6c}}, 0x0)

8.683623508s ago: executing program 1:
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]})
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000a80)='kfree\x00', r0}, 0x10)
recvfrom$inet_nvme(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4)
r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e000000040000000000000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000080)='sys_enter\x00', r2}, 0x10)
io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
r3 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'wg0\x00', <r4=>0x0})
sendto$packet(r3, &(0x7f0000000080)="0b0305000200000002004788aa96a13bb100", 0x12, 0x0, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000240)='rxrpc_notify_socket\x00', r5}, 0x10)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES16, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="ff072d912cc374b1b701365e062671beee6d37413531c9e849cea2739e5e8d77d48a2eb5c45d528133ec10b6ebd8f9c775d82bc26fdc52f468c22907014be3041647fd2a9699f86f6717c8f340274f06b74eabf95c616e4ec2bd72959cf02e883c4f7c9df65cf32a7c012f300b84270b3e86c60b188717c8ac631d98d27c3f1686153f2f92de581d173d000e7be0c021da607e38df63d3199fc526c003a0448fb6c23b52dc73b07feb87fc78471c8e0f68fa5a620898f9e42b910468da3b64c373ae75a77abe2b669ccca918f676679d5e9d79ef02cb338813991c"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
r6 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000340)=ANY=[@ANYBLOB="840100001000130700000000000000007f000001000000000000000000000000fe8000000000000000000000000000bb00000000000000edffffff0000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb0000000032000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c001400636d61632861657329000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000"], 0x184}}, 0x0)
r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x331e, 0x1, 0x401, 0x2905, 0xffffffffffffffff, 0x3, '\x00', r4, r1, 0x3, 0x1, 0x1, 0x6}, 0x48)
r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c340000000000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0)
prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]})
brk(0x0)
syz_usb_control_io$hid(r8, &(0x7f00000001c0)={0x24, &(0x7f0000000dc0)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0)
ptrace(0x10, 0x1)
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r9=>0xffffffffffffffff})
recvmsg(r9, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000540)=""/254, 0xfe}], 0x1}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRESHEX=r7], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
openat$pfkey(0xffffffffffffff9c, &(0x7f0000000340), 0x4380, 0x0)

5.041693707s ago: executing program 4:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet_icmp(0x2, 0x2, 0x1)
r2 = inotify_init1(0x0)
ioctl$F2FS_IOC_MOVE_RANGE(r2, 0x541b, &(0x7f00000000c0)={<r3=>0xffffffffffffffff})
getsockname(r1, &(0x7f00000001c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, <r4=>0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000040)=0x80)
close(r4)
r5 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r5, 0x6, 0x2, &(0x7f0000000440)=0x82, 0x49)
umount2(&(0x7f0000000140)='./file0\x00', 0x0)
setsockopt$sock_int(r5, 0x1, 0x21, &(0x7f0000000080), 0x4)
bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10)
connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
sendto$inet(r5, &(0x7f0000000480)="fbbf0b5044e308cb7bd572aa2b42e967f3aed14dc94a114bd2b45956aebe2b10ff3ee8655d1a5f9e0383611afdd3f8bac3d5cfd7772a3ab48d0ba4b601731e357e38716c449fae7c28548a642105f44bafd08ef8c064db041f1a405e3f650fc3b0926d481c364fca00000000000000006d3a3ede9fc738b8d86209c060161d5ddb5fcf3d09001117cdb9d055aa2d89fe3458720724853a876448d4a1fe9ef0569ad98a05ab5df763923b4e2c576e00000000000000000000000000000000002090666159e3075f7244cf4ec3d78193ec097245fa260e16ded4fb05a947414c0c934f44e200219e6dd7bc23397d5f2f2c76a5baddd0fd3a1dd62be23d7b8ef7a0ac51b74b6b05000000948514cd466943d08eeb3895b80499da2b0120f423c892dd58de6ec2b88f209da4f3ec5e3744ce3e863b0e04d0ec2f39edf50b6e08c4b47e448a35414763d687fbe3792ee15c5b9791310a346472723c100bf77a310b0ced8004b5ac6d48c40439f512e8ef34a53d65f55563f68136a577736ca5f6f66e01ef4ec2cdc8db34f6de50713adaa3f70189958263fddc1314f8a28ccdef6e1390c5fbaeadc3035d019f0dc75de307de6c0d010000000000000027083d1d5b4b013c503b863b560688d94de886b6dc73d5da2dfeff4bed49a975a6c8dbb480e4415ddca5657a5a8e3b8a151015499e952bb5e8d8f60de3d688df7802c6e8b27b31fac4e199038b79a3999920e634a5af162a958130e6647e4107002465", 0x21d, 0x0, 0x0, 0x0)
shutdown(r3, 0x1)
r6 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/tcp\x00')
sendfile(r0, r6, 0x0, 0x7)

4.879030872s ago: executing program 3:
syz_mount_image$hfsplus(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x80000c, &(0x7f0000000180)={[{@force}, {@nls={'nls', 0x3d, 'cp852'}}, {@barrier}, {@type={'type', 0x3d, "883b7f38"}}, {@umask={'umask', 0x3d, 0x6}}, {@umask={'umask', 0x3d, 0x9}}, {@force}, {@nodecompose}, {@gid}]}, 0x2, 0x6da, &(0x7f0000000580)="$eJzs3UtoHOcdAPD/rFarXRUcOfEjLYEsMaSlorZkobTqpW4pRYdQQnroebHlWHgtB0kpsimN0se9h5x6Sg+6hR5Keje054ZAyVXHQCGXnHRTmdmZ1Ur7lKzHJv39xMx8M99z/rMzsw/EBPB/a3k2ys8iieXZN7fS9d2dhebEzsJUnt2MiEpElCLKrUUka5Hl3smn+Ha6MS+f9Ovnw9Wltz//aveL1lo5n7LypUH1eqh0b9rOp6hHxES+7DbZp8VPjnZ/qL27fdsbVdLewzRgN4rAxV+eq1V4bvtdttt5H/8nmw+qfpzzFhhTSeu+2WUmYjoiqhGtu35+dSid7+hO3/ZFDwAAAACOq3b8Ki/sxV5sxaWzGA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8U+XP/0/yqVSk65EUz/+v5NsiT4+h4Q9C/GyqtXx29oMBAAAAAAAAgDP36l7sxVZcKtb3k+w3/9c6fuP/VrwXG7ES63EztqIRm7EZ6zEfETMdDVW2Gpub6/NZzYgrA2rejk971Lzdf4x3TnmfAQAAAAAAAGDMVYfkP5zs3vb7WD74/R8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMZBEjHRWmTTlSI9E6VyRFQjopKW2474tEh/TSS9Nj47/3EAAADAc6keXk2qI9R54f3Yi624VKzvJ9ln/mvZ5+VqvBdrsRmrsRnNWIl7+Wfo9FN/aXdnobm7s/Aonbrb/emXxxp61mK0vnvo3fPLWYla3I/VbMvNuBtJ7GdKeSsv7+4spMtHvcf1QTqm5Ce5AaOZ6EjfS2fXP8nSfz78LUL5WLt4QqW+OTNZ7mQ7InP52NIal4sI9I7E0KNTHtjTfJTa3/xcGdxT75h/MLj36SOlen5zcyGORuJ2lNpH6NrgSER89x8f//pBc+3hg/sbs+OzSz29P7TE0UgsdETi+jcoEsPNZZG42l5fjl/Er2I2vpx6K9ZjNX4TjdiMlXqR38hfz+l8ZnCkPpvuXHtr2EjSc7Levn71GlM9Do0p6vHzLNWI17JjeilWI4nHEbESb2R/t2O+fTU4OMJXRzjrSyNcaTvc+F62aIcpav3L/m20Jk9LGtfLHXHtvObOZHmdWw6i9GLPKBX3utHvRx3K38kTaQt/GHh/OG9HIzHfEYmX+r1eWiH9634632iuPVx/0Hh3xP5ez5fpefSnsbpLpEf4xajmO3c5myfZOTWX5b3UvsMejlcl/8WlpdSVd7Vdr3Wm/jIex71DZ+oPYzEWYykrfS0rPdl1x0rzrrdbOnwNT/PSd1rl9g87ne+3Hkez9X4IgPE2/f3pSu2/tX/XPqr9sfag9mb1Z1M/mnqlEpP/mvxxeW7i9dIryd/jo/jdwed/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg5DaePH3YaDZX1nsnSr2zksG1Gs394kFiA8ocSiT5o3JGKJxsPHm6P7TBwYmpfHgnrH6aieJpjcML189wGMn20eNVHX4siqc8jdBF0hXwtPKJx1z0fLBlcgwO5dFE/fQaLF6wHVnHf/XWeh2viYjoVXjIhWPiNK4+wEW6tfno3VsbT57+YPVR452Vd1bWJhcXl+aWFt9YuHV/tbky15p3VDiXh98C56Hz7URbJSJeHV53wINaAQAAAAAAAAAAgDN0Hv8LcdH7CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHy9Lc9G+VkkMT93cy5d391ZaKZTkT4oWY6IUkQkv41I/hlxJ1pTzHQ0l/Tr58PVpbc//2r3i4O2ykX5UsR233qj2c6nqEfERL48rfbuDm+vcpCc6pGdtCOTBuxGETi4aP8LAAD//7co7JU=")
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001980)='cgroup.stat\x00', 0x275a, 0x0)
write$UHID_INPUT(r0, &(0x7f0000000940)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125c7ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2a36e01c2e7b3aadb32bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bd6c108fab3591bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1a6f65158bb6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2034fae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b8b74e26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd6929bbc2850cd4901389e6ea6e86041e0efa1158f334e7afda0e11c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff0854ee0c83d7b596d273625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c6692abb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b29674bfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bcddf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d672250658bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb15ac56438ea331820ae59c8c474e36fc73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4659698549646bd63175adf77b5cdcfe676e1b1a9af15102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4b9f6e46a8ce73eb22ebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f842629049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21bbfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e00686a3ed499cfb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9f058cc048f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002af6a6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b42e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae6644493f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a", 0x1000}}, 0x1006)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0)
syz_open_dev$sndpcmc(&(0x7f0000000200), 0x0, 0x0)

3.433685643s ago: executing program 0:
socket$nl_route(0x10, 0x3, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x48, 0x2, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}}, 0x0)
sendmsg$IPSET_CMD_SAVE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, 0x8, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0)
r1 = socket(0x18, 0x0, 0x0)
syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x60, 0x0, 0x0, {{0x0, 0x20000000000, 0x0, 0x4, 0x0, 0xff, 0x0, 0xfffffffd}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0x2, @local, 'geneve1\x00'}}, 0x1e)
sendmmsg$unix(r1, &(0x7f0000002140)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000280)="57d3", 0x5ea}], 0x1}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000ac0)="f4e9", 0x2}], 0x1}}], 0x2, 0x0)
syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x3, &(0x7f0000000000), 0x1, 0x614, &(0x7f0000000ac0)="$eJzs3c1vFOUfAPDvbN/b388WNCoepIkxkCgtLWCIMRGORkLw5eap0EKQQgmt0SKJJcGLifHiwcSTB/G/UBKvHrx68OLJkBBjOIhBWTO7O+10u1v6trtt9/NJhp1npjvPM2W//c4++zyzAbSt4fSfQsS+iLiaRAzm9nVGZedw+efu/3njXLokUSy+80cSNz5JFvLHSiqPA5Un/zsYyc+FiL0dK+udnb9+aWJ6eupapTw6d/nq6Oz89UMXL09cmLowdWX8lfHjx44eOz52eFPnl6/61K33Pxz87PR73379MBn77tfTSZyIR5UfSM+r+rk9m6o5/Z0NR7HsQX57+ns9vsljbxd/DWavkyVJ9Qa2rfOV1+OTEfFMDEZH7n9zMD59q6WNAxqqmESWo4C2k2wo/nu3viFAk2XXAdl7+1rvg1cqNPiqBGiGeyfLHQDl2O+KiCz+O8t9g9Eb6db++8myfp4kIjbXM1eW1vHTj6dvpUvU6YcDGmPhZtbLXZ3/k1JsDkVvqdR/v7As/gu5Jd3+9gbrH64qi39onoWbEfFsJf93x7rifzgX/2c3WL/4BwAAAAAAgK1z52REvFxr/F9hcfxPd43xPwMRcWIL6q/z+V/f0pbC3cpKsgXVATn3Tka8VnP87+IY36GOSun/pfEAXcn5i9NThyPiiYg4GF09aXms6rj5EcKHPt/7Vb368+P/0iWtPxsLWDnS3c6qibiTE3MTmz1vIOLezYjnSuN/91e2LB//k+b/pEb+T+P76hrr2Pvi7TP19j0+/oFGKX4TcaBm/l+63E5Wvz/HaOl6YDS7Kljp+Y+/+L5e/eIfWifN//2rx39Pkr9fz+z6jt8dEUfmO4v19m/0+r87ebcjO37qo4m5uWtjEd3JqZXbx9fXZthxzv6zfEJvHVk8ZPGSxv/BF1bv/1u8/s/FYV9ELKyxaU8/Gvit3j75H1onjf/JVfL/G2+WS0v5f/0r47eHfqhX/5k15f+jpZx+sLJF/x/krbgfR/b52WMDtPltBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICdrxAR/4ukMLK4XiiMjEQMRMRT0V+Ynpmde+n8zAdXJtN9pe//L2Tf9DtYLifZ9/8P5crjVeUjEbEnIr7s6CuVR87NTE+2+uQBAAAAAAAAAAAAAAAAAABgmxgozfkv9lTP/0/93tHq1gEN11l5FO/Qfjo3/MxiT/mxb+saAzTVxuMf2OnWHv9dDW0H0Hz14//Bw2JJU5sDNJHrf2hfG4x/HxfALiD/Q7taY59eb6PbAbSC/A8AAAAAALvKnv13fkkiYuHVvtKS6q7sM9gfdrdCqxsAtIwxvNC+Omda3QKgVbzHB5LFtb9rTvavP/o/aUyDAAAAAAAAAAAAAIAVDuwz/x/a1erz/43th91slfn/tYLf7QJgF6n/1R9yP+x23uMDj8v25v8DAAAAAAAAAAAAwDbQe/3SxPT01LXZ+Z238vr2aMb6VhYmtkUztnTlUWOO3BUR2+MEm72S3YKjCXXFQu1dLf67BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALPovAAD//8g9LAI=")
syz_open_dev$video4linux(&(0x7f0000000000), 0x0, 0x0)
ioctl$VIDIOC_TRY_DECODER_CMD(0xffffffffffffffff, 0xc008561b, 0x0)
socket(0x0, 0x0, 0x0)
r2 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', <r3=>0x0})
sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="340000001c0073fc000000000000000007000003", @ANYRES32=r3, @ANYBLOB="420000000a0002"], 0x34}}, 0x0)
syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wlan1\x00'})
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000005c0)={@dev={0xfe, 0x80, '\x00', 0x20}, 0x4, 0x1, 0x1, 0xa, 0x2}, 0x20)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000071122e00000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x80)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000a000000000018000180140002006e657464657673696d300000000000000800080000fcffff0800090000000000080011000000000008000e008000000008000d"], 0x5c}}, 0x0)
sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r1, &(0x7f0000000400)={&(0x7f0000000380), 0xc, &(0x7f00000003c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="28020000", @ANYRES16=0x0, @ANYBLOB="000128bd7000fddbdf250e000000140001800800030001000000080003000100000000020280c8000380080001800400030020000180040003000800010080ffffff040003000400030008000100070000000c000180080001000700000020000180040003000900020065787434000000000400030008000100010000002c0001800a0002000303030303030000070002002d2d000008000100fdffffff0900020073797a3200000000200001800500020000000000040003000f0002002f6465762f6932632d230000240001800500020000000000040003000d0002002d40212924292c2f0000000004000300e7000500ad2d8488027c9e273def0377dd6e9d4783085943174157f99b7088ce372dcec3d4840c8e6b8ebadd92fe47cf16ca94f3ceb52724c284d38d194037e8210003c09a991629c0eb82ce0254296f7bed8cbcff9adf1cf96a4906ef11ecbaaa85e22b9f1275b5d0822a60d25f722b9db74225309480c8e96859a2b2c77d199aad40748b53babd63ed88c3737a3c5bbc3fb05a83dcd5fa83b95678b9ae8ec1b3b7eb23f72094c809abdf8b6f57a6613bc4d24956d5ef69f6ffc8a04247d8ef59c9ee608cee0a154a451c44da3777c0a9b9f7b454056ec6f21445f15076e3eb270b1067c6434c0eac0004007b42802ad4d85adcb66937e32d1af1019117504890726760f0690000040001002500050048be24e2db9290c5928065c3b284908700745c8870983249d07f283c4ee8bab2e9000000"], 0x228}, 0x1, 0x0, 0x0, 0x4}, 0x0)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000280), r4)
sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x40004)

0s ago: executing program 2:
syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f00000000c0)='./file0\x00', 0x8016, &(0x7f0000000100)={[{@compress_algo={'compress', 0x3d, 'zlib'}}, {@noacl}, {@flushoncommit}, {@noautodefrag}, {@barrier}, {@autodefrag}, {@nossd_spread}, {@enospc_debug}]}, 0x1, 0x50f3, &(0x7f000000a2c0)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTsT3573JENYvrOR3E/wmHm5XUpgfKxQ6WkmPbbFHXpgfLxQ65pIemydDeHBhZX9S+H8stJPClbV54UhSOB0L+fnQLRxLCifimfb52ny6aeH7WMgvsJiPV1Cs6V4SkfS42q/HQuGGPc52Dw4AAHBPieE5z7Jjvc2QRtn52qAdVg/aYWTQDvVBO4wmO6Q79tseZnsLcXv7zMalPf//yHD5P74Vq7JFv+v/Q7z+P3+uYff6/9lYaCSF+VhopXcMaMVjZGH343iMRivvcWV9twAAAAB3tfi9QH2F5wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAP+zda4xcV30A8LPP8T683gQqQopggTrGBa/XdnioTcU6TVUUSlmXlKhCFBt7HRZvsLGdgiNAjg1KUZQ0LZHgQ6M4QqjOh6QWCQo0ieJGwihqHihVI5IoEWmdIKLQNIBCIRKpZu49s3fO3XnY3nW86e8neefM/M/zzsNz7r1zLgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA/w9Hv/K5v20Vv/+3Fz3+1KWTnz6w8dLnv3jR2Q+HMFV7vCsLdw1efePkz2+98LYDd62/6Y7jF7+zPy+Xx8NQ9U93fufLsdbjy0O4syuE3jSwZjgL9OX3h2N9bxoO4awwF6iXmB7MSqQNh+8PhHAozAXqVX1vIIThQuCSR+6799pq4oaBEFaGECppG09WsjYG0sB5/VlgMA3s7M0Cv3olUw98tzsLwCmLb4b6i/7IVGOG0fnLNXn99S1Yx15d6fB6YmK0eb6fbVzkThX0zyUfr/2dOqWnrX/BOkYrpbfHUe+2JfBuK23n6z1txS9S+TeUV+ZCldC9bXr7litm98ZHusP4eE+zmhbpeX7sxS9sPZH0knkdxg6MLsjr8LqHVt7as/pDD96xZuWzh9918LlT7eaPCpu0mF5slZC/5pbM8xhN+jxZAm+/0rekMV+6QgjbP/V7H24VL83/R1vP/+PLOd52N+SOtb48ks3N4yPDMfHCSDY3BwAAgCVjKew13Tl+z/ta1Vea/491dvw/HvLPJ/PZaI+GMFlLHFwRwjm1x7PALbG5T64I4a211FRjYGMSOBrCG2uJ1fWqkhLLYomxJPCTkTwwmQSOxcBUEvhWDFyfBL4cA0eSwNYYOJoELoyBMNM4jt8fycfRcWAgBjZnG/FIPAvhFyOxtWRbPVGvCgAAYIHks8O+xruFcx1ONUOcXh4ZaJchnoHdNEMlqSGdwdanVU1r6G1XQ3e7Gurj3t96+KWau9rVXDoNo6sxw42//JuPhBZK8/+J1vP/yjwd6Sod/w9hU+1vzN2dR2br8c1TDRkAAACAUzD0v09/s1W8NP+f7Oz8/7hPpKeQOTwQd0PsWBHCRGMgq/YPy4HsqPdQHgAAAICloH48vn4sfCa/zU7RTufT5fxTJ5g/HvifnDd//9G7N7fqb2n+P9XZ+f+DjbdZJ47FXnxtRQjLCoEfxF5WAzVjMfDj9zcG8vEfixvgmlhVfmJCvaprYonNMTCRBA41K/HDeolzGgP5k1Vv/GB9HDN5iUIAAAAATru4OyAel4/n/7/tN+s/16pcaf6/+cTO/6/Ng0un988OhbC2N4Se9IcBDwxmCwPGwHBXnrhnMKurJ63qqsEQLqgOLK3q6Xz9/950jcFHBrKqYuCctx1+8bxq4psDIawtBh792M3vrib2JoF64385EMJbqqNNG//OsqzxvrTxry8L4c2FQL2qTy4LodpYf1rVfZX8OgZpVf9cCeF1hUC9qvdUQtgXAFii4n+l24oP7tl35Y4ts7PTuxcxEffhD4TtM7PT41t3zm6rNOnTtqTPDcsYXVUeU6dXvnkiX6Loo7dvGu4kXf+d4ESxrXw/funEwfx+/C7UVxvn+r6GuxvSIb/j7eUmQuGbVLMhdy/ykAeLlcw9iaX6Y/7+MBSWXbFnevf457fs3bt7Xfa30+zrs7/xMFO2rdal22pwvr518PJoulpW4mS31apiJWv3Xr5r7Z59V66ZuXzLZdOXTX9m3XvWT5w/sWHiveevrY5qIvvbZqir5qs6GeorN3c4rgUc6rm9hUpOx6eGhITEUkvsHFrV8v/k0vx/V+v5f/zUiZ/8+foMzY7/j8bD/Nnjc4f5N8fAoU6P/482O5pfPzFgLAnsj4H9DvMDAADw2hAn+XFvZtwr/dPV33m2VbnS/H9/Z7//X6D1/+tL11/cbJn/1bHERLP1/9Nl/uvr/+9vtv5/usx/ff3/Q6/C+v9X1APJJvmF9f8BAIDXgtO3/n/b5f3TCwSUMrRd3j+9QEApQ9tl/Du9QMAJr///5H/+1X+HFkrz/+s7m/9buB8AAADOHF/6s8/9Tqt4af5/qLP5/+lf/y80O/9/rFlgqtnCgNb/AwAAYIlqtv7f6NWDn2hVrjT/P9LZ/D+edtHdkDvW+vJItqZdSNe0e2Gk/pMBAAAAWBq6w/h4X4d5G1ZG3XjybT6WLwXaKl309J8cP7Hz/492Nv9v+F3GdQ+tvLVn9YcefPmONSufPfyug8/NHf8HAAAAFk+n+yUAAAAAAAAAAAAAAIBX39P/cWBDq3jp9/9hU+3xZr//j9f9i78veH1D7lhr+/X/8vuXfPC2fbUlCx8YCeHtxcCOAzvOCvm1+VcVA/d+fPUbqokDaYm7n7rwmWriE2ngA2vOfqmauCAJbI6LJL4xDcSrKr60PAnE5RX/PQ3E7XEkDfTnga8uz8bRlW6rnw5n26or3VaPD4ewohCob6s7h7M2utIB3pAE6gP8bBqIA/zzPNCd9uq2oaxXMTAci940lPUKAIAzVvwW2Be2z8xOT8Sv8PH23N7G26hhybKrytV2ddj8E/nSZB+9fdNwJ+me9Lvo3LXG+0KlOoR1pa+rxSxdtVEuTC1tNt3rmwy53Wpv3U3KpU500/U3H9FANqLxrTtnt/W1HfiG9lnW97bNsq402Slm6a5t0g5q6aAvHYyow23TQZfj/e4wPt6T5PqDGBwNDdq9Ijr9vX5xnb9mr4Jins8cP/irVvWV5v+jnc3/K8VxvZRfDGB/vLLe362wzD8AAAAsrq9u/PU34r+PXH3/o63ylub/Y53N/+MerPxQcLa342i8/v/BFSHULq0/mgVuic19ckUIb62lpmKJ7IL6F8cSE1nglrjDZHUssXmqsaplMXAkCfxkJA8cTQLHYiDfS3E45Lty/n4khHfXUpsaS+yKJUaTwIdjYCwJjMfARBJYHgOTSeD55XlgKgn8WwyEmcZtdfvyfFsBAACciHye1dd4N6TzvCO97TJ0tcsw2C5Dd7sMlXYZmo0i3v92zNCXnLzSVcjUl9Y6kNRSyhAvhn/C/SplCD9szJkWLDUdzz+on2/Q1Zjhrvf1VkILpfn/RGfz/8HG26z1Y3H+P3f9vyzwg9i9r8VTx8di4MfvbwzkOwaOxcnuNfWqpvIS+aT9mlhiMgbGksCuGJhMAps35YFDb2gM5DPteuMH643P5CUKAQAAADjt4g6CuJsmzv9v2vOVoVblSvP/yc7m/7G9oWJjX461Hl8ewp1dc72pB9YMZ4G4H2M4/jz+TcMhnFXYwVEvMT2YlehPGg7fH8h+od6fVvW9gezHB/H+JY/cd++11cQNAyGsLOx9qbfxZCVrYyANnNefBQbTwM7eLBD3/NQD3+3OAnDK6nsF4wsqP9WlbnT+ck1ef6+Va4KmwyvtA50n33y/uVospR2u+T7VuhN72lruv2XBlN4eR73bluK7bdS7rfhFKv+G8spcqBK6t01v33LF7N74SPGXrCWL9DwXf6XaSXoBXof7T7637VXSDkwkHx8T85eb/3XYFau77qGVt/as/tCDd6xZ+ezhdx18ruNuNBF/KHzfF/91+EeFzbvYKiF/zS25z5MpnydL8b+BMU9bCGHT81+/plW8NP+f6mz+35vc1vw6bsw9K0J4R2HjPhA3/x+vyD4HC4HsU/J15UB2yP2/Rpp+cgIAAMBCq+/uqO8vmMlvsxPC03lyOf/UCeaP+ysm583fab8H//rjK1vFS/P/za3n/8uSbjr+7/g/i8Tx/3md6buil6UP7D+lXdGl6lgUjv/P60x/tzn+Py/H/x3/n4/j/204/j+vM/1pK31L2uVLVwjh2T+65/FW8dL8f1dn83/r/82/aF99/b/Nzdb/29Vs/b/91v8DAAAWVZOF5tJ5Xmn1vlKGdPW+Uoa2CwS2XWLQ+n8nvP7fM+c++ZvQQmn+v7+z+X98OQwVW18q6/+NbWpS1fUxsMvCgAAAAJyJmu0gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4NV11z/8z7ZW8ft/e9HjT106+ekDGy99/osXnf1wCDO1x7uycNfg1TdO/vzWC287cNf6m+44fvE7K3m5vvz2dxtyx1pfHgnhUOGR4Zh4YaR6Zy5wyQdv29dbTTwwEsLbi4EdB3acVU18aySEVcXAvR9f/YZq4kBa4u6nLnymmvhEGvjAmrNfqiYuyANdaXf/cXnW3a60u9cuD2FFIVDv7qeXN1ZVb+NP80B32sY/DWdtxMBwLPqN4ayNGJiNJWaWhbC2N4SetKr7K1lVPWlV/1LJqupJq/pSJYQLQgi9aVVP9WdV9aYjf7g/qyoGznnb4RfPqyYO9Yewthh49GM3v7ua+GwSqDf+F/0hvKX6kkkb/3Zf1nhf2vgNfSG8OYTQn5b4ZW9Woj8t8XRvCK8rBOqNf6o3hH2B14T44dPwibZn35U7tszOTu9exER/3tZA2D4zOz2+defstkrSp2a6CulXrjr5sT/x4he2Vm8/evum4U7SvXm5vlqX1/c13N1wpvc+9muwWMnc81GqP+bvD0Nh2RV7pnePf37L3r2712V/O82+Pvvbk0ezbbVuqWyrVcVK1u69fNfaPfuuXDNz+ZbLpi+b/sy696yfOH9iw8R7z19bHdVE9nchhnrz6R/qub2FSk7HB4CEhMRSS3Q3fLpNnOkf5KUv+nMd7QuV2gd0aVpRzNJVG+VCDHrjSY74ZL6ntB3RutLEoZRlffssG0qTibksA1mW2ve60uSwWFN3bZPG+91hfLyn2XYYbbxb3Lw/O4XN+1i+6TpNAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD/sQMHAgAAAABA/q+NUFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVYUdOBAAAAAAAPJ/bYSqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoq7MCxAAAAAIAwf+swejYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALgUAAD//x2KI+E=")
openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x48140, 0x0)
acct(&(0x7f0000000040)='\xe9\x1fq\x89Y\x1e\x923aK\x00')
acct(0x0)

kernel console output (not intermixed with test programs):

k
[  340.962064][ T7026] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  341.198057][ T7026] team0: Port device team_slave_0 added
[  341.519074][ T7026] team0: Port device team_slave_1 added
[  341.555612][ T1105] device hsr_slave_0 left promiscuous mode
[  341.638727][ T7075] loop2: detected capacity change from 0 to 512
[  341.648741][ T1105] device hsr_slave_1 left promiscuous mode
[  341.735399][ T1105] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  341.752347][ T1105] batman_adv: batadv0: Removing interface: batadv_slave_0
[  341.802959][ T1105] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  341.839150][ T7075] EXT4-fs (loop2): filesystem is read-only
[  341.845898][ T1105] batman_adv: batadv0: Removing interface: batadv_slave_1
[  341.887611][ T1105] device bridge_slave_1 left promiscuous mode
[  341.908178][ T7077] loop0: detected capacity change from 0 to 512
[  341.914854][ T1105] bridge0: port 2(bridge_slave_1) entered disabled state
[  341.924870][ T1105] device bridge_slave_0 left promiscuous mode
[  341.982965][ T1105] bridge0: port 1(bridge_slave_0) entered disabled state
[  342.005194][ T7077] EXT4-fs (loop0): filesystem is read-only
[  342.150687][ T1105] device veth1_macvtap left promiscuous mode
[  342.167125][ T1105] device veth0_macvtap left promiscuous mode
[  342.177870][ T1105] device veth1_vlan left promiscuous mode
[  342.403437][ T3587] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  342.568334][ T1105] device veth0_vlan left promiscuous mode
[  342.850940][ T3568] Bluetooth: hci1: command tx timeout
[  342.963504][   T27] kauditd_printk_skb: 16 callbacks suppressed
[  342.963519][   T27] audit: type=1800 audit(1717706582.806:260): pid=7085 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="bus" dev="sda1" ino=1962 res=0 errno=0
[  343.046386][ T7085] loop3: detected capacity change from 0 to 512
[  343.086916][ T7085] EXT4-fs warning (device loop3): read_mmp_block:115: Error -117 while reading MMP block 0
[  343.099717][   T27] audit: type=1800 audit(1717706582.806:261): pid=7085 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="bus" dev="sda1" ino=1962 res=0 errno=0
[  343.174864][ T7085] 9pnet_fd: Insufficient options for proto=fd
[  343.396668][ T1105] team0 (unregistering): Port device team_slave_1 removed
[  343.449056][ T7094] loop2: detected capacity change from 0 to 1024
[  343.476042][ T1105] team0 (unregistering): Port device team_slave_0 removed
[  343.508114][ T1105] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  343.524680][ T7094] EXT4-fs (loop2): Test dummy encryption mode enabled
[  343.532901][ T1105] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  343.550570][ T7094] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback.
[  344.459217][ T1105] bond0 (unregistering): Released all slaves
[  344.520542][ T7082] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
[  344.534655][ T7026] batman_adv: batadv0: Adding interface: batadv_slave_0
[  344.547680][ T7026] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  344.601070][ T7026] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  344.647506][ T7105] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'.
[  344.659051][ T7105] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.0'.
[  344.680506][ T7105] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check.
[  344.704984][ T7106] netlink: 'syz-executor.2': attribute type 1 has an invalid length.
[  344.715118][ T7106] netlink: 100 bytes leftover after parsing attributes in process `syz-executor.2'.
[  344.737260][ T7026] batman_adv: batadv0: Adding interface: batadv_slave_1
[  344.754351][ T7026] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  344.808933][ T7026] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  344.820109][   T27] audit: type=1326 audit(1717706584.656:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7108 comm="syz-executor.4" exe="/root/syz-executor.4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3eb0c7cf69 code=0x0
[  344.931294][ T3568] Bluetooth: hci1: command tx timeout
[  345.051056][ T6296] EXT4-fs (loop2): unmounting filesystem.
[  345.107383][ T7121] netlink: 'syz-executor.2': attribute type 10 has an invalid length.
[  345.186304][ T7121] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.2'.
[  345.268230][ T7121] bridge0: port 2(syz_tun) entered blocking state
[  345.297699][ T7121] bridge0: port 2(syz_tun) entered disabled state
[  345.360089][ T7121] device syz_tun entered promiscuous mode
[  345.387845][ T7121] bridge0: port 2(syz_tun) entered blocking state
[  345.394456][ T7121] bridge0: port 2(syz_tun) entered forwarding state
[  345.474309][ T7026] device hsr_slave_0 entered promiscuous mode
[  345.488436][ T7026] device hsr_slave_1 entered promiscuous mode
[  345.522423][ T7123] bridge0: port 2(syz_tun) entered disabled state
[  345.574285][ T7123] device syz_tun left promiscuous mode
[  345.579926][ T7123] bridge0: port 2(syz_tun) entered disabled state
[  346.113756][ T7128] loop4: detected capacity change from 0 to 512
[  347.010901][ T3568] Bluetooth: hci1: command tx timeout
[  347.104491][ T7128] EXT4-fs (loop4): filesystem is read-only
[  347.739135][ T7139] loop2: detected capacity change from 0 to 512
[  347.792042][ T7139] EXT4-fs (loop2): filesystem is read-only
[  347.937097][ T7026] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  347.990904][ T7026] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  348.059675][ T7026] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  348.111800][ T7026] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  348.754512][ T7144] loop3: detected capacity change from 0 to 8192
[  348.770246][ T7026] 8021q: adding VLAN 0 to HW filter on device bond0
[  348.829170][  T152] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  348.838303][ T7144]  loop3: AHDI p1 p2 p4
[  348.847838][ T7144] loop3: p1 size 1048576 extends beyond EOD, truncated
[  348.873656][  T152] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  348.899961][ T7144] loop3: p4 size 50331648 extends beyond EOD, truncated
[  348.932204][ T7026] 8021q: adding VLAN 0 to HW filter on device team0
[  349.419469][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  350.374058][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  350.669077][ T3616] bridge0: port 1(bridge_slave_0) entered blocking state
[  350.676276][ T3616] bridge0: port 1(bridge_slave_0) entered forwarding state
[  351.035087][ T7156] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
[  351.051095][ T7155] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
[  351.060335][ T7155] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.3'.
[  351.118428][ T3587] udevd[3587]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory
[  351.141090][ T7155] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check.
[  351.171531][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  351.179582][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  351.195014][ T3558] udevd[3558]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory
[  351.229402][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  351.270277][   T22] bridge0: port 2(bridge_slave_1) entered blocking state
[  351.277440][   T22] bridge0: port 2(bridge_slave_1) entered forwarding state
[  351.371241][ T3577] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  351.400159][ T3577] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  351.423123][ T7163] loop3: detected capacity change from 0 to 128
[  351.442195][ T7163] FAT-fs (loop3): Unrecognized mount option "0x0000000000000000" or missing value
[  351.454159][ T3577] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  351.484357][ T3577] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  351.561591][ T3577] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  351.637797][ T7026] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[  351.652406][ T7026] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  351.669808][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  351.692318][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  351.807476][ T7168] loop4: detected capacity change from 0 to 1024
[  351.821275][ T7168] EXT4-fs: Ignoring removed orlov option
[  352.571524][ T7168] EXT4-fs (loop4): Test dummy encryption mode enabled
[  352.589341][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  352.608732][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  352.625347][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  352.655222][   T22] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  352.681549][ T7168] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback.
[  352.783074][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  352.973649][ T6359] EXT4-fs (loop4): unmounting filesystem.
[  353.198685][ T3630] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  353.224672][ T3630] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  353.270378][ T7026] 8021q: adding VLAN 0 to HW filter on device batadv0
[  353.319510][ T7178] loop3: detected capacity change from 0 to 4096
[  353.372110][ T3630] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  353.390473][ T3630] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  353.419834][ T7183] loop4: detected capacity change from 0 to 512
[  353.450442][ T3630] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  353.473873][ T3630] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  353.485068][ T7178] NILFS (loop3): invalid segment: Checksum error in segment payload
[  353.515231][ T7026] device veth0_vlan entered promiscuous mode
[  353.534656][ T7186] fuse: Bad value for 'user_id'
[  353.540619][  T152] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  353.555027][ T7178] NILFS (loop3): trying rollback from an earlier position
[  353.555589][  T152] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  353.582226][ T7183] EXT4-fs (loop4): filesystem is read-only
[  353.671982][ T7178] NILFS (loop3): recovery complete
[  353.674843][ T7185] 8021q: adding VLAN 0 to HW filter on device bond0
[  353.713952][ T7185] team0: Port device bond0 added
[  353.719356][ T7187] NILFS (loop3): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  353.763660][ T7026] device veth1_vlan entered promiscuous mode
[  353.795181][ T3630] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  353.854273][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  353.874639][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  353.887661][ T7026] device veth0_macvtap entered promiscuous mode
[  353.919816][ T7026] device veth1_macvtap entered promiscuous mode
[  354.002063][ T7026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  354.045465][ T7026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  354.088628][ T7026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  354.117755][ T7026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  354.133086][ T7026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  354.149717][ T7026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  354.282881][ T7026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  354.376836][ T7026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  354.437707][ T7026] batman_adv: batadv0: Interface activated: batadv_slave_0
[  354.535905][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  354.549259][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  354.763660][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  355.179783][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  355.214901][ T7026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  355.250556][ T7026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  355.297971][ T7026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  355.327688][ T7026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  355.383273][ T7026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  355.404513][ T7026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  355.436100][ T7026] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  355.467138][ T7026] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  355.504057][ T7026] batman_adv: batadv0: Interface activated: batadv_slave_1
[  355.528089][ T7196] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'.
[  355.603289][ T7198] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
[  355.642097][ T7198] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.2'.
[  355.656412][ T7198] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check.
[  355.683617][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  355.708682][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  355.755491][ T7026] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  355.792644][ T7026] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  355.818583][ T7026] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  355.848189][ T7026] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  356.000422][ T3568] Bluetooth: hci4: unexpected cc 0x0c5a length: 1 < 2
[  356.970682][ T4127] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  356.988290][ T4127] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  357.128574][    T7] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  357.157473][ T4127] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  357.174073][ T4127] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  357.291057][ T7215] loop2: detected capacity change from 0 to 1024
[  357.302447][ T7215] EXT4-fs: Ignoring removed orlov option
[  357.648489][ T3643] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[  357.928344][ T7215] EXT4-fs (loop2): Test dummy encryption mode enabled
[  357.955788][ T7215] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback.
[  358.122671][ T7219] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'.
[  358.185280][ T6296] EXT4-fs (loop2): unmounting filesystem.
[  358.318636][ T7222] Bluetooth: MGMT ver 1.22
[  358.675860][ T7234] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'.
[  358.710678][ T7234] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.0'.
[  358.840929][ T7234] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check.
[  359.164191][ T7239] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
[  359.944951][ T7246] loop4: detected capacity change from 0 to 512
[  360.049291][ T7246] EXT4-fs (loop4): filesystem is read-only
[  360.429746][ T7226] loop2: detected capacity change from 0 to 40427
[  360.508879][ T7226] F2FS-fs (loop2): Insane cp_payload (553648128 >= 504)
[  360.528189][ T7226] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock
[  360.548649][ T7226] F2FS-fs (loop2): invalid crc value
[  360.685721][ T7226] F2FS-fs (loop2): Found nat_bits in checkpoint
[  360.727449][ T3568] Bluetooth: hci3: unexpected cc 0x0c5a length: 1 < 2
[  360.806676][ T7226] F2FS-fs (loop2): Cannot turn on quotas: -2 on 1
[  360.877511][ T7226] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0
[  360.898652][ T7226] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5
[  360.916898][ T7253] loop0: detected capacity change from 0 to 4096
[  360.926492][ T7253] ntfs3: loop0: Different NTFS' sector size (2048) and media sector size (512)
[  360.982454][ T3568] Bluetooth: hci4: unexpected subevent 0x1a length: 10 > 6
[  360.993458][ T7253] ntfs3: loop0: Mark volume as dirty due to NTFS errors
[  361.007861][ T7253] ntfs3: loop0: Failed to load $BadClus.
[  361.144199][   T27] audit: type=1800 audit(1717706600.986:263): pid=7259 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="file1" dev="loop2" ino=14 res=0 errno=0
[  361.145131][ T7259] 9pnet_fd: Insufficient options for proto=fd
[  361.423557][ T6296] syz-executor.2: attempt to access beyond end of device
[  361.423557][ T6296] loop2: rw=2049, sector=45096, nr_sectors = 16 limit=40427
[  362.338109][ T7264] loop0: detected capacity change from 0 to 32768
[  362.342247][ T7276] loop3: detected capacity change from 0 to 512
[  362.480568][ T7276] EXT4-fs (loop3): filesystem is read-only
[  362.523807][ T7264] XFS (loop0): Mounting V5 Filesystem
[  362.574214][ T7274] 9pnet_fd: Insufficient options for proto=fd
[  362.594963][ T7274] loop2: detected capacity change from 0 to 128
[  362.618298][ T7274] FAT-fs (loop2): Unrecognized mount option "shortname=win9M" or missing value
[  362.783935][ T7264] XFS (loop0): Ending clean mount
[  362.853183][ T7294] loop4: detected capacity change from 0 to 512
[  362.970189][ T7294] EXT4-fs (loop4): filesystem is read-only
[  363.183731][ T6627] XFS (loop0): Unmounting Filesystem
[  363.198869][ T7299] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
[  363.240938][ T7299] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.2'.
[  363.348071][ T7299] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check.
[  363.361641][ T7270] loop1: detected capacity change from 0 to 32768
[  363.415785][ T3558] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop1 scanned by udevd (3558)
[  363.457708][ T7270] BTRFS info (device loop1): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  363.528263][ T7270] BTRFS info (device loop1): using crc32c (crc32c-intel) checksum algorithm
[  363.576576][ T7270] BTRFS info (device loop1): using free space tree
[  363.970611][ T7315] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'.
[  364.269267][ T7270] BTRFS info (device loop1): enabling ssd optimizations
[  364.441461][ T7026] BTRFS info (device loop1): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  366.427911][ T7350] loop1: detected capacity change from 0 to 512
[  366.659612][ T7350] EXT4-fs (loop1): filesystem is read-only
[  366.760152][ T7353] loop3: detected capacity change from 0 to 256
[  366.840164][ T7353] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0xf6e00961, utbl_chksum : 0xe619d30d)
[  367.197402][ T7361] 9pnet_fd: Insufficient options for proto=fd
[  367.239560][ T7361] loop3: detected capacity change from 0 to 128
[  367.264010][ T7361] FAT-fs (loop3): Unrecognized mount option "shortname=win9M" or missing value
[  367.593954][ T7343] loop0: detected capacity change from 0 to 40427
[  367.609961][ T7343] F2FS-fs (loop0): Insane cp_payload (553648128 >= 504)
[  367.618006][ T7343] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[  367.673670][ T7343] F2FS-fs (loop0): invalid crc value
[  367.709444][ T7343] F2FS-fs (loop0): Found nat_bits in checkpoint
[  367.897018][ T7343] F2FS-fs (loop0): Cannot turn on quotas: -2 on 1
[  367.908436][ T7343] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0
[  367.919143][ T7343] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
[  367.920564][ T7367] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
[  367.969748][ T3568] Bluetooth: hci3: unexpected subevent 0x1a length: 10 > 6
[  367.990870][ T7367] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.4'.
[  368.026342][ T7367] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check.
[  368.084023][   T27] audit: type=1800 audit(1717706607.926:264): pid=7374 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.0" name="file1" dev="loop0" ino=14 res=0 errno=0
[  368.106802][ T7374] 9pnet_fd: Insufficient options for proto=fd
[  368.348050][ T6627] syz-executor.0: attempt to access beyond end of device
[  368.348050][ T6627] loop0: rw=2049, sector=45096, nr_sectors = 16 limit=40427
[  368.407683][ T7375] loop3: detected capacity change from 0 to 512
[  368.437876][ T7383] loop4: detected capacity change from 0 to 512
[  368.478093][ T7375] EXT4-fs (loop3): filesystem is read-only
[  368.519275][ T7383] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended
[  368.563712][ T7385] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'.
[  368.754227][ T7383] EXT4-fs error (device loop4): ext4_orphan_get:1396: inode #17: comm syz-executor.4: iget: bad i_size value: -6917529027641081756
[  368.831590][ T7383] EXT4-fs error (device loop4): ext4_orphan_get:1401: comm syz-executor.4: couldn't read orphan inode 17 (err -117)
[  368.865913][ T7383] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback.
[  368.909806][ T7389] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
[  368.976638][ T7391] loop2: detected capacity change from 0 to 512
[  369.046496][ T7391] EXT4-fs (loop2): Test dummy encryption mode enabled
[  369.140160][ T6359] EXT4-fs (loop4): unmounting filesystem.
[  369.181401][ T7391] EXT4-fs error (device loop2): __ext4_iget:5044: inode #11: block 1: comm syz-executor.2: invalid block
[  369.194645][ T7391] EXT4-fs error (device loop2): ext4_orphan_get:1401: comm syz-executor.2: couldn't read orphan inode 11 (err -117)
[  369.212005][ T7391] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none.
[  369.586059][ T7404] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
[  369.714886][ T7402] loop4: detected capacity change from 0 to 512
[  370.396640][ T7402] EXT4-fs (loop4): filesystem is read-only
[  370.822737][ T7407] loop1: detected capacity change from 0 to 512
[  370.896998][ T7407] EXT4-fs (loop1): Test dummy encryption mode enabled
[  370.958590][ T7407] EXT4-fs error (device loop1): __ext4_iget:5044: inode #11: block 1: comm syz-executor.1: invalid block
[  370.970586][ T7407] EXT4-fs error (device loop1): ext4_orphan_get:1401: comm syz-executor.1: couldn't read orphan inode 11 (err -117)
[  371.188455][ T7414] loop0: detected capacity change from 0 to 40427
[  371.202673][ T7407] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none.
[  371.215848][ T7414] F2FS-fs (loop0): invalid crc value
[  371.279950][ T7414] F2FS-fs (loop0): Found nat_bits in checkpoint
[  371.384646][ T7414] F2FS-fs (loop0): Cannot turn on quotas: -2 on 1
[  371.429177][ T7414] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5
[  371.627200][ T6627] syz-executor.0: attempt to access beyond end of device
[  371.627200][ T6627] loop0: rw=524288, sector=45064, nr_sectors = 8 limit=40427
[  371.680952][ T6627] syz-executor.0: attempt to access beyond end of device
[  371.680952][ T6627] loop0: rw=0, sector=45064, nr_sectors = 8 limit=40427
[  371.799614][ T1105] kworker/u4:5: attempt to access beyond end of device
[  371.799614][ T1105] loop0: rw=2049, sector=45096, nr_sectors = 24 limit=40427
[  371.844701][ T6627] bridge0: port 3(syz_tun) entered disabled state
[  371.860042][ T6627] device syz_tun left promiscuous mode
[  371.867872][ T6627] bridge0: port 3(syz_tun) entered disabled state
[  372.013049][ T6296] EXT4-fs (loop2): unmounting filesystem.
[  372.102465][ T1105] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  372.274316][ T7426] 9pnet_fd: Insufficient options for proto=fd
[  372.297119][ T7426] loop2: detected capacity change from 0 to 128
[  372.312324][ T7426] FAT-fs (loop2): Unrecognized mount option "shortname=win9M" or missing value
[  372.317976][ T1105] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  372.575608][ T1105] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  372.682504][ T1105] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  373.094515][ T3585] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  373.107067][ T3585] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  373.118395][ T3585] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  373.148893][ T3585] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  373.156488][ T3585] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[  373.165112][ T3585] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  373.597307][ T7443] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'.
[  373.639310][ T7026] EXT4-fs (loop1): unmounting filesystem.
[  373.810435][ T7432] chnl_net:caif_netlink_parms(): no params data found
[  374.096478][ T7430] loop3: detected capacity change from 0 to 40427
[  374.111073][ T7430] F2FS-fs (loop3): Insane cp_payload (553648128 >= 504)
[  374.122390][ T7430] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock
[  374.133953][ T1105] device hsr_slave_0 left promiscuous mode
[  374.143137][ T1105] device hsr_slave_1 left promiscuous mode
[  374.155518][ T1105] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  374.166871][ T1105] batman_adv: batadv0: Removing interface: batadv_slave_0
[  374.175833][ T7430] F2FS-fs (loop3): invalid crc value
[  374.217043][ T7430] F2FS-fs (loop3): Found nat_bits in checkpoint
[  374.218925][ T1105] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  374.333521][ T1105] batman_adv: batadv0: Removing interface: batadv_slave_1
[  374.365235][ T7430] F2FS-fs (loop3): Cannot turn on quotas: -2 on 1
[  374.369785][ T7461] loop4: detected capacity change from 0 to 512
[  374.390261][ T1105] device bridge_slave_1 left promiscuous mode
[  374.398003][ T7430] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0
[  374.398186][ T1105] bridge0: port 2(bridge_slave_1) entered disabled state
[  374.435584][ T7466] vivid-004: disconnect
[  374.445054][ T7430] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
[  374.465425][ T7461] EXT4-fs (loop4): filesystem is read-only
[  374.466592][ T1105] device bridge_slave_0 left promiscuous mode
[  374.517129][ T1105] bridge0: port 1(bridge_slave_0) entered disabled state
[  374.534656][ T3585] Bluetooth: hci2: unexpected subevent 0x1a length: 10 > 6
[  374.590314][ T1105] device veth1_macvtap left promiscuous mode
[  374.619567][ T1105] device veth0_macvtap left promiscuous mode
[  374.640008][   T27] audit: type=1800 audit(1717706614.476:265): pid=7470 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="file1" dev="loop3" ino=14 res=0 errno=0
[  374.692007][ T1105] device veth1_vlan left promiscuous mode
[  374.718410][ T1105] device veth0_vlan left promiscuous mode
[  374.805660][ T6220] syz-executor.3: attempt to access beyond end of device
[  374.805660][ T6220] loop3: rw=2049, sector=45096, nr_sectors = 16 limit=40427
[  374.907621][ T7448] loop1: detected capacity change from 0 to 32768
[  375.079434][ T7448] XFS (loop1): Mounting V5 Filesystem
[  375.178746][ T7462] vivid-004: reconnect
[  375.251161][ T3585] Bluetooth: hci3: command tx timeout
[  375.327743][ T1105] team0 (unregistering): Port device team_slave_1 removed
[  375.354772][ T1105] team0 (unregistering): Port device team_slave_0 removed
[  375.377471][ T1105] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  375.409041][ T7448] XFS (loop1): Ending clean mount
[  375.414444][ T3585] Bluetooth: hci2: command 0x0406 tx timeout
[  375.466586][ T1105] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  375.546505][ T7488] loop3: detected capacity change from 0 to 512
[  375.750177][ T7026] XFS (loop1): Unmounting Filesystem
[  375.847458][ T7488] EXT4-fs (loop3): Test dummy encryption mode enabled
[  375.886042][ T1105] bond0 (unregistering): Released all slaves
[  375.953960][ T7492] loop2: detected capacity change from 0 to 512
[  375.970404][ T7492] EXT4-fs (loop2): filesystem is read-only
[  375.994338][ T7488] EXT4-fs error (device loop3): __ext4_iget:5044: inode #11: block 1: comm syz-executor.3: invalid block
[  376.057008][ T7488] EXT4-fs error (device loop3): ext4_orphan_get:1401: comm syz-executor.3: couldn't read orphan inode 11 (err -117)
[  376.157349][ T7488] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none.
[  376.265665][ T7487] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
[  376.437602][ T7432] bridge0: port 1(bridge_slave_0) entered blocking state
[  376.486781][ T7432] bridge0: port 1(bridge_slave_0) entered disabled state
[  376.519036][ T7432] device bridge_slave_0 entered promiscuous mode
[  376.528172][ T7432] bridge0: port 2(bridge_slave_1) entered blocking state
[  376.535836][ T7432] bridge0: port 2(bridge_slave_1) entered disabled state
[  376.545375][ T7432] device bridge_slave_1 entered promiscuous mode
[  376.677287][ T7432] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  376.693109][ T7432] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  376.741528][ T7432] team0: Port device team_slave_0 added
[  376.760467][ T7432] team0: Port device team_slave_1 added
[  376.835541][ T7432] batman_adv: batadv0: Adding interface: batadv_slave_0
[  376.847990][ T7432] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  376.960377][ T7432] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  377.037025][ T7432] batman_adv: batadv0: Adding interface: batadv_slave_1
[  377.065090][ T7432] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  377.217911][ T7432] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  377.331012][ T3585] Bluetooth: hci3: command tx timeout
[  377.851924][ T7432] device hsr_slave_0 entered promiscuous mode
[  377.874670][ T7432] device hsr_slave_1 entered promiscuous mode
[  377.911375][ T7432] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  377.938897][ T7432] Cannot create hsr debugfs directory
[  377.959412][ T7510] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
[  378.337296][ T7511] loop1: detected capacity change from 0 to 512
[  378.453134][ T1255] ieee802154 phy0 wpan0: encryption failed: -22
[  378.459467][ T1255] ieee802154 phy1 wpan1: encryption failed: -22
[  378.600332][ T6220] EXT4-fs (loop3): unmounting filesystem.
[  378.617216][ T7511] EXT4-fs (loop1): Test dummy encryption mode enabled
[  378.748113][ T7515] loop4: detected capacity change from 0 to 1024
[  378.760459][ T7515] EXT4-fs: Ignoring removed orlov option
[  378.916984][ T7515] EXT4-fs (loop4): Test dummy encryption mode enabled
[  379.410887][ T3568] Bluetooth: hci3: command tx timeout
[  379.494278][ T7515] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback.
[  379.578687][ T7511] EXT4-fs error (device loop1): __ext4_iget:5044: inode #11: block 1: comm syz-executor.1: invalid block
[  379.771603][ T7511] EXT4-fs error (device loop1): ext4_orphan_get:1401: comm syz-executor.1: couldn't read orphan inode 11 (err -117)
[  379.788750][ T6359] EXT4-fs (loop4): unmounting filesystem.
[  379.798907][ T7511] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none.
[  380.003538][ T7524] netlink: 'syz-executor.4': attribute type 10 has an invalid length.
[  380.031256][ T7524] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'.
[  380.085212][ T7524] bridge0: port 3(syz_tun) entered blocking state
[  380.125047][ T7524] bridge0: port 3(syz_tun) entered disabled state
[  380.186061][ T7524] device syz_tun entered promiscuous mode
[  380.200331][ T7524] bridge0: port 3(syz_tun) entered blocking state
[  380.206945][ T7524] bridge0: port 3(syz_tun) entered forwarding state
[  380.312751][ T7527] bridge0: port 3(syz_tun) entered disabled state
[  380.364729][ T7527] device syz_tun left promiscuous mode
[  380.374877][ T7527] bridge0: port 3(syz_tun) entered disabled state
[  380.418099][ T7530] netlink: 'syz-executor.2': attribute type 4 has an invalid length.
[  380.495752][ T7529] netlink: 'syz-executor.2': attribute type 4 has an invalid length.
[  380.531309][ T3568] Bluetooth: hci4: command 0x0406 tx timeout
[  381.501019][ T3568] Bluetooth: hci3: command tx timeout
[  381.939707][ T7432] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  382.019012][ T7432] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  382.029657][ T3585] Bluetooth: hci0: unexpected cc 0x0c5a length: 1 < 2
[  382.056452][ T7432] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  382.104169][ T7432] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  382.200387][ T7026] EXT4-fs (loop1): unmounting filesystem.
[  382.356689][ T7432] 8021q: adding VLAN 0 to HW filter on device bond0
[  382.404099][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  382.414642][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  382.436404][ T7432] 8021q: adding VLAN 0 to HW filter on device team0
[  382.457131][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  382.469686][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  382.491969][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[  382.499152][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[  382.537654][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  382.537927][ T7536] loop3: detected capacity change from 0 to 40427
[  382.546019][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  382.561531][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  382.570283][ T3616] bridge0: port 2(bridge_slave_1) entered blocking state
[  382.577474][ T3616] bridge0: port 2(bridge_slave_1) entered forwarding state
[  382.586458][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  382.600977][ T7536] F2FS-fs (loop3): Insane cp_payload (553648128 >= 504)
[  382.608139][ T7536] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock
[  382.635437][ T7067] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  382.648835][ T7067] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  382.649981][ T7536] F2FS-fs (loop3): invalid crc value
[  382.663523][ T7067] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  382.672409][ T7067] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  382.682070][ T7067] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  382.691426][ T7067] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  382.701761][ T7067] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  382.715859][ T7432] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  382.727210][ T7536] F2FS-fs (loop3): Found nat_bits in checkpoint
[  382.730334][ T7432] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  382.748951][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  382.758944][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  382.773581][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  382.886486][ T7536] F2FS-fs (loop3): Cannot turn on quotas: -2 on 1
[  382.912214][ T7536] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0
[  382.919407][ T7536] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
[  382.975453][ T3585] Bluetooth: hci2: unexpected subevent 0x1a length: 10 > 6
[  383.038296][ T7541] loop2: detected capacity change from 0 to 32768
[  383.147550][   T27] audit: type=1800 audit(1717706622.986:266): pid=7567 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.3" name="file1" dev="loop3" ino=14 res=0 errno=0
[  383.238719][ T7541] XFS (loop2): Mounting V5 Filesystem
[  383.371354][ T6220] syz-executor.3: attempt to access beyond end of device
[  383.371354][ T6220] loop3: rw=2049, sector=45096, nr_sectors = 16 limit=40427
[  383.567099][ T7541] XFS (loop2): Ending clean mount
[  383.618445][ T7432] 8021q: adding VLAN 0 to HW filter on device batadv0
[  383.667878][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  383.680525][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  383.729053][ T7585] loop1: detected capacity change from 0 to 512
[  383.737134][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  383.766796][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  383.819730][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  383.832111][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  383.834016][ T7585] EXT4-fs (loop1): filesystem is read-only
[  383.857372][ T7432] device veth0_vlan entered promiscuous mode
[  383.870365][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  383.879807][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  383.895359][ T7432] device veth1_vlan entered promiscuous mode
[  383.981971][ T6296] XFS (loop2): Unmounting Filesystem
[  384.071719][ T4197] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  384.084819][ T4197] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[  384.101298][ T4197] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  384.120087][ T4197] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  384.176794][ T7432] device veth0_macvtap entered promiscuous mode
[  384.217421][ T7432] device veth1_macvtap entered promiscuous mode
[  384.290174][ T7432] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  384.327923][ T7432] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  384.363768][ T7432] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  384.400162][ T7432] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  384.437836][ T7432] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  384.473955][ T7432] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  384.510700][ T7432] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  384.562154][ T7432] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  384.606101][ T7432] batman_adv: batadv0: Interface activated: batadv_slave_0
[  384.735363][ T7589] netlink: 'syz-executor.3': attribute type 10 has an invalid length.
[  384.747818][ T7589] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.3'.
[  384.759022][ T7589] bridge0: port 3(syz_tun) entered blocking state
[  384.766708][ T7589] bridge0: port 3(syz_tun) entered disabled state
[  384.876679][ T7597] loop2: detected capacity change from 0 to 1024
[  384.888141][ T7597] EXT4-fs: Ignoring removed orlov option
[  384.909440][ T7597] EXT4-fs (loop2): Test dummy encryption mode enabled
[  385.533007][ T7589] device syz_tun entered promiscuous mode
[  385.540718][ T7597] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback.
[  385.594783][ T7589] bridge0: port 3(syz_tun) entered blocking state
[  385.601414][ T7589] bridge0: port 3(syz_tun) entered forwarding state
[  385.633926][ T4203] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  385.644993][ T4203] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  385.667154][ T4203] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  385.702522][ T4203] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  385.778474][ T6296] EXT4-fs (loop2): unmounting filesystem.
[  385.780540][ T7591] bridge0: port 3(syz_tun) entered disabled state
[  385.835028][ T7591] device syz_tun left promiscuous mode
[  385.841179][ T7591] bridge0: port 3(syz_tun) entered disabled state
[  385.883259][ T7432] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  385.917625][ T7432] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  385.961358][ T7432] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  385.969414][ T7584] loop4: detected capacity change from 0 to 40427
[  386.009700][ T7432] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  386.023404][ T7584] F2FS-fs (loop4): invalid crc value
[  386.031650][ T7432] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  386.035056][ T7584] F2FS-fs (loop4): Found nat_bits in checkpoint
[  386.047499][ T7432] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  386.064856][ T7432] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  386.076265][ T7432] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  386.086144][ T7584] F2FS-fs (loop4): Cannot turn on quotas: -2 on 1
[  386.100540][ T7432] batman_adv: batadv0: Interface activated: batadv_slave_1
[  386.105225][ T7584] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5
[  386.119507][ T4203] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  386.134035][ T4203] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  386.156897][ T7432] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  386.168927][ T7432] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  386.179398][ T7432] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  386.189835][ T7432] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  386.307920][ T6359] syz-executor.4: attempt to access beyond end of device
[  386.307920][ T6359] loop4: rw=524288, sector=45064, nr_sectors = 8 limit=40427
[  386.366082][ T6359] syz-executor.4: attempt to access beyond end of device
[  386.366082][ T6359] loop4: rw=0, sector=45064, nr_sectors = 8 limit=40427
[  386.387561][ T5496] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  386.419208][ T5496] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  386.447201][ T4196] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  386.453286][ T3721] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  386.507391][ T3721] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  386.560213][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[  386.622074][   T11] kworker/u4:1: attempt to access beyond end of device
[  386.622074][   T11] loop4: rw=2049, sector=45096, nr_sectors = 24 limit=40427
[  386.836433][ T3721] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  386.837168][ T7611] loop0: detected capacity change from 0 to 1024
[  386.991806][ T7613] loop2: detected capacity change from 0 to 256
[  387.013415][ T3721] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  387.035702][ T7613] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xf6e00961, utbl_chksum : 0xe619d30d)
[  387.051501][ T7611] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback.
[  387.172763][ T7617] EXT4-fs error (device loop0): ext4_clear_blocks:883: inode #14: comm syz-executor.0: attempt to clear invalid blocks 1886221359 len 1
[  387.200336][ T3721] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  387.288042][ T3585] Bluetooth: hci4: unexpected cc 0x0c5a length: 1 < 2
[  387.294963][ T3585] Bluetooth: hci4: unexpected event for opcode 0x0c5a
[  387.382847][ T3721] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  387.419398][ T7432] EXT4-fs (loop0): unmounting filesystem.
[  388.453281][ T7632] fuse: Bad value for 'fd'
[  389.095215][ T7636] loop1: detected capacity change from 0 to 8192
[  389.632988][ T3721] device hsr_slave_0 left promiscuous mode
[  389.670652][ T3721] device hsr_slave_1 left promiscuous mode
[  389.698896][ T3721] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  389.763084][ T3721] batman_adv: batadv0: Removing interface: batadv_slave_0
[  389.803087][ T3721] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  389.810554][ T3721] batman_adv: batadv0: Removing interface: batadv_slave_1
[  389.886386][ T3721] device bridge_slave_1 left promiscuous mode
[  389.944837][ T3721] bridge0: port 2(bridge_slave_1) entered disabled state
[  389.980371][ T3568] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  389.993505][ T3568] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  390.003959][ T3568] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  390.012123][ T3568] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  390.019759][ T3568] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[  390.027626][ T3568] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  390.058408][ T3721] device bridge_slave_0 left promiscuous mode
[  390.077869][ T3721] bridge0: port 1(bridge_slave_0) entered disabled state
[  390.187231][ T3721] device veth1_macvtap left promiscuous mode
[  390.200696][ T3721] device veth0_macvtap left promiscuous mode
[  390.306288][ T3721] device veth1_vlan left promiscuous mode
[  390.312274][ T3721] device veth0_vlan left promiscuous mode
[  390.321736][ T7653] loop1: detected capacity change from 0 to 512
[  391.208254][ T7653] EXT4-fs (loop1): Test dummy encryption mode enabled
[  391.313519][ T7653] EXT4-fs error (device loop1): __ext4_iget:5044: inode #11: block 1: comm syz-executor.1: invalid block
[  391.356743][ T7653] EXT4-fs error (device loop1): ext4_orphan_get:1401: comm syz-executor.1: couldn't read orphan inode 11 (err -117)
[  391.404577][ T7653] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none.
[  391.522207][ T7673] loop3: detected capacity change from 0 to 4096
[  391.887304][ T3721] team0 (unregistering): Port device team_slave_1 removed
[  391.966929][ T3721] team0 (unregistering): Port device team_slave_0 removed
[  392.018950][ T3721] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  392.061068][ T3568] Bluetooth: hci0: command tx timeout
[  392.086460][ T3721] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  392.471395][ T3721] bond0 (unregistering): Released all slaves
[  392.554661][ T7650] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
[  392.860416][ T7026] EXT4-fs (loop1): unmounting filesystem.
[  392.995981][ T3568] Bluetooth: hci2: unexpected cc 0x0c5a length: 1 < 2
[  393.003139][ T3568] Bluetooth: hci2: unexpected event for opcode 0x0c5a
[  393.345227][ T7654] chnl_net:caif_netlink_parms(): no params data found
[  393.398776][ T7690] loop0: detected capacity change from 0 to 256
[  393.564537][ T7697] loop3: detected capacity change from 0 to 1024
[  393.759150][ T7696] ptrace attach of "/root/syz-executor.1 exec"[7026] was attempted by "                                                                                                                                                                                                ��u�ví�K�JȕU�~x`M�v�U����xtB��Pzy��A�h�U��k�&�o����%IA���QхT�!�O�&��lk�ɴ7+(!0��/Ѕ�����܉YB%ׄA�3.��&�x�\x07!��q�%C�J4Y8\x22D���D��,\x0d���#���K�I���~0�dB�%�&���9��F�����b�������V�w��iI�n7���NU��=:�\x0a����d5�����Ep]U�P��Ί���n��K�j�\x22��L�
���-B�*б��XX��\x0b���\x5cl�v��^�����O��b��O#�c�#?�F\x5c^Z�Y����~}H��m�60a9�a\x0c���ibd[�Y�I8�m\x0c�z�~�LëJ�\x1b�BS�\x22��\x0c���w��
�����\x09�~c�1�냛�B�椗�Q�;��-��� 3S�\x1b��lA��c�4Pu��d��R˜��� �n� ��Wx�W�g���ȧ\x1bJ�^@ǒN���V��9�{(�*f��D���Ӕ��
P��d�e�\x0a�,��\x0d�P��L|���-�<��ӁQ��g��0U7\x0c)����Ү=�ߧ~v�U���k��(Q4i�{
T�x4Y(\x07c�t�ج-P��bo�i��òSO� �D�3�\x22\x0d�l!��<
[  393.787296][ T7696] loop1: detected capacity change from 0 to 1024
[  393.881842][ T7696] hfsplus: unable to parse mount options
[  394.362074][ T3568] Bluetooth: hci0: command tx timeout
[  394.366186][ T7690] exFAT-fs (loop0): failed to load upcase table (idx : 0x0000fe7f, chksum : 0x39626d3b, utbl_chksum : 0xe619d30d)
[  394.369166][ T7697] EXT4-fs: Ignoring removed orlov option
[  394.391550][ T7697] EXT4-fs (loop3): Test dummy encryption mode enabled
[  394.505689][ T7697] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback.
[  394.550606][ T7705] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.2'.
[  394.590300][ T7705] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.2'.
[  394.602135][ T7705] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check.
[  394.619557][ T7654] bridge0: port 1(bridge_slave_0) entered blocking state
[  394.628198][ T7654] bridge0: port 1(bridge_slave_0) entered disabled state
[  394.702435][ T7654] device bridge_slave_0 entered promiscuous mode
[  394.735351][ T7654] bridge0: port 2(bridge_slave_1) entered blocking state
[  394.743139][ T7654] bridge0: port 2(bridge_slave_1) entered disabled state
[  394.762275][ T6220] EXT4-fs (loop3): unmounting filesystem.
[  394.764028][ T7654] device bridge_slave_1 entered promiscuous mode
[  394.854778][ T7654] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  394.874695][ T7654] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  394.929826][ T7654] team0: Port device team_slave_0 added
[  394.954664][ T7654] team0: Port device team_slave_1 added
[  395.144864][ T7654] batman_adv: batadv0: Adding interface: batadv_slave_0
[  395.147865][ T7716] loop3: detected capacity change from 0 to 512
[  395.160127][ T7654] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  395.247241][ T7654] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  395.328910][ T7716] EXT4-fs (loop3): filesystem is read-only
[  395.489936][ T7654] batman_adv: batadv0: Adding interface: batadv_slave_1
[  395.517542][ T7654] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  395.543520][    C1] vkms_vblank_simulate: vblank timer overrun
[  395.553171][ T7718] loop0: detected capacity change from 0 to 2048
[  395.564156][ T7719] loop1: detected capacity change from 0 to 4096
[  395.671888][ T7718] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[  395.762359][ T7654] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  395.851486][ T7718] loop0: detected capacity change from 2048 to 0
[  395.866278][    C1] I/O error, dev loop0, sector 64 op 0x0:(READ) flags 0x3000 phys_seg 1 prio class 2
[  395.876024][ T7720] EXT4-fs error (device loop0): __ext4_find_entry:1684: inode #2: comm syz-executor.0: reading directory lblock 0
[  396.018926][ T7718] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'.
[  396.038038][ T5209] loop: Write error at byte offset 9223372036854775807, length 2048.
[  396.075085][    C1] I/O error, dev loop0, sector 0 op 0x1:(WRITE) flags 0x3800 phys_seg 1 prio class 2
[  396.084666][    C1] I/O error, dev loop0, sector 0 op 0x1:(WRITE) flags 0x3800 phys_seg 1 prio class 2
[  396.094793][    C1] Buffer I/O error on dev loop0, logical block 0, lost sync page write
[  396.103546][ T7720] EXT4-fs (loop0): I/O error while writing superblock
[  396.120455][ T7654] device hsr_slave_0 entered promiscuous mode
[  396.156410][ T7654] device hsr_slave_1 entered promiscuous mode
[  396.218186][    C1] I/O error, dev loop0, sector 64 op 0x0:(READ) flags 0x3000 phys_seg 1 prio class 2
[  396.228124][ T7654] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  396.245331][ T7654] Cannot create hsr debugfs directory
[  396.249989][    C1] I/O error, dev loop0, sector 16 op 0x0:(READ) flags 0x3000 phys_seg 1 prio class 2
[  396.274440][ T7432] EXT4-fs error (device loop0): ext4_get_inode_loc:4633: inode #2: block 4: comm syz-executor.0: unable to read itable block
[  396.306782][    C1] I/O error, dev loop0, sector 32 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  396.316460][    C1] I/O error, dev loop0, sector 28 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  396.326116][    C1] I/O error, dev loop0, sector 24 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  396.334022][ T5209] loop: Write error at byte offset 9223372036854775807, length 2048.
[  396.335723][    C1] I/O error, dev loop0, sector 20 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2
[  396.389073][    C0] I/O error, dev loop0, sector 0 op 0x1:(WRITE) flags 0x3800 phys_seg 1 prio class 2
[  396.398667][    C0] Buffer I/O error on dev loop0, logical block 0, lost sync page write
[  396.407046][ T7432] EXT4-fs (loop0): I/O error while writing superblock
[  396.426182][ T7432] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5868: IO failure
[  396.464647][ T3568] Bluetooth: hci0: command tx timeout
[  396.471948][ T1105] loop: Write error at byte offset 9223372036854775807, length 2048.
[  396.491931][    C0] Buffer I/O error on dev loop0, logical block 0, lost sync page write
[  396.503449][ T7432] EXT4-fs (loop0): I/O error while writing superblock
[  396.539061][ T7732] mkiss: ax0: crc mode is auto.
[  396.551229][ T7432] EXT4-fs error (device loop0): ext4_dirty_inode:6072: inode #2: comm syz-executor.0: mark_inode_dirty error
[  396.565975][ T5209] loop: Write error at byte offset 9223372036854775807, length 2048.
[  396.574706][    C1] Buffer I/O error on dev loop0, logical block 0, lost sync page write
[  396.583454][ T7432] EXT4-fs (loop0): I/O error while writing superblock
[  396.668347][   T11] EXT4-fs error (device loop0): __ext4_get_inode_loc_noinmem:4618: inode #2: block 4: comm kworker/u4:1: unable to read itable block
[  396.686428][ T5209] loop: Write error at byte offset 9223372036854775807, length 2048.
[  396.697411][    C1] Buffer I/O error on dev loop0, logical block 0, lost sync page write
[  396.706311][   T11] EXT4-fs (loop0): I/O error while writing superblock
[  396.719823][ T7432] EXT4-fs (loop0): unmounting filesystem.
[  396.744716][   T11] loop: Write error at byte offset 9223372036854775807, length 2048.
[  396.757127][    C1] Buffer I/O error on dev loop0, logical block 0, lost sync page write
[  396.765562][ T7432] EXT4-fs (loop0): I/O error while writing superblock
[  396.778021][   T11] loop: Write error at byte offset 9223372036854906879, length 2048.
[  396.788056][    C1] Buffer I/O error on dev loop0, logical block 64, lost sync page write
[  397.316228][   T22] usb 2-1: new high-speed USB device number 7 using dummy_hcd
[  397.721418][   T22] usb 2-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad
[  397.746108][   T22] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  397.773392][ T7654] netdevsim netdevsim4 netdevsim0: renamed from eth0
[  397.789548][   T22] usb 2-1: config 0 descriptor??
[  397.809131][ T7654] netdevsim netdevsim4 netdevsim1: renamed from eth1
[  397.835958][ T7654] netdevsim netdevsim4 netdevsim2: renamed from eth2
[  397.856038][ T7740] loop3: detected capacity change from 0 to 512
[  397.867371][   T22] gspca_main: spca508-2.14.0 probing 8086:0110
[  397.882881][ T7654] netdevsim netdevsim4 netdevsim3: renamed from eth3
[  397.973698][ T7740] EXT4-fs (loop3): Test dummy encryption mode enabled
[  398.086873][   T22] gspca_spca508: reg_read err -32
[  398.174409][ T3585] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  398.188425][ T3585] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  398.197713][ T3585] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  398.213281][ T3585] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  398.221293][ T3585] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[  398.230273][ T3585] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  398.341791][ T7746] loop2: detected capacity change from 0 to 512
[  398.381090][ T7736] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
[  398.398407][ T7740] EXT4-fs error (device loop3): __ext4_iget:5044: inode #11: block 1: comm syz-executor.3: invalid block
[  398.419456][ T7740] EXT4-fs error (device loop3): ext4_orphan_get:1401: comm syz-executor.3: couldn't read orphan inode 11 (err -117)
[  398.434602][ T7746] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback.
[  398.443715][ T7746] ext4 filesystem being mounted at /root/syzkaller-testdir3809531778/syzkaller.v9yl9a/68/bus supports timestamps until 2038 (0x7fffffff)
[  398.461558][ T7740] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none.
[  398.566936][ T3585] Bluetooth: hci0: command tx timeout
[  399.254867][   T22] gspca_spca508: reg_read err -71
[  399.281616][   T22] gspca_spca508: reg_read err -71
[  399.296994][ T6296] EXT4-fs (loop2): unmounting filesystem.
[  399.318292][   T22] gspca_spca508: reg write: error -71
[  399.324542][   T22] spca508: probe of 2-1:0.0 failed with error -71
[  399.337427][   T22] usb 2-1: USB disconnect, device number 7
[  399.430987][ T7654] 8021q: adding VLAN 0 to HW filter on device bond0
[  399.525938][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  399.558979][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  399.598224][ T7654] 8021q: adding VLAN 0 to HW filter on device team0
[  399.939686][ T7756] loop2: detected capacity change from 0 to 1024
[  399.952197][ T7756] EXT4-fs: Ignoring removed orlov option
[  399.977421][ T7756] EXT4-fs (loop2): Test dummy encryption mode enabled
[  400.006297][ T7753] ptrace attach of "/root/syz-executor.1 exec"[7026] was attempted by "                                                                                                                                                                                                ��u�ví�K�JȕU�~x`M�v�U����xtB��Pzy��A�h�U��k�&�o����%IA���QхT�!�O�&��lk�ɴ7+(!0��/Ѕ�����܉YB%ׄA�3.��&�x�\x07!��q�%C�J4Y8\x22D���D��,\x0d���#���K�I���~0�dB�%�&���9��F�����b�������V�w��iI�n7���NU��=:�\x0a����d5�����Ep]U�P��Ί���n��K�j�\x22��L�
���-B�*б��XX��\x0b���\x5cl�v��^�����O��b��O#�c�#?�F\x5c^Z�Y����~}H��m�60a9�a\x0c���ibd[�Y�I8�m\x0c�z�~�LëJ�\x1b�BS�\x22��\x0c���w��
�����\x09�~c�1�냛�B�椗�Q�;��-��� 3S�\x1b��lA��c�4Pu��d��R˜��� �n� ��Wx�W�g���ȧ\x1bJ�^@ǒN���V��9�{(�*f��D���Ӕ��
P��d�e�\x0a�,��\x0d�P��L|���-�<��ӁQ��g��0U7\x0c)����Ү=�ߧ~v�U���k��(Q4i�{
T�x4Y(\x07c�t�ج-P��bo�i��òSO� �D�3�\x22\x0d�l!��<
[  400.033856][ T7753] loop1: detected capacity change from 0 to 1024
[  400.157529][ T7753] hfsplus: unable to parse mount options
[  400.302363][ T3585] Bluetooth: hci3: command tx timeout
[  400.857766][ T3615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  400.862969][ T7756] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback.
[  400.909392][ T3615] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  400.958318][ T3615] bridge0: port 1(bridge_slave_0) entered blocking state
[  400.966781][ T3615] bridge0: port 1(bridge_slave_0) entered forwarding state
[  400.991363][ T3615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  401.077379][ T3615] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  401.079698][ T6296] EXT4-fs (loop2): unmounting filesystem.
[  401.105130][ T3615] bridge0: port 2(bridge_slave_1) entered blocking state
[  401.114176][ T3615] bridge0: port 2(bridge_slave_1) entered forwarding state
[  401.287535][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  401.302285][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  401.432738][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  401.463139][ T7764] Bluetooth: MGMT ver 1.22
[  401.469275][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  401.505826][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  401.525238][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  401.545531][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  401.557071][ T7764] loop1: detected capacity change from 0 to 4096
[  401.559452][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  401.581266][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  401.583882][ T7764] ntfs: (device loop1): parse_options(): Option utf8 is no longer supported, using option nls=utf8. Please use option nls=utf8 in the future and make sure utf8 is compiled either as a module or into the kernel.
[  401.593273][ T7654] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  401.638140][ T7654] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  401.694911][ T7764] ntfs: (device loop1): ntfs_is_extended_system_file(): Non-resident file name. You should run chkdsk.
[  401.726462][ T7764] ntfs: (device loop1): ntfs_read_locked_inode(): $DATA attribute is missing.
[  401.747551][ T7764] ntfs: (device loop1): ntfs_read_locked_inode(): Failed with error code -2.  Marking corrupt inode 0x1 as bad.  Run chkdsk.
[  401.762504][ T7764] ntfs: (device loop1): load_system_files(): Failed to load $MFTMirr.  Mounting read-only.  Run ntfsfix and/or chkdsk.
[  401.807323][ T7768] loop2: detected capacity change from 0 to 4096
[  401.810351][ T7764] ntfs: volume version 3.1.
[  401.873428][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  401.892626][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  401.905490][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  401.933704][ T7742] chnl_net:caif_netlink_parms(): no params data found
[  402.099104][   T27] audit: type=1804 audit(1717706641.936:267): pid=7764 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir28965613/syzkaller.Bb9lmL/23/file0" dev="sda1" ino=1947 res=1 errno=0
[  402.104606][ T6220] EXT4-fs (loop3): unmounting filesystem.
[  402.138756][ T3721] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  402.339659][ T3721] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  402.391898][ T3585] Bluetooth: hci3: command tx timeout
[  402.585480][ T3721] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  403.052515][ T7742] bridge0: port 1(bridge_slave_0) entered blocking state
[  403.217640][ T7742] bridge0: port 1(bridge_slave_0) entered disabled state
[  403.269895][ T7742] device bridge_slave_0 entered promiscuous mode
[  403.333766][ T7789] loop1: detected capacity change from 0 to 128
[  403.512575][ T7792] loop3: detected capacity change from 0 to 512
[  403.518027][ T3721] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  403.555562][ T7792] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback.
[  403.564897][ T7792] ext4 filesystem being mounted at /root/syzkaller-testdir4007341580/syzkaller.MsCvoh/74/bus supports timestamps until 2038 (0x7fffffff)
[  403.645133][ T7742] bridge0: port 2(bridge_slave_1) entered blocking state
[  403.661609][ T7742] bridge0: port 2(bridge_slave_1) entered disabled state
[  403.696801][ T7742] device bridge_slave_1 entered promiscuous mode
[  403.812820][ T7742] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  404.521382][ T3568] Bluetooth: hci3: command tx timeout
[  404.633573][ T4197] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  404.643820][ T6220] EXT4-fs (loop3): unmounting filesystem.
[  404.645774][ T4197] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  404.680636][ T7742] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  404.699435][ T7654] 8021q: adding VLAN 0 to HW filter on device batadv0
[  405.015498][ T7742] team0: Port device team_slave_0 added
[  405.435268][ T7742] team0: Port device team_slave_1 added
[  405.911920][ T7742] batman_adv: batadv0: Adding interface: batadv_slave_0
[  405.954508][ T7742] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  406.090874][ T7742] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  406.105197][ T7742] batman_adv: batadv0: Adding interface: batadv_slave_1
[  406.120961][ T7742] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[  406.262896][ T7818] loop3: detected capacity change from 0 to 1024
[  406.276390][ T7818] EXT4-fs: Ignoring removed orlov option
[  406.371810][ T7818] EXT4-fs (loop3): Test dummy encryption mode enabled
[  406.490722][ T7818] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback.
[  406.583723][ T3585] Bluetooth: hci3: command tx timeout
[  406.755336][ T7742] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  406.892731][ T6220] EXT4-fs (loop3): unmounting filesystem.
[  407.067942][ T7742] device hsr_slave_0 entered promiscuous mode
[  407.132610][ T7742] device hsr_slave_1 entered promiscuous mode
[  407.141882][ T7825] loop3: detected capacity change from 0 to 512
[  407.187158][ T7825] EXT4-fs (loop3): filesystem is read-only
[  407.193513][ T7742] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[  407.210990][ T7742] Cannot create hsr debugfs directory
[  407.332630][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  407.348865][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  407.499845][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  407.520601][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  407.576595][ T7654] device veth0_vlan entered promiscuous mode
[  407.585953][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  407.602166][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  407.640488][ T7654] device veth1_vlan entered promiscuous mode
[  407.810311][ T7654] device veth0_macvtap entered promiscuous mode
[  407.861921][ T7064] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  407.880333][ T7064] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[  407.898273][ T7064] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  407.917474][ T7064] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  407.955274][ T7654] device veth1_macvtap entered promiscuous mode
[  407.977424][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  407.992569][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  408.099453][ T7654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  408.142727][ T7654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  408.157267][ T7654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  408.172197][ T7654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  408.202487][ T7654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  408.238345][ T7654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  408.251515][ T7654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  408.264881][ T7654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  408.267355][ T3568] Bluetooth: hci4: unexpected cc 0x0c5a length: 1 < 2
[  408.282534][ T3568] Bluetooth: hci4: unexpected event for opcode 0x0c5a
[  408.300105][ T7654] batman_adv: batadv0: Interface activated: batadv_slave_0
[  408.354064][ T2965] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  408.372149][ T2965] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  408.383755][ T7654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  408.396763][ T7654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  408.409156][ T7654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  408.433395][ T7654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  408.447115][ T7654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  408.470389][ T7654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  408.503975][ T7654] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  408.625363][ T7654] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  408.641244][ T7654] batman_adv: batadv0: Interface activated: batadv_slave_1
[  408.654217][ T7654] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  408.673397][ T7654] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  408.761729][ T7654] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  408.772867][ T7654] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  409.523891][ T4204] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  409.566583][ T4204] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  409.577473][ T7846] overlayfs: failed to resolve './file1': -2
[  409.686530][ T3721] device hsr_slave_0 left promiscuous mode
[  409.700084][ T3721] device hsr_slave_1 left promiscuous mode
[  409.730501][ T3721] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  409.767748][ T3721] batman_adv: batadv0: Removing interface: batadv_slave_0
[  409.818772][ T3721] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  409.857499][ T3721] batman_adv: batadv0: Removing interface: batadv_slave_1
[  409.868172][ T3721] device bridge_slave_1 left promiscuous mode
[  409.874773][ T3721] bridge0: port 2(bridge_slave_1) entered disabled state
[  409.883780][ T3721] device bridge_slave_0 left promiscuous mode
[  409.891879][ T3721] bridge0: port 1(bridge_slave_0) entered disabled state
[  409.947812][ T3721] device veth1_macvtap left promiscuous mode
[  409.960266][ T3721] device veth0_macvtap left promiscuous mode
[  409.979790][ T3721] device veth1_vlan left promiscuous mode
[  409.992251][ T3721] device veth0_vlan left promiscuous mode
[  410.528072][ T7855] loop3: detected capacity change from 0 to 1024
[  410.539861][ T7855] EXT4-fs: Ignoring removed orlov option
[  410.591805][ T7855] EXT4-fs (loop3): Test dummy encryption mode enabled
[  410.865311][ T3721] team0 (unregistering): Port device team_slave_1 removed
[  410.926127][ T3721] team0 (unregistering): Port device team_slave_0 removed
[  411.068776][ T3721] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  411.090365][ T7855] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback.
[  411.183144][ T3721] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  411.189325][ T7848] loop2: detected capacity change from 0 to 32768
[  411.204494][ T7848] XFS: attr2 mount option is deprecated.
[  411.210523][ T7848] XFS: noikeep mount option is deprecated.
[  411.227480][ T7848] XFS (loop2): Mounting V5 filesystem in no-recovery mode. Filesystem will be inconsistent.
[  411.309852][ T3721] bond0 (unregistering): Released all slaves
[  411.330474][ T6220] EXT4-fs (loop3): unmounting filesystem.
[  411.339413][ T7848] XFS (loop2): Quotacheck needed: Please wait.
[  411.371793][    T9] XFS (loop2): Metadata CRC error detected at xfs_rmapbt_read_verify+0x39/0xc0, xfs_rmapbt block 0x14 
[  411.395800][    T9] XFS (loop2): Unmount and run xfs_repair
[  411.411990][    T9] XFS (loop2): First 128 bytes of corrupted metadata buffer:
[  411.430620][    T9] 00000000: 52 4d 42 33 00 00 00 0c ff ff ff ff ff ff ff ff  RMB3............
[  411.463711][    T9] 00000010: 00 00 02 00 00 00 00 14 00 00 00 01 00 00 00 80  ................
[  411.572735][    T9] 00000020: bf dc 47 fc 10 d8 4e ed a5 62 11 a8 31 b3 f7 91  ..G...N..b..1...
[  411.594173][    T9] 00000030: 00 00 00 00 5b af 3b 1d 00 00 00 00 00 00 00 01  ....[.;.........
[  411.617903][    T9] 00000040: ff ff ff ff ff ff ff fd 00 00 00 00 00 00 00 00  ................
[  411.618452][ T7742] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  411.636029][ T3654] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  411.661850][ T3654] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  411.689618][    T9] 00000050: 00 00 00 01 00 00 00 02 ff ff ff ff ff ff ff fb  ................
[  411.720701][    T9] 00000060: 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 02  ................
[  411.741259][    T9] 00000070: ff ff ff ff ff ff ff fa 00 00 00 00 00 00 00 00  ................
[  411.759627][ T3616] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  411.776006][ T7742] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  411.809695][    T9] XFS (loop2): metadata I/O error in "xfs_btree_read_buf_block+0x26e/0x370" at daddr 0x14 len 4 error 74
[  411.835386][ T7742] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  411.880252][ T7742] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  411.890626][ T4127] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  411.920485][    T9] XFS (loop2): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x6a5/0xb80 (fs/xfs/xfs_trans_buf.c:296).  Shutting down filesystem.
[  411.927375][ T4127] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  411.987039][    T9] XFS (loop2): Please unmount the filesystem and rectify the problem(s)
[  412.386983][ T7848] XFS (loop2): Quotacheck: Unsuccessful (Error -117): Disabling quotas.
[  412.706424][ T4203] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[  412.718515][ T6296] XFS (loop2): Unmounting Filesystem
[  412.910060][ T7742] 8021q: adding VLAN 0 to HW filter on device bond0
[  412.953465][ T7876] netlink: 'syz-executor.1': attribute type 10 has an invalid length.
[  413.002548][ T7876] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.1'.
[  413.051815][ T7876] bridge0: port 3(syz_tun) entered blocking state
[  413.077728][ T7876] bridge0: port 3(syz_tun) entered disabled state
[  413.093509][ T7879] loop4: detected capacity change from 0 to 512
[  413.094395][ T7876] device syz_tun entered promiscuous mode
[  413.171544][ T7876] bridge0: port 3(syz_tun) entered blocking state
[  413.178369][ T7876] bridge0: port 3(syz_tun) entered forwarding state
[  413.186099][ T7879] EXT4-fs (loop4): Test dummy encryption mode enabled
[  413.221012][ T7877] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
[  413.249368][ T7879] EXT4-fs error (device loop4): __ext4_iget:5044: inode #11: block 1: comm syz-executor.4: invalid block
[  413.274641][ T7880] bridge0: port 3(syz_tun) entered disabled state
[  413.290026][ T7879] EXT4-fs error (device loop4): ext4_orphan_get:1401: comm syz-executor.4: couldn't read orphan inode 11 (err -117)
[  413.304474][ T7880] device syz_tun left promiscuous mode
[  413.337480][ T7879] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none.
[  413.347699][ T7867] loop3: detected capacity change from 0 to 40427
[  413.375779][ T7867] F2FS-fs (loop3): Insane cp_payload (553648128 >= 504)
[  413.428745][ T7880] bridge0: port 3(syz_tun) entered disabled state
[  413.448376][ T7867] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock
[  413.462326][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  413.479202][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  413.529478][ T7742] 8021q: adding VLAN 0 to HW filter on device team0
[  413.553656][ T7867] F2FS-fs (loop3): invalid crc value
[  413.570515][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  413.606630][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  413.618353][ T7867] F2FS-fs (loop3): Found nat_bits in checkpoint
[  413.636936][   T26] bridge0: port 1(bridge_slave_0) entered blocking state
[  413.644078][   T26] bridge0: port 1(bridge_slave_0) entered forwarding state
[  413.787396][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[  413.799437][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  413.833193][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  413.862744][ T3624] bridge0: port 2(bridge_slave_1) entered blocking state
[  413.869845][ T3624] bridge0: port 2(bridge_slave_1) entered forwarding state
[  413.882322][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[  413.894492][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[  413.929239][ T7867] F2FS-fs (loop3): Cannot turn on quotas: -2 on 1
[  413.949926][ T3615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[  413.968686][ T3615] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[  414.015399][ T3615] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[  414.068695][ T3615] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[  414.087764][ T7867] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0
[  414.101215][ T7867] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
[  414.124572][ T3615] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[  414.206769][ T3615] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[  414.256160][ T3568] Bluetooth: hci2: unexpected subevent 0x1a length: 10 > 6
[  414.273989][ T7742] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[  414.323621][ T7892] loop1: detected capacity change from 0 to 512
[  414.356249][ T7742] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[  414.462193][ T7892] EXT4-fs (loop1): filesystem is read-only
[  414.482189][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[  414.523473][ T6220] syz-executor.3: attempt to access beyond end of device
[  414.523473][ T6220] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  414.579389][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[  414.683555][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[  415.408378][ T7654] EXT4-fs (loop4): unmounting filesystem.
[  415.703402][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[  415.712398][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[  416.521881][ T7742] 8021q: adding VLAN 0 to HW filter on device batadv0
[  416.688251][ T7064] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[  416.706759][ T7064] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[  416.795119][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[  416.810634][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[  416.849316][ T7742] device veth0_vlan entered promiscuous mode
[  416.866326][ T7064] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[  416.878934][ T7064] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[  416.928795][ T7742] device veth1_vlan entered promiscuous mode
[  417.009994][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[  417.029189][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[  417.063678][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[  417.102464][   T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[  417.144258][ T7742] device veth0_macvtap entered promiscuous mode
[  417.171877][ T7742] device veth1_macvtap entered promiscuous mode
[  417.304251][ T7742] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  417.339356][ T7742] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  417.368361][ T7742] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  417.388473][ T7928] loop2: detected capacity change from 0 to 512
[  417.396387][ T7742] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  417.419197][ T7742] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  417.439714][ T7928] EXT4-fs (loop2): filesystem is read-only
[  417.468979][ T7742] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  417.507954][ T7742] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[  417.534649][ T7742] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  417.578413][ T7934] loop3: detected capacity change from 0 to 4096
[  417.609488][ T7742] batman_adv: batadv0: Interface activated: batadv_slave_0
[  417.869311][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[  417.896185][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[  417.925081][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[  417.969398][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[  418.001620][ T7936] bridge0: port 3(vlan2) entered blocking state
[  418.021450][ T7936] bridge0: port 3(vlan2) entered disabled state
[  418.051187][ T7936] device vlan2 entered promiscuous mode
[  418.064397][ T7939] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
[  418.191731][ T7940] loop4: detected capacity change from 0 to 512
[  418.268190][ T7940] EXT4-fs (loop4): Test dummy encryption mode enabled
[  418.540631][ T7940] EXT4-fs error (device loop4): __ext4_iget:5044: inode #11: block 1: comm syz-executor.4: invalid block
[  418.558660][ T7940] EXT4-fs error (device loop4): ext4_orphan_get:1401: comm syz-executor.4: couldn't read orphan inode 11 (err -117)
[  418.583724][ T7940] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none.
[  418.597336][ T7742] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  418.625503][ T7742] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  418.697397][ T7742] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  418.728107][ T7742] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  418.745965][ T7742] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  418.767213][ T7742] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  418.781334][ T7742] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[  418.805827][ T7742] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[  418.855716][ T7742] batman_adv: batadv0: Interface activated: batadv_slave_1
[  418.891701][ T7942] netlink: 'syz-executor.3': attribute type 10 has an invalid length.
[  418.911159][ T7942] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.3'.
[  418.982031][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[  418.996070][ T3624] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[  419.029166][ T7742] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  419.053096][ T7742] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  419.076250][ T7742] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  419.092999][ T7742] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  419.506244][ T1105] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  419.516976][ T1105] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  419.546092][ T2965] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[  419.609320][ T7966] loop3: detected capacity change from 0 to 512
[  419.667213][ T1105] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  419.680001][ T1105] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  419.697297][ T2965] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[  419.705538][ T7966] EXT4-fs (loop3): filesystem is read-only
[  420.047349][ T7973] loop0: detected capacity change from 0 to 512
[  420.107545][ T7973] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback.
[  420.117645][ T7973] ext4 filesystem being mounted at /root/syzkaller-testdir1918833477/syzkaller.WWzlNn/0/bus supports timestamps until 2038 (0x7fffffff)
[  420.257125][ T7978] loop2: detected capacity change from 0 to 1024
[  420.280195][ T7978] EXT4-fs (loop2): bad geometry: first data block 100663296 is beyond end of filesystem (512)
[  421.185045][ T7742] EXT4-fs (loop0): unmounting filesystem.
[  421.274047][ T7981] overlayfs: missing 'lowerdir'
[  421.775373][ T7991] loop1: detected capacity change from 0 to 512
[  422.933033][ T7991] EXT4-fs (loop1): filesystem is read-only
[  423.358223][ T7654] EXT4-fs (loop4): unmounting filesystem.
[  423.789699][ T8002] vivid-000: disconnect
[  423.832920][ T8001] vivid-000: reconnect
[  424.111567][ T8008] netlink: 'syz-executor.0': attribute type 10 has an invalid length.
[  424.129246][ T8008] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.0'.
[  424.171422][ T8008] bridge0: port 3(syz_tun) entered blocking state
[  424.184654][ T8004] loop4: detected capacity change from 0 to 4096
[  424.196366][ T8008] bridge0: port 3(syz_tun) entered disabled state
[  424.210100][ T8008] device syz_tun entered promiscuous mode
[  424.308596][ T8008] bridge0: port 3(syz_tun) entered blocking state
[  424.315236][ T8008] bridge0: port 3(syz_tun) entered forwarding state
[  424.461320][ T8010] bridge0: port 3(syz_tun) entered disabled state
[  424.524124][ T8010] device syz_tun left promiscuous mode
[  424.572639][ T8010] bridge0: port 3(syz_tun) entered disabled state
[  424.851193][ T4204] usb 5-1: new high-speed USB device number 4 using dummy_hcd
[  425.204747][ T8021] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
[  425.231090][ T4204] usb 5-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad
[  425.241849][ T4204] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  425.261954][ T4204] usb 5-1: config 0 descriptor??
[  425.308088][ T4204] gspca_main: spca508-2.14.0 probing 8086:0110
[  425.521141][ T4204] gspca_spca508: reg_read err -32
[  425.842654][ T8013] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
[  425.906289][   T27] audit: type=1326 audit(1717706665.746:268): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8028 comm="syz-executor.1" exe="/root/syz-executor.1" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cfb87cf69 code=0x7ffc0000
[  427.012997][ T4204] gspca_spca508: reg_read err -110
[  427.030992][ T4204] gspca_spca508: reg_read err -71
[  427.422454][ T4204] gspca_spca508: reg write: error -71
[  427.430006][ T4204] spca508: probe of 5-1:0.0 failed with error -71
[  427.477357][ T4204] usb 5-1: USB disconnect, device number 4
[  427.479836][ T8033] tmpfs: Unknown parameter 'nolazytime��'
[  427.518984][ T8035] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
[  427.547363][   T27] audit: type=1326 audit(1717706665.746:269): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8028 comm="syz-executor.1" exe="/root/syz-executor.1" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7cfb87cf69 code=0x7ffc0000
[  427.594050][ T8033] Bluetooth: MGMT ver 1.22
[  427.597345][   T27] audit: type=1326 audit(1717706665.746:270): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8028 comm="syz-executor.1" exe="/root/syz-executor.1" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cfb87cf69 code=0x7ffc0000
[  427.623011][   T27] audit: type=1326 audit(1717706665.746:271): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8028 comm="syz-executor.1" exe="/root/syz-executor.1" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7cfb87cf69 code=0x7ffc0000
[  427.654068][   T27] audit: type=1326 audit(1717706665.746:272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8028 comm="syz-executor.1" exe="/root/syz-executor.1" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cfb87cf69 code=0x7ffc0000
[  427.678210][   T27] audit: type=1326 audit(1717706665.746:273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8028 comm="syz-executor.1" exe="/root/syz-executor.1" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7cfb87cf69 code=0x7ffc0000
[  427.704477][   T27] audit: type=1326 audit(1717706665.816:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8028 comm="syz-executor.1" exe="/root/syz-executor.1" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7cfb87cf69 code=0x7ffc0000
[  427.727540][   T27] audit: type=1326 audit(1717706666.836:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8028 comm="syz-executor.1" exe="/root/syz-executor.1" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f7cfb87a6e7 code=0x7ffc0000
[  427.751906][   T27] audit: type=1326 audit(1717706666.836:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8028 comm="syz-executor.1" exe="/root/syz-executor.1" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f7cfb8403b9 code=0x7ffc0000
[  427.785548][   T27] audit: type=1326 audit(1717706666.836:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8028 comm="syz-executor.1" exe="/root/syz-executor.1" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f7cfb87a6e7 code=0x7ffc0000
[  429.424639][ T8049] netlink: 'syz-executor.1': attribute type 10 has an invalid length.
[  429.436514][ T8049] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.1'.
[  429.671252][ T8056] netlink: 'syz-executor.2': attribute type 10 has an invalid length.
[  429.689013][ T8050] loop4: detected capacity change from 0 to 4096
[  429.713925][ T8056] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.2'.
[  429.851331][ T8065] Zero length message leads to an empty skb
[  430.185811][ T8080] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
[  430.256346][ T8079] loop0: detected capacity change from 0 to 512
[  430.317594][ T8079] EXT4-fs (loop0): filesystem is read-only
[  431.563228][ T8096] loop2: detected capacity change from 0 to 512
[  431.633236][ T8096] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback.
[  431.642762][ T8096] ext4 filesystem being mounted at /root/syzkaller-testdir3809531778/syzkaller.v9yl9a/88/bus supports timestamps until 2038 (0x7fffffff)
[  434.066555][ T6296] EXT4-fs (loop2): unmounting filesystem.
[  434.094842][ T3568] Bluetooth: hci1: unexpected cc 0x0c5a length: 1 < 2
[  434.256141][ T8120] netlink: 'syz-executor.3': attribute type 10 has an invalid length.
[  434.276043][ T8120] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.3'.
[  434.336591][ T8119] loop0: detected capacity change from 0 to 7
[  434.404445][ T8119] Dev loop0: unable to read RDB block 7
[  434.427572][ T8119]  loop0: unable to read partition table
[  434.475222][ T8119] loop0: partition table beyond EOD, truncated
[  434.496402][ T8119] loop_reread_partitions: partition scan of loop0 (�被x������ڬ��dƤ����ݡ�����
[  434.496402][ T8119] 
) failed (rc=-5)
[  434.612603][ T8129] netlink: 'syz-executor.4': attribute type 10 has an invalid length.
[  434.660509][ T8129] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'.
[  434.787779][ T8129] bridge0: port 3(syz_tun) entered blocking state
[  434.805740][ T8129] bridge0: port 3(syz_tun) entered disabled state
[  434.893703][ T8129] device syz_tun entered promiscuous mode
[  434.904246][ T8127] loop1: detected capacity change from 0 to 4096
[  434.926807][ T8129] bridge0: port 3(syz_tun) entered blocking state
[  434.934302][ T8129] bridge0: port 3(syz_tun) entered forwarding state
[  434.946717][ T8136] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'.
[  434.999696][ T8137] bridge0: port 3(syz_tun) entered disabled state
[  435.069153][ T8137] device syz_tun left promiscuous mode
[  435.137624][ T8137] bridge0: port 3(syz_tun) entered disabled state
[  435.158948][ T8139] binder: 8138:8139 unknown command 0
[  435.179267][ T8139] binder: 8138:8139 ioctl c0306201 20000480 returned -22
[  436.020960][ T8153] loop3: detected capacity change from 0 to 40427
[  436.029808][ T8153] F2FS-fs (loop3): Invalid log_blocksize (268), supports only 12
[  436.037624][ T8153] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock
[  436.083865][ T8153] F2FS-fs (loop3): Found nat_bits in checkpoint
[  436.111936][ T8153] F2FS-fs (loop3): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix.
[  436.166275][ T8153] F2FS-fs (loop3): Try to recover 1th superblock, ret: 0
[  436.174340][ T8153] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
[  438.063783][ T3568] Bluetooth: hci0: unexpected cc 0x0c5a length: 1 < 2
[  438.066795][ T6220] F2FS-fs (loop3): invalid namelen(0), ino:0, run fsck to fix.
[  438.120343][ T6220] F2FS-fs (loop3): invalid namelen(0), ino:0, run fsck to fix.
[  438.135708][ T6220] F2FS-fs (loop3): invalid namelen(0), ino:0, run fsck to fix.
[  438.164619][ T6220] F2FS-fs (loop3): invalid namelen(0), ino:0, run fsck to fix.
[  438.182232][ T6220] F2FS-fs (loop3): invalid namelen(0), ino:0, run fsck to fix.
[  438.189909][ T6220] F2FS-fs (loop3): invalid namelen(0), ino:0, run fsck to fix.
[  438.254411][ T6220] F2FS-fs (loop3): invalid namelen(0), ino:0, run fsck to fix.
[  438.326072][ T8182] loop0: detected capacity change from 0 to 128
[  438.343785][ T8176] loop1: detected capacity change from 0 to 2048
[  438.428767][ T8183] loop4: detected capacity change from 0 to 1024
[  438.461066][ T8185] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  438.486768][ T8176] NILFS (loop1): corrupt root inode
[  438.538102][ T8183] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none.
[  438.579303][ T8179] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  438.593182][ T8179] batman_adv: batadv0: Removing interface: batadv_slave_0
[  438.669931][ T7654] EXT4-fs (loop4): unmounting filesystem.
[  438.698557][ T8193] netlink: 'syz-executor.1': attribute type 10 has an invalid length.
[  438.708474][ T8193] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.1'.
[  438.831043][   T26] usb 3-1: new high-speed USB device number 8 using dummy_hcd
[  438.885029][ T8200] loop4: detected capacity change from 0 to 1024
[  438.908082][ T8202] loop0: detected capacity change from 0 to 512
[  438.989649][ T8202] EXT4-fs (loop0): filesystem is read-only
[  439.265097][   T26] usb 3-1: New USB device found, idVendor=8086, idProduct=0110, bcdDevice=bf.ad
[  439.282929][   T26] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  439.300631][   T26] usb 3-1: config 0 descriptor??
[  439.342864][   T26] gspca_main: spca508-2.14.0 probing 8086:0110
[  439.390879][   T22] usb 4-1: new high-speed USB device number 5 using dummy_hcd
[  439.551011][   T26] gspca_spca508: reg_read err -32
[  439.620734][ T8216] loop1: detected capacity change from 0 to 4096
[  439.670866][   T22] usb 4-1: Using ep0 maxpacket: 32
[  439.823260][   T22] usb 4-1: config index 0 descriptor too short (expected 35577, got 27)
[  439.840551][   T22] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32
[  439.893384][ T1255] ieee802154 phy0 wpan0: encryption failed: -22
[  439.901584][ T1255] ieee802154 phy1 wpan1: encryption failed: -22
[  439.924379][   T22] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92
[  440.040958][   T26] gspca_spca508: reg_read err -71
[  440.059001][   T22] usb 4-1: config 1 has no interface number 0
[  440.067569][   T26] gspca_spca508: reg_read err -71
[  440.161137][   T26] gspca_spca508: reg write: error -71
[  440.172442][   T22] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  440.191747][   T26] spca508: probe of 3-1:0.0 failed with error -71
[  440.349895][   T26] usb 3-1: USB disconnect, device number 8
[  440.356537][   T22] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17
[  441.231758][ T3568] Bluetooth: hci0: unexpected cc 0x0c5a length: 1 < 2
[  441.249888][   T22] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8
[  441.315904][   T22] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  441.423356][   T22] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found
[  441.464453][ T8229] loop4: detected capacity change from 0 to 4096
[  441.518455][ T8229] NILFS (loop4): invalid segment: Checksum error in segment payload
[  441.573290][ T8229] NILFS (loop4): trying rollback from an earlier position
[  441.619068][ T8229] NILFS (loop4): recovery complete
[  441.643188][   T22] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now attached
[  441.663775][   T27] kauditd_printk_skb: 112 callbacks suppressed
[  441.663819][   T27] audit: type=1800 audit(1717706681.506:390): pid=8235 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.1" name="file0" dev="sda1" ino=1964 res=0 errno=0
[  441.699152][ T8237] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  441.702599][   T27] audit: type=1804 audit(1717706681.536:391): pid=8235 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir28965613/syzkaller.Bb9lmL/50/file0" dev="sda1" ino=1964 res=1 errno=0
[  441.838593][   T27] audit: type=1800 audit(1717706681.576:392): pid=8229 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.4" name="bus" dev="loop4" ino=13 res=0 errno=0
[  441.847672][ T8210] loop3: detected capacity change from 0 to 164
[  441.998755][ T8240] 
: renamed from ipvlan1
[  442.007392][   T22] usb 4-1: USB disconnect, device number 5
[  442.028385][   T22] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected
[  442.462170][   T26] usb 2-1: new high-speed USB device number 8 using dummy_hcd
[  442.572642][ T8254] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
[  442.669023][ T3568] Bluetooth: hci3: unexpected cc 0x0c5a length: 1 < 2
[  442.731185][   T26] usb 2-1: Using ep0 maxpacket: 32
[  442.778163][ T8264] loop4: detected capacity change from 0 to 2048
[  442.872932][   T26] usb 2-1: config index 0 descriptor too short (expected 35577, got 27)
[  442.892734][ T8267] loop0: detected capacity change from 0 to 256
[  442.900444][   T26] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32
[  442.923536][   T26] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92
[  442.942789][ T8264] NILFS (loop4): unrecognized mount option "0xffffffffffffffff��000000000000000000000000177777777777777777777700000000000000000000000"
[  442.962273][   T26] usb 2-1: config 1 has no interface number 0
[  442.974158][   T26] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  442.990150][   T26] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17
[  443.029254][   T26] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8
[  443.079250][   T26] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  443.157922][   T26] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found
[  443.511848][   T26] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now attached
[  446.924986][   T22] snd_usb_pod 2-1:1.1: line6_send_raw_message_async_part: usb_submit_urb failed (-22)
[  447.006145][   T26] usb 2-1: USB disconnect, device number 8
[  447.013798][   T26] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected
[  447.566033][ T8292] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'.
[  448.380949][   T26] usb 2-1: new high-speed USB device number 9 using dummy_hcd
[  448.515189][ T8297] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
[  448.541494][ T8289] loop2: detected capacity change from 0 to 512
[  448.550370][ T8297] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.4'.
[  448.559775][   T22] usb 4-1: new high-speed USB device number 6 using dummy_hcd
[  448.587923][ T8297] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check.
[  448.670936][   T26] usb 2-1: Using ep0 maxpacket: 32
[  448.713272][ T8289] EXT4-fs (loop2): filesystem is read-only
[  448.777704][ T3568] Bluetooth: hci0: unexpected cc 0x0c5a length: 1 < 2
[  448.821123][   T26] usb 2-1: config index 0 descriptor too short (expected 35577, got 27)
[  448.839369][   T26] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32
[  448.861012][   T22] usb 4-1: Using ep0 maxpacket: 32
[  448.884703][   T26] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92
[  448.930607][   T26] usb 2-1: config 1 has no interface number 0
[  448.955826][   T26] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  448.990977][   T22] usb 4-1: config index 0 descriptor too short (expected 35577, got 27)
[  449.084028][   T22] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32
[  449.103462][   T26] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17
[  449.112797][ T8306] loop0: detected capacity change from 0 to 4096
[  449.121186][   T22] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92
[  449.125728][ T8306] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 1024)
[  449.771703][   T22] usb 4-1: config 1 has no interface number 0
[  449.773688][ T8306] NILFS (loop0): broken superblock, retrying with spare superblock (blocksize = 4096)
[  449.854098][   T26] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8
[  449.984103][ T8318] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  450.008768][   T22] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  450.843308][ T8325] loop4: detected capacity change from 0 to 8
[  450.852628][   T26] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  450.879087][   T22] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17
[  450.897870][   T26] usb 2-1: can't set config #1, error -71
[  450.909771][   T26] usb 2-1: USB disconnect, device number 9
[  450.932402][   T22] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8
[  450.941695][   T22] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  450.993462][   T22] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found
[  451.966806][   T22] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now attached
[  451.985406][ T8333] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'.
[  452.037280][ T8339] fuse: Unknown parameter 'group_i00000000000000000000'
[  452.384715][ T8337] loop3: detected capacity change from 0 to 164
[  452.505805][   T22] usb 4-1: USB disconnect, device number 6
[  452.518872][   T22] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected
[  452.709491][ T8344] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.3'.
[  452.731683][ T8344] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.3'.
[  452.749762][ T8344] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check.
[  452.926632][ T3568] Bluetooth: hci2: unexpected cc 0x0c5a length: 1 < 2
[  452.933794][ T3568] Bluetooth: hci2: unexpected event for opcode 0x0c5a
[  452.946458][ T8349] loop4: detected capacity change from 0 to 256
[  454.160019][ T8363] loop2: detected capacity change from 0 to 256
[  454.166942][ T8368] netlink: 'syz-executor.4': attribute type 10 has an invalid length.
[  454.167431][ T8370] ptrace attach of "/root/syz-executor.0 exec"[7742] was attempted by "/root/syz-executor.0 exec"[8370]
[  454.216301][ T8368] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.4'.
[  454.246941][ T8363] FAT-fs (loop2): Directory bread(block 64) failed
[  454.260103][ T8363] FAT-fs (loop2): Directory bread(block 65) failed
[  454.279410][ T8363] FAT-fs (loop2): Directory bread(block 66) failed
[  454.287006][ T8363] FAT-fs (loop2): Directory bread(block 67) failed
[  454.295826][ T8363] FAT-fs (loop2): Directory bread(block 68) failed
[  454.303354][ T8363] FAT-fs (loop2): Directory bread(block 69) failed
[  454.310695][ T8363] FAT-fs (loop2): Directory bread(block 70) failed
[  454.324573][ T8363] FAT-fs (loop2): Directory bread(block 71) failed
[  454.360259][ T8363] FAT-fs (loop2): Directory bread(block 72) failed
[  454.381038][ T7327] usb 4-1: new high-speed USB device number 7 using dummy_hcd
[  454.384279][ T8363] FAT-fs (loop2): Directory bread(block 73) failed
[  454.631128][ T7327] usb 4-1: Using ep0 maxpacket: 32
[  454.651235][ T8382] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'.
[  454.674378][ T8382] netlink: 28 bytes leftover after parsing attributes in process `syz-executor.4'.
[  454.684423][ T8383] loop0: detected capacity change from 0 to 128
[  454.751183][ T7327] usb 4-1: config index 0 descriptor too short (expected 35577, got 27)
[  454.768927][ T7327] usb 4-1: config 1 has too many interfaces: 92, using maximum allowed: 32
[  454.799421][ T7327] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 92
[  454.837202][ T7327] usb 4-1: config 1 has no interface number 0
[  454.856605][ T7327] usb 4-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  454.878836][   T27] audit: type=1326 audit(1717706694.716:393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8386 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f83c0e7a6e7 code=0x7ffc0000
[  454.928605][ T7327] usb 4-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17
[  454.970446][   T27] audit: type=1326 audit(1717706694.746:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8386 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f83c0e403b9 code=0x7ffc0000
[  455.017891][ T7327] usb 4-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8
[  455.050882][ T7327] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  455.087707][   T27] audit: type=1326 audit(1717706694.746:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8386 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f83c0e7a6e7 code=0x7ffc0000
[  455.123437][   T27] audit: type=1326 audit(1717706694.746:396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8386 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f83c0e403b9 code=0x7ffc0000
[  455.153522][ T7327] snd_usb_pod 4-1:1.1: Line 6 Pocket POD found
[  455.242245][   T27] audit: type=1326 audit(1717706694.746:397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8386 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f83c0e7a6e7 code=0x7ffc0000
[  455.324281][   T27] audit: type=1326 audit(1717706694.746:398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8386 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f83c0e403b9 code=0x7ffc0000
[  455.361907][ T7327] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now attached
[  455.414303][   T27] audit: type=1326 audit(1717706694.746:399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8386 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f83c0e7a6e7 code=0x7ffc0000
[  455.510044][   T27] audit: type=1326 audit(1717706694.746:400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8386 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f83c0e403b9 code=0x7ffc0000
[  455.612428][   T27] audit: type=1326 audit(1717706694.746:401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8386 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f83c0e7a6e7 code=0x7ffc0000
[  455.692021][   T27] audit: type=1326 audit(1717706694.746:402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8386 comm="syz-executor.2" exe="/root/syz-executor.2" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f83c0e403b9 code=0x7ffc0000
[  455.997446][ T8400] process 'syz-executor.1' launched './file0' with NULL argv: empty string added
[  456.174489][ T4203] usb 4-1: USB disconnect, device number 7
[  456.191094][ T4203] snd_usb_pod 4-1:1.1: Line 6 Pocket POD now disconnected
[  456.849120][ T8423] netlink: 'syz-executor.3': attribute type 4 has an invalid length.
[  456.919209][ T8426] netlink: 'syz-executor.3': attribute type 4 has an invalid length.
[  457.617533][ T8453] hub 6-0:1.0: USB hub found
[  457.627116][ T8453] hub 6-0:1.0: 1 port detected
[  458.446485][ T8465] loop2: detected capacity change from 0 to 256
[  458.607598][ T8468] netlink: 'syz-executor.0': attribute type 10 has an invalid length.
[  458.643847][ T8468] netlink: 40 bytes leftover after parsing attributes in process `syz-executor.0'.
[  459.404661][ T8473] loop1: detected capacity change from 0 to 2048
[  459.456726][ T8473] EXT4-fs: Ignoring removed orlov option
[  459.470507][ T4203] usb 4-1: new high-speed USB device number 8 using dummy_hcd
[  459.528352][ T8473] EXT4-fs (loop1): Test dummy encryption mode enabled
[  459.540031][ T8473] EXT4-fs error (device loop1): __ext4_fill_super:5399: inode #2: comm syz-executor.1: casefold flag without casefold feature
[  459.554180][ T8473] EXT4-fs (loop1): warning: mounting fs with errors, running e2fsck is recommended
[  459.582536][ T8473] EXT4-fs (loop1): Errors on filesystem, clearing orphan list.
[  459.591093][ T8473] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback.
[  460.285370][ T7026] EXT4-fs (loop1): unmounting filesystem.
[  460.631158][ T4203] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0
[  460.659965][ T4203] usb 4-1: New USB device found, idVendor=046d, idProduct=c534, bcdDevice= 0.00
[  460.734856][ T8496] loop1: detected capacity change from 0 to 2048
[  460.754213][ T4203] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  460.769331][   T27] kauditd_printk_skb: 33 callbacks suppressed
[  460.769345][   T27] audit: type=1800 audit(1717706700.606:436): pid=8500 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz-executor.2" name="bus" dev="sda1" ino=1957 res=0 errno=0
[  460.775579][ T4203] usb 4-1: config 0 descriptor??
[  460.790403][ T8496] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none.
[  460.888915][ T8505] hub 6-0:1.0: USB hub found
[  460.895779][ T8505] hub 6-0:1.0: 1 port detected
[  461.730571][ T7026] EXT4-fs (loop1): unmounting filesystem.
[  461.764484][ T4203] usbhid 4-1:0.0: couldn't find an input interrupt endpoint
[  461.782972][ T4203] usb 4-1: USB disconnect, device number 8
[  462.038621][ T8530] overlayfs: missing 'lowerdir'
[  462.450947][ T3585] Bluetooth: hci1: command 0x0406 tx timeout
[  462.582973][ T8538] loop0: detected capacity change from 0 to 2048
[  462.638425][ T8528] loop1: detected capacity change from 0 to 40427
[  462.646245][ T8538] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none.
[  462.677041][ T8528] F2FS-fs (loop1): Found nat_bits in checkpoint
[  462.827230][ T8528] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5
[  462.864309][ T8548] loop2: detected capacity change from 0 to 512
[  462.902386][ T8548] EXT4-fs: Ignoring removed orlov option
[  462.921764][ T8548] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE
[  462.961240][ T8548] EXT4-fs (loop2): Test dummy encryption mode enabled
[  462.993773][ T7026] syz-executor.1: attempt to access beyond end of device
[  462.993773][ T7026] loop1: rw=524288, sector=45064, nr_sectors = 8 limit=40427
[  462.994738][ T8548] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a040e01c, mo2=0002]
[  463.011046][ T7026] syz-executor.1: attempt to access beyond end of device
[  463.011046][ T7026] loop1: rw=0, sector=45064, nr_sectors = 8 limit=40427
[  463.067755][ T7742] EXT4-fs (loop0): unmounting filesystem.
[  463.131118][ T8548] System zones: 1-12
[  463.139839][ T5430] kworker/u4:13: attempt to access beyond end of device
[  463.139839][ T5430] loop1: rw=2049, sector=40960, nr_sectors = 32 limit=40427
[  463.159278][ T8548] EXT4-fs error (device loop2): ext4_orphan_get:1396: inode #15: comm syz-executor.2: casefold flag without casefold feature
[  463.196540][ T8548] EXT4-fs error (device loop2): ext4_xattr_inode_iget:404: inode #12: comm syz-executor.2: missing EA_INODE flag
[  463.226162][ T8551] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off.
[  463.247997][ T8548] EXT4-fs error (device loop2): ext4_xattr_inode_iget:409: comm syz-executor.2: error while reading EA inode 12 err=-117
[  463.268222][ T8548] EXT4-fs (loop2): 1 orphan inode deleted
[  463.286546][ T8548] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none.
[  464.252976][ T6296] EXT4-fs (loop2): unmounting filesystem.
[  488.533349][ T3585] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  488.553412][ T3585] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  488.562383][ T3585] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  488.570138][ T3585] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  488.577671][ T3585] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[  488.593768][ T3585] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  490.691145][ T3568] Bluetooth: hci1: command tx timeout
[  492.128617][ T3585] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  492.138880][ T3585] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  492.153085][ T3585] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  492.173552][ T3585] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  492.181207][ T3585] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3
[  492.189158][ T3585] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  492.330909][ T3585] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1
[  492.347957][ T3585] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9
[  492.358117][ T3585] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9
[  492.367306][ T3585] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4
[  492.375075][ T3585] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3
[  492.382465][ T3585] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2
[  492.770853][ T3585] Bluetooth: hci1: command tx timeout
[  493.693253][ T3568] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1
[  493.703667][ T3568] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9
[  493.711929][ T3568] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9
[  493.719640][ T3568] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4
[  493.728505][ T3568] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3
[  493.741198][ T3568] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2
[  494.222053][ T3585] Bluetooth: hci5: command tx timeout
[  494.451135][ T3585] Bluetooth: hci6: command tx timeout
[  494.851119][ T3585] Bluetooth: hci1: command tx timeout
[  495.811078][ T3585] Bluetooth: hci7: command tx timeout
[  496.290889][ T3585] Bluetooth: hci5: command tx timeout
[  496.530942][ T3585] Bluetooth: hci6: command tx timeout
[  496.930899][ T3585] Bluetooth: hci1: command tx timeout
[  497.094231][ T3583] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1
[  497.104423][ T3583] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9
[  497.113413][ T3583] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9
[  497.128684][ T3583] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4
[  497.136293][ T3583] Bluetooth: hci8: unexpected cc 0x0c25 length: 249 > 3
[  497.148960][ T3583] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2
[  497.898808][ T3585] Bluetooth: hci7: command tx timeout
[  498.370869][ T3585] Bluetooth: hci5: command tx timeout
[  498.610951][ T3585] Bluetooth: hci6: command tx timeout
[  499.171086][ T3585] Bluetooth: hci8: command tx timeout
[  499.978534][ T3585] Bluetooth: hci7: command tx timeout
[  500.450909][ T3585] Bluetooth: hci5: command tx timeout
[  500.691076][ T3583] Bluetooth: hci6: command tx timeout
[  501.250842][ T3585] Bluetooth: hci8: command tx timeout
[  501.341073][ T1255] ieee802154 phy0 wpan0: encryption failed: -22
[  501.347412][ T1255] ieee802154 phy1 wpan1: encryption failed: -22
[  502.060725][ T3585] Bluetooth: hci7: command tx timeout
[  503.330849][ T3585] Bluetooth: hci8: command tx timeout
[  505.411006][ T3585] Bluetooth: hci8: command tx timeout
[  513.651042][ T3583] Bluetooth: hci0: command 0x0406 tx timeout
[  523.891091][ T3585] Bluetooth: hci3: command 0x0406 tx timeout
[  553.857344][ T3585] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1
[  553.868447][ T3585] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9
[  553.881012][ T3585] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9
[  553.888763][ T3585] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4
[  553.896424][ T3585] Bluetooth: hci9: unexpected cc 0x0c25 length: 249 > 3
[  553.905226][ T3585] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2
[  555.970974][ T3583] Bluetooth: hci9: command tx timeout
[  557.201632][ T3568] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1
[  557.212630][ T3568] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9
[  557.220955][ T3568] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9
[  557.229969][ T3568] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4
[  557.237754][ T3568] Bluetooth: hci10: unexpected cc 0x0c25 length: 249 > 3
[  557.245130][ T3568] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2
[  557.360251][ T3568] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1
[  557.370192][ T3568] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9
[  557.379370][ T3568] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9
[  557.390451][ T3568] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4
[  557.404895][ T3568] Bluetooth: hci11: unexpected cc 0x0c25 length: 249 > 3
[  557.412375][ T3568] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2
[  558.050850][ T3583] Bluetooth: hci9: command tx timeout
[  558.736776][ T3585] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1
[  558.748814][ T3585] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9
[  558.757261][ T3585] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9
[  558.765374][ T3585] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4
[  558.773117][ T3585] Bluetooth: hci12: unexpected cc 0x0c25 length: 249 > 3
[  558.780448][ T3585] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2
[  559.330956][ T3585] Bluetooth: hci10: command tx timeout
[  559.490977][ T3585] Bluetooth: hci11: command tx timeout
[  560.130914][ T3585] Bluetooth: hci9: command tx timeout
[  560.851111][ T3585] Bluetooth: hci12: command tx timeout
[  561.411156][ T3585] Bluetooth: hci10: command tx timeout
[  561.582315][ T3585] Bluetooth: hci11: command tx timeout
[  562.148009][ T3583] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1
[  562.159558][ T3583] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9
[  562.167922][ T3583] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9
[  562.176277][ T3583] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4
[  562.183913][ T3583] Bluetooth: hci13: unexpected cc 0x0c25 length: 249 > 3
[  562.196516][ T3583] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2
[  562.211559][ T3583] Bluetooth: hci9: command tx timeout
[  562.781081][ T1255] ieee802154 phy0 wpan0: encryption failed: -22
[  562.787383][ T1255] ieee802154 phy1 wpan1: encryption failed: -22
[  562.930906][ T3585] Bluetooth: hci12: command tx timeout
[  563.490909][ T3585] Bluetooth: hci10: command tx timeout
[  563.650837][ T3585] Bluetooth: hci11: command tx timeout
[  564.210892][ T3585] Bluetooth: hci13: command tx timeout
[  565.010862][ T3585] Bluetooth: hci12: command tx timeout
[  565.570957][ T3585] Bluetooth: hci10: command tx timeout
[  565.730918][ T3585] Bluetooth: hci11: command tx timeout
[  566.290865][ T3585] Bluetooth: hci13: command tx timeout
[  567.090907][ T3585] Bluetooth: hci12: command tx timeout
[  568.370930][ T3585] Bluetooth: hci13: command tx timeout
[  570.450891][ T3585] Bluetooth: hci13: command tx timeout
[  610.931178][ T3585] Bluetooth: hci1: command 0x0406 tx timeout
[  616.050928][ T8609] Bluetooth: hci5: command 0x0406 tx timeout
[  616.057111][ T8609] Bluetooth: hci6: command 0x0406 tx timeout
[  616.060980][ T3583] Bluetooth: hci7: command 0x0406 tx timeout
[  619.153407][ T8608] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1
[  619.168645][ T8608] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9
[  619.177956][ T8608] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9
[  619.186002][ T8608] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4
[  619.195037][ T8608] Bluetooth: hci14: unexpected cc 0x0c25 length: 249 > 3
[  619.208287][ T8608] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2
[  621.170896][ T3583] Bluetooth: hci8: command 0x0406 tx timeout
[  621.261101][ T8609] Bluetooth: hci14: command tx timeout
[  622.296990][ T3583] Bluetooth: hci15: unexpected cc 0x0c03 length: 249 > 1
[  622.312389][ T3583] Bluetooth: hci15: unexpected cc 0x1003 length: 249 > 9
[  622.321583][ T3583] Bluetooth: hci15: unexpected cc 0x1001 length: 249 > 9
[  622.329445][ T3583] Bluetooth: hci15: unexpected cc 0x0c23 length: 249 > 4
[  622.338411][ T3583] Bluetooth: hci15: unexpected cc 0x0c25 length: 249 > 3
[  622.346789][ T3583] Bluetooth: hci15: unexpected cc 0x0c38 length: 249 > 2
[  622.393478][ T8609] Bluetooth: hci16: unexpected cc 0x0c03 length: 249 > 1
[  622.403136][ T8609] Bluetooth: hci16: unexpected cc 0x1003 length: 249 > 9
[  622.412548][ T8609] Bluetooth: hci16: unexpected cc 0x1001 length: 249 > 9
[  622.422552][ T8609] Bluetooth: hci16: unexpected cc 0x0c23 length: 249 > 4
[  622.430161][ T8609] Bluetooth: hci16: unexpected cc 0x0c25 length: 249 > 3
[  622.437715][ T8609] Bluetooth: hci16: unexpected cc 0x0c38 length: 249 > 2
[  623.330912][ T3583] Bluetooth: hci14: command tx timeout
[  623.772429][ T3568] Bluetooth: hci17: unexpected cc 0x0c03 length: 249 > 1
[  623.787294][ T3568] Bluetooth: hci17: unexpected cc 0x1003 length: 249 > 9
[  623.795533][ T3568] Bluetooth: hci17: unexpected cc 0x1001 length: 249 > 9
[  623.804552][ T3568] Bluetooth: hci17: unexpected cc 0x0c23 length: 249 > 4
[  623.812236][ T3568] Bluetooth: hci17: unexpected cc 0x0c25 length: 249 > 3
[  623.819548][ T3568] Bluetooth: hci17: unexpected cc 0x0c38 length: 249 > 2
[  624.221070][ T1255] ieee802154 phy0 wpan0: encryption failed: -22
[  624.227383][ T1255] ieee802154 phy1 wpan1: encryption failed: -22
[  624.370866][ T3568] Bluetooth: hci15: command tx timeout
[  624.530900][ T3568] Bluetooth: hci16: command tx timeout
[  625.410943][ T3568] Bluetooth: hci14: command tx timeout
[  625.501060][   T28] INFO: task kworker/1:0:22 blocked for more than 143 seconds.
[  625.516566][   T28]       Not tainted 6.1.92-syzkaller #0
[  625.523435][   T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  625.536331][   T28] task:kworker/1:0     state:D stack:23160 pid:22    ppid:2      flags:0x00004000
2024/06/06 20:47:45 SYZFATAL: failed to recv *flatrpc.HostMessageRaw: EOF
[  625.546825][   T28] Workqueue: events_power_efficient reg_check_chans_work
[  625.570967][   T28] Call Trace:
[  625.574282][   T28]  <TASK>
[  625.577220][   T28]  __schedule+0x142d/0x4550
[  625.583192][   T28]  ? do_raw_spin_unlock+0x137/0x8a0
[  625.588436][   T28]  ? __sched_text_start+0x8/0x8
[  625.593519][   T28]  ? print_irqtrace_events+0x210/0x210
[  625.598998][   T28]  ? do_raw_spin_unlock+0x137/0x8a0
[  625.604557][   T28]  ? _raw_spin_unlock_irq+0x1f/0x40
[  625.609777][   T28]  ? lockdep_hardirqs_on+0x94/0x130
[  625.616680][   T28]  schedule+0xbf/0x180
[  625.620855][   T28]  schedule_preempt_disabled+0xf/0x20
[  625.630939][   T28]  __mutex_lock+0x6b9/0xd80
[  625.635468][   T28]  ? __mutex_lock+0x53c/0xd80
[  625.640155][   T28]  ? reg_check_chans_work+0x8d/0xdb0
[  625.650499][   T28]  ? mutex_lock_nested+0x10/0x10
[  625.660483][   T28]  ? process_one_work+0x7a9/0x11d0
[  625.672425][   T28]  reg_check_chans_work+0x8d/0xdb0
[  625.677573][   T28]  ? read_lock_is_recursive+0x10/0x10
[  625.687100][   T28]  ? reg_process_ht_flags+0xba0/0xba0
[  625.693782][   T28]  ? _raw_spin_unlock_irqrestore+0xd9/0x130
[  625.699691][   T28]  ? do_raw_spin_unlock+0x137/0x8a0
[  625.709055][   T28]  ? process_one_work+0x7a9/0x11d0
[  625.717372][   T28]  process_one_work+0x8a9/0x11d0
[  625.726513][   T28]  ? worker_detach_from_pool+0x260/0x260
[  625.741087][   T28]  ? _raw_spin_lock_irqsave+0x120/0x120
[  625.746668][   T28]  ? kthread_data+0x4e/0xc0
[  625.759529][   T28]  ? wq_worker_running+0x97/0x190
[  625.764782][   T28]  worker_thread+0xa47/0x1200
[  625.769500][   T28]  kthread+0x28d/0x320
[  625.778843][   T28]  ? worker_clr_flags+0x190/0x190
[  625.785514][   T28]  ? kthread_blkcg+0xd0/0xd0
[  625.790120][   T28]  ret_from_fork+0x1f/0x30
[  625.799837][   T28]  </TASK>
[  625.803545][   T28] INFO: task kworker/0:3:2965 blocked for more than 143 seconds.
[  625.830867][   T28]       Not tainted 6.1.92-syzkaller #0
[  625.836449][   T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  625.850371][   T28] task:kworker/0:3     state:D stack:23224 pid:2965  ppid:2      flags:0x00004000
[  625.859947][   T28] Workqueue: ipv6_addrconf addrconf_verify_work
[  625.871786][   T28] Call Trace:
[  625.875090][   T28]  <TASK>
[  625.878031][   T28]  __schedule+0x142d/0x4550
[  625.886741][   T28]  ? __sched_text_start+0x8/0x8
[  625.891974][ T3568] Bluetooth: hci17: command tx timeout
[  625.906596][   T28]  ? print_irqtrace_events+0x210/0x210
[  625.912128][   T28]  ? do_raw_spin_unlock+0x137/0x8a0
[  625.917337][   T28]  ? _raw_spin_unlock_irq+0x1f/0x40
[  625.923073][   T28]  ? lockdep_hardirqs_on+0x94/0x130
[  625.928302][   T28]  schedule+0xbf/0x180
[  625.932430][   T28]  schedule_preempt_disabled+0xf/0x20
[  625.937819][   T28]  __mutex_lock+0x6b9/0xd80
[  625.942591][   T28]  ? __mutex_lock+0x53c/0xd80
[  625.947284][   T28]  ? addrconf_verify_work+0x15/0x30
[  625.952522][   T28]  ? mutex_lock_nested+0x10/0x10
[  625.957464][   T28]  ? lockdep_hardirqs_on_prepare+0x438/0x7a0
[  625.964832][   T28]  ? print_irqtrace_events+0x210/0x210
[  625.970312][   T28]  ? _raw_spin_unlock_irqrestore+0xd9/0x130
[  625.976253][   T28]  ? do_raw_spin_unlock+0x137/0x8a0
[  625.982402][   T28]  ? process_one_work+0x7a9/0x11d0
[  625.987536][   T28]  addrconf_verify_work+0x15/0x30
[  625.992634][   T28]  process_one_work+0x8a9/0x11d0
[  625.997594][   T28]  ? worker_detach_from_pool+0x260/0x260
[  626.003411][   T28]  ? _raw_spin_lock_irqsave+0x120/0x120
[  626.008968][   T28]  ? kthread_data+0x4e/0xc0
[  626.013515][   T28]  ? wq_worker_running+0x97/0x190
[  626.018554][   T28]  worker_thread+0xa47/0x1200
[  626.023790][   T28]  kthread+0x28d/0x320
[  626.027877][   T28]  ? worker_clr_flags+0x190/0x190
[  626.032933][   T28]  ? kthread_blkcg+0xd0/0xd0
[  626.037530][   T28]  ret_from_fork+0x1f/0x30
[  626.042138][   T28]  </TASK>
[  626.045228][   T28] INFO: task syz-executor.1:7026 blocked for more than 143 seconds.
[  626.053571][   T28]       Not tainted 6.1.92-syzkaller #0
[  626.059113][   T28] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  626.067911][   T28] task:syz-executor.1  state:D stack:20568 pid:7026  ppid:1      flags:0x00004002
[  626.078516][   T28] Call Trace:
[  626.081952][   T28]  <TASK>
[  626.084892][   T28]  __schedule+0x142d/0x4550
[  626.089427][   T28]  ? __mutex_lock+0x6b4/0xd80
[  626.094947][   T28]  ? __sched_text_start+0x8/0x8
[  626.099817][   T28]  ? __mutex_trylock_common+0x8d/0x2e0
[  626.105419][   T28]  ? do_raw_spin_unlock+0x137/0x8a0
[  626.110631][   T28]  schedule+0xbf/0x180
[  626.114834][   T28]  schedule_preempt_disabled+0xf/0x20
[  626.120232][   T28]  __mutex_lock+0x6b9/0xd80
[  626.140931][   T28]  ? __mutex_lock+0x53c/0xd80
[  626.145655][   T28]  ? tun_chr_close+0x3a/0x1b0
[  626.150341][   T28]  ? mutex_lock_nested+0x10/0x10
[  626.170938][   T28]  tun_chr_close+0x3a/0x1b0
[  626.175476][   T28]  ? tun_chr_open+0x4d0/0x4d0
[  626.180162][   T28]  __fput+0x3b7/0x890
[