last executing test programs:

191.629716ms ago: executing program 3 (id=16):
membarrier(0x0, 0x0)

162.328067ms ago: executing program 3 (id=22):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio1', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio1', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio1', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio1', 0x800, 0x0)

127.932638ms ago: executing program 0 (id=27):
bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000), 0x0)

127.818518ms ago: executing program 1 (id=28):
open(&(0x7f0000000000), 0x0, 0x0)

93.363738ms ago: executing program 1 (id=32):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/onlycap', 0x2, 0x0)

93.264738ms ago: executing program 0 (id=33):
io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x0)

92.954918ms ago: executing program 0 (id=36):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/damon/schemes', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/damon/schemes', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/damon/schemes', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/damon/schemes', 0x800, 0x0)

92.842278ms ago: executing program 1 (id=37):
recvmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0)

92.804458ms ago: executing program 4 (id=38):
syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0)

53.488519ms ago: executing program 0 (id=40):
pread64(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)

53.324079ms ago: executing program 1 (id=41):
pwrite64(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0)

53.271399ms ago: executing program 2 (id=42):
renameat(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffffff, &(0x7f0000000000))

53.208359ms ago: executing program 4 (id=43):
shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000000))

53.139669ms ago: executing program 3 (id=44):
sched_setaffinity(0x0, 0x0, &(0x7f0000000000))

53.095919ms ago: executing program 4 (id=45):
futex_waitv(&(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000), 0x0)

31.45708ms ago: executing program 1 (id=46):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ocfs2_control', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ocfs2_control', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ocfs2_control', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ocfs2_control', 0x800, 0x0)

31.34212ms ago: executing program 0 (id=47):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse', 0x2, 0x0)

31.176949ms ago: executing program 1 (id=48):
socket$caif_stream(0x25, 0x1, 0x0)

31.10314ms ago: executing program 2 (id=49):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nvram', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nvram', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nvram', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nvram', 0x800, 0x0)

31.047249ms ago: executing program 3 (id=50):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20', 0x800, 0x0)

30.92913ms ago: executing program 2 (id=51):
read(0xffffffffffffffff, &(0x7f0000000000), 0x0)

30.86846ms ago: executing program 4 (id=52):
socket$isdn_base(0x22, 0x3, 0x0)

742.02µs ago: executing program 0 (id=53):
shmget(0xffffffffffffffff, 0x0, 0x0, 0x0)

629.21µs ago: executing program 3 (id=54):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vmci', 0x2, 0x0)

568.88µs ago: executing program 2 (id=55):
syz_init_net_socket$rose(0xb, 0x5, 0x0)

471.86µs ago: executing program 2 (id=56):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/exec', 0x2, 0x0)

304.18µs ago: executing program 4 (id=57):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/raw-gadget', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/raw-gadget', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/raw-gadget', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/raw-gadget', 0x800, 0x0)

149.91µs ago: executing program 3 (id=58):
openat2(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0)

90.56µs ago: executing program 2 (id=59):
socket$inet(0x2, 0x1, 0x0)

0s ago: executing program 4 (id=60):
openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/userio', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userio', 0x1, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/userio', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/userio', 0x800, 0x0)

0s ago: executing program 1 (id=61):
io_destroy(0x0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.1.53' (ED25519) to the list of known hosts.
syzkaller login: [   30.060480][ T4036] cgroup: Unknown subsys name 'net'
[   30.315395][ T4036] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   30.606144][ T4036] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k SSFS
[   31.594214][ T4112] Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP
[   31.595589][ T4112] Modules linked in:
[   31.596274][ T4112] CPU: 0 PID: 4112 Comm: syz.1.61 Not tainted syzkaller #0
[   31.597518][ T4112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
[   31.599219][ T4112] pstate: 42400405 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=jc)
[   31.600589][ T4112] pc : lookup_ioctx+0x10c/0x7c0
[   31.601485][ T4112] lr : lookup_ioctx+0xe8/0x7c0
[   31.602422][ T4112] sp : ffff80001fae7c40
[   31.603117][ T4112] x29: ffff80001fae7c40 x28: ffff0000dd179b40 x27: 0000000000000000
[   31.604576][ T4112] x26: 1fffe0001ba2f368 x25: 1ffff00003f5cfd6 x24: ffff0000dc4a8b80
[   31.606014][ T4112] x23: dfff800000000000 x22: 00000000fffffff2 x21: 0000000000000000
[   31.607471][ T4112] x20: ffff0000dd179b40 x19: 0000000000000000 x18: 0000000000000000
[   31.609003][ T4112] x17: 0000000000000000 x16: ffff800008a31938 x15: 0000000000000000
[   31.610502][ T4112] x14: 0000000000000003 x13: 1ffff0000288002b x12: 0000000097863b1e
[   31.611996][ T4112] x11: ff80800008a31914 x10: 0000000000000000 x9 : 0000ffffffffffff
[   31.613466][ T4112] x8 : 0000000000000000 x7 : ffff800008763824 x6 : 0000000000000000
[   31.614923][ T4112] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001
[   31.616361][ T4112] x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000
[   31.617740][ T4112] Call trace:
[   31.618288][ T4112]  lookup_ioctx+0x10c/0x7c0
[   31.619041][ T4112]  __arm64_sys_io_destroy+0x9c/0x1d8
[   31.619936][ T4112]  invoke_syscall+0x98/0x28c
[   31.620713][ T4112]  el0_svc_common+0x13c/0x258
[   31.621577][ T4112]  do_el0_svc+0x5c/0x140
[   31.622283][ T4112]  el0_svc+0x78/0x1d0
[   31.622970][ T4112]  el0t_64_sync_handler+0xcc/0xe4
[   31.623831][ T4112]  el0t_64_sync+0x1a0/0x1a4
[   31.624650][ T4112] Code: d503229f 2a1f03f6 2a1f03e0 b8400953 (2a1603e1) 
[   31.625885][ T4112] ---[ end trace c423cb1c0d13e686 ]---
[   31.863440][ T4112] Kernel panic - not syncing: Oops - BTI: Fatal exception
[   31.864768][ T4112] SMP: stopping secondary CPUs
[   31.865618][ T4112] Kernel Offset: disabled
[   31.866392][ T4112] CPU features: 0xa,000003c1,7d33ffd9
[   31.867387][ T4112] Memory Limit: none
[   32.078011][ T4112] Rebooting in 86400 seconds..