last executing test programs: 3.232274809s ago: executing program 3 (id=548): r0 = shmget(0x3, 0x2000, 0x380, &(0x7f0000ffe000/0x2000)=nil) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) shmat(r0, &(0x7f0000002000/0x2000)=nil, 0xa22a45e31f5d5c6b) semget(0x1, 0x0, 0x108) shmget(0x3, 0x2000, 0x380, &(0x7f0000ffe000/0x2000)=nil) (async) shmat(r0, &(0x7f0000ffe000/0x2000)=nil, 0x2000) (async) shmat(r0, &(0x7f0000002000/0x2000)=nil, 0xa22a45e31f5d5c6b) (async) semget(0x1, 0x0, 0x108) (async) 3.200394552s ago: executing program 3 (id=552): r0 = socket$inet6(0x18, 0x4000, 0x4) bind$inet6(r0, &(0x7f0000000040)={0x18, 0x3, 0xdb2, 0x9a}, 0xc) r1 = socket$unix(0x1, 0x5, 0x0) bind$unix(r1, &(0x7f0000000200)=@file={0xd570d0466b6018f, './file0\x00'}, 0xa) listen(r1, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) r3 = socket(0x18, 0x2, 0x0) setsockopt(r3, 0x1000000000029, 0xa, &(0x7f00000002c0)="03000000", 0x4) setsockopt(r3, 0x1000000000029, 0xc, 0x0, 0x0) connect$unix(r2, &(0x7f0000000000)=@file={0xd1653077bafa0114, './file0\x00'}, 0xa) r4 = socket$unix(0x1, 0x5, 0x0) connect$unix(r4, &(0x7f0000000000)=@file={0xd1653077bafa0114, './file0\x00'}, 0xa) sysctl$kern(&(0x7f00000000c0)={0x1, 0x29}, 0x2, &(0x7f0000000180), 0x0, 0x0, 0x0) close(r1) 3.131126615s ago: executing program 3 (id=557): select(0x40, &(0x7f0000000140)={0x5, 0x5, 0x8, 0x8001, 0xfffffffffffffffc, 0x7fffffff, 0xfffffffffffffffb, 0x8}, &(0x7f0000000180)={0x0, 0xb9, 0xffffffffffffffff, 0x3, 0x1, 0x6, 0x10, 0xffffffffffffffff}, &(0x7f00000001c0)={0x81, 0x0, 0x40, 0xe, 0x3, 0x81, 0x2, 0x3}, &(0x7f0000000200)={0x8, 0xa}) sendmsg$unix(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, 0xfffffffffffffe23}, 0x40c) sysctl$kern(&(0x7f0000000080)={0x1, 0x5b}, 0x2, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x2, 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r1 = dup(r0) setsockopt$inet_opts(r1, 0x0, 0x14, &(0x7f0000000080)='\x00\x00\x00\x00', 0x4) sysctl$vm_swapencrypt(&(0x7f0000000000), 0x3, 0x0, 0x0, 0x0, 0x0) r2 = socket$inet(0x2, 0x3, 0x0) close(r2) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r3, 0x0, 0x200000000000c, &(0x7f0000000000)="ea00000100000000", 0x8) setsockopt$inet_opts(r3, 0x0, 0x200000000000c, &(0x7f0000000240)="ea00eb0100000000", 0x8) sysctl$net_inet_ipip(&(0x7f0000001c00)={0x4, 0x2, 0x11, 0x1}, 0x4, 0x0, 0x0, &(0x7f0000001cc0)='\x00\x00\x00\x00', 0x4) setsockopt$inet_opts(r2, 0x0, 0xd, &(0x7f0000000240)="ea00000100000000", 0x8) sysctl$vm_swapencrypt(&(0x7f00000003c0)={0x2, 0x5, 0x2}, 0x3, &(0x7f0000000400)="b113e42c6ab2ded949a794b3ae57e8ec68f715c812af47686a58b61a4932745d615c83b27609129c79b51408b7931eb5aa4a264e52cc35edfc3581a59c42c31514ee880798b58e8e5bce81", &(0x7f0000000480)=0x4b, &(0x7f00000004c0)="8b98030a8772ccf344666276fb768e22f3f6029cb88ececedd904dc6b28dcd75ad1fb073b6f403454904fef09996c8cd9719b415552f76c0f84bf0a5d7607371461ae26f0e5ea483ef", 0x49) recvfrom(r3, &(0x7f0000000300)=""/182, 0xb6, 0x802, 0x0, 0x0) r4 = socket$inet(0x2, 0x2, 0x0) select(0x40, &(0x7f0000000680)={0x6, 0x3, 0x49c10b05, 0x8, 0x9, 0x2, 0xffffffffffffff81, 0x49}, &(0x7f00000006c0)={0x3, 0x7fffffffffffffff, 0x8, 0x400, 0xfe1, 0x2, 0x7, 0x4}, &(0x7f0000000700)={0x3ff, 0x1, 0x9, 0x5, 0x4, 0x7, 0x6, 0x2}, &(0x7f0000000740)={0x8001, 0x9}) getsockopt$sock_int(r4, 0xffff, 0x2000, &(0x7f0000000040), &(0x7f0000001280)=0x4) r5 = open$dir(&(0x7f0000000040)='./file0\x00', 0x100, 0x15b) r6 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000780), 0x8000, 0x0) ioctl$BIOCSETIF(r6, 0x8020426c, &(0x7f00000007c0)={'tap', 0x0}) ioctl$FIOSETOWN(r5, 0x8004667c, &(0x7f0000000080)=0x4) r7 = openat$wsdisplay(0xffffffffffffff9c, &(0x7f0000000100), 0x100, 0x0) ioctl$KDENABIO(r7, 0x20004b3c) sysctl$vm_swapencrypt(&(0x7f0000000540), 0x3, &(0x7f0000000580)="163fdd33fd10d73488862499a10bb7679e2f", &(0x7f00000005c0)=0x12, &(0x7f0000000600)="6ca89c26731deaf73fbd8867bac1baeacc1c40f8498ad86b52621ed7279822769b1a5fb02dfba409abab3529e92abd783a43eb15035048f714cbd43d46d1a3a7f0da40f07ee68e5b0011dc8736bae201715ecccc4157fb98cad5110dd78d206dc0069d50d24b5c73795bc86be0f58a792f2fbfd2503caea15d7df3", 0x7b) ioctl$VNDIOCSET(0xffffffffffffffff, 0xc0384600, &(0x7f00000002c0)={&(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000000280)='./file0\x00', 0x8}) 3.129169889s ago: executing program 3 (id=560): r0 = syz_open_pts() socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) read(r1, &(0x7f0000000140)=""/4096, 0x1000) execve(0x0, 0x0, 0x0) syz_open_pts() r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x40, 0xac) symlinkat(&(0x7f0000000040)='./file0\x00', r2, &(0x7f0000000100)='./file0\x00') ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f00000000c0)={0xf, 0x3, 0xfffffffe, 0xfffffff6, "ff0107002015c8a32d00000065c0bdf9c6f04aaf", 0x9, 0x40000}) ioctl$TIOCSTAT(r0, 0x20007465, 0x0) 2.219923178s ago: executing program 3 (id=612): r0 = openat$wskbd(0xffffffffffffff9c, &(0x7f0000000000), 0x89f412044c2a749c, 0x0) ioctl$WSKBDIO_SETMAP(r0, 0x8010570e, &(0x7f0000000040)={0x8, &(0x7f0000000180)=[{0x3ff, 0x800, 0x6, 0x1, 0x9}, {0x1, 0x9, 0x101, 0x5, 0xcad}, {0x6e, 0x8, 0x1ff, 0x4008, 0xe6bd}, {0x4, 0xffb9, 0x7, 0x4, 0xceaf}, {0x1fe8, 0x7f, 0xe0, 0xba39, 0xff81}, {0x401, 0x4, 0x3, 0xe, 0x2}, {0x6cd, 0x5, 0x6, 0x4, 0x81}, {0x7fff, 0x7fff, 0x0, 0x5, 0xc}]}) pwrite(0xffffffffffffffff, &(0x7f0000000080)="4f8e8bca7c5076cbbcba046bea103ccb80ecd9b7a7c70364c9ffa85239eb11766937405afd4c03a074c1256c0cd63e0e2376d39174c3134950a1414d6cc18ed8deb1601537951212953e0100ab5c8d6d9d2b9c720cb3d7525361b8269fcebba0cd2f42", 0x63, 0x8) setuid(0xee01) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r1 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) fcntl$dupfd(r1, 0x0, r1) ioctl$WSKBDIO_BELL(r1, 0x20005701) 2.208378022s ago: executing program 3 (id=614): r0 = socket(0x2, 0x400000000002, 0x0) setsockopt(r0, 0x0, 0x1e, 0x0, 0x0) r1 = syz_open_pts() ioctl$FIONBIO(r1, 0x8004667e, &(0x7f0000000040)=0x8a) writev(r1, &(0x7f0000000700)=[{&(0x7f0000000080)="34eb4cd59e8456ebc0881681c60e1cd9e0bf01b618b3cb934394c5951c1db0fd943a", 0xff99}], 0x1) write(r1, &(0x7f0000000100)="58ba189eea91", 0x6) r2 = open$dir(&(0x7f0000000100)='./file0\x00', 0x200, 0x0) fchmod(0xffffffffffffffff, 0x80) r3 = open$dir(&(0x7f00000000c0)='./file0\x00', 0x2, 0x0) pwritev(r3, &(0x7f0000000080)=[{&(0x7f0000000140)="1cd2d176f4b8f82c1d094d2feb0900000ef96200000034f0fed1989827dbff847d9eb566f68e89843a6f9de4d0936d2693db0eef6305358bb25edae73e89b4ace942d50222e2bad37e968fc85bc8a052710ba78eeee4370ed5929f9011995688523776d6515ecb7844b66f31330950f379f166fb08e5d76fa170c1358024decba613bd60b6d3955100188600ced2ef1e72e732eb38993c091cad444439b48cda91d221eb745d00d8896be8b518a6dc910f815e1e912e7aadf0a3911800c4a1ad3f03d3222a2679067366e74765125b84d04ec3809448fdbaa273ab08e775aa6641b3a426f9057b3a215a9087ac18e687f56a7c1a4154f32d59b73a83e75adf5c3b9bc5", 0x103}], 0x1, 0x0) syz_emit_ethernet(0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="ff728fffffffffffffffffff86dd605f6a99001c2ca902000013000000000000000000000000fe8000000000000000000000000000aa3c000005000043b22b10"]) r4 = syz_open_pts() ioctl$TIOCSTAT(r4, 0x20007465, 0x0) r5 = getpid() setpgid(0x0, 0x0) msgctl$IPC_SET(0x0, 0x1, &(0x7f00000000c0)={{}, 0x0, 0x0, r5}) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) ioctl$WSKBDIO_GETMAP(r6, 0x80047476, &(0x7f0000000100)={0x0, 0x0}) r7 = getppid() setpgid(0x0, r7) ioctl$TIOCSETD(r4, 0x8004741b, &(0x7f0000000040)=0x7) r8 = socket(0x18, 0x2, 0x0) setsockopt(r8, 0x1000000000029, 0xb, &(0x7f0000003680), 0x0) dup(r4) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4, 0x2810, r2, 0x1ffffffc) truncate(&(0x7f0000000080)='./file0\x00', 0x61c5) execve(&(0x7f0000000000)='./file0\x00', &(0x7f00000003c0)=[&(0x7f0000000280)='$/*$\x00', &(0x7f00000002c0)=':{(\x00', &(0x7f0000000300)='!\x00', &(0x7f0000000340)='/]!-$:],@$^(-\x00', &(0x7f0000000380)='\x00'], &(0x7f00000005c0)=[&(0x7f0000000400)='\\\x00', &(0x7f0000000440)='**}!*^\x00', &(0x7f0000000480)='+\\}*q}%\x00', &(0x7f00000004c0)='[*^]/\x00', &(0x7f0000000500)='%\x00', &(0x7f0000000540)='^(^[\x00', &(0x7f0000000580)='[\x00']) 1.710302733s ago: executing program 1 (id=628): setrlimit(0x8, &(0x7f0000000980)={0xb, 0x54}) (async, rerun: 64) r0 = syz_open_pts() (rerun: 64) close(r0) (async) syz_open_pts() (async, rerun: 32) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) getsockopt$sock_cred(r1, 0xffff, 0x1024, &(0x7f0000000100), &(0x7f0000000000)=0xc) (async) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) (async) r2 = open(&(0x7f0000000000)='./file0\x00', 0x200, 0xc0) ioctl$WSMOUSEIO_SCALIBCOORDS(r2, 0x81205724, &(0x7f0000000100)={0x7ff, 0xa4, 0x9, 0x0, 0x80000001, 0xa1b0, 0x40010002, 0x10, [{0x0, 0x2890, 0x5, 0x71002}, {0x6, 0xe, 0x8, 0xfffffff9}, {0x101, 0x6, 0xfffffffc, 0x9}, {0x4, 0x10001, 0x8012, 0x7}, {0x401, 0xffff, 0x2800, 0x7}, {0x1, 0x0, 0x203, 0x9b}, {0xcde, 0x80000001, 0x4d1, 0x6}, {0x1000009, 0x8, 0x14, 0x5910}, {0x6000001, 0x82, 0x6, 0x6}, {0x3, 0x8005, 0x40, 0x4}, {0x1ce, 0x800, 0xda9d, 0x3}, {0x10, 0xa, 0x8, 0x2000}, {0x8, 0x7, 0x4, 0x8}, {0x0, 0xfffffffa, 0x0, 0x7}, {0x6, 0x20000005, 0x5, 0x4}, {0x0, 0x0, 0xfff, 0x30003}]}) r3 = open$dir(&(0x7f0000000000)='./file0\x00', 0x20000, 0x18b) (async, rerun: 32) r4 = socket(0x2, 0x3, 0x0) (rerun: 32) sysctl$kern(&(0x7f0000000040)={0x1, 0x23}, 0x2, 0x0, 0x0, 0x0, 0x0) (async) close(r4) (async) close(r2) setsockopt(r4, 0x1000000029, 0x31, 0x0, 0x0) (async) sendmsg$unix(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000180)=@file={0x1, './file0\x00'}, 0xa, 0x0, 0x0, &(0x7f0000000680), 0x0, 0x5}, 0x0) (async) r5 = semget$private(0x0, 0x0, 0x620) (async) mknod(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x51fe) (async) r6 = open(&(0x7f0000000000)='./file0\x00', 0x80, 0x2) fcntl$setstatus(r6, 0x4, 0xc4) (async) ioctl$BIOCSETIF(r6, 0x8020426c, 0x0) semop(r5, &(0x7f0000000380)=[{0x0, 0x2acf, 0x800}, {0x1, 0x80, 0x1000}, {0x2, 0x1, 0x800}, {0x1, 0x1ff, 0x1800}, {0x3, 0x8, 0x1000}, {0x0, 0x400, 0x800}], 0x6) (async) semctl$SETALL(0x0, 0x0, 0x9, &(0x7f0000000240)=[0x40, 0x9, 0x9, 0x2, 0x65c, 0x6b, 0x5]) (async) r7 = fcntl$dupfd(r3, 0x3, 0xffffffffffffff9c) munmap(&(0x7f00000a1000/0x2000)=nil, 0x2000) (async, rerun: 64) write(r7, &(0x7f0000000100), 0xfffffe5d) (async, rerun: 64) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) ioctl$VNDIOCSET(r2, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) (async) ioctl$VNDIOCSET(r2, 0x80044403, &(0x7f00000001c0)={0x0, 0xfffffffffffffffd, 0x0}) 1.566265954s ago: executing program 5 (id=637): r0 = socket(0x18, 0x2, 0x0) close(r0) (async) r1 = socket(0x2, 0x3, 0x0) mknod(&(0x7f0000001040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0xd02) r2 = socket(0x2, 0x3, 0x0) (async) execve(0x0, &(0x7f00000001c0)=[0x0, &(0x7f00000000c0)='/dev/speaker\x00'], 0x0) r3 = socket(0x1, 0x2, 0x0) r4 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) ioctl$BIOCSETIF(r4, 0x8020426c, &(0x7f0000000040)={'tap', 0x0}) (async) ioctl$BIOCSETF(r4, 0x80104267, &(0x7f0000000000)={0x4, &(0x7f0000000180)=[{0x1, 0x2, 0x0, 0x20000003}, {0x40, 0xe, 0xb}, {0x7, 0x9, 0x9, 0x2}, {0x3c56, 0x3, 0x6, 0x7}]}) (async) syz_emit_ethernet(0x1000e, &(0x7f0000000080)=ANY=[]) (async) syz_emit_ethernet(0x42, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa08004806003400640003069d9078ffffffffffffffff070b1eac1400aa7f800001000e009078000b0008000003fc0000000400000009"]) (async) ioctl$FIONREAD(r3, 0xc0106924, &(0x7f00000001c0)) r5 = kqueue() kevent(r5, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) (async) ioctl$FIONREAD(r2, 0xc0206921, &(0x7f00000001c0)) r6 = socket(0x2, 0x2, 0x0) ioctl$FIONREAD(r6, 0x80206913, &(0x7f00000001c0)) (async) close(r1) (async) r7 = socket(0x18, 0x2, 0x0) setsockopt(r7, 0x1000000029, 0x33, &(0x7f0000000080)="031000086941e7c5ce5876778f181b12184c256b1ca6f583b03f959b5253027d08b90779da6a56ed10c81a19096dc2baca0179cdd9967a674820f89c4daa330fee01c76728490d1851d4ab60059f6a3f7cc45ac10500000078bbf169d0632f4ce57a508bc82acd00000000140e0343395b00737a4a00000084fc604fd6642787b31558a39bd20000", 0x88) (async, rerun: 64) r8 = syz_open_pts() (rerun: 64) ioctl$TIOCSBRK(r8, 0x2000747b) (async, rerun: 64) ioctl$TIOCSWINSZ(r8, 0x80087467, &(0x7f0000000040)={0x5, 0x7, 0xa, 0xf}) (rerun: 64) setsockopt(r1, 0x1000000029, 0x31, &(0x7f0000000140)="b211d7170d816685c8e360f2fa41c1a0946988b272d2dd3dc90142a84231a746e337b372e93320cff6669cbe7868de45ed3fc33719ca6df71ecec8a918458b2c10a1f8c66653b276e180e9cb9b21f9982230f575295d48889c9a920796b2dd92fc8575680b37ba955d2c15e6d7c9198ed900ab006ddfb67869b51a2216114d1ece85f593e74035f5bc054eb1dbddf42a", 0x90) (async) semctl$IPC_SET(0x0, 0x0, 0x1, &(0x7f00000000c0)={{0x8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40, 0x200}, 0x5, 0x8001, 0x24b83c97}) r9 = socket(0x18, 0x3, 0x0) connect$unix(r9, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) (async) getsockname$inet(r9, &(0x7f00000000c0), &(0x7f0000000000)=0xffffffffffffff35) connect$unix(r0, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) 1.513474482s ago: executing program 1 (id=641): chmod(&(0x7f0000000040)='.\x00', 0x35e) (async) chmod(&(0x7f0000000040)='.\x00', 0x35e) setuid(0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x2, 0x1, 0x400000000000, 0x100000403}) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') faccessat(0xffffffffffffffff, &(0x7f00000000c0)='./file0/file0/..\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) mkdir(&(0x7f0000000080)='./file0/file0\x00', 0x183) rename(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00') mkdir(&(0x7f0000000100)='./file0\x00', 0x100) mkdir(&(0x7f0000000180)='./file0/../file0\x00', 0x1c1) mkdir(&(0x7f0000000340)='./file0/file0/..\x00', 0x153) unveil(&(0x7f00000007c0)='./file0/../file0\x00', &(0x7f00000000c0)='c\x00') unveil(&(0x7f0000000200)='./file0/file0\x00', &(0x7f00000001c0)='x\x00') mkdir(&(0x7f0000000240)='./file0/../file0\x00', 0x110) (async) mkdir(&(0x7f0000000240)='./file0/../file0\x00', 0x110) openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x0) (async) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x0) mknod(&(0x7f0000000480)='./file0\x00', 0x6000, 0x400) open(&(0x7f0000000040)='.\x00', 0x0, 0x0) (async) r0 = open(&(0x7f0000000040)='.\x00', 0x0, 0x0) openat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) (async) openat(r0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) (async) open$dir(&(0x7f0000000080)='./bus\x00', 0x0, 0x0) mkdir(&(0x7f0000000280)='./file2/file0\x00', 0xc1) mkdir(&(0x7f0000000300)='./file2/file0\x00', 0xc2) sysctl$net_inet_divert(&(0x7f0000000000)={0x4, 0x2, 0x102, 0x2}, 0x4, 0x0, &(0x7f0000000080), 0x0, 0x0) (async) sysctl$net_inet_divert(&(0x7f0000000000)={0x4, 0x2, 0x102, 0x2}, 0x4, 0x0, &(0x7f0000000080), 0x0, 0x0) sysctl$net_inet_ip(&(0x7f0000000040)={0x4, 0x2, 0x0, 0x1a}, 0x4, 0x0, 0x0, 0x0, 0x0) (async) sysctl$net_inet_ip(&(0x7f0000000040)={0x4, 0x2, 0x0, 0x1a}, 0x4, 0x0, 0x0, 0x0, 0x0) rmdir(&(0x7f0000000140)='./file0/file0\x00') mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$net_inet_tcp(&(0x7f0000000040)={0x4, 0x2, 0x6, 0x19}, 0x4, 0xfffffffffffffffe, &(0x7f0000000080)=0x42, 0x0, 0x0) socket(0x1, 0x5, 0x0) socket(0x2, 0x2, 0x0) 1.458473508s ago: executing program 5 (id=642): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r0, &(0x7f00000002c0)="ed", 0x1) recvmmsg(r1, &(0x7f0000000880)={&(0x7f0000000080)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000540)=""/185, 0xb9}], 0x1, 0x0}}, 0x10, 0x2042, 0x0) fcntl$setstatus(r1, 0x4, 0x4) sysctl$net_inet_ip(&(0x7f0000000040)={0x4, 0x2, 0x0, 0x20}, 0x4, &(0x7f00000004c0)="84793b0fdbaee0137a7e9cec2a2516deb50aad2f014f5d3e687dc7364c65", &(0x7f0000000000)=0x1e, &(0x7f0000000480)="01000000", 0x4) recvmsg(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) 1.453454401s ago: executing program 1 (id=645): ioctl$TIOCSTSTAMP(0xffffffffffffffff, 0x8008745a, &(0x7f0000000040)={0x20e89, 0xd}) syz_emit_ethernet(0xe, &(0x7f0000000000)=ANY=[@ANYBLOB="0000000000000001"]) writev(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000000)="6dc100167f", 0x5}], 0x1) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r0 = socket(0x2, 0x1, 0x0) connect$unix(r0, &(0x7f0000000000), 0x10) setsockopt$inet_opts(r0, 0x0, 0x1, &(0x7f0000000040)="27913c11b3c9e91fbdf59c32417020e3a81e536e", 0x14) shutdown(r0, 0x1) fchmod(r0, 0x40) 1.295524053s ago: executing program 1 (id=649): select(0x40, &(0x7f0000000180)={0xffffffffdffffff9, 0x44809e9d, 0xffffffffffffffff, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x2000000000000044}, 0x0, 0x0, 0x0) syz_open_pts() writev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000080)="76e5eac907f9ccf7a251ceddcec7d6aa45cffe2c63a56077123a276d3ba4e9d17eb3eb5db12a3783a8e0620d357de1fe04fa9465b5bd1286e9624dec06a00c222f", 0x41}], 0x1) ioctl$TIOCMBIC(0xffffffffffffffff, 0x8004746b, 0x0) rename(&(0x7f0000000100)='./file0\x00', 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) symlink(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='.\x00') mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000c00)='./file0\x00', 0x0, 0x0) fchdir(r0) ioctl$TIOCSETA(0xffffffffffffffff, 0x802c7414, &(0x7f00000001c0)={0xf66b, 0xfffffffe, 0x401, 0x1fffff05, "9cdc45c6307e8b61c7d61df7fb7f6c00005fdd04", 0x707, 0x2}) chmod(&(0x7f0000000040)='.\x00', 0x35e) setuid(0xee01) mkdir(&(0x7f0000000400)='./file0\x00', 0xc2) rename(&(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='./file2\x00') r1 = kqueue() kevent(r1, &(0x7f00000000c0), 0x8, &(0x7f00000001c0), 0x15, 0x0) ioctl$FIONREAD(r1, 0x4004667f, &(0x7f0000000040)) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x637e) r2 = open(&(0x7f0000000080)='./file0\x00', 0x40, 0x100) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x4, 0x1, 0x7, 0xc, 0x3, 0x80, 0x8, 0x10, [{0x0, 0x7, 0x4, 0x4}, {0x7, 0xd5, 0x2, 0x7}, {0x6, 0x9, 0x100, 0xaf5}, {0x8, 0x8, 0xb, 0x3}, {0x80000007, 0xfffffff8, 0xfffffff7, 0x9}, {0x20000002, 0x7, 0xffffffff, 0x9c}, {0x80000cdc, 0xffffffff, 0x5, 0x71}, {0x2000a, 0x803, 0x14, 0x8}, {0x0, 0x81, 0x1, 0x9}, {0x3ff, 0x8001, 0xc7, 0x87}, {0x4, 0x5, 0xd, 0x10aeb}, {0x805, 0x40, 0x2, 0x5}, {0xfff, 0x2, 0x80005, 0x3ff}, {0x29a71717, 0xfffffffa, 0x3, 0x100006}, {0x4, 0x9, 0x7}, {0x0, 0x3, 0x4, 0x30000}]}) select(0x40, &(0x7f0000000180)={0xfffffffffffffff7, 0x44809e9d, 0x7, 0xfffffffffffffffd, 0x2800000000000000, 0x181c, 0x8, 0x8000010}, 0x0, 0x0, 0x0) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x2) ioctl$FIONBIO(r2, 0x82907003, &(0x7f0000000140)=0x1) 1.184567204s ago: executing program 1 (id=651): pwritev(0xffffffffffffffff, &(0x7f0000000080), 0xfffffffffffffe3, 0x99b) socket(0x2, 0x3, 0x11) r0 = open(&(0x7f0000000040)='./file0\x00', 0x18289, 0x110) select(0x40, &(0x7f0000000000)={0xfffffffffffffffd}, 0x0, 0x0, 0x0) write(r0, &(0x7f0000000080)="b9", 0x1) 1.17802371s ago: executing program 1 (id=653): r0 = syz_open_pts() close(r0) syz_open_pts() r1 = msgget$private(0x0, 0x221) getsockopt$sock_cred(r0, 0xffff, 0x1022, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) r3 = getegid() r4 = getuid() setreuid(0xee00, r4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r5, 0xffff, 0x1022, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000280)=0xc) setrlimit(0x8, &(0x7f0000000000)={0x42, 0x62}) r7 = syz_open_pts() ioctl$TIOCSTOP(r7, 0x2000746f) open(&(0x7f0000000040)='./file0\x00', 0x18289, 0x110) select(0x40, &(0x7f0000000180)={0xfffffffffffffffd, 0x44809e9d, 0xffffffffffffffff, 0x1, 0x2000000000000000, 0x181c, 0x8, 0x9}, 0x0, 0x0, 0x0) setgroups(0x1, &(0x7f0000000000)=[r6]) r8 = getpgrp() r9 = getpgid(0x0) msgctl$IPC_SET(r1, 0x1, &(0x7f0000000180)={{0x7ff, r2, r3, r4, r6, 0xa0, 0x40}, 0x4, 0x4, r8, r9, 0x0, 0x5, 0x400, 0xf}) write(r0, &(0x7f00000007c0)="16bb4b", 0x3) ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000040)={0x1000f66c, 0x8, 0x9, 0x5fffff5f, "9cdc452e307e0804002f4c0000002f9e68cd3304", 0x3, 0x9}) r10 = open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x186) mmap(&(0x7f000028c000/0x1000)=nil, 0x1000, 0x1, 0x2016, r10, 0x0) r11 = open(&(0x7f0000000000)='./file0\x00', 0x102b8, 0x1ca) syz_emit_ethernet(0x22, &(0x7f0000000040)={@random="8d7eaa32cc8a", @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x3a, 0x0, @multicast1, @multicast1}}}}}) setsockopt$inet6_MRT6_ADD_MIF(r11, 0x29, 0x66, &(0x7f0000000080)={0x8001, 0x0, 0x4, 0xb5a5}, 0xc) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) lchown(&(0x7f0000000200)='./file0\x00', r4, r3) open(&(0x7f00000000c0)='./file0\x00', 0x615, 0x0) 1.173006248s ago: executing program 7 (id=654): poll(&(0x7f0000000000)=[{0xffffffffffffffff, 0x10}], 0x1, 0x887e) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) execve(0x0, 0x0, 0x0) r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0x240, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000240)={'tap', 0x0}) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000080), 0x8, 0x0) ioctl$TIOCCBRK(r1, 0x2000747a) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x7, 0x1, 0x4, 0x2}, {0x87, 0x5, 0x81, 0x241b06}, {0x6, 0x2, 0x4d, 0x1}]}) sysctl$kern(&(0x7f0000000040)={0x1, 0x52}, 0x2, 0x0, 0x0, 0x0, 0x0) syz_emit_ethernet(0x1000e, &(0x7f00000000c0)=ANY=[]) 1.0811444s ago: executing program 7 (id=657): sysctl$kern(&(0x7f00000000c0)={0x1, 0x14}, 0x2, &(0x7f0000000000)="4ba7841143", &(0x7f0000000040)=0x5, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$kern(&(0x7f0000000000)={0x1, 0x1b}, 0x2, &(0x7f0000001940), &(0x7f0000000040)=0xffffffffffffff2a, 0x0, 0xffffffffffffffb7) r0 = semget(0x0, 0x1, 0x11) sysctl$net_inet_ip(&(0x7f0000000080)={0x4, 0x2, 0x0, 0x11}, 0x4, 0x0, 0x0, 0x0, 0x0) semctl$GETZCNT(r0, 0x0, 0x7, &(0x7f0000000000)=""/85) setuid(0x0) stat(&(0x7f0000001080)='./file0\x00', &(0x7f00000010c0)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = msgget$private(0x0, 0x224) msgrcv(r1, &(0x7f0000001240)={0x0, ""/189}, 0xc5, 0x2, 0x800) r2 = kqueue() kevent(r2, 0x0, 0x80000000, 0x0, 0x9, &(0x7f0000000240)={0x1, 0x8}) msgget$private(0x0, 0x0) semctl$GETVAL(r0, 0x0, 0x5, &(0x7f0000000080)=""/4096) setuid(0xffffffffffffffff) semget(0x0, 0x2, 0x281) r3 = openat$wsdisplay(0xffffffffffffff9c, &(0x7f0000001140), 0x10000, 0x0) ioctl$WSDISPLAYIO_SETSCREEN(r3, 0x80045756, &(0x7f0000001180)=0xffffff00) geteuid() mprotect(&(0x7f00003db000/0x4000)=nil, 0x4000, 0x2b2a98b3669ad904) getegid() sendto$unix(0xffffffffffffffff, &(0x7f0000000000)="b1000504000004000000000007000000331c13fecea10500fef96ec0c72fd3357ae30200004e3039d2d236acf20b7804be38164991f7c8cf5f882b297be1aa0500000051e2f0ad3ebbc257699a1f139b67", 0x51, 0x0, 0x0, 0x0) sysctl$kern(&(0x7f0000000040)={0x1, 0x3f}, 0x4, &(0x7f0000000040), 0x0, 0x0, 0xfffffffffffffda3) getuid() ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc2585601, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="89000000ffff000001"], 0x9}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r5, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=""/240, 0xf0}, 0x0) sendmsg(r4, &(0x7f0000000380)={0x0, 0x32c, 0x0, 0x0, &(0x7f0000000000), 0x90}, 0x0) 957.554131ms ago: executing program 7 (id=659): ioctl$VMM_IOC_RESETCPU(0xffffffffffffffff, 0x82405605, &(0x7f0000000100)={0x0, 0x0, {[0xfffffbeffffffffb, 0x1, 0x2, 0x2, 0x8001, 0xfffffffffffffffe, 0x6, 0xffffffffffffffff, 0x0, 0x2f00, 0x0, 0x3, 0xffffffffffffffff, 0x400000000000000, 0x0, 0xffffffffffffffa5, 0x82, 0xce5], [0xfffffffffffffffe, 0x80000001, 0xfffffffffffffff9, 0x2, 0x0, 0x7b98, 0x1fe, 0x0, 0xfffffffffffffffe], [0x5ad8, 0x2, 0x40000002, 0x0, 0xfffffffffffffffb, 0x11003, 0x4], [0xd, 0x20000000000, 0xfffffffffffffffc, 0x8040000100000000, 0xfffffffffffffffa, 0x4], [{0xdb6e, 0x4, 0x0, 0x40007d06}, {0xfffc, 0x2, 0x5}, {0x0, 0x0, 0xfffffffe, 0x80}, {0x3, 0x4b72, 0x3, 0xffffffffffffffff}, {0x0, 0xfffff3d8, 0x0, 0x8}, {0x0, 0x2003, 0x40000, 0x6}, {0x6b7}, {0x0, 0x965, 0xfffffffc, 0x9}], {0x2000, 0x7, 0x5}, {0x29, 0x6, 0xb0, 0x2}}}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg(r0, &(0x7f0000000080)={0x0, 0x80000d}, 0x48, 0x402) r1 = openat$pf(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) writev(r1, &(0x7f0000000180)=[{&(0x7f0000000440)="2e06b5a54fdc15d0e5ba5cd619e395d842161263a5bcf8d360b109113dd229c0dd47d6ff4f038bc8f40206bf8a1ef55ba04d8d4e4174e29e744d8606170795a2edaf3456112807f6d55fd9c3815257c10e07e8f0be3a7366f8123a42cb43f4302bf6b149e9b9bab6116b11b8ae693250f7fa8080cd8a2fc7c7e4ebf5c106c80fd386c7786c0421183de7b10dbde8040d96f51522423ca8e0f70989e1530cd2eaf7faaad41584384bf407ed7bed944e099fd18b59c86af22bb45fe92b05087191e530bc83a9e0975fc2a0f5988e9ae663b4fe25f69d661eb4ad0842a7be35dbe21e8911da844c7dce8d80f66713e13d96b30d5b4a13fb15282cf2a61a24880049b94a6e46bce752ff3230cd36789c42b37db904fd77060a84ca071839da23ef66bb45a18c9face3b3982d2edef1234405ec89e3ac812208780a2866cf52a8bbbe80b77e07f53d751ea0da7185414c403df8282d22a45b8a5ee7dc9b534106d98bb65aea3af32dea9a7a9881e7fdfbb46801408f1b94018abf7d5816d4e0344ab9dd8a6d43a2503180582f6d553e1a81fe4e8d68fafcd095560e83feda2fcd68d73fc71d7ff20511859f1b895d1a3f42970f1fb4dd61487901de9d5efcb92d63466e92bbe485aaf63988e255cbb607ac7ff9ee30732dd2482be6280b8946e32cf0ec48fc7c89e53c4aecb4af7af69e0dc04dd17405ce02898adf547f851e885964f836ec6b04d77f14d85025e415a01553d6b7e5dd946be3ea735515a624f74e2c09b863881e4412135ecbdd1f1ec73762d2b1bcb0f04f0bd1369f9c374d73fb9cc7465bbdb5e77078870423340ea32c9f49980888427f49eb9d4daf99a87d6d6e44aecd7dfeba2c6f1844b2b537d6de1ba1c8bd90f7ec014b4c84a9bfba26bb92b0d740de1e20c97ec18417a1f3d68fea076ad9aeb884efa6cedf35845dd4bc6eae82e37a2304c76ab6e7467f2d868e76df28b7dbba656b0998da5d54a00e706e8dc0699e961bfe8b6cef550c66eb7e5a40ef12896fb571be1d73d817d17e177f06c0679c784feb85129836c8724bf0c3e6026a3eb831c5335475950287c988059987f9198a074e7d92cdcf6c196d91f9368490b5d5f7033374c27b2aed8732fb84933a8fbe2bcaa68b68eea3400b5b022a2fae01ef3df9bf1ba0739b54faaa56ebe38c40fc6d1d99522c07af188a", 0x34e}], 0x1) ioctl$TIOCSETA(r1, 0xc0504417, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x400003, "0000000000000000000100", 0x15, 0x10006}) 955.550152ms ago: executing program 7 (id=661): mprotect(&(0x7f0000034000/0x3000)=nil, 0x3000, 0x0) mknod(&(0x7f0000000040)='./bus\x00', 0x2000, 0x3200) r0 = open(&(0x7f0000000080)='./bus\x00', 0xf, 0x1) pread(r0, &(0x7f0000000040)="3cd15db7c30016", 0x50cc00, 0x0) munmap(&(0x7f000000e000/0x400000)=nil, 0x400000) 954.752256ms ago: executing program 7 (id=662): sysctl$kern(&(0x7f0000000040)={0x1, 0x57}, 0x2, &(0x7f0000001940), &(0x7f0000000100)=0xfffffffffffffe70, 0x0, 0x0) mknod(&(0x7f0000000580)='./file0/file0\x00', 0x2000, 0xd02) r0 = open(&(0x7f00000004c0)='./bus\x00', 0x0, 0x0) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x10000, 0x0) preadv(r1, &(0x7f0000000340)=[{&(0x7f0000000600)=""/193, 0xd3}, {&(0x7f00000000c0)=""/61, 0x43}, {&(0x7f0000000080)=""/49}], 0x4a, 0x20000040) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4, 0x10, r1, 0x0) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) r2 = getpgid(0xffffffffffffffff) fcntl$lock(r0, 0x8, &(0x7f0000000440)={0x1, 0x1, 0x100000000, 0x3, r2}) open(&(0x7f0000000400)='./bus\x00', 0x10, 0x20) r3 = open(&(0x7f00000005c0)='./file0\x00', 0x80, 0x2a) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x7ff, 0x17, 0x2100007, 0x101, 0x80000001, 0x80000001, 0x10001, 0x10, [{0x0, 0x8, 0x4, 0x71000}, {0x8, 0x9, 0x8, 0xfffffff9}, {0x8, 0xf86, 0x0, 0x9}, {0x1, 0x800, 0x8007}, {0x401, 0x200726, 0x2800, 0x7}, {0x2, 0xa, 0x3, 0x99}, {0x6, 0x3, 0x4f8, 0x6d}, {0x6, 0x300, 0x5c, 0x8}, {0x2, 0x82, 0x5, 0x9}, {0x4, 0x8001, 0xd1b, 0x8b}, {0x1ce, 0x10001, 0xc, 0x3}, {0x7ff, 0x9, 0x0, 0x9}, {0xb8c, 0x4, 0x8, 0x4}, {0x29a71717, 0x7b, 0x1, 0x6}, {0xc, 0x1ff, 0x5}, {0x8000, 0x1, 0x1002, 0x30004}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$VNDIOCSET(r3, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) unveil(&(0x7f00000003c0)='./bus\x00', &(0x7f0000000240)='r\x00') openat$vmm(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) r4 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) ioctl$BIOCLOCK(r4, 0x20004276) ioctl$FIONREAD(r4, 0x4004667f, &(0x7f00000002c0)) setreuid(0xee00, 0x0) ioctl$VNDIOCSET(r3, 0x80044403, &(0x7f00000001c0)={0x0, 0xfffffffffffffffe, 0x0}) select(0x40, &(0x7f0000000000)={0x40000000000096, 0x5, 0x4, 0x2, 0xd13, 0xfc2, 0x40000000001ff, 0x7}, 0x0, 0x0, 0x0) r5 = socket(0x18, 0x2, 0x0) setsockopt(r5, 0x1000000000029, 0xa, &(0x7f00000002c0)="03000000", 0x4) setsockopt(r5, 0x1000000000029, 0xc, &(0x7f0000000000), 0x14) sysctl$kern(&(0x7f0000000000)={0x1, 0x42}, 0x6, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) ioctl$VNDIOCSET(r0, 0x40086475, &(0x7f0000000500)={0x0, 0x0, 0x0}) 766.98056ms ago: executing program 6 (id=669): sysctl$hw(&(0x7f00000000c0)={0x6, 0xc}, 0x2, 0x0, &(0x7f0000000080), 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) ioctl$TIOCSETA(0xffffffffffffffff, 0x802c7414, &(0x7f0000000080)={0xffffffff, 0x1, 0xe, 0x7fb, "2cf9892af9a590e4cb52e88608007673f99e5fd7", 0x2, 0x4000a8}) r0 = openat$speaker(0xffffffffffffff9c, &(0x7f0000000140), 0x782, 0x0) r1 = semget(0x0, 0x1, 0x281) setgid(0xffffffffffffffff) getgid() getgroups(0x4, &(0x7f0000000340)=[0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff]) setgroups(0x0, 0x0) setuid(0xffffffffffffffff) semctl$SETVAL(r1, 0x0, 0x8, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) msync(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4) ioctl$SPKRTUNE(r0, 0x20005302, &(0x7f0000000080)={0xa2a5, 0x7fffffff}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sysctl$hw(&(0x7f0000000000)={0x6, 0xc}, 0x2, &(0x7f0000000100)="58b9e99d514ff49616ec2a07bf72ee594ac02d00e7e0876bb016b669ea05423cb03d8ea581f44dc7c36f7e131abacc839e4db0d0a57df48d0845a97fdfe5739647ac6293182ae08872d14e2ae5803ae867ace4d94c0f3ad8cc84a64306734cc6398f5632049a7b486b09410e9d716e16579a7606a8cc5cb6e360a8f80032067959c8c7b1d040ec7e378e53205a0d0852fed1ab9a2db59bec442243d70688d69a9e965d1bd372a1a65025af3ecbe26a68309e4501b77a58edba084eeed10b43e8bcc25cb8d9df64d9155823448f8a6761b54ee506a79d6ecdee87491d6670ef1d180c2de612d8f387a192460000", &(0x7f0000000280)=0xed, &(0x7f00000002c0)="a2098f0b8818ff030000000000000000da5fcca1d2d2ac3cae36733bd2945408cda97f112c7cdb668156d456b40dea0d1cc00add0e364b2638bdd0e90bd39e6eaba6f23c23c655decbc28828593c2ebe8c718d769811adf58be7becfd900"/104, 0x68) sysctl$hw(&(0x7f00000000c0)={0x6, 0x4}, 0x2, &(0x7f0000000280), &(0x7f0000000080), 0x0, 0x0) 693.771158ms ago: executing program 6 (id=671): socket$inet(0x2, 0x2, 0x0) socketpair(0x6, 0x4007, 0xf7, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt(r0, 0xfff, 0xa, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) (async) socketpair(0x6, 0x4007, 0xf7, &(0x7f0000000000)) (async) getsockopt(r0, 0xfff, 0xa, 0x0, 0x0) (async) 692.851726ms ago: executing program 6 (id=673): r0 = socket$inet(0x2, 0x3, 0x2) setsockopt(r0, 0x0, 0x16, 0x0, 0x0) socketpair(0x1, 0x8000, 0x3, &(0x7f0000000000)) 692.586926ms ago: executing program 6 (id=674): r0 = socket(0x800000018, 0x3, 0x0) setrlimit(0x8, &(0x7f0000000980)={0x8, 0x56}) r1 = syz_open_pts() close(r1) syz_open_pts() ioctl$TIOCSETAF(r1, 0x802c7416, &(0x7f00000000c0)={0x6, 0x10101, 0x7, 0x1, "3b082001f78b67af9e3bb0c49d73230100040c00", 0x202, 0xf}) ioctl$FIONBIO(r1, 0x8004667e, &(0x7f0000000040)=0x8a) sysctl$kern(&(0x7f0000000000)={0x1, 0xa}, 0x2, &(0x7f0000000100)="279e466d9e09aafec008a8a8ad4f1c828c9cd9ee7d3b6edfe2535955d8599d2902d99763234a334201d8aa77d01057e32e06a6008586b64edf9ced0199551bc266da17b384ee561027c165594b9ce3f438c9823b1b6e1ffa215b09f48e1541eaf774b546409b40fdad8e02e3f3203b8db20ad6b8176aa096a06c7bd742e62d01e47391286ebbedee11dedf48e98952b6fe9106777ed92b8455613a8658b1253feab339b4f3f12e2ff9bc259f382318f9cc8b8a7d14a59026b2a516a5188bccaa2e18409597e31423f3e3f06b5b2ab2511b2dcc9568a883f6c69fa6ddab4f090749", &(0x7f0000000200)=0xe1, &(0x7f0000000240)="49005d6c82c62b51bf1f4bd1e9b3369c2c3050b6171f3f403f35625807650e32669ab64c797fc3291fa2b688162ab91aa6fc64a321ac3571ebdcbce65a4abf8e7f87e7b9067cb49309046b4afcf9c2559b10f82cc7ad3aeffe226c185dc204e64f0905f84dec359afc7da35ad573eeeaec4bed1378190e5e14713224db94a1a79a52245133c21173c39b9267f009a7c15d86b5d703dba07a1e5b97d5b7290bbf4cea83f7484421dac8251136d49749d8d777a88514e89d46585a01d9ff007db000c6994ce4dd0d8603a992f25f75308104f590cfb02c72f6d0a5a16c", 0xdc) writev(r1, &(0x7f0000000700)=[{&(0x7f0000000080)="34eb4cd59e8456ebc0881681c60e1cd9e0bf01b618b3cb934394c5951c1db0fd943a", 0xff99}], 0x1) setsockopt(r0, 0x1000000000029, 0x1b, 0x0, 0x0) 560.029405ms ago: executing program 5 (id=675): mkdir(&(0x7f0000000180)='./file0\x00', 0x14) r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000240)=@file={0xd570d0466b6018f, './file0\x00'}, 0xa) listen(r0, 0x0) accept(r0, 0x0, 0x0) close(r0) execve(0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0/file0\x00', 0x6c) rename(&(0x7f00000002c0)='./file0/file0/..\x00', &(0x7f0000000040)='./file1\x00') 533.590254ms ago: executing program 4 (id=676): semctl$GETALL(0x0, 0x0, 0x6, &(0x7f0000000100)=""/200) r0 = openat$pf(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x409}, 0x3) ioctl$BIOCGFILDROP(r0, 0x40044278, &(0x7f00000000c0)) getsockopt$sock_cred(r0, 0xffff, 0x1022, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0xc) fchownat(r0, &(0x7f0000000200)='./file0\x00', r1, 0xffffffffffffffff, 0x2) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$TIOCSETA(r0, 0xc4504443, &(0x7f0000000740)={0x0, 0x2, 0x0, 0x0, "01d04b0a0047c1d100", 0x4, 0x6}) 526.753906ms ago: executing program 0 (id=677): r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x10000, 0x28) ioctl$VMM_IOC_RESETCPU(r0, 0x82405605, &(0x7f0000000040)={0x3, 0x9, {[0x8, 0x9, 0x9, 0x5, 0x3, 0x0, 0x40, 0x8, 0x9461, 0x5, 0x2, 0x3, 0x8000000000000000, 0x8, 0x200, 0x6, 0x4, 0xffffffffffff7fff], [0x2, 0x5, 0xffffffff, 0x401, 0x7, 0x2a, 0x6, 0xd, 0x8001], [0x9, 0x6, 0x8, 0x4, 0x1, 0xb77, 0x6], [0xd, 0x8, 0x8, 0x7, 0x3ff, 0xc74f], [{0x3, 0x7, 0x2, 0xffff}, {0xfff9, 0x8, 0x3, 0x3}, {0x9, 0x9, 0x5, 0x25}, {0x0, 0x280, 0x7fff, 0x1ff}, {0x6, 0xfffffffd, 0x1, 0x6}, {0x7db, 0x100, 0x9, 0x1ff}, {0x81, 0x3, 0x9, 0x200}, {0x2, 0x81, 0x7, 0x5}], {0x6, 0x80, 0x4, 0x6}, {0x4, 0x2, 0x1, 0x33}}}) ioctl$VNDIOCSET(r0, 0xc0384600, &(0x7f0000000300)={&(0x7f0000000280)='./file0\x00', 0x9, &(0x7f00000002c0)='./file1\x00', 0x8}) getsockopt$SO_PEERCRED(r0, 0xffff, 0x1022, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0xc) setgid(r3) close(r0) ioctl$VNDIOCGET(r0, 0xc4104603, &(0x7f0000000380)={'./file0\x00', 0x6, 0x0, 0x3ff}) rmdir(&(0x7f00000007c0)='./file2\x00') r4 = shmget$private(0x0, 0x2000, 0x54e, &(0x7f0000ffd000/0x2000)=nil) shmctl$IPC_SET(r4, 0x1, &(0x7f0000000800)={{0xc, r2, r3, r2, r3, 0x0, 0x5}, 0x0, 0x81, r1, r1, 0x6, 0x19ea, 0x6}) shmat(r4, &(0x7f0000ffa000/0x4000)=nil, 0x800) r5 = shmget(0x1, 0x2000, 0x381, &(0x7f0000ffa000/0x2000)=nil) r6 = getuid() shmctl$IPC_SET(r5, 0x1, &(0x7f0000000880)={{0x80000000, r2, r3, r6, r3, 0x4, 0xfffa}, 0x1, 0x7, r1, r1, 0x3, 0x5, 0x7ff}) ioctl$WSDISPLAYIO_GETSCREENTYPE(r0, 0xc028575d, &(0x7f0000000900)={0x7, 0x3, './file1\x00', 0xfffffd25, 0xa, 0x93, 0x7f}) link(&(0x7f0000000940)='./file1\x00', &(0x7f0000000980)='./file1\x00') r7 = socket$unix(0x1, 0x1, 0x0) madvise(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x6) writev(r7, &(0x7f0000000ac0)=[{&(0x7f00000009c0)="778267672a039ebbe9a678202a0e61c77c341c17591a2dca4625821cf39428e4288ca2d7ccad110c1a5feb04883421e09b41b922f359d2c875c0a2c9d7a0197617e541eddf3eb1deabe096f949eeac04c7aa9376990148cbbad93e14974e14212877f77871236ca7825d9e20ad70e1495cfcebe200d995956eade319211a6b91d2e2be9ddc935da9bad3e898cc8cf2abb3a0bd32574723b5f849e2295066820bf766f58a401663f6b371ebebea76f7ba92056ab5d257986f88602d50551271e500bbf0270a4ab297fdb6520e853e7073fa585e", 0xd3}], 0x1) ioctl$TIOCSTSTAMP(r0, 0x8008745a, &(0x7f0000000b00)={0x2}) munmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000) r8 = socket(0x2, 0x849710d72f2d9a58, 0x8) ioctl$FIONREAD(r0, 0x4004667f, &(0x7f0000000b40)) chroot(&(0x7f0000000b80)='./file1\x00') mquery(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x1, 0x10, r7, 0x5) kqueue() bind(r8, &(0x7f0000000bc0)=@in6={0x18, 0x0, 0x2, 0x18}, 0xc) mknod(&(0x7f0000000c00)='./file0\x00', 0x2, 0xffffffff) r9 = openat$wsmouse(0xffffffffffffff9c, &(0x7f0000000c40), 0x2, 0x0) mmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1, 0x11, r9, 0xfffffffffffffff9) 523.38197ms ago: executing program 6 (id=678): setrlimit(0x8, &(0x7f0000000980)={0x8, 0x54}) r0 = syz_open_pts() close(r0) syz_open_pts() openat$wskbd(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0) r1 = getuid() lchown(&(0x7f0000000200)='./file0\x00', r1, 0x0) seteuid(r1) ioctl$TIOCSETAF(r0, 0x802c7416, &(0x7f0000000000)={0x40978b, 0x10001, 0xfffffc01, 0x80a1a4, "bb08000100f167d910508bc49d7323000000007e", 0x0, 0xffffffff}) writev(r0, &(0x7f0000000700)=[{&(0x7f0000000080)="34eb4cd59e8456ebc0881681c60e1cd9e0bf01b618b3cb934394c5951c1db0fd943a", 0xff99}], 0x1) ioctl$FIOASYNC(r0, 0x80047469, &(0x7f00000001c0)=0x1) 515.462936ms ago: executing program 0 (id=679): mkdir(&(0x7f0000000100)='./file0\x00', 0x51) (async, rerun: 64) mknod$loop(&(0x7f0000000380)='./file0/file1\x00', 0x40, 0x1) (async, rerun: 64) r0 = socket$unix(0x1, 0x5, 0x0) (async) r1 = geteuid() setuid(r1) (async, rerun: 64) r2 = socket(0x2, 0x3, 0x0) (rerun: 64) close(r2) (async) r3 = open(&(0x7f0000000380)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf7949) writev(r3, &(0x7f0000000280)=[{&(0x7f0000000040)='#!', 0x2}], 0x1) write(r3, &(0x7f0000000180)="092020090900db0000ff4278ad535c2a415642000000005624b77b6a0a", 0x1d) (async) execve(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) (async) r4 = socket(0x18, 0x2, 0x0) setsockopt(r4, 0x1000000029, 0x23, 0x0, 0x0) (async) sysctl$kern(&(0x7f0000000140)={0x1, 0x29}, 0x2, 0x0, 0x0, 0x0, 0x0) (async) sendmsg$unix(r2, &(0x7f0000000040)={&(0x7f0000000000)=@abs={0x1, 0x0, 0x1}, 0x8, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18"], 0x20, 0x409}, 0x4) (async, rerun: 64) bind$unix(r0, &(0x7f0000000040)=@file={0x2, './file0\x00'}, 0xa) (async, rerun: 64) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="28000000ffff000001"], 0x28}, 0x0) listen(r0, 0x0) (async) getsockopt$SO_PEERCRED(r5, 0xffff, 0x1022, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0xc) lchown(&(0x7f00000002c0)='./file1\x00', r1, r6) r7 = socket$unix(0x1, 0x5, 0x0) (async, rerun: 64) ioctl$TIOCSETA(0xffffffffffffffff, 0x802c7414, &(0x7f0000000000)={0x7fff, 0x8, 0x6, 0xa, "98a5dc64ec016855120a6e5a03ed0e3dedffa497", 0x40, 0x80000001}) (async, rerun: 64) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async, rerun: 32) r8 = socket(0x18, 0x2, 0x0) (rerun: 32) setsockopt(r8, 0x1000000000029, 0xb, &(0x7f0000003680)='\x00\x00\x00\x00', 0x4) (async) setsockopt(r8, 0x1000000029, 0xc, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) getpeername$unix(r7, &(0x7f0000000180)=@file={0x0, ""/248}, &(0x7f0000000080)=0xfa) connect$unix(r7, &(0x7f0000000000)=@file={0xd1653077bafa0114, './file0\x00'}, 0xa) (async) close(r0) 509.584848ms ago: executing program 4 (id=680): mknod(&(0x7f0000000000)='./bus\x00', 0x2000, 0x2e00) r0 = socket(0x18, 0x2, 0x0) close(r0) r1 = socket(0x2, 0x3, 0x0) close(r1) (async) r2 = openat$tty(0xffffffffffffff9c, &(0x7f0000000200), 0x800, 0x0) ioctl$TIOCCONS(r2, 0x80047462, &(0x7f0000000240)=0x7f) (async) r3 = socket(0x18, 0x2, 0x0) setsockopt(r3, 0x1000000029, 0x33, &(0x7f0000000080)="031000086941e7c5ce5876778f181b12184c256b1ca6f583b03f959b5253027d08b90779da6a56ed10c81a19096dc2baca0179cdd9967a674820f89c4daa330fee01c76728490d1851d4ab60059f6a3f7cc45ac10500000078bbf169d0632f4ce57a508bc82acd00000000140e0343395b00737a4a00000084fc604fd6642787b31558a39bd20000", 0x88) (async) setsockopt(r1, 0x1000000029, 0x32, &(0x7f0000000140)="b211d7170d816685c8e360f2fa41c1a0946988b272d2dd3dc90142a84231a746e337b372e93320cff6669cbe7868de45ed3fc33719ca6df71ecec8a918458b2c10a1f8c66653b276e180e9cb9b21f9982230f575295d48889c9a920796b2dd92fc8575680b37ba955d2c15e6d7c9198ed900ab006ddfb67869b51a2216114d1ece85f593e74035f5bc054eb1dbddf42a", 0x90) (async) r4 = getuid() semctl$IPC_SET(0x0, 0x0, 0x1, &(0x7f00000000c0)={{0x2, r4, 0xffffffffffffffff, 0x0, 0x0, 0x40, 0x200}, 0x5, 0x8001, 0x24b83c97}) (async) r5 = socket(0x18, 0x5, 0x0) connect$unix(r5, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) (async) getsockname$inet(r5, &(0x7f00000000c0), &(0x7f0000000000)=0xffffffffffffff35) (async) connect$unix(r0, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) (async) write(r0, 0x0, 0x0) (async) ktrace(&(0x7f0000000040)='./bus\x00', 0x1, 0x103a, 0x0) (async) sysctl$vm_swapencrypt(&(0x7f0000000040)={0x7, 0x2}, 0x3, 0x0, 0x0, 0x0, 0x0) 508.549791ms ago: executing program 0 (id=681): setrlimit(0x1, &(0x7f0000000000)={0xfffffffffffffffd, 0xffffffffffffffff}) r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x186) r1 = open(&(0x7f0000000040)='./file0\x00', 0x18289, 0x164) write(r1, &(0x7f00000001c0)="397c3c854b053568919c0ab51b3a01fcb8afd84fa45955e66b813f6c4fea5af04c9a2dfee8743f25e171d59792bd75e7d07db917c7c1bcb4c22a55ac000000000000", 0x42) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x2012, r0, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) writev(r2, &(0x7f0000000140)=[{&(0x7f0000000500)="3dc899cfe93fc20d04dd833bcdfcad153c2d2cf5f956ed12ed17cfe3bfac5bb39a56b2c78ed17af69fd66c8bfeddaef56648ea15011bc191a1e65c012a70dee5b83bf57dfec614207f98c7d8d011fcf063056c66eb27430002b486ac36769a395b53e356220395e946b28ea57b6a901aa1640a5625a40bedd4ac9406dc2847ccce02812e7aa56691a1d221a84799aa0008889ea081b84e135f301b0039a00d71a5afc03613c5f50389faafbaebf75723fba90e4da9d539681dc3a13509e1a44066796dde1574129764f204665eddd8c551c70ed3c58497d076d4d31da337568b406c348216bb4af978e74455a74366a8c010a7e2222fac4cfdd1594566ada2cdd9de0a269214d691ddb27ca4f25b53f4378a3149836f651da84687b7dd091f493102e64b25e3c6a9666eb820f00f01ab3a2ce86c110fa178914a266d59ac88933b783a08d4a9b5bcc5eb5b3a8d065f490cb9e04b9890e73eb2b365b524445ceee2bf6739b8c1f4bb4f7a1ccf20e2f97600b9d2751c692cc9064b7c416e54333fd6595e3395bb3df0b11a70f31d4df20596782f1c30e382edb8e2ca8bbb54407c61a32f08e07250916b0673d7750c652c7ffce0441ce505f54a0e6a69117b7a271f7689edcac81067369e244c5c814447c5bbbbdc27ca594200487df4b06942bcb0b7e0216ce9c3a5007ffa8abc7fe2125c3481f0291da7d15054cc28b271477f874a17c0eda6e616181d77460b222dc4d1c02390cf18d59da1e38410142468d865e3e022065930128c207c1f7a0b09c63106d3ecf594bfa2a32d48a6846d717e0ae200e6974a1d970103784cae3facede6a6febc6b6292e8e575a859c09ac89d12a689c98a5a9eeb1b36ef33b2d159981b0fb46190a6d4e2d21e5edb7b7b9694ccb28161469760cb9f72d67a1e1c499a87c06f5f4e574cdfd70e1c9a64fb33ab418bf52de24403028680ba9b9cb744a382ce0a1a2f23735246f2b3aa4d0f46c07f63530347b1cf4ba8d9b3e5d3a1961c8b29ccaf91d5b5e413cba40174a34d134946e936828d5bfb1421f1c58d5b6a4b444e5762d9bafd22d51c80342ac9f188c11d6a95b51e2130cc000fb81f099542299697c095260e04d9ba538028b063943e3e9e3904e2b03990a64ae2edede9ba9f73b7a6a79e29a6e6603d1f57d19749336688e9a83f8e3889e783efeaeb15328fb2c5231643971a695a48dff9500c86cbf0cc90d041f4709b611a9ab5138e002744ef0d39f0784631a3eecc3cd21b8b9b015ad94456503b508b3f4eeb7d26d0c0b51e9270e70ff115c6e02f27a6af8412c1c84308041412cb3248a9a1c345406421d68ebdc983b6b5ec36dedff9a62663ea08c3dc24dfc2cd62c1d38d4786467a52d86f6d747bd597241a223906e06c76e95d626acfc667ff84bec14f67a9e38b78621a1a047b14dddfacad19cdd8ccee735738d42a4c692949f3f54090f57185a262877abb146b3f366920349a31b4b8b2836289a68e45a2fe06af026cf7284ffa1bc6035e24b0820d9bfa4c2fa99a72809523906a432a26e1eaf99f3ae3f37eb456b2074f11df8d56103561316b9d7ca673b3c9fd59b038e1a153022714de46ef809ca9a5df96541f712fbf1eecf4e40866f5666a020566adc369d846994d926eee4f6e04f9f3689931c4bb5cfb31b3c19bb6dd8d7f10f48e128e6ed494952b117e33a59aecfa87738b0844696158e6edeb61e95bb59eeda41fe9b03992c135174b9869b006b2e12b3e3d4f23db52f8fbb41f07cd401a486d9f383e83a1682ce549acbab7af9d751b1e22bd8312eb6f81a6455e1d060295987a49655d715a9af88e875b487c925bdcf34105865075d4d8a5aa394907bc45f31c3cc2cab7bdde856115373f8ba21147007b534f7f406f39309d545f5939d174d22956b77beee9c9e26fde8d8c1946a61515c390c2a411e8490cd1287fdddf9c0e2f3ff6749434136709dad801336a8b62c90465bb521ce528847f59df6f3d9e025f1ca9d88b689baf0e948f10e965a4cd1a3a6f90ccb31b58968ffd3d82dbeb881cb0d18e8be378e4b2f974a8e86b3d6e0bde7b5a6086f8a14e759a0b875ba20d411cd26a889cd5fa255162a2e641dc715cbbccc42dc390f18fefbaeb573d217a29ba75f49c07178e240716bf55e1299dc7dfee08b429f52951b0cec97ad0bec5bfe603c3760d450f640fe2d4bceecb765a430b84d444a3bb6aab3b0a4af51caf81888bcccbc8ad47121eb41f9ee05f155643a2362da73ce8cce5fea68a26cf0950e2fc330bb9d2534aa1d07337187e21ebf72f836a624001b7992bf6b5623a9c56a5b8014747736fc4c8e594bf1448bd42ca70ab2d46b875f0af681ea432703a6436fb8e0b4c37ab2ce2a309627cd8994f8fc6434a0cfdbf3f78d7b937ca509d6c541d630e810acd60e5a0dccad8eb20ea4d1b6e0a31572caeaf5325e0c90d917032f359a15006954bf454305fa7cdd1cd5f08c64e9102cb618f5467099404454aa25419579cb1df6094e8ad53f06fe53586b6a6a85da3cd6bb28627b4e4f3b80c9b748433c5a728cfec9dc950ed5bc60929475baa64f8a6f8c0c480c2610eb42794d5cdbaec8f3b251ab1edec75335afea464ddc5c67ccd4fe05ecf670c809854dae40a6213f0e8a283959b1ca545f2c7d3f4e8a38c6017b268a7d209cf92c8864968891e62f0c75dff15bd5192567ba1ddf62ed620ec1da80ecfa1d9b230857f0c812d89b2a8cead2f3a0a2feb33eb8eb4b63cfd447dd4008b3cdcdbd64f01ef060ab52c14ee6c9ecc05f100dee06560fd17c274f6cb179e88657dbb67e71b5fe0c2afa21e99600687b0878f6b2bd795d6ed467686798b14a4d4c36dfdaa2dee7638942eea40105ff0a03dcdad611f7fb93321cc72f4476e5dd16a893f798b950714418a214255c7e05a6f93f153ff9788f6d50a2c67f69e69f72425f3fb9de2dc94d0f77f5f1df85a63abc29ed26a70f35902914ade1f2adf06092a0def5d14749901e5dd54a1d4669fb4b091a9477842e29934573c4299714c106bda6a05d8ca966af5e89bc427943c63c0d446ed0b92cd3dcec21e5b73980a5fb36e42d7032caac1f78468ff3c5c2d6d8239c887c82242afd4c59b75b3abd6c431fff483ce8be7c1f6cf97c776d0ff74f55af73af81e8a74176d16a505c9c2bb533a7a360b19fe5f09e8668fdf841d2491042529e5cf8beff65b94890f6ea554ba00a68f0d9065f993ae32a56eb7ae363f4596f9bcb5ba83a02caa808937aad7081d4bce749d1c41a2d73f552d0e399c43755f63d9b0751f72e24df0051b053a38a182c4318be2972511c1b2ebf29957ccf2c4c8fceba2e362fa4bc0ad4cc26c3fc7e31c0dc50cb09e42293eb4128d5af999f225e3ca1b415e89aac0535b8e5399a449b6e2edc7165edc800b2e363a9dfdc7a1742f202540cfed8f9484eb15fec4ce896e81e15f872a5dfd44752586f6d5e6c8417c680a6f887351b7df9a2b957a02d21c61ad2da5c2c5ae3df84947f36a76f2bb56c2738b4d56e74a2f1da2084488237e8461a8a9d7083574a51b87134daab61c130147d47ff6060f9eae26f7d7c289a53667fd15a29f2942b94a79d540edec3443c4cd633d11833231ab94890c8f478600c76ae6978e99494c8e29abb5e882abcb8b5f91386eeedede928cf5042a91bf449b60183e0c425377b5a295a66478189a1fd1581e9e9dd556bfb507547620b33f347fd1cea30babb14d898f1aa1e663d640e6d922938a979c867d17997324882df80ba662a1df72a1aeca2145eca3e03ed9c2d142c5d31e75265b5f90f9648450c3f11dc02e0b88efe796d89d9739f961dae3f0d1097d28237c2eb004c544dcb51569f04ddd15261d7e4fdc2724494b5f444661fdff0748af4559b2cdd47ccb86ed2d6874e91b0edf6c8163dd8b752e10519e766bf663a90cb07b3a818f81b948bdc33e58e7f5436ccc1ca8319f4951c77916d2db3d", 0xb01}], 0x1) write(r2, &(0x7f0000000080)="c30516845e", 0xff55) close(r3) mprotect(&(0x7f0000394000/0x4000)=nil, 0x4000, 0x4) syz_open_pts() accept(r1, 0x0, 0x0) r4 = open(&(0x7f0000000000)='./file0\x00', 0x8, 0x9bf2d3725864749b) ioctl$BIOCSETIF(r4, 0x40384900, 0x0) ioctl$BIOCSETF(r2, 0x80104267, 0x0) r5 = socket(0x18, 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x0, 0x1, 0x0, 0x100400000000000, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x1c) 507.602348ms ago: executing program 4 (id=682): socket$inet(0x2, 0x1, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0x2000, 0x4800) r0 = open(&(0x7f0000000040)='./bus\x00', 0x0, 0x9) ioctl$FIOASYNC(r0, 0xc0107005, &(0x7f00000000c0)) socket(0x11, 0x3, 0x0) r1 = socket$inet(0x2, 0x3, 0x2) r2 = syz_open_pts() ioctl$TIOCGTSTAMP(r2, 0x4010745b, &(0x7f0000000500)) setsockopt$inet_opts(r1, 0x0, 0x64, &(0x7f0000000180)="01000000", 0x4) close(r1) r3 = socket(0x11, 0x3, 0x0) setsockopt(r3, 0x11, 0x2, &(0x7f0000000000), 0x4) ioctl$VMM_IOC_RESETCPU(0xffffffffffffff9c, 0x82405605, &(0x7f0000000100)={0x0, 0xb3f, {[0xfffffbfffffffffb, 0x0, 0x2, 0x100200000, 0x6, 0x7, 0xdf60, 0xfffffffffffffffe, 0x0, 0x2f01, 0x93, 0x4, 0xffffffffffffffff, 0x200000000002, 0xd, 0x4, 0xfffffffffffffffe, 0x400000000100], [0xfffffffffffffffe, 0xf0, 0xfffefffffffffffd, 0x20000001, 0x5e, 0x7b98, 0x6, 0x0, 0x3], [0x100000001, 0x8000, 0x8, 0x0, 0xb, 0x11000, 0xffffffff00000000], [0x8, 0x1fffffffffb, 0x7ffffffffffffffc, 0x100000000, 0xfffffffffffffffe, 0x8], [{0x0, 0x0, 0x0, 0x7d0a}, {0xfffc, 0x22, 0x6}, {0x1ff, 0x0, 0xfffffffe, 0x80}, {0x3, 0x4, 0x5, 0xffffffffffffffff}, {0x0, 0x2, 0x7f, 0x8}, {0x0, 0x9, 0x9, 0x2000000000000000}, {0x0, 0x0, 0xfffffff9}, {0x0, 0xfd, 0x0, 0x7}], {0x1, 0x5, 0x6, 0x3}, {0xfffe, 0xfd04, 0x6d5, 0x6}}}) r4 = kqueue() kevent(r4, 0x0, 0xfffffffd, &(0x7f0000000040), 0x5, 0x0) select(0x40, &(0x7f0000000080)={0xc39, 0x80000001, 0x9, 0x9, 0xfffffffffffffff3, 0x9, 0x4, 0x7fff}, &(0x7f0000000340)={0x2b, 0x3, 0x6, 0x200000, 0x4, 0x100000001, 0xa445, 0xd05}, &(0x7f0000000380)={0x9, 0x7fff, 0x6, 0x1000, 0x9, 0x4, 0x8, 0x969}, &(0x7f00000003c0)={0x400, 0x1}) kevent(r4, &(0x7f0000000000), 0x3ff, 0x0, 0x8000800, 0x0) 499.829063ms ago: executing program 5 (id=684): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) sysctl$vm(0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)="42ee4583", 0x4) r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x186) r1 = open(&(0x7f0000000040)='./file0\x00', 0x18289, 0x110) write(r1, &(0x7f00000004c0)="b96abcf5ac7cffa09ea845315c0d853a14", 0xffffff1c) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x2012, r0, 0x0) sysctl$net_inet_icmp(&(0x7f0000000040)={0x4, 0x2, 0x1, 0x5}, 0x4, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r2 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x80, 0x0) r3 = socket(0x18, 0x3, 0x0) ioctl$FIONREAD(r3, 0xc028698a, &(0x7f0000000100)) ioctl$BIOCSETIF(r2, 0x8020426c, &(0x7f0000000280)={'tap', 0x0}) ioctl$BIOCSETF(r2, 0x80104267, &(0x7f0000000080)={0x3, &(0x7f0000000040)=[{0x34, 0x3, 0x92, 0x40006}, {0x48, 0x1, 0x86, 0x3}, {0x1026, 0xa0, 0x1, 0xfffff001}]}) ioctl$BIOCFLUSH(r2, 0x20004268) syz_emit_ethernet(0x22, &(0x7f0000000080)=ANY=[]) readlinkat(r1, &(0x7f0000000000)='./file1\x00', &(0x7f0000000100)=""/71, 0x47) sysctl$net_inet_carp(&(0x7f0000000040)={0x4, 0x2, 0x6, 0x2}, 0x4, 0x0, 0x0, &(0x7f00000010c0)="e5000000", 0x4) 310.643735ms ago: executing program 0 (id=686): r0 = socket(0x18, 0x2, 0x0) r1 = open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x186) mmap(&(0x7f00003a0000/0x2000)=nil, 0x2000, 0x1, 0x2011, r1, 0x0) ktrace(&(0x7f0000000200)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r2 = open(&(0x7f0000000040)='./file0\x00', 0x280, 0x60) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3, 0x10, r2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$FIONREAD(r0, 0x8020697a, &(0x7f00000001c0)) 309.487252ms ago: executing program 4 (id=687): ioctl$FIOASYNC(0xffffffffffffffff, 0xc2c04200, 0x0) mknod(&(0x7f00000000c0)='./bus\x00', 0x2000, 0xd02) r0 = open(0x0, 0x20, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, 0x0) open(0x0, 0x0, 0x0) r1 = open(&(0x7f0000000100)='./bus\x00', 0x1, 0x40) ioctl$TIOCSETD(0xffffffffffffffff, 0x8004741b, &(0x7f0000000040)=0x5) execve(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$net_inet_ip(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$VNDIOCSET(r1, 0xc0285108, &(0x7f0000000040)={0x0, 0x29, 0x0, 0x14}) r2 = open(&(0x7f0000000040)='./bus\x00', 0x10005, 0x0) ioctl$TIOCEXCL(r2, 0x2000740d) ioctl$TIOCSFLAGS(r2, 0x8004745c, &(0x7f0000000080)=0x5) sysctl$net_inet_udp(&(0x7f0000000000)={0x4, 0x2, 0x11, 0x6}, 0x4, 0x0, 0x0, 0x0, 0x0) 170.77187ms ago: executing program 2 (id=689): pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setstatus(r0, 0x4, 0xc0) r2 = getppid() msgctl$IPC_SET(0xffffffffffffffff, 0x1, &(0x7f00000000c0)={{0xe5, 0x0, 0xffffffffffffffff}, 0x0, 0x0, r2, 0x0, 0x2000000000, 0x0, 0x1}) ioctl$WSMUXIO_INJECTEVENT(r1, 0x80185760, &(0x7f0000000040)={0x2, 0x4, {0xfff, 0x5}}) r3 = socket(0x11, 0x3, 0x0) fchdir(r3) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) ioctl$WSKBDIO_GETMAP(r4, 0x80047476, &(0x7f0000000100)={0x0, 0x0}) r5 = fcntl$getown(r4, 0x5) pipe(&(0x7f0000000000)) setreuid(0x0, 0xee01) fcntl$setown(r0, 0x6, r5) setuid(0xee01) close(r0) 169.64083ms ago: executing program 2 (id=690): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc0e99db6de761f86, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x80000000000206, 0x0) select(0x40, &(0x7f0000000080)={0x8, 0xfffffffffffffffe, 0xd, 0x4, 0x20000000000, 0x1, 0x7, 0x4}, &(0x7f00000000c0)={0xfffffffffffffff8, 0x1000, 0x463c, 0xfe9, 0xa, 0x8, 0x5, 0x4}, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) sysctl$kern(&(0x7f00000000c0)={0x1, 0x49}, 0x2, &(0x7f0000000100), 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) 166.86744ms ago: executing program 5 (id=691): mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async, rerun: 64) sysctl$hw(&(0x7f0000000080)={0x6, 0x18}, 0x2, &(0x7f00000000c0), 0x0, 0x0, 0x0) (async, rerun: 64) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) (async) syz_emit_ethernet(0x3e, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff88a819008100370008004500002800670000001d9078ffffffffac1400aa0d00907800080002000000032000342a4dc400000ed7"]) (async) setrlimit(0x8, &(0x7f0000000980)={0xb, 0x800000054}) (async) r0 = syz_open_pts() close(r0) getrlimit(0x8, &(0x7f0000000000)) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0x200000000000a, &(0x7f0000000000)="ea00005c00000000", 0x1) (async) setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f0000000040)="ea00000100060000", 0x8) (async, rerun: 64) r2 = syz_open_pts() (rerun: 64) dup(r2) (async) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) (async, rerun: 64) r3 = open(&(0x7f0000000080)='./file0\x00', 0x200, 0x29) (rerun: 64) ioctl$WSMOUSEIO_SCALIBCOORDS(r3, 0x81205724, &(0x7f0000000100)={0x7ff, 0x6, 0x9, 0x0, 0x80000001, 0xa1b0, 0x40010001, 0x10, [{0x0, 0x2890, 0x5, 0x71002}, {0x40009, 0xe, 0x20000008, 0x8}, {0xfa13, 0x9, 0xfffffffc, 0x9}, {0x0, 0x800, 0x8012, 0x200007}, {0x1c, 0xffff, 0x7, 0x9}, {0x1, 0xfffffffd, 0x3, 0x9b}, {0x0, 0xffffffff, 0x4d4, 0x6}, {0x1000006, 0x0, 0x14, 0x590d}, {0x2000002, 0x82, 0x6, 0x6}, {0x3, 0x8009, 0x1000}, {0x1ca, 0x4, 0xfffff733, 0x3}, {0x3, 0xa, 0x8}, {0x4, 0x7, 0x89, 0x5968}, {0x29a71717, 0x7f, 0x60, 0x7}, {0x1100c, 0x3, 0x9654, 0x4}, {0x0, 0x101, 0xfff}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async, rerun: 64) r4 = open(&(0x7f0000000080)='./file0\x00', 0x80, 0x2a) (rerun: 64) ioctl$VNDIOCSET(r4, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) (async) mknod(0x0, 0x6000, 0x1e61) (async) ioctl$VNDIOCSET(0xffffffffffffffff, 0x80044403, &(0x7f00000001c0)={0x0, 0x6, 0x0}) (async) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) (async) kevent(0xffffffffffffff9c, &(0x7f0000000040)=[{{}, 0xfffffffffffffff8, 0x0, 0x44, 0x6}], 0xffffffd8, 0x0, 0x2, 0x0) (async, rerun: 32) sysctl$net_inet_ip(&(0x7f0000000040)={0x4, 0x11, 0x0, 0x2}, 0x4000000000000006, 0x0, 0x0, 0x0, 0x0) (async, rerun: 32) setrlimit(0x8, &(0x7f0000000980)={0xb, 0x54}) (async) r5 = syz_open_pts() close(r5) syz_open_pts() (async) ioctl$FIOASYNC(r5, 0x80047469, &(0x7f00000000c0)=0x5) close(r5) 165.348454ms ago: executing program 0 (id=692): setrlimit(0x8, &(0x7f0000000080)={0xb, 0x54}) r0 = syz_open_pts() open(&(0x7f0000000180)='./file0\x00', 0x80000000000206, 0x0) close(r0) r1 = open(&(0x7f0000000140)='./file0\x00', 0x8000, 0x0) r2 = getpid() ktrace(&(0x7f0000000040)='./file0\x00', 0x0, 0x40000928, r2) utimensat(0xffffffffffffffff, 0x0, &(0x7f0000000100)={{0xfffffffffffffffe, 0xb}, {0x2, 0xf}}, 0x2) r3 = socket(0x2, 0x1, 0x0) shutdown(r3, 0x2) getsockname$unix(r3, 0x0, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x6) sendmsg$unix(0xffffffffffffffff, 0x0, 0x0) bind$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs={0x1f95d27d48731892, 0x7}, 0x1c) semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, &(0x7f00000000c0)={{0x10001, 0x0, 0x0, 0x0, 0x0, 0x81}, 0x14800000000000, 0x6}) ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x0, {0x0, 0x10000000000001}}) connect$unix(0xffffffffffffffff, &(0x7f00000000c0)=@abs={0x682eb13985c518e6, 0x7}, 0x8) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r4 = socket(0x18, 0x1, 0x0) socket(0x18, 0x2, 0x0) connect$unix(r4, &(0x7f00000000c0)=@abs={0x0, 0x7}, 0x1c) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x5, 0x10, r1, 0x0) writev(r0, &(0x7f00000004c0)=[{&(0x7f0000000180)='>', 0x1}, {0x0}], 0x2) 163.701007ms ago: executing program 4 (id=693): r0 = socket(0x2, 0x2, 0x0) accept(r0, &(0x7f0000000140)=@in, &(0x7f0000000100)=0x1) r1 = socket(0x2, 0x400000000002, 0x0) setsockopt(r1, 0x0, 0x21, &(0x7f0000000080)="c5f5d915", 0x4) r2 = dup2(r1, r0) setsockopt$sock_int(r2, 0xffff, 0x800, &(0x7f0000000040)=0x9, 0x4) select(0x40, &(0x7f0000000000)={0xfffffffffffffffd, 0x0, 0x0, 0x564, 0x9ce8, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0x0) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) bind(r0, &(0x7f0000000000), 0x10) r3 = socket(0x2, 0x2, 0x0) setsockopt$sock_int(r3, 0xffff, 0x20, &(0x7f0000000080)=0x6, 0x4) connect$unix(r3, &(0x7f0000000000), 0x10) write(r3, 0x0, 0x0) 157.707311ms ago: executing program 6 (id=694): mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) r0 = open(&(0x7f0000000080)='./file0\x00', 0x80, 0x2a) r1 = getuid() r2 = getegid() setgid(r2) lchown(&(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r1, r2) rename(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0xffffffc0, 0x6, 0x2000007, 0x5f, 0x80000001, 0xa, 0x80, 0x10, [{0x1000000, 0x4b22, 0x0, 0x71003}, {0xd8, 0x5, 0x8, 0xfffffff9}, {0x0, 0xfffffff6, 0x8, 0x6}, {0x5, 0x65, 0x3, 0xfffffffd}, {0xf, 0xf2b, 0x9, 0x2}, {0x7a, 0x1, 0x4000008, 0x95}, {0x81, 0x7, 0x9d29, 0x400006d}, {0x3, 0x803, 0x14, 0x2}, {0xffffffff, 0x82, 0x4, 0xaf}, {0x5, 0x7ffffffe, 0xd1b, 0x88}, {0x1d1, 0x7, 0x2c, 0x4}, {0x7fc, 0x9, 0x8, 0x80000000}, {0x81f, 0x2, 0xfffffffc, 0x1001}, {0x29a71713, 0xfffffffa, 0x6, 0x3}, {0xc, 0x9, 0x6}, {0x800000, 0x2, 0x1, 0x7fbf}]}) open(&(0x7f0000000140)='./file0\x00', 0x78e, 0x20) setrlimit(0x1, &(0x7f0000000000)={0xfffffffffffffffd, 0xffffffffffffffff}) truncate(&(0x7f00000000c0)='./file0\x00', 0x6001000004) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$VNDIOCSET(r0, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) ioctl$VNDIOCSET(r0, 0x80044403, &(0x7f00000001c0)={0x0, 0x80000000100007, 0x0}) truncate(&(0x7f00000000c0)='./file0\x00', 0x6000000005) rename(&(0x7f0000000040)='./file0\x00', &(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) (async) open(&(0x7f0000000080)='./file0\x00', 0x80, 0x2a) (async) getuid() (async) getegid() (async) setgid(r2) (async) lchown(&(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r1, r2) (async) rename(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') (async) ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0xffffffc0, 0x6, 0x2000007, 0x5f, 0x80000001, 0xa, 0x80, 0x10, [{0x1000000, 0x4b22, 0x0, 0x71003}, {0xd8, 0x5, 0x8, 0xfffffff9}, {0x0, 0xfffffff6, 0x8, 0x6}, {0x5, 0x65, 0x3, 0xfffffffd}, {0xf, 0xf2b, 0x9, 0x2}, {0x7a, 0x1, 0x4000008, 0x95}, {0x81, 0x7, 0x9d29, 0x400006d}, {0x3, 0x803, 0x14, 0x2}, {0xffffffff, 0x82, 0x4, 0xaf}, {0x5, 0x7ffffffe, 0xd1b, 0x88}, {0x1d1, 0x7, 0x2c, 0x4}, {0x7fc, 0x9, 0x8, 0x80000000}, {0x81f, 0x2, 0xfffffffc, 0x1001}, {0x29a71713, 0xfffffffa, 0x6, 0x3}, {0xc, 0x9, 0x6}, {0x800000, 0x2, 0x1, 0x7fbf}]}) (async) open(&(0x7f0000000140)='./file0\x00', 0x78e, 0x20) (async) setrlimit(0x1, &(0x7f0000000000)={0xfffffffffffffffd, 0xffffffffffffffff}) (async) truncate(&(0x7f00000000c0)='./file0\x00', 0x6001000004) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) (async) ioctl$VNDIOCSET(r0, 0x80184404, &(0x7f00000001c0)={0x0, 0x0, 0x0}) (async) ioctl$VNDIOCSET(r0, 0x80044403, &(0x7f00000001c0)={0x0, 0x80000000100007, 0x0}) (async) truncate(&(0x7f00000000c0)='./file0\x00', 0x6000000005) (async) rename(&(0x7f0000000040)='./file0\x00', &(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') (async) 157.150159ms ago: executing program 2 (id=695): mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x5200) (async) chmod(&(0x7f0000000040)='.\x00', 0x35e) r0 = getuid() chown(&(0x7f0000000080)='./file1\x00', r0, 0xffffffffffffffff) (async) setuid(r0) (async) r1 = socket(0x2, 0x2, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="00001c00ac"]) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) (async) dup(r1) (async) setsockopt$inet_opts(r1, 0x0, 0x14, &(0x7f0000000080)='\t\x00\x00\x00', 0x4) (async) connect$unix(r1, &(0x7f0000000000), 0x10) write(r1, 0x0, 0x0) (async) setreuid(r0, r0) unveil(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)='x\x00') 105.141418ms ago: executing program 2 (id=696): ioctl$VMM_IOC_RESETCPU(0xffffffffffffffff, 0x82405605, &(0x7f0000000100)={0x0, 0x0, {[0xfffffbeffffffffb, 0x1, 0x2, 0x2, 0x8001, 0xfffffffffffffffe, 0x6, 0xffffffffffffffff, 0x0, 0x2f00, 0x0, 0x3, 0xffffffffffffffff, 0x400000000000000, 0x0, 0xffffffffffffffa5, 0x82, 0xce5], [0xfffffffffffffffe, 0x80000001, 0xfffffffffffffff9, 0x2, 0x0, 0x7b98, 0x1fe, 0x0, 0xfffffffffffffffe], [0x5ad8, 0x2, 0x40000002, 0x0, 0xfffffffffffffffb, 0x11003, 0x4], [0xd, 0x20000000000, 0xfffffffffffffffc, 0x8040000100000000, 0xfffffffffffffffa, 0x4], [{0xdb6e, 0x4, 0x0, 0x40007d06}, {0xfffc, 0x2, 0x5}, {0x0, 0x0, 0xfffffffe, 0x80}, {0x3, 0x4b72, 0x3, 0xffffffffffffffff}, {0x0, 0xfffff3d8, 0x0, 0x8}, {0x0, 0x2003, 0x40000, 0x6}, {0x6b7}, {0x0, 0x965, 0xfffffffc, 0x9}], {0x2000, 0x7, 0x5}, {0x29, 0x6, 0xb0, 0x2}}}) socket(0x2, 0x3, 0x7) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x56, 0x0, 0x7fff, 0x0) syz_emit_ethernet(0x76, &(0x7f0000000000)={@local, @local, [{[{0x88a8, 0x0, 0x1, 0x1}], {0x8100, 0x1}}], {@ipv6={0x86dd, {0x6, 0x6, "03816a", 0x72, 0x88, 0x30, @rand_addr="000058d6423611a3d67a00", @local={0xfe, 0x80, '\x00', 0x0}, {[], @generic="3d259c06b15a443aa1d72c0ce98378b65dde37b9ed8455da3b03f6c5ebcedc616d02c1acdfe1a272edafbfd473518c7c987fa7126589dd94"}}}}}) 104.605467ms ago: executing program 4 (id=697): fchflags(0xffffffffffffffff, 0x0) r0 = syz_open_pts() r1 = socket(0x2, 0x1, 0x0) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) ioctl$FIONREAD(r1, 0xc1126939, &(0x7f00000001c0)) ioctl$TIOCSTAT(r0, 0x20007465, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x8004741b, &(0x7f0000000040)=0x8) ioctl$TIOCSETD(0xffffffffffffffff, 0x8004741b, &(0x7f0000000080)=0xc) execve(0x0, 0x0, 0x0) 103.131937ms ago: executing program 7 (id=698): r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x186) r1 = open(&(0x7f0000000040)='./file0\x00', 0x18289, 0x110) write(r1, &(0x7f00000004c0)="b96abcf5ac7cffa09ea845315c0d853a14", 0xffffff1c) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x2012, r0, 0x0) sysctl$net_inet_icmp(&(0x7f0000000040)={0x4, 0x2, 0x1, 0x5}, 0x4, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$net_inet_carp(&(0x7f00000002c0)={0x4, 0x2, 0x6, 0x2}, 0x4000000000000080, 0x0, 0x0, &(0x7f0000000280)="e5000000", 0x4) sysctl$net_inet_carp(&(0x7f0000000000)={0x4, 0x2, 0x70, 0x3}, 0x4, &(0x7f0000000100)="64621c897ff642acab7b1883d9b580bd99e91197490f8854c96ce266038867980d526334126094d482f3288a8e34951b470391c6baa75693af936271ea45369abeeb2e5b572cddde7d72f46f71fd3bb9f48e3ee1b680", &(0x7f0000000080)=0x56, &(0x7f0000000180)="b3d2fd58b2a74647b900e1c84ff98fa38298936ff4ca9858f69ee627d200eb0677d3a077b26421d47a72632f58e626e8b6bb37a7a8bc0e633b2fde783b56630430627945316c2e24d3334aab784ed2e70c838284ff5660a62625f1d6f2cd1459035f4a33daf68b19a2c6140949e49e0ec7f1d5a00b921b3b6c95762b963e246aab778e84bccbbc00d1f056665ed6547c1b74673882d70052012c963475207d1cfafe5e04315eb27c5fdd02ff97d0da782ad3b1eb2f61f90a9150252370702b2149dac93be384e5b4fd2bb55506", 0xcd) 35.728396ms ago: executing program 5 (id=699): chmod(&(0x7f0000000040)='.\x00', 0x35e) (async) setuid(0xee01) (async) r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000200)=@file={0xd570d0466b6018f, './file0\x00'}, 0xa) chmod(&(0x7f0000000240)='./file0\x00', 0x161) (async) r1 = syz_open_pts() ioctl$TIOCSTSTAMP(r1, 0x8008745a, &(0x7f0000001cc0)={0x22f63c67, 0xdd}) r2 = socket$unix(0x1, 0x2, 0x0) sendmsg$unix(r2, &(0x7f0000000080)={&(0x7f0000000040)=@file={0x170, './file0\x00'}, 0xa, 0x0, 0x0, 0x0, 0x0, 0x404}, 0xe) 19.027736ms ago: executing program 2 (id=700): ioctl$WSKBDIO_SETKEYREPEAT(0xffffffffffffff9c, 0x800c5707, &(0x7f00000000c0)={0x4, 0xc, 0x9}) getsockname$unix(0xffffffffffffffff, 0x0, &(0x7f0000000040)) syz_emit_ethernet(0x3e, &(0x7f0000000040)=ANY=[@ANYBLOB="ffffffffffff"]) recvmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f00000024c0)=""/232, 0xe8}, 0x0) (async) recvmsg(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f00000024c0)=""/232, 0xe8}, 0x0) r0 = socket(0x18, 0x3, 0x0) setsockopt$sock_int(r0, 0xffff, 0x800, &(0x7f0000000080)=0x4, 0x4) setsockopt(r0, 0x1000000029, 0x24, &(0x7f0000000000)="5ab7776a", 0x4) bind(r0, &(0x7f0000000100)=@in={0x2, 0x1}, 0xc) (async) bind(r0, &(0x7f0000000100)=@in={0x2, 0x1}, 0xc) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@broadcast, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "36e282", 0x8, 0x3b, 0x0, @rand_addr="01984b0e23742b40c3fa3d76af5fc1fa", @mcast2, {[], @udp={{0x1, 0x0, 0x8}}}}}}}) (async) syz_emit_ethernet(0x3e, &(0x7f0000000040)={@broadcast, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "36e282", 0x8, 0x3b, 0x0, @rand_addr="01984b0e23742b40c3fa3d76af5fc1fa", @mcast2, {[], @udp={{0x1, 0x0, 0x8}}}}}}}) recvmmsg(r0, &(0x7f0000000340)={0x0, 0x4}, 0x10, 0x800, 0x0) 7.064026ms ago: executing program 0 (id=701): pipe(&(0x7f0000000000)={0xffffffffffffffff}) poll(&(0x7f0000000400)=[{0xffffffffffffffff, 0xa0}, {0xffffffffffffffff, 0x100}, {0xffffffffffffffff, 0x2}, {r0, 0x8}], 0x4, 0xa) 0s ago: executing program 2 (id=702): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000440), 0x10, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) (async, rerun: 32) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000000)={0x3, &(0x7f0000000100)=[{0x3, 0x54, 0x27, 0x1}, {0x50, 0x11, 0x4, 0x8}, {0x6, 0xaa, 0x2, 0x4000008}]}) (async, rerun: 32) syz_emit_ethernet(0x1000e, &(0x7f0000001500)=ANY=[@ANYRESOCT=r0, @ANYRES64]) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$pf(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) ioctl$TIOCSETA(r3, 0xc450443e, &(0x7f00000000c0)={0xfffeffff, 0xb2, 0x8460, 0xfffefffc, "080000de06512a1e0400"}) (async) r4 = socket$inet6(0x18, 0x4002, 0x0) getsockopt(r4, 0x29, 0x27, 0x0, 0x0) (async) select(0x40, &(0x7f0000000140)={0xffbffffffffffffa, 0x9, 0x960, 0x3, 0x89, 0x3, 0x1, 0x1}, 0x0, 0x0, 0x0) readv(r1, &(0x7f0000000000)=[{&(0x7f0000000240)=""/91, 0x5b}], 0x1) (async, rerun: 32) dup2(r2, r1) (async, rerun: 32) execve(0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.125' (ED25519) to the list of known hosts. pckbd_enable: command error pckbd_enable: command error pckbd_enable: command error vm_create: uvm_map failed: 12 OpenBSD/amd64 (ci-openbsd-multicore-0.us-central1-b.c.syzkaller.internal) (tty00) login: vm_create: uvm_map failed: 12 86<¦Óˆ~ûw”€[¬·ðTmòÊ-nK'xåût[)—É/¬Á8yÿ†Â^˜ô/Î ™ž dÔ‘ÿ¨_Øð8Ñtôò~ù”÷£ÉF™X(‘H¿5ÁRÔVÉG8yÿ;ÖëÐ%=rX„%h}æïDXŸ \¤qTd(N6ÃêI  šN%$„€à1»dÿ!ëPÅ/kø\L%ûŽhÒìËaÝ~ÌuÓ°ðÈ¿úȳy4­=/_ø(xã¨Sað´ÞõPDÑȸü†Ý‰p¶ì=b_““K«·¸™þV…àR$Ðö÷p^5+«TuW¿ ^ùnÖr^b¨b³d’¢Šlä Xø1ZL˜²}ÁµBôxtÔÑ(ãqBï{ùå;×+ûµQb”¨O¼QÅSé“ù¼âRÇ*WT¸FG&†áŸ}Âû¹è97Ê :ZéÖeûã±PÕnä «s’ß-~™¶’òCWrO5ÿT ˜¾ÙëÚ.ÝB‡Ÿ†äqBº‹Í¾Ü-¬`§\Œ°ÙË™ÆQn(Iw­Z0 ýyµ^öÄu”­LÔ0²u_cKzŽ&‰!Fk±lÔ¶õÐ1lÓ‚~ g+>}‡]D­.¾0CæqåòÍcwitness: lock order reversal: 1st 0xffff800010fd96d8 sbufsnd (&so->so_snd.sb_lock) 2nd 0xfffffd80768d97a0 inode (&ip->i_lock) lock order [1] sbufsnd (&so->so_snd.sb_lock) -> [2] inode (&ip->i_lock) lock order data 0xffffffff8341b403 -> 0xffffffff833873c0 is missing lock order [2] inode (&ip->i_lock) -> [3] sbufrcv (&so->so_rcv.sb_lock) #0 rw_do_enter_write+0xba #1 sblock+0xb6 #2 soreceive+0x27d #3 fifo_read+0x117 #4 VOP_READ+0x101 #5 vn_rdwr+0x15b #6 vndsetcred+0xa1 #7 vndioctl+0xdfc #8 VOP_IOCTL+0xac #9 vn_ioctl+0xf8 #10 sys_ioctl+0x674 #11 syscall+0xbd4 #12 Xsyscall+0x128 lock order [3] sbufrcv (&so->so_rcv.sb_lock) -> [1] sbufsnd (&so->so_snd.sb_lock) #0 rw_do_enter_write+0xba #1 sblock+0xb6 #2 sosplice+0x312 #3 sys_setsockopt+0x2ba #4 syscall+0xbd4 #5 Xsyscall+0x128 Stopped at db_enter+0x25: addq $0x8,%rsp ddb{1}> ddb{1}> set $lines = 0 ddb{1}> set $maxwidth = 0 ddb{1}> show panic the kernel did not panic ddb{1}> trace db_enter() at db_enter+0x25 witness_checkorder(fffffd80768d97a0,9,0) at witness_checkorder+0x10d1 rw_do_enter_write(fffffd80768d9788,1) at rw_do_enter_write+0xba rrw_enter(fffffd80768d9788,1) at rrw_enter+0xc6 VOP_LOCK(fffffd806c4873b0,2001) at VOP_LOCK+0xbd vn_lock(fffffd806c4873b0,2001) at vn_lock+0xa4 vfs_lookup(ffff800037fc9d60) at vfs_lookup+0x11c namei(ffff800037fc9d60) at namei+0x7ca unp_connect(ffff800010fd94f0,fffffd806f2db500,ffff8000fffe27f0) at unp_connect+0x29d uipc_dgram_send(ffff800010fd94f0,fffffd805fbbac00,fffffd806f2db500,0) at uipc_dgram_send+0x163 sosend(ffff800010fd94f0,fffffd806f2db500,ffff800037fc9fe8,0,0,e) at sosend+0x804 sendit(ffff8000fffe27f0,4,ffff800037fca168,e,ffff800037fca220) at sendit+0x5a5 sys_sendmsg(ffff8000fffe27f0,ffff800037fca2d0,ffff800037fca220) at sys_sendmsg+0x246 syscall(ffff800037fca2d0) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x68316a01050, count: -15 ddb{1}> show registers rdi 0 rsi 0 rbp 0xffff800037fc99d0 rbx 0 rdx 0 rcx 0xffff8000fffe27f0 rax 0xffff8000299ddff0 r8 0xffff800037fc98b0 r9 0x8080808080808080 r10 0x9c8bae7e3801662c r11 0x363b608d1aab76ad r12 0xfffffd8003f598c0 r13 0xfffffd8004742808 r14 0x3 r15 0xffffffff83421e46 substchar+0xccdf rip 0xffffffff81428175 db_enter+0x25 cs 0x8 rflags 0x246 rsp 0xffff800037fc99c0 ss 0x10 db_enter+0x25: addq $0x8,%rsp ddb{1}> show proc PROC (syz-executor) tid=175863 pid=20334 tcnt=3 stat=onproc flags process=10 proc=4000000 runpri=32, usrpri=86, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff8000fffe3780,0xffff8000fffe8a90 process=0xffff80003c4bc9d0 user=0xffff800037fc5000, vmspace=0xfffffd806c8329a8 estcpu=36, cpticks=0, pctcpu=0.0, user=0, sys=0, intr=0 ddb{1}> ps PID TID PPID UID S FLAGS WAIT COMMAND 91618 178042 31364 0 7 0 syz-executor 20334 303382 37757 60929 2 0x10 syz-executor *20334 175863 37757 60929 7 0x4000010 syz-executor 20334 17275 37757 60929 3 0x4000090 fsleep syz-executor 11485 293752 22881 0 3 0x80 nanoslp syz-executor 11485 470187 22881 0 3 0x4000000 biowait syz-executor 11485 117952 22881 0 3 0x4000080 fsleep syz-executor 14542 275031 0 0 3 0x14280 nfsidl nfsio 84605 211494 0 0 3 0x14280 nfsidl nfsio 43471 311580 0 0 3 0x14280 nfsidl nfsio 6420 521235 0 0 3 0x14280 nfsidl nfsio 81747 411531 0 0 3 0x14280 nfsidl nfsio 8172 345157 0 0 3 0x14280 nfsidl nfsio 20338 255125 0 0 3 0x14280 nfsidl nfsio 97687 64766 0 0 3 0x14280 nfsidl nfsio 40688 171986 0 0 3 0x14280 nfsidl nfsio 51283 451099 0 0 3 0x14280 nfsidl nfsio 73867 34613 0 0 3 0x14280 nfsidl nfsio 88223 162916 0 0 3 0x14280 nfsidl nfsio 57673 17726 0 0 3 0x14280 nfsidl nfsio 74364 363224 0 0 3 0x14280 nfsidl nfsio 5773 257636 0 0 3 0x14280 nfsidl nfsio 1713 431176 0 0 3 0x14280 nfsidl nfsio 12211 165989 0 0 3 0x14280 nfsidl nfsio 96956 398587 0 0 3 0x14280 nfsidl nfsio 26713 53514 0 0 3 0x14280 nfsidl nfsio 26423 187942 0 0 3 0x14280 nfsidl nfsio 90806 215427 1 0 3 0x100083 ttyin getty 22881 309013 18204 0 3 0x82 nanoslp syz-executor 31770 312071 18204 0 3 0x82 nanoslp syz-executor 37757 285805 18204 0 3 0x82 nanoslp syz-executor 71883 145456 18204 0 3 0x82 nanoslp syz-executor 13959 451340 18204 0 3 0x82 nanoslp syz-executor 31364 438187 18204 0 3 0x82 nanoslp syz-executor 55628 454072 18204 0 3 0x82 nanoslp syz-executor 38212 427909 18204 0 3 0x2 biowait syz-executor 18204 115320 67595 0 3 0x82 kqread syz-executor 67595 69521 37277 0 3 0x10008a sigsusp ksh 37277 217990 24322 0 3 0x98 kqread sshd-session 24322 61800 46968 0 3 0x92 kqread sshd-session 46968 465866 1 0 3 0x88 kqread sshd 51260 484180 91312 74 3 0x1100092 bpf pflogd 91312 299346 1 0 3 0x80 sbwait pflogd 4304 453797 8338 73 3 0x1100090 kqread syslogd 8338 413743 1 0 3 0x100082 sbwait syslogd 62214 180365 1 0 3 0x100080 kqread resolvd 7214 334965 42504 77 3 0x100092 kqread dhcpleased 81678 204919 42504 77 3 0x100092 kqread dhcpleased 42504 244587 1 0 3 0x80 kqread dhcpleased 24084 301589 0 0 3 0x14200 bored smr 40037 352683 0 0 3 0x14200 pgzero zerothread 6902 222964 0 0 3 0x14200 aiodoned aiodoned 86737 455874 0 0 3 0x14200 syncer update 73287 147357 0 0 3 0x14200 cleaner cleaner 37645 493065 0 0 3 0x14200 reaper reaper 49214 47570 0 0 3 0x14200 pgdaemon pagedaemon 2147 168548 0 0 3 0x14200 bored viomb 35151 361600 0 0 3 0x40014200 acpi0 acpi0 61939 263336 0 0 3 0x40014200 idle1 98625 340462 0 0 3 0x14200 bored softnet1 29686 32684 0 0 2 0x14200 softnet0 99202 418230 0 0 3 0x14200 bored systqmp 79106 361836 0 0 3 0x14200 bored systq 6965 99679 0 0 3 0x14200 tmoslp softclockmp 17793 228149 0 0 3 0x40014200 tmoslp softclock 72331 191856 0 0 3 0x40014200 idle0 1 479342 0 0 3 0x82 wait init 0 0 -1 0 3 0x10010200 scheduler swapper ddb{1}> show all locks Process 91618 (syz-executor) thread 0xffff8000fffe9248 (178042) exclusive rwlock amaplk r = 0 (0xfffffd8074655bd8) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 uvm_fault_check+0x8a9 #3 uvm_fault+0x106 #4 upageflttrap+0xa9 #5 usertrap+0x42f #6 recall_trap+0x8 shared rwlock vmmaplk r = 0 (0xfffffd806c832c90) #0 witness_lock+0x5f1 #1 rw_do_enter_read+0x3e8 #2 uvmfault_lookup+0x122 #3 uvm_fault_check+0x4f #4 uvm_fault+0x106 #5 upageflttrap+0xa9 #6 usertrap+0x42f #7 recall_trap+0x8 Process 20334 (syz-executor) thread 0xffff8000fffe27f0 (175863) exclusive kernel_lock &kernel_lock r = 0 (0xffffffff83952040) #0 witness_lock+0x5f1 #1 unp_connect+0x28c #2 uipc_dgram_send+0x163 #3 sosend+0x804 #4 sendit+0x5a5 #5 sys_sendmsg+0x246 #6 syscall+0xbd4 #7 Xsyscall+0x128 exclusive rwlock sbufsnd r = 0 (0xffff800010fd96d8) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 sblock+0xb6 #3 sosend+0x2e9 #4 sendit+0x5a5 #5 sys_sendmsg+0x246 #6 syscall+0xbd4 #7 Xsyscall+0x128 Process 11485 (syz-executor) thread 0xffff8000fffe8fb0 (470187) exclusive rrwlock inode r = 0 (0xfffffd806bdbf0e8) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 rrw_enter+0xc6 #3 VOP_LOCK+0xbd #4 vn_lock+0xa4 #5 vn_write+0x18f #6 dofilewritev+0x242 #7 sys_write+0xa2 #8 syscall+0xbd4 #9 Xsyscall+0x128 Process 38212 (syz-executor) thread 0xffff8000ffffd4c8 (427909) exclusive rrwlock inode r = 0 (0xfffffd806f0ec208) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 rrw_enter+0xc6 #3 VOP_LOCK+0xbd #4 ufs_ihashins+0x4f #5 ffs_vget+0x187 #6 ffs_inode_alloc+0x279 #7 ufs_mkdir+0xfc #8 VOP_MKDIR+0x101 #9 domkdirat+0x179 #10 syscall+0xb17 #11 Xsyscall+0x128 exclusive rrwlock inode r = 0 (0xfffffd806dcd6ea8) #0 witness_lock+0x5f1 #1 rw_do_enter_write+0x419 #2 rrw_enter+0xc6 #3 VOP_LOCK+0xbd #4 vn_lock+0xa4 #5 vfs_lookup+0x11c #6 namei+0x7ca #7 domkdirat+0x8b #8 syscall+0xb17 #9 Xsyscall+0x128 ddb{1}> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11098 12187K 12267K 166960K 12901 0 pcb 17 15K 16K 166960K 222 0 rtable 223 10K 10K 166960K 852 0 pf 38 18K 82K 166960K 107 0 ifaddr 35 5K 7K 166960K 69 0 ifgroup 51 2K 2K 166960K 116 0 sysctl 2 1K 9K 166960K 7 0 counters 68 36K 37K 166960K 146 0 ioctlops 0 0K 4K 166960K 1714 0 iov 0 0K 20K 166960K 118 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1430 90K 90K 166960K 2056 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 1K 5K 166960K 14 0 VM map 2 1K 1K 166960K 2 0 sem 12 0K 0K 166960K 108 0 dirhash 12 2K 3K 166960K 27 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 17 61K 89K 166960K 833 0 sigio 0 0K 0K 166960K 50 0 proc 72 115K 164K 166960K 603 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 108 0 in_multi 76 5K 7K 166960K 120 0 ether_multi 1 0K 0K 166960K 8 0 mrt 1 0K 0K 166960K 9 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 241 1076K 1076K 166960K 241 0 exec 0 0K 1K 166960K 463 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 241 159K 181K 166960K 9586 0 UVM aobj 30 6K 8K 166960K 34 0 pinsyscall 42 84K 102K 166960K 1999 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 203 0 NDP 11 0K 2K 166960K 47 0 temp 60 8679K 8758K 166960K 48516 0 kqueue 13 20K 33K 166960K 181 0 SYN cache 2 8K 16K 166960K 3 0 ddb{1}> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle plcache 128 26 0 0 1 0 1 1 0 8 0 rtpcb 120 113 0 110 2 0 2 2 0 8 1 rtentry 176 324 0 235 6 0 6 6 0 8 0 unpcb 144 588 0 569 7 3 4 4 0 8 3 syncache 336 11 0 11 1 0 1 1 0 8 1 tcpqe 32 1 0 1 1 0 1 1 0 8 1 tcpcb 736 239 0 234 7 0 7 7 0 8 5 arp 136 87 0 73 1 0 1 1 0 8 0 inpcb 328 948 0 939 9 2 7 7 0 8 5 nd6 152 27 0 6 1 0 1 1 0 8 0 pkpcb 40 4 0 4 1 0 1 1 0 8 1 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1192 31 0 31 1 0 1 1 0 8 1 pppxif 1504 2 0 2 1 0 1 1 0 8 1 pfstscr 40 2 0 2 1 1 0 1 0 8 0 pffrag 232 9 0 2 1 0 1 1 0 482 0 pffrnode 88 9 0 2 1 0 1 1 0 8 0 pffrent 40 12 0 5 1 0 1 1 0 8 0 pfosfp 40 1428 0 1005 5 0 5 5 0 8 0 pfosfpen 112 1428 0 714 21 0 21 21 0 8 0 pfrktable 1344 3 0 1 1 0 1 1 0 8 0 pfanchor 1288 4 0 0 1 0 1 1 0 8 0 pfqueue 320 1 0 1 1 0 1 1 0 8 1 pfstitem 24 2 0 0 1 0 1 1 0 8 0 pfstkey 128 6 0 4 2 1 1 1 0 8 0 pfstate 448 3 0 2 2 1 1 1 0 8 0 pfrule 1360 4 0 2 1 0 1 1 0 8 0 rttmr 136 1 0 1 1 1 0 1 0 8 0 art_heap8 4096 3 0 0 3 0 3 3 0 8 0 art_heap4 256 946 0 564 56 19 37 55 0 8 8 art_table 40 949 0 564 9 0 9 9 0 8 3 art_node 32 323 0 242 3 0 3 3 0 8 1 sysvmsgpl 40 9 0 4 1 0 1 1 0 8 0 semapl 112 105 0 95 1 0 1 1 0 8 0 shmpl 112 26 0 1 1 0 1 1 0 8 0 dirhash 1024 27 0 10 3 0 3 3 0 8 0 dino2pl 256 3073 0 1567 96 0 96 96 0 8 0 ffsino 296 3073 0 1567 118 1 117 118 0 8 0 nchpl 144 4287 0 2594 64 0 64 64 0 8 0 rtmask 32 5 0 5 1 0 1 1 0 8 1 vnodes 216 3471 0 0 193 0 193 193 0 8 0 namei 1024 15835 0 15833 1 0 1 1 0 8 0 percpumem 16 88 0 39 1 0 1 1 0 8 0 vcpupl 3968 2 0 0 1 0 1 1 0 8 0 vmpool 848 4 0 2 1 0 1 1 0 8 0 pfiaddrpl 120 1 0 0 1 0 1 1 0 8 0 kstatmem 264 66 0 40 3 1 2 3 0 8 0 acpiwqpl 32 1 0 1 1 0 1 1 1 8 1 scsiplug 72 5 0 5 1 0 1 1 0 8 1 scxspl 216 21770 0 21768 9 7 2 8 1 8 1 plimitpl 152 444 0 425 1 0 1 1 0 8 0 sigapl 424 1172 0 1105 9 1 8 8 0 8 0 knotepl 120 311 0 0 10 0 10 10 0 8 0 kqueuepl 224 395 0 386 5 2 3 5 0 8 2 pipepl 344 176 0 149 3 0 3 3 0 8 0 fdescpl 528 1134 0 1103 3 0 3 3 0 8 0 filepl 160 7698 0 7470 17 0 17 17 0 8 5 lockfpl 104 352 0 349 1 0 1 1 0 8 0 lockfspl 48 144 0 141 1 0 1 1 0 8 0 sessionpl 144 30 0 21 1 0 1 1 0 8 0 pgrppl 48 147 0 130 1 0 1 1 0 8 0 ucredpl 104 1248 0 1232 1 0 1 1 0 8 0 zombiepl 144 1109 0 1105 1 0 1 1 0 8 0 processpl 1232 1172 0 1105 7 1 6 6 0 8 0 procpl 664 2410 0 2339 8 0 8 8 0 8 1 sosppl 176 6 0 6 1 0 1 1 0 8 1 sockpl 752 1672 0 1641 15 4 11 12 0 8 7 mcl64k 65536 5 0 0 1 0 1 1 0 8 0 mcl16k 16384 3 0 0 1 0 1 1 0 8 0 mcl9k 9216 1 0 0 1 0 1 1 0 8 0 mcl8k 8192 2 0 0 1 0 1 1 0 8 0 mcl4k 4096 109 0 0 14 0 14 14 0 8 0 mcl2k2 2112 1 0 0 1 0 1 1 0 8 0 mcl2k 2048 26 0 0 4 0 4 4 0 8 0 mtagpl 96 4 0 0 1 0 1 1 0 8 0 mbufpl 256 243 0 0 15 0 15 15 0 8 0 bufpl 280 8493 0 2357 439 0 439 439 0 8 0 anonpl 32 10863 0 0 88 0 88 88 0 246 0 amapchunkpl 152 33407 0 32935 42 8 34 42 0 158 12 amappl16 200 3591 0 3549 16 4 12 14 0 8 8 amappl15 192 9 0 9 1 1 0 1 0 8 0 amappl14 184 7 0 7 1 1 0 1 0 8 0 amappl13 176 429 0 427 1 0 1 1 0 8 0 amappl12 168 1547 0 1505 3 0 3 3 0 8 0 amappl11 160 10 0 10 1 1 0 1 0 8 0 amappl10 152 50 0 36 1 0 1 1 0 8 0 amappl9 144 249 0 249 1 1 0 1 0 8 0 amappl8 136 52 0 50 1 0 1 1 0 8 0 amappl7 128 142 0 141 1 0 1 1 0 8 0 amappl6 120 283 0 270 1 0 1 1 0 8 0 amappl5 112 88 0 77 1 0 1 1 0 8 0 amappl4 104 464 0 434 1 0 1 1 0 8 0 amappl3 96 5459 0 5371 4 1 3 3 0 8 0 amappl2 88 1335 0 1259 2 0 2 2 0 8 0 amappl1 80 13896 0 13309 14 0 14 14 0 8 0 amappl 88 8678 0 8515 5 0 5 5 0 92 0 uvmvnodes 80 133 0 0 3 0 3 3 0 8 0 dma8192 8192 1 0 1 1 0 1 1 0 8 1 dma4096 4096 1 0 1 1 1 0 1 0 8 0 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 8 0 8 2 1 1 1 0 8 1 dma128 128 256 0 256 2 1 1 1 0 8 1 dma64 64 6 0 6 1 1 0 1 0 8 0 dma32 32 7 0 7 1 1 0 1 0 8 0 dma16 16 18 0 17 1 0 1 1 0 8 0 aobjpl 72 33 0 4 1 0 1 1 0 8 0 uaddrrnd 24 1134 0 1103 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 1134 0 1103 1 0 1 1 0 8 0 vmmpekpl 168 11512 0 11481 2 0 2 2 0 8 0 vmmpepl 168 80693 0 78784 104 1 103 104 0 357 12 vmsppl 488 1133 0 1103 5 0 5 5 0 8 0 rwobjpl 80 24365 0 23280 29 1 28 29 0 8 1 pdppl 4096 2283 0 2212 104 31 73 83 0 8 2 pvpl 32 19621 0 0 159 0 159 159 0 265 0 pmappl 256 1137 0 1105 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 318 0 53 8 0 8 8 0 8 0 ddb{1}> machine ddbcpu 0 Stopped at x86_ipi_db+0x27: addq $0x8,%rsp ddb{0}> trace x86_ipi_db(ffffffff838a8ff0) at x86_ipi_db+0x27 x86_ipi_handler() at x86_ipi_handler+0xd9 Xresume_lapic_ipi() at Xresume_lapic_ipi+0x27 __mp_lock(ffffffff83951840) at __mp_lock+0x192 intr_handler(ffff80003c4411c0,ffff800000079600) at intr_handler+0xe9 Xintr_ioapic_edge16_untramp() at Xintr_ioapic_edge16_untramp+0x18f __mp_lock(ffffffff83951840) at __mp_lock+0x192 intr_handler(ffff80003c441320,ffff8000002a3480) at intr_handler+0xe9 Xintr_ioapic_edge23_untramp() at Xintr_ioapic_edge23_untramp+0x18f Xspllower() at Xspllower+0x1d pmap_enter(fffffd806c844100,eb6b1e90000,5f08c000,3,22) at pmap_enter+0xc3f uvm_fault_upper(ffff80003c4416f0,ffff80003c441728,ffff80003c4415f0) at uvm_fault_upper+0x338 uvm_fault(fffffd806c832b90,eb6b1e90000,0,2) at uvm_fault+0x198 upageflttrap(ffff80003c441890,eb6b1e90070) at upageflttrap+0xa9 usertrap(ffff80003c441890) at usertrap+0x42f recall_trap() at recall_trap+0x8 end of kernel end trace frame: 0x729a5f8ee900, count: -16 ddb{0}> machine ddbcpu 1 Stopped at db_enter+0x25: addq $0x8,%rsp ddb{1}> trace db_enter() at db_enter+0x25 witness_checkorder(fffffd80768d97a0,9,0) at witness_checkorder+0x10d1 rw_do_enter_write(fffffd80768d9788,1) at rw_do_enter_write+0xba rrw_enter(fffffd80768d9788,1) at rrw_enter+0xc6 VOP_LOCK(fffffd806c4873b0,2001) at VOP_LOCK+0xbd vn_lock(fffffd806c4873b0,2001) at vn_lock+0xa4 vfs_lookup(ffff800037fc9d60) at vfs_lookup+0x11c namei(ffff800037fc9d60) at namei+0x7ca unp_connect(ffff800010fd94f0,fffffd806f2db500,ffff8000fffe27f0) at unp_connect+0x29d uipc_dgram_send(ffff800010fd94f0,fffffd805fbbac00,fffffd806f2db500,0) at uipc_dgram_send+0x163 sosend(ffff800010fd94f0,fffffd806f2db500,ffff800037fc9fe8,0,0,e) at sosend+0x804 sendit(ffff8000fffe27f0,4,ffff800037fca168,e,ffff800037fca220) at sendit+0x5a5 sys_sendmsg(ffff8000fffe27f0,ffff800037fca2d0,ffff800037fca220) at sys_sendmsg+0x246 syscall(ffff800037fca2d0) at syscall+0xbd4 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x68316a01050, count: -15