program: syz_80211_inject_frame(&(0x7f0000000100)=@device_b, 0x0, 0x7b) socket$nl_route(0x10, 0x3, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x55, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7b, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x32, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x2007}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$FS_IOC_RESVSP(r2, 0x40305828, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(0xffffffffffffffff, 0x54a1) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$bcachefs(&(0x7f00000000c0), &(0x7f0000000180)='./bus\x00', 0x0, &(0x7f0000000480)=ANY=[@ANYRES8], 0xff, 0x5975, &(0x7f000001c640)="$eJzs3X+MHNWdIPBX3T2e9ox/jA0sDoTxYPAuC5t4zC+RsNp493bJCljkiFUWc05gwGPWiW0s2yxg2MXsQQ4ERGSVVUKSP0hE0JE4ERJcgoNC+HE2l5AgLjl0IuiSO5I/ciIcVgAfinKZ1UzX6+mu6Zrq6enxD/h85Jnqev36+15Vva6u7+v2dAAAAOBdYf/tOw5ecsJf/eCfR9+65a+/s+XW0F+eKK/GCgPp8obD1UMOpd7Ksolldlz80U1f++XQ1X/x/Yf7vvr2vg0nb/zpXx5z9eOfuHDvfV986s2Fj/7+laK4cTydPrmevJaEUP3ugX/91L7njh8vS0II5VDaHcKSZOlTS5JMiOHfhhA2jMfoDWFZ5s5H3jpr4/jy1rt6m8oXZ+oZ7+9u1XSc7Tp4/RnhZ3++7rYfLf/mN3r2vLp7skpSbRhPISy6svHxPSGE+enPuDja4niMg3ZtCKGv4XHnFfTrlDb7vypn/cR0OS9d9hfEifevyKyXMvWy61FPZtlX0N5s5fWj03pFFmTWsyej2crrZyxfki6/nS5Pn2H8cvxJQikJlXr3NyeTYyQ0HLckJBPHslpfL9WPbUi3P7OeZNZLmfVyT2a7JtpNB1o5SZrLY71MeTwdV9LykxvP1S1cmlP+nnRZTZ+ob8f1kL1R0z/lRn27JsR+HZimL4dCqeEc1Kq8fuDTg9GflvUnS6c8ZqyFeN++dXevLK9/ev9ATj+Sh5M0ftJR/F0/XLLg41+/87rs63o9/pWlNH6po/g/v+j51y+/8ytfyI1/b4xf7ij+mU/0vXbRM7evyN0/B+L+qXQUf+SVZ+9ZfuxVe3L7f3+MX+0o/pq9z/cuPPjEk7n9H477Z35H8V8+/4JfPPTiY6/mxg8xfl9H8dfv3fbp3sGDp+XGfzLun/7Oxs8be859aXDwV3kvBMkLMf7CjuI/uPu+Dz6w+K4Lc4/v2rh/BjqKf/Gpj9+24OBjJ+WdO5P7u/XKCfDudEx6jXVHut5pnjlbDfnC54cqtWu+BenPwm42lLn4HG9nUTfjAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAI4bgz/uuH//dHB16rpOu96Y2XS7VlLJ8XQjI/hLBj58j2nZu2XjP0iWuv2751ZPPQyM6h0a07t984dPafDG0f3bZ55Mbxe4ffd1btcUtDUlsmJ01pu3dsbKw00FwW2/t3p+752crz/s+vQxg+7ieDldz+r7pvywPHtvidkawZ+9CW6y75yTlfTrdrIO3XQIt+jY2NjYWcfv3fy373wL8c+OVpIQz/wXT9evblP/teU4cmCibjpEq9odah3qSvZT/qvU77E/dXZeOmzaPD0+/f8ceXc7bj39/06m833vCZ39X2bzV3O9rcv/PXjG0ufW7dxf//czfXCor6dbiOe9H+jlsR+xf3XzXd34vS7VqUs12VnO26/UdPvvjdE+58c3cYrryxfGrbRdvVkw6AnuQ9bbUbW+hLljSVV9P68YjHx63auWXbqh037nrfpi0j14xeM7r1A6vPXn3u8DnnnrNqYstXdXn7Y/t/2Ob2H5rxtPgfdn87/m5vPBX1q2h/jPereH809ijv+dd36ac++4H7nrmkVlA0zmPt+vkkXfaNH+fVoWG8Td1XrbaraD+EEIZa7YfX37wwHP8/Nt1WdB5qPDKNvzOSNWPPrfjNl8/70rI/rRUckvN8Y4c6PM/Xez3Zn4n9VU2Px9gRun97Qzndrv6W/Vr93DM9d+//9T/W+zdvXrhhZOfO7atrvxekPV2QnNiyX9nSuF3LJ36XQ7pbQn2Ythiv43pCrX/Z82esnt2r/el9/cnSltuVFe/bt+7uleX1T+/P29PJw7UW54eFtWXy3pyamzMPLNc73Kr9I/X5VzQ+Bj/8pUc/+ui3zp4yPs6s/S7ariRnu7754oOf/epn/uO3urddH/6z5wd+8z//fmWt4Ig/r5RrHan3Ou1P0nheOTOEouff8tB6O3Kff6XW21P0/Mu2M1m/dbyhzHp/KHf0fD3zib7XLnrm9hW5z9cD7T5fb25aKxc8X4+U8ZN9fiWV5n7M3fOraaAka8a+f8cxu5+6Ze0JtYKi18t67Vbj+qw28o+c7fre5S8NXjv0H/57984bX/uTR6746ciaf6oVdH7cY1+6c9yr6f6t5uzfeq9j3tm4f99/9bWbN9TKj9zr33RZkP/EU8mOG3d9cmTz5tHtO9rbrnZfT2M72b3c6etpPLstLdiu0pTtmrsb7eyvdp9vsf8bOt5fzc+3/pB09Lqw64dLFnz863deNzDlUWlDV5bS+KWO4v/8oudfv/zOr3whN/69MX6lo/gjrzx7z/Jjr9qTG//+JI1f7Sj+mr3P9y48+MSTufGHY//ndxT/5fMv+MVDLz72am78EOP3d7b/39hz7kuDg7/Kjf9CkrYzfo0UwiNvnbWxtp6EnvT5FvvR09SvkF1PMuulzHq5cb1Um2utN1BOkubyWC8tP7mhL638XU55vAqrLqst347rIXtj+vIjTanh3N+qvOg6FQDgnS6+/x+vQeP7/6PphVIld0YdJs02D1uWEzfmYZPzOfOa7l+Wxo+Pj/OAg+8Pw+PLW4dqF/ozfR8hPh+y85yxndNOaY7R6Txn0fz7isx67FdtvrzSkIempuY1ldDG/PvUdqaff89sfvH8+NAdU7o11DBvlT1+PemMWavPO2T6WxmPkDc+svNi8fMcg4vC2on22hwf2c/RxOOQ/RxNbOeEzIRrp5+jme34iN2eZnxMdLn4/Y2pxy9Ms38nj1/raNnjN4PjXR2vP9fvz3Zh3rDlKW3G84aV0Hy+bHvecG7fDzMvmRM/fYId6fOGsTxuR6XN+cSP5pR3az4xni5ivw5M05dDwXwi8E4V8//4GjGe/49fgP+/TL2i69DsVWOMl/s5oXLr/hTlHVM/p9fX0ev4+r3bPt07ePC03OucJ9v93M+2prW+gs/9FO3HlZn1wv2Y81GQonwv207Rfs9+LqM/LOxovz+4+74PPrD4rgtz9/va2gtp8X7/bNPawoL9fhTkC63jH7LPGcgXWsY/Sj7HUDR/dtjykfSDT3OVj/xtTvlM85G+KTfq2zXhyM1HJl9Im/KRnkPbLwDg6BHz//r7Z2n+/79ihfQ6oihvPT2zHuPl5q051yd5eevfpMsbMvX70/9RMdPr5otPffy2BQcfOyk3b7m/3Tz0PzWtDeTmoYvTGrPLm3PziLXd+bx4bh5Rz7Nmlyfm9r+eJ84uT8+NX8/TZ5dH5+6feh49u3mA3Pj1eYCjPc8tmK/LNBZX252vOyx59KLm7ZyTPDr977NzlUdfmlM+0zy6f8qN+nZNOHLz6OZyeTQA8E4V8/94GRfz/2cy9Wb7PntuXtCl6/bs3wOpx3/hUOWVc533zXXeOtd5/VzPSxztefFczwvN7TzZYXt/+UjJi9NGj/a8uCIvBgB4R4v5//x0PT//n11+0ip/62nKT46+/Lyxnvw8J/47Jj8/2ue/5P/eFy/mfXEAgHe2mP/H//YY//7ff0nXs3+3/mjM04P30eXpR02e3v15tuBzAId3HmD+ZH3zAAAAHA49E5nS1P9n/7F0mf1/9nn/L//ynPrtqqSXx1ft3D46esV12zaM7By9Yuu1G0Z3XHH99k07d45urdWbbd6Ym7ekeWNPqKT7o3W9bN62OP17CItz/h5Ctn4Me+LEjal/DyHb7PwWf0fgtobtmzx+7fU37/iVpqnfanzkHe+8+H+XUz+qH/+r//7MKzbuuGLT1k07N41s3rRrtLneeNbaN4PvzUzSnxl9X2rm1xSlmX9/Zzw8s+tHaUo/etL9kff97EmmH0vSnizJ+/6DnH7/4L/9yz+cOva7h0IYPq783lntv2TN2H++bPRvdu7/ybbx/pem7X+9Ztqvou8rzdaP21PZfO2OnWdsvPa6rdlvlOxMnM8o1dfnaD4jffqX25yfWJ9TPtPPKZSn3DgytT0/AQBAk/j+f7yeje8ffia9gIrl7efps3v/ODdPH24vT89+L1lRnp6tH7e33Ty9WvB354vy9Gz7RXl6q/qt8vS8vDsv/t/m1J+p9sfJ7D7nkTtOrmxvnGS/z6BonGTrz3ScJLMcJ9n2i8ZJq/qtxknecc+L/5Gc+nmKxkOlPh5m97mc3PFwb3vj4Y8z60XjIVt/puOhNMvxkG2/aDy0qt9qPOQd37z4l+TUb1fz+BgfGBPjYvSK66/d/smGenP9/Rcd9m/eZP/m9vs/OtX+/p3bz33Nff/n9nNlc9//2X2uLLf/L8xuJqz9/s/t97tk5FWf+vhDNV+bngmKPn9WNI+7Lqd8pvO486bcODKZx4XDJ+b/8e2emP/flS67/TbQ0f89ab7HrGX8Ln2PWdF1jNfz5vIj7fXR6zkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAe3oryyaW+2/fcfCSE/7qB/88+tYtf/2dLbf+0U1f++XQ1X/x/Yf7vvr2vg0nb/zpXx5z9eOfuHDvfV986s2Fj/7+lcLAAxO/K6enq9UQkteSEKrfPfCvn9r33PHjZUkIoZwM7A5hSbL0qSVJJsLwb0MIG+r9bL7zkbfO2ji+vPWu3qbyxZkg2e0K/eXYn8Z+hnBD4RZxFKqm42zXwevPCD/783W3/Wj5N7/Rs+fV3ZNVkmrDeAph0ZWNj+8JIcxPf8bF0bYsPjhdrg0h9DU87ryCfp3SZv9X5ayfmC7npcv+gjjx/hWZ9VKmXnY96sks+wram628fnRar8iCzHr2ZDRbef2M5UvS5bfT5ekzjF+OP0koJaFS7/7mZHKMhIbjloRk4lhW6+ul+rEN6fZn1pPMeimzXu7JbNdEu+lAKydJc3mslymPp+NKWn5y47m6hUtzyt+TLqvpE/XtuB6yN2r6p9yob9eE2K8D0/TlUCg1nINaldcPfHow+tOy/mTplMeMtRDv27fu7pXl9U/vH8jpR/JwksZPOoq/64dLFnz863detywv/pWlNH6po/g/v+j51y+/8ytfyI1/b4xf7ij+mU/0vXbRM7evyN0/B+L+qXQUf+SVZ+9ZfuxVe3L7f3+MX+0o/pq9z/cuPPjEk7n9H477Z35H8V8+/4JfPPTiY6/mxg8xfl9H8dfv3fbp3sGDp+XGfzLun/7Oxs8be859aXDwV0N58V+I8Rd2FP/B3fd98IHFd12Ye3zXxv0z0FH8i099/LYFBx87Ke/cmdzfrVdOgHenY9JrrDvS9U7zzNlqyBc+P1SpXfMtSH8WdrOhjPF2Fs1hfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA3pl+fPPZH7vsQx9ZV0lCSHLqjLUQ7yvPW7NmqIN2R1559p7lx161p7FsWQdxAAAAgGIxDy/VS6phWbg+mR9ObFk/zhGcGNeS5vLsHEKMk50j6DROqUtxyl2KU2kvzgULCuL0dKk/87oUp7dLcaoFcaqhvTjzp4lTGR8Vbfanb9r+tB+nv0txFnQpzsIuxVnUpTiLuxRnYNo47Y/DJV2Ks7RLcY7pUpxjuxTnuC7F+YMuxTm+S3Gyc8ozHYcL05on5MWZuFEujFNJyvU7Ws2nH5+2c9Is2+kvaGdh0etxm+3Mb7OdUzKPK7XbTnpCq7bZzh922k5cb7OdP55lO6WCduK4vSHbv9hOXGtz/N/YpTi7uhTnpi7FublLcf6xS3H+qUtxbpllHIB2xfx/Mt8bCL2VPw196RknOwsQ893lE7+nvt7lnZBivPdmyucVxcsm6pl4y2fav+wEQibeikx5T1O8Sj0fmSZetTHeysyd023v+Wta960x3umZ8t5p4jVtAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcAj+++eyPXfahj6wLSRj/19JYC/G+8rw1a4Y6aHffurtXltc/vb+xrLfSQSAAAACgUMzDe+ol1dBbWR16k3lN9arpPEA1XS8P1JaDi8La8WUyVJpY70uWTPu4Svq4VTu3bFu148Zd79u0ZeSa0WtGt35g9dmrzx0+59xzVm3ctHl0uPY7hN6CeCGEiemHHTfu+uTI5s2j23fUCrP9X5Y+blm6nqSPG3x/GB5f3pr2f2lBe6Up7c3djeKjBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwb+zaXYhcVx0A8HNnZmem28aM9Gsams2QjxK1ahK3kmrpXBAsNB9kKchMdS3BJljcNKFNSqxjG7CtCYrQEgiRPBiJxdbiSz9sEftBIFKjATcGaYvmQR+UVitpyYOkjGR37uzM7ExnHUq3TX+/h3vv/M//nP8987DwPzsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw/pqsjY5XymPV4SiEqEdOvYtkLJ2N49IAdb/23I4f5UbOrmyN5TIDLAQAAAD0lfThQ81IPuQy6ZAOV019WhpaBsJM3w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHz0TNZGxyvlserFUQhRj5x6F8lYOhvHpQHqnn7ric+/MjLyj9ZYcYB1AAAAgP6SPjzVjORDMSwLQ9FVbXnJ2cCijvmdeck6i+eY13l20Ctv2Rzzrplj3if65G1s3HcHAAAA+PBL+v9MM1IIucyCnv1/v74+yVvSkZdu3Of+W4HsnDMBAACAd5f0/7lmpBhymWKzX59rv7+0Iy+Z3+//9sn8FT3m9/t//obG3f/pAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODDY7I2Ol4pj1XTUQhRj5x6F8lYOhvHpQHqrnl++F/rjj64tDWWywywEAAAANBX0ofPtN75kMsMh6Fw8VTfP3LToae+8tQzoyGE6TY/mw27N+/cedea6WuSt/r40aEfHnvju7PyVk9f522DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAe2ayNjpeKY9VL4pCiHrk1LtIxtLZOC4NUPe1L375b4+devb11lhxgHUAAACA/pI+fKb3z4diyIZsuGLqU2uvf16qY36vMwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgwnH3t+/91uaJiS13efDgwUPzYb7/MgEAAO+1JSEK9f/TlZvm+60BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAPgsna6HilPFbNRyFEPXLqXSRj6WwclwaoGz93Irfg7PMvtsaKA6wDAAAA9Jf04TO9fz4Uw1AYCpdPfep2JjDV/xfex5cEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPlAma6PjlfJYdUEUQtQjp95FMpbOxnFpgLqP7jn4hSMLf3BzayyXGWAhAAAAoK+kD882I/mQy3wy5MLVjc8T7ROidOPe/VxgZt6OtmnDc55Xa5uXnvO8vR07yzR2Mz0vn6xXmL4355Vmzyu1zCuGZvlS27ywv23Wgj7vGQAAAGAeJf1/rhkphFwm19Ln/rwtv6DPBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB6mKyNjlfKY9UoCiHqkVPvIhlLZ+O4NEDde3//8Uu+/ot9u1pjxQHWAQAAAPpL+vCZ3j8fimFx+FhYPNX3h0J7fpL378q5I4/85+8rQ1h1xcmRTOeyP0kefvvajS90XkJItWenQljYqBf1qPe7Pz5yz/L6ucdCWHV5+upZ9cK712tfMq4/XdmyYeexkzv6fDkAAABwgUj6/6FmpBBymTt79v9J592n/2+aasAX3rPnV5c1ro2OvGNGqtCol+pR70vLn/jrirX/fON8/z+73qebT589uO3IZW0FpyMdorhe3rZr48nrDqeSXU/XT3fUT76Xr37n9f9u3f3wuen6+ZBvxBd1vMp0tdnXjvIhrk+kDlTXv3Og1l4/02P/D/7hxVO/WbTv7fP131oy3Kx/TehWv3XnXfd/UVwfvuWh/dcfPLqxvX4IodSt/ptv3xyu/PMdD3Tuf7hj4dZvvvXa+QXE9eNLzxxee6h4Q3v9qKN+8v3/8tSj+3/28PefSeonvxVZuWyu9VMd9V/ee+mel+7ftKi9fqrH/l+49ZWR7aXv/alz/7e3rZrp+Raz9//4tU/e9urm+L7OIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAvLZG10vFIeq6aiEKIeOfUukrF0No5LA9Q9ve7Em7fu++mPW2PFAdYBAAAA+kv68JnePx+KIRuyYXiq73+6smXDzmMnd4TC9GjUuGcmtt+981Nbt++68/Z5enMAAABgrk6vi6b6/0wzUgi5zPIw1Oj/y9t2bTx53eFU0v+nzt+jEMLWOya2rArNvJf3Xrrnpfs3LWqeE4Qw9bOA/Pm8z83k3XTjicKZv3xzRde8NTN5x5eeObz2UPGGJC+05q0OzfOJx6998rZXN8f3Nd+vNe8z39g+0TieSNYdvuWh/dcfPLoxlZxjNO7DjXWTvInUger6dw7Ukrx0455v7BsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmG2yNjpeKY9VQzqEqEdOvYtkLJ2N49IAddcv//UDl5x9dnFrLJcZYCEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+xw4cCAAAAAAA+b82QlVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVRX26y9EqrKPA/jzzOy+O+7s6q6+0Fa0rlYUdpEURNRNRUVohNCVIWFpXkRBEFHYRWtoJFZ0E2TdSFRQbSEU5CaJFmv0T7rpooIC6yIQaaEcpIuKnXnOOHuc49TZCqrPB4Znnuec8z2/c55nzswAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPyjDPSNNdvDO+5v3HLODR89eteJR256595tFz386ncTm677cO/gSydnNq/Y8uX1yzbtv3vN9O7nD/00/NYvR3sGP9RqVqVuLYR4PIZQe3f2mcdmPj5rbiyGEKpxZDKE0bj00GjMJaz+OYSwuV3n/I1vnrh8y1y7bdfAvPEluZD8dYV6NaunZWR+vfy71NI629p48JLw9bXrt3+6/I3X+6eOTZ7aJdY61lMIizd2Ht8fQliUXnOy1TaWHZzadSGEwY7jruxR1/m/s/5LC/rnpvZ/qa33yMm2r8z1K7n98v1Mf64d7HG+hSqqo+x+vQzl+vmH0UIV1ZmNj6b27dSu+oP51ewVQyWGvnb598RTayR0zFsMsTmXtXa/0p7bkK4/14+5fiXXr/bnrqt53rTQqjHOH8/2y41nj+O+NL6i81ndxa0F42entpY+qCezfsi/aamf9qZ9XU1ZXbNnqOXvUOl4BnUbb098mox6GqvHpacd82sX2baZ9U9cWN3w3uGRgjri3pjyY6n8rZ+MDt3+2s4HxoryN1ZSfqVU/jdrj/xw284XnivMfzrLr5bKv+zA4PG17+9YWXh/ZrP701cq/46jHzy5/P93TnWb62b+niy/Vir/mukjA8ONAwcL61+d3Z9FpfK/uvrGb1/5fN+xwvyQ5Q+Wyt8wfd9TA+ONiwvzD7Y+CvXmCi2xfn6cuuKL8fHvJ4ryP8vu/3CX/Ngz/+XJ3Ve9uGTXmsL1uS67PyOl6r/5gv3bhxr7zit6dsY9f9Y3J8B/07L0G+vx1C/7P3OhOv4vPDvR1/oGGkqv4ebwmX5Flzd3nsV/STIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAb+zAAQkAAACAoP+v2xEoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABnBQAA//8vLCJz") [ 61.869149][ T5315][ 58.970585][ T5301] Bluetooth: hci0: command tx timeout [ 59.013131][ T5315] loop0: detected capacity change from 0 to 32768 [ 59.094575][ T5315] bcachefs (loop0): starting version 1.7: mi_btree_bitmap opts=errors=continue,metadata_checksum=none,data_checksum=none,compression=lz4,nojournal_transaction_names,nocow [ 59.102630][ T5315] bcachefs (loop0): recovering from clean shutdown, journal seq 10 [ 59.105763][ T5315] bcachefs (loop0): Version upgrade required: [ 59.105763][ T5315] Version upgrade from 0.24: unwritten_extents to 1.7: mi_btree_bitmap incomplete [ 59.105763][ T5315] Doing incompatible version upgrade from 0.24: unwritten_extents to 1.20: directory_size [ 59.105763][ T5315] running recovery passes: check_allocations,check_alloc_info,check_lrus,check_btree_backpointers,check_backpointers_to_extents,check_extents_to_backpointers,check_alloc_to_lru_refs,bucket_gens_init,check_snapshot_trees,check_snapshots,check_subvols,check_subvol_children,delete_dead_snapshots,check_inodes,check_extents,check_indirect_extents,check_dirents,check_xattrs,check_root,check_unreachable_inodes,check_subvolume_structure,check_directory_structure,check_nlinks,set_fs_needs_rebalance [ 59.139524][ T5315] bcachefs (loop0): error validating btree node on loop0 at btree dirents level 0/0 [ 59.139574][ T5315] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0 [ 59.139585][ T5315] node offset 16/24: btree node data missing: expected 24 sectors, found 16, fixing [ 59.153195][ T5315] bcachefs (loop0): btree_node_read_work: rewriting btree node at due to error [ 59.153195][ T5315] btree=dirents level=0 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq 9aa2895aefce4bdf written 24 min_key POS_MIN durability: 1 ptr: 0:41:0 gen 0 [ 59.162425][ T5315] bcachefs (loop0): error validating btree node at btree alloc level 0/0 [ 59.162439][ T5315] u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 59.162449][ T5315] node offset 8/24 bset u64s 375 bset byte offset 184: keys out of order: u64s 11 type alloc_v4 0:32:0 len 0 ver 0 > u64s 11 type alloc_v4 0:2:0 len 0 ver 0, fixing [ 59.177455][ T5315] bcachefs (loop0): btree_node_read_work: rewriting btree node at due to error [ 59.177455][ T5315] btree=alloc level=0 u64s 11 type btree_ptr_v2 SPOS_MAX len 0 ver 0: seq ac62141f8dc7e261 written 24 min_key POS_MIN durability: 1 ptr: 0:26:0 gen 0 [ 59.190374][ T5315] ================================================================== [ 59.193336][ T5315] BUG: KASAN: use-after-free in bch2_btree_node_read_done+0x1015/0x5f70 [ 59.196292][ T5315] Read of size 8 at addr ffff888045170010 by task syz.0.0/5315 [ 59.199018][ T5315] [ 59.199940][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted 6.13.0-syzkaller-08291-g805ba04cb7cc #0 [ 59.199956][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 59.199963][ T5315] Call Trace: [ 59.199969][ T5315] [ 59.199976][ T5315] dump_stack_lvl+0x241/0x360 [ 59.199993][ T5315] ? __pfx_dump_stack_lvl+0x10/0x10 [ 59.200004][ T5315] ? __pfx__printk+0x10/0x10 [ 59.200018][ T5315] ? _printk+0xd5/0x120 [ 59.200034][ T5315] ? __virt_addr_valid+0x183/0x530 [ 59.200051][ T5315] ? __virt_addr_valid+0x183/0x530 [ 59.200065][ T5315] print_report+0x169/0x550 [ 59.200080][ T5315] ? __virt_addr_valid+0x183/0x530 [ 59.200093][ T5315] ? __virt_addr_valid+0x183/0x530 [ 59.200106][ T5315] ? __virt_addr_valid+0x45f/0x530 [ 59.200120][ T5315] ? __phys_addr+0xba/0x170 [ 59.200136][ T5315] ? bch2_btree_node_read_done+0x1015/0x5f70 [ 59.200148][ T5315] kasan_report+0x143/0x180 [ 59.200162][ T5315] ? bch2_btree_node_read_done+0x1015/0x5f70 [ 59.200177][ T5315] bch2_btree_node_read_done+0x1015/0x5f70 [ 59.200199][ T5315] ? __pfx_bch2_btree_node_read_done+0x10/0x10 [ 59.200210][ T5315] ? __pfx_lock_release+0x10/0x10 [ 59.200222][ T5315] ? __lock_acquire+0x1397/0x2100 [ 59.200238][ T5315] ? bch2_bkey_pick_read_device+0x1561/0x1850 [ 59.200252][ T5315] ? bch2_bkey_pick_read_device+0x221/0x1850 [ 59.200264][ T5315] ? __pfx_bch2_bkey_pick_read_device+0x10/0x10 [ 59.200274][ T5315] ? bch2_btree_ptr_v2_to_text+0x209/0x2f0 [ 59.200286][ T5315] ? __pfx_bch2_btree_ptr_v2_to_text+0x10/0x10 [ 59.200300][ T5315] btree_node_read_work+0x6dc/0x1380 [ 59.200317][ T5315] ? __pfx_btree_node_read_work+0x10/0x10 [ 59.200329][ T5315] ? bch2_latency_acct+0x47b/0x550 [ 59.200341][ T5315] ? __pfx_bch2_latency_acct+0x10/0x10 [ 59.200352][ T5315] ? bio_associate_blkg+0x6c/0x230 [ 59.200365][ T5315] bch2_btree_node_read+0x2433/0x29f0 [ 59.200383][ T5315] ? bch2_trans_unlock+0x35e/0x480 [ 59.200398][ T5315] ? __pfx_bch2_btree_node_read+0x10/0x10 [ 59.200411][ T5315] ? __pfx___bch2_btree_node_hash_insert+0x10/0x10 [ 59.200426][ T5315] ? bch2_trans_unlock+0x3b5/0x480 [ 59.200442][ T5315] bch2_btree_root_read+0x617/0x7a0 [ 59.200455][ T5315] ? __pfx_bch2_btree_root_read+0x10/0x10 [ 59.200468][ T5315] ? bch2_current_has_btree_trans+0x142/0x180 [ 59.200478][ T5315] read_btree_roots+0x3d3/0xa70 [ 59.200494][ T5315] ? __pfx_read_btree_roots+0x10/0x10 [ 59.200506][ T5315] ? journal_replay_entry_early+0x4d/0xb70 [ 59.200519][ T5315] ? bch2_sb_upgrade+0x1d0/0x250 [ 59.200532][ T5315] ? bch2_recovery_passes_from_stable+0x104/0x120 [ 59.200545][ T5315] bch2_fs_recovery+0x260f/0x3de0 [ 59.200562][ T5315] ? __pfx_bch2_fs_recovery+0x10/0x10 [ 59.200581][ T5315] ? __pfx_lock_release+0x10/0x10 [ 59.200594][ T5315] ? bch2_get_next_online_dev+0x2b/0x4f0 [ 59.200606][ T5315] ? __pfx_lock_release+0x10/0x10 [ 59.200622][ T5315] ? bch2_get_next_online_dev+0x2b/0x4f0 [ 59.200634][ T5315] ? bch2_get_next_online_dev+0x4b9/0x4f0 [ 59.200646][ T5315] ? bch2_get_next_online_dev+0x2b/0x4f0 [ 59.200659][ T5315] ? llist_reverse_order+0x72/0x90 [ 59.200674][ T5315] bch2_fs_start+0x37c/0x610 [ 59.200688][ T5315] bch2_fs_get_tree+0xd8d/0x1740 [ 59.200707][ T5315] ? __pfx_bch2_fs_get_tree+0x10/0x10 [ 59.200723][ T5315] ? generic_parse_monolithic+0x387/0x400 [ 59.200738][ T5315] ? rcu_is_watching+0x15/0xb0 [ 59.200750][ T5315] ? apparmor_capable+0x13b/0x1b0 [ 59.200763][ T5315] vfs_get_tree+0x90/0x2b0 [ 59.200780][ T5315] do_new_mount+0x2be/0xb40 [ 59.200792][ T5315] ? __pfx_do_new_mount+0x10/0x10 [ 59.200806][ T5315] __se_sys_mount+0x2d6/0x3c0 [ 59.200818][ T5315] ? __pfx___se_sys_mount+0x10/0x10 [ 59.200837][ T5315] ? do_syscall_64+0x100/0x230 [ 59.200896][ T5315] ? __x64_sys_mount+0x20/0xc0 [ 59.200909][ T5315] do_syscall_64+0xf3/0x230 [ 59.200923][ T5315] ? clear_bhb_loop+0x35/0x90 [ 59.200941][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.200958][ T5315] RIP: 0033:0x7fb35258e4ca [ 59.200969][ T5315] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 59.200979][ T5315] RSP: 002b:00007fb353454e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 59.200993][ T5315] RAX: ffffffffffffffda RBX: 00007fb353454ef0 RCX: 00007fb35258e4ca [ 59.201003][ T5315] RDX: 00000000200000c0 RSI: 0000000020000180 RDI: 00007fb353454eb0 [ 59.201011][ T5315] RBP: 00000000200000c0 R08: 00007fb353454ef0 R09: 0000000000000000 [ 59.201019][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000180 [ 59.201026][ T5315] R13: 00007fb353454eb0 R14: 0000000000005975 R15: 0000000020000480 [ 59.201040][ T5315] [ 59.201044][ T5315] [ 59.367997][ T5315] The buggy address belongs to the physical page: [ 59.370298][ T5315] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x45170 [ 59.373534][ T5315] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 59.376155][ T5315] raw: 04fff00000000000 ffffea0001145d08 ffff88801fc44be0 0000000000000000 [ 59.379061][ T5315] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 59.382235][ T5315] page dumped because: kasan: bad access detected [ 59.384662][ T5315] page_owner tracks the page as freed [ 59.386653][ T5315] page last allocated via order 2, migratetype Reclaimable, gfp_mask 0x452cd0(GFP_KERNEL_ACCOUNT|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_RECLAIMABLE), pid 5315, tgid 5314 (syz.0.0), ts 59065160483, free_ts 59187847126 [ 59.394326][ T5315] post_alloc_hook+0x1f4/0x240 [ 59.396124][ T5315] get_page_from_freelist+0x365c/0x37a0 [ 59.398141][ T5315] __alloc_frozen_pages_noprof+0x292/0x710 [ 59.400289][ T5315] __alloc_pages_noprof+0xa/0x30 [ 59.402132][ T5315] ___kmalloc_large_node+0x8b/0x1d0 [ 59.404096][ T5315] __kmalloc_large_node_noprof+0x1a/0x80 [ 59.406165][ T5315] __kmalloc_node_noprof+0x33a/0x4d0 [ 59.408111][ T5315] __kvmalloc_node_noprof+0x72/0x190 [ 59.409985][ T5315] btree_node_data_alloc+0xdb/0x260 [ 59.411884][ T5315] __bch2_btree_node_mem_alloc+0x1d8/0x3e0 [ 59.413972][ T5315] bch2_fs_btree_cache_init+0x27a/0x630 [ 59.415971][ T5315] bch2_fs_open+0x2890/0x2d50 [ 59.417662][ T5315] bch2_fs_get_tree+0x738/0x1740 [ 59.419484][ T5315] vfs_get_tree+0x90/0x2b0 [ 59.421155][ T5315] do_new_mount+0x2be/0xb40 [ 59.422781][ T5315] __se_sys_mount+0x2d6/0x3c0 [ 59.424484][ T5315] page last free pid 5315 tgid 5314 stack trace: [ 59.426760][ T5315] free_frozen_pages+0xe0d/0x10e0 [ 59.428650][ T5315] __folio_put+0x2b3/0x360 [ 59.430280][ T5315] free_large_kmalloc+0xfe/0x180 [ 59.432075][ T5315] kfree+0x212/0x430 [ 59.433528][ T5315] bch2_btree_node_read_done+0x3b1f/0x5f70 [ 59.435635][ T5315] btree_node_read_work+0x6dc/0x1380 [ 59.437594][ T5315] bch2_btree_node_read+0x2433/0x29f0 [ 59.439578][ T5315] bch2_btree_root_read+0x617/0x7a0 [ 59.441469][ T5315] read_btree_roots+0x3d3/0xa70 [ 59.443347][ T5315] bch2_fs_recovery+0x260f/0x3de0 [ 59.445216][ T5315] bch2_fs_start+0x37c/0x610 [ 59.446935][ T5315] bch2_fs_get_tree+0xd8d/0x1740 [ 59.448816][ T5315] vfs_get_tree+0x90/0x2b0 [ 59.450446][ T5315] do_new_mount+0x2be/0xb40 [ 59.452089][ T5315] __se_sys_mount+0x2d6/0x3c0 [ 59.453833][ T5315] do_syscall_64+0xf3/0x230 [ 59.455456][ T5315] [ 59.456344][ T5315] Memory state around the buggy address: [ 59.458452][ T5315] ffff88804516ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 59.461400][ T5315] ffff88804516ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 59.464382][ T5315] >ffff888045170000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 59.467282][ T5315] ^ [ 59.468990][ T5315] ffff888045170080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 59.471947][ T5315] ffff888045170100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 59.474878][ T5315] ================================================================== [ 59.486213][ T5315] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 59.489021][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted 6.13.0-syzkaller-08291-g805ba04cb7cc #0 [ 59.492845][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 59.496808][ T5315] Call Trace: [ 59.498083][ T5315] [ 59.499207][ T5315] dump_stack_lvl+0x241/0x360 [ 59.500992][ T5315] ? __pfx_dump_stack_lvl+0x10/0x10 [ 59.502934][ T5315] ? __pfx__printk+0x10/0x10 [ 59.504714][ T5315] ? preempt_schedule+0xe1/0xf0 [ 59.506528][ T5315] ? vscnprintf+0x5d/0x90 [ 59.508183][ T5315] panic+0x349/0x880 [ 59.509638][ T5315] ? check_panic_on_warn+0x21/0xb0 [ 59.511525][ T5315] ? __pfx_panic+0x10/0x10 [ 59.513212][ T5315] ? _raw_spin_unlock_irqrestore+0x130/0x140 [ 59.515370][ T5315] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 59.517673][ T5315] ? print_report+0x502/0x550 [ 59.519367][ T5315] check_panic_on_warn+0x86/0xb0 [ 59.521183][ T5315] ? bch2_btree_node_read_done+0x1015/0x5f70 [ 59.523326][ T5315] end_report+0x77/0x160 [ 59.524906][ T5315] kasan_report+0x154/0x180 [ 59.526590][ T5315] ? bch2_btree_node_read_done+0x1015/0x5f70 [ 59.528714][ T5315] bch2_btree_node_read_done+0x1015/0x5f70 [ 59.530790][ T5315] ? __pfx_bch2_btree_node_read_done+0x10/0x10 [ 59.533012][ T5315] ? __pfx_lock_release+0x10/0x10 [ 59.534850][ T5315] ? __lock_acquire+0x1397/0x2100 [ 59.536650][ T5315] ? bch2_bkey_pick_read_device+0x1561/0x1850 [ 59.538784][ T5315] ? bch2_bkey_pick_read_device+0x221/0x1850 [ 59.540973][ T5315] ? __pfx_bch2_bkey_pick_read_device+0x10/0x10 [ 59.543182][ T5315] ? bch2_btree_ptr_v2_to_text+0x209/0x2f0 [ 59.545297][ T5315] ? __pfx_bch2_btree_ptr_v2_to_text+0x10/0x10 [ 59.547507][ T5315] btree_node_read_work+0x6dc/0x1380 [ 59.549477][ T5315] ? __pfx_btree_node_read_work+0x10/0x10 [ 59.551573][ T5315] ? bch2_latency_acct+0x47b/0x550 [ 59.553396][ T5315] ? __pfx_bch2_latency_acct+0x10/0x10 [ 59.555343][ T5315] ? bio_associate_blkg+0x6c/0x230 [ 59.557204][ T5315] bch2_btree_node_read+0x2433/0x29f0 [ 59.559158][ T5315] ? bch2_trans_unlock+0x35e/0x480 [ 59.561092][ T5315] ? __pfx_bch2_btree_node_read+0x10/0x10 [ 59.563096][ T5315] ? __pfx___bch2_btree_node_hash_insert+0x10/0x10 [ 59.565440][ T5315] ? bch2_trans_unlock+0x3b5/0x480 [ 59.567179][ T5315] bch2_btree_root_read+0x617/0x7a0 [ 59.569057][ T5315] ? __pfx_bch2_btree_root_read+0x10/0x10 [ 59.571134][ T5315] ? bch2_current_has_btree_trans+0x142/0x180 [ 59.573434][ T5315] read_btree_roots+0x3d3/0xa70 [ 59.575303][ T5315] ? __pfx_read_btree_roots+0x10/0x10 [ 59.577380][ T5315] ? journal_replay_entry_early+0x4d/0xb70 [ 59.579512][ T5315] ? bch2_sb_upgrade+0x1d0/0x250 [ 59.581360][ T5315] ? bch2_recovery_passes_from_stable+0x104/0x120 [ 59.583773][ T5315] bch2_fs_recovery+0x260f/0x3de0 [ 59.585802][ T5315] ? __pfx_bch2_fs_recovery+0x10/0x10 [ 59.587845][ T5315] ? __pfx_lock_release+0x10/0x10 [ 59.589814][ T5315] ? bch2_get_next_online_dev+0x2b/0x4f0 [ 59.591932][ T5315] ? __pfx_lock_release+0x10/0x10 [ 59.593886][ T5315] ? bch2_get_next_online_dev+0x2b/0x4f0 [ 59.596101][ T5315] ? bch2_get_next_online_dev+0x4b9/0x4f0 [ 59.598262][ T5315] ? bch2_get_next_online_dev+0x2b/0x4f0 [ 59.600360][ T5315] ? llist_reverse_order+0x72/0x90 [ 59.602259][ T5315] bch2_fs_start+0x37c/0x610 [ 59.604024][ T5315] bch2_fs_get_tree+0xd8d/0x1740 [ 59.605895][ T5315] ? __pfx_bch2_fs_get_tree+0x10/0x10 [ 59.607987][ T5315] ? generic_parse_monolithic+0x387/0x400 [ 59.610150][ T5315] ? rcu_is_watching+0x15/0xb0 [ 59.612029][ T5315] ? apparmor_capable+0x13b/0x1b0 [ 59.613990][ T5315] vfs_get_tree+0x90/0x2b0 [ 59.615671][ T5315] do_new_mount+0x2be/0xb40 [ 59.617434][ T5315] ? __pfx_do_new_mount+0x10/0x10 [ 59.619373][ T5315] __se_sys_mount+0x2d6/0x3c0 [ 59.621202][ T5315] ? __pfx___se_sys_mount+0x10/0x10 [ 59.623149][ T5315] ? do_syscall_64+0x100/0x230 [ 59.625027][ T5315] ? __x64_sys_mount+0x20/0xc0 [ 59.626850][ T5315] do_syscall_64+0xf3/0x230 [ 59.628573][ T5315] ? clear_bhb_loop+0x35/0x90 [ 59.630370][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.632666][ T5315] RIP: 0033:0x7fb35258e4ca [ 59.634336][ T5315] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 de 1a 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 59.641472][ T5315] RSP: 002b:00007fb353454e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 59.644891][ T5315] RAX: ffffffffffffffda RBX: 00007fb353454ef0 RCX: 00007fb35258e4ca [ 59.648550][ T5315] RDX: 00000000200000c0 RSI: 0000000020000180 RDI: 00007fb353454eb0 [ 59.651881][ T5315] RBP: 00000000200000c0 R08: 00007fb353454ef0 R09: 0000000000000000 [ 59.654936][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000020000180 [ 59.657947][ T5315] R13: 00007fb353454eb0 R14: 0000000000005975 R15: 0000000020000480 [ 59.661043][ T5315] [ 59.662460][ T5315] Kernel Offset: disabled [ 59.664122][ T5315] Rebooting in 86400 seconds..