last executing test programs: 2.515994958s ago: executing program 3 (id=1392): r0 = openat$wsmouse(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) preadv(r0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/98, 0x62}], 0x1, 0x5) ioctl$DIOCGETSTATES(0xffffffffffffffff, 0xc0104419, 0x0) access(0x0, 0x2) execve(0x0, 0x0, 0x0) ioctl$DIOCRGETADDRS(0xffffffffffffffff, 0xc4504446, 0x0) 2.250626055s ago: executing program 0 (id=1403): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() ioctl$TIOCSETA(r1, 0x802c7414, &(0x7f00000000c0)={0x5b0, 0xee6f, 0x7, 0x160350d, "cc14d30d2100caa26a364fa8a325850d1ec100", 0xa00001, 0x6}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) 1.658366828s ago: executing program 3 (id=1434): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x62}) r0 = syz_open_pts() close(r0) syz_open_pts() ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000080)={0xffff, 0xf, 0xffffdf81, 0xfdfffffd, "18e67be0911affffe255ce2f7006440004401e00", 0x2, 0x4432a253}) writev(r0, &(0x7f0000000300)=[{&(0x7f00000005c0)="62bab39b5019e45650c18a095a667f8cb9212084d4b8af4f31fac97bd35805db175cccc2961f76c14c19f0b5bda14d72ae9787801a3067e8ff5923165f6879976635c09cb8496b02d2a4ecc3b9100b2e6ede53e452b47259891a38f474fa5a0974cffb5ded63ea871fcc93813973231060fb179710c0689150ea8755663ee5df492962fea8f06976f0ba2267216c5e927cf70853df96a1ae5710e87777ed0d57bf6253a4664ae0a1eab65a7b8f32b383cafc85431145d92050c644b4f56e038a141d92e8cf0f905682ef0458adebb3ba2fe6b7dc1a", 0xd5}], 0x1) 1.433253251s ago: executing program 3 (id=1448): setsid() mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x40000802) r0 = open(&(0x7f0000000000)='./file0\x00', 0x100, 0xc2) ioctl$TIOCSCTTY(r0, 0x20007461) r1 = open(&(0x7f0000000040)='./file0\x00', 0x18289, 0x23) write(r1, &(0x7f00000004c0)="b96abcf5ac7cffa09ea845315c0d853a14", 0xffffff1c) 1.414714719s ago: executing program 0 (id=1451): setgid(0xffffffffffffffff) setgroups(0x0, 0x0) chmod(&(0x7f0000000080)='.\x00', 0x3db) setuid(0xffffffffffffffff) symlink(&(0x7f0000000900)='.\x00', &(0x7f0000000240)='./file0\x00') chdir(&(0x7f0000000000)='./file0\x00') 1.3416238s ago: executing program 5 (id=1453): r0 = open$dir(&(0x7f00000000c0)='./file0\x00', 0xf02, 0x186) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x12, r0, 0x0) ktrace(&(0x7f0000000080)='./file0\x00', 0x4, 0xd27d43220c7df9f, 0x0) sysctl$net_inet_icmp(&(0x7f0000000040)={0x4, 0x2, 0x1, 0x5}, 0x4, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$net_inet_carp(&(0x7f0000000040)={0x4, 0x2, 0x6, 0x4}, 0x4, 0x0, 0x0, &(0x7f00000010c0)="e50000b9", 0x4) 1.337285895s ago: executing program 0 (id=1454): setrlimit(0x8, &(0x7f0000000580)={0xa, 0x56}) r0 = syz_open_pts() close(r0) syz_open_pts() ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f00000000c0)={0x1e, 0x10001, 0xfffdff80, 0x160350d, "04f0ee091a0004be1fa614e0ff22700907ffdd00", 0x400, 0x7f}) writev(r0, &(0x7f0000002780)=[{&(0x7f0000000440)="cf35c1cc67189f94e3d78c9608394bd2394adaf385d5dd3eb04c115c56c3813f8d49730be2bcedfa4627e5e4b2e07d150327af66d701adb6823521b35bd0b7eb659f97f90825265098c86aef670a8b1168bf63ffeb80954876dbc2547393fbd5bb7d650ea4f818046f4e1951e9327eae7b1a594990d920cbe26fb93e21a77e1c21dfac58e10b543404d25ce3038e501344aa4185a36eb97eebbea2cdb350195ea9c7ab1e3463f9ed82e5f65d5948cb4ddd", 0xb1}], 0x1) 1.214837063s ago: executing program 5 (id=1461): msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000080)={{0x0, 0x0, 0x0, 0x0, 0x8, 0x20, 0x3ff, 0x0, 0x9}, 0x400, 0x9, 0x0, 0x0, 0x4004, 0x1, 0x0, 0xdf}) sysctl$kern(0x0, 0x0, &(0x7f0000000000)="71f9", 0x0, 0x0, 0x0) mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x33b9) r0 = open(&(0x7f0000000480)='./file0\x00', 0x10, 0x4ebfac6bbaf7900) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$VNDIOCCLR(r0, 0xc0a86b05, &(0x7f0000000000)={0x0, 0xa, 0x0}) 1.182169609s ago: executing program 5 (id=1464): mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xc0e99db6de761f86, 0x0) r0 = socket(0x18, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x2, r0) close(r1) open(&(0x7f0000000080)='./file0\x00', 0x18289, 0x190) dup2(r0, r1) 1.060382758s ago: executing program 2 (id=1470): r0 = open(&(0x7f00000000c0)='./file0\x00', 0x615, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x2, 0x11, r0, 0x0) r1 = socket(0x2, 0x8002, 0x0) r2 = fcntl$dupfd(r1, 0x2, 0xffffffffffffffff) closefrom(r2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x5012, 0xffffffffffffffff, 0x0) 1.017509265s ago: executing program 0 (id=1472): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) r0 = syz_open_pts() close(r0) syz_open_pts() ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f00000001c0)={0xa, 0x6, 0xffffdfc1, 0xffffffff, "25589519020000007fd8f90d6400ffffbfff6aa0", 0x3, 0x4}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) 840.175589ms ago: executing program 6 (id=1477): select(0x40, &(0x7f0000000000)={0xfffffffffffffffd, 0x0, 0x0, 0x564, 0x9ce8, 0x7, 0x0, 0xfffffffffffffffd}, 0x0, 0x0, 0x0) mknod(&(0x7f0000000100)='./bus\x00', 0x2000, 0xd02) r0 = open(&(0x7f0000000240)='./bus\x00', 0x2, 0x111) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) ioctl$VNDIOCSET(r0, 0xc0285108, &(0x7f0000000000)={0x0, 0xda, 0x0}) 826.42538ms ago: executing program 6 (id=1478): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x87, 0x7b, 0x5, 0x4a}, {0x40, 0xa, 0xff, 0x6}, {0x6, 0x6, 0x6, 0xfffff823}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x0, 0x0}) syz_emit_ethernet(0x36, &(0x7f00000001c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3d, 0x28, 0x6b, 0x0, 0x0, 0x6, 0x0, @empty, @local={0xac, 0x14, 0x0}}, @tcp={{0x3, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x8, 0x0, 0xfffc}}}}}}) 811.416179ms ago: executing program 6 (id=1480): mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x5900) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB="ff02"]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x2, 0x3, 0x1) connect$unix(r0, &(0x7f0000000000), 0x10) write(r0, &(0x7f00000000c0), 0x0) 798.027894ms ago: executing program 4 (id=1482): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f00000001c0), 0x40000, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x64, 0x6d, 0x5, 0x8}, {0xb1, 0xf0, 0x1, 0x900}, {0x6, 0x24, 0x0, 0x4}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x0, 0x0}) syz_emit_ethernet(0x1000e, &(0x7f0000000080)=ANY=[]) 794.437428ms ago: executing program 2 (id=1483): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1000, 0x0) r0 = openat$diskmap(0xffffffffffffff9c, &(0x7f0000000180), 0x8, 0x0) ioctl$DIOCMAP(r0, 0xc0106477, &(0x7f00000000c0)={&(0x7f0000000140)='./file0\x00', r0, 0x3}) ioctl$FIOASYNC(0xffffffffffffffff, 0x80047460, &(0x7f00000000c0)=0x4) setsockopt(0xffffffffffffffff, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13b9fd812eaa4e713048e69931929648", 0x14) execve(0x0, 0x0, 0x0) 780.047808ms ago: executing program 4 (id=1484): setuid(0xffffffffffffffff) openat$bpf(0xffffffffffffff9c, 0x0, 0x10000, 0x0) openat$bpf(0xffffffffffffff9c, 0x0, 0x40000, 0x0) ioctl$BIOCSETIF(0xffffffffffffffff, 0x8020426c, &(0x7f00000001c0)={'tap', 0x0}) r0 = socket(0x2, 0x1, 0x0) ioctl$FIONREAD(r0, 0x80206913, &(0x7f00000001c0)) 754.321369ms ago: executing program 4 (id=1485): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getsockopt$sock_cred(r0, 0xffff, 0x1022, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f00000001c0)=0xc) setresgid(r1, r1, 0x0) setgroups(0x0, 0x0) setuid(0xffffffffffffffff) unveil(&(0x7f00000000c0)='.\x00', &(0x7f0000000100)='r\x00') 738.696673ms ago: executing program 4 (id=1486): r0 = msgget$private(0x0, 0x1ba) msgsnd(r0, &(0x7f0000000140)=ANY=[@ANYRESOCT], 0x401, 0x0) msgsnd(r0, 0x0, 0x401, 0x0) msgrcv(r0, 0x0, 0x0, 0x3, 0x1000) execve(0x0, 0x0, 0x0) msgctl$IPC_RMID(r0, 0x0) 574.89298ms ago: executing program 7 (id=1491): mknod(&(0x7f0000000280)='./file0\x00', 0x2000, 0x1e5f) r0 = open(&(0x7f0000000080)='./file0\x00', 0x8000, 0xa) ioctl$VNDIOCSET(r0, 0x80184404, &(0x7f00000001c0)={0x0, 0x4, 0x0}) ioctl$VNDIOCSET(r0, 0x80044403, &(0x7f00000001c0)={0x0, 0xfffffffffffffffd, 0x0}) r1 = openat$wsmuxmouse(0xffffffffffffff9c, &(0x7f0000000080), 0x10000, 0x0) ioctl$DIOCRSETTFLAGS(r1, 0xc450444a, &(0x7f0000000140)={{'./file0\x00', './file0/file0\x00', 0x26, 0x3}, 0x0, 0x0, 0x0, 0x2, 0x4, 0x4, 0xdea3, 0x8, 0x9}) 550.52581ms ago: executing program 7 (id=1493): mknod(&(0x7f00000002c0)='./file0\x00', 0x2000, 0x5200) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$VMM_IOC_RESETCPU(0xffffffffffffff9c, 0x82405605, &(0x7f0000000480)={0x3, 0xb3f, {[0xfffffbfffffffffb, 0x0, 0x2, 0x100000000, 0x4, 0x0, 0xdf60, 0xfffffffffffffffe, 0x0, 0x2f01, 0xfffffffffffffffc, 0x3, 0xffffffffffffffff, 0x0, 0x0, 0x4, 0x2, 0x100], [0xfffffffffffffffe, 0x80000001, 0xfffffffffffffffd, 0x20000001, 0x5e, 0x7b98, 0x1fe, 0x0, 0x6], [0xc41, 0x2, 0x101, 0x0, 0xb, 0x11000, 0xffffffff00000000], [0x5, 0x1ffffffffff, 0x7ffffffffffffffc, 0x2, 0xfffffffffffffffe, 0xfffffffffffffffa], [{0x1, 0x4, 0x0, 0x7d06}, {0xfffc, 0x2, 0x5}, {0x4, 0x0, 0xfffffffe, 0x20000080}, {0x3, 0x5, 0x6, 0x2}, {0x0, 0x2000002, 0x3, 0x8}, {0x0, 0x401, 0x3, 0x1000}, {}, {0x2, 0x100, 0x31, 0x8}], {0x0, 0x5, 0x5}, {0xfffe, 0x80000000, 0x6d5, 0x1002}}}) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x138, 0x0, 0xffffffff, 0x0) kevent(r0, 0x0, 0x0, &(0x7f00000000c0), 0x6, 0x0) 508.731421ms ago: executing program 1 (id=1494): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f00000001c0), 0x40000, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f00000000c0)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x30, 0x6a, 0x5, 0x5}, {0xb1, 0xf0, 0x44, 0x900}, {0x6, 0x24, 0x82, 0x1004}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETF(r0, 0x80104267, &(0x7f0000000040)={0x0, 0x0}) syz_emit_ethernet(0x1000e, &(0x7f0000000080)=ANY=[]) 494.070831ms ago: executing program 6 (id=1495): r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x24, &(0x7f0000000180)="fd0cc085", 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000280)={0x1c, 0x18, 0x3, 0x8d, "fe80000400000000000000000000fdff"}, 0x1c) sendmsg(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000080)=@in={0x2}, 0xc, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1000000000000000000000000000000014"], 0x180}, 0xe) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x18}, 0xe) 479.163261ms ago: executing program 6 (id=1496): open(&(0x7f0000000380)='./file0\x00', 0x80000000000206, 0x4ebfac6bbaf79e5) r0 = open$dir(&(0x7f0000000000)='./file0\x00', 0x2, 0x0) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000000), 0x2cfea}], 0x1000000000000013) r1 = open(&(0x7f0000000040)='./file0\x00', 0x18289, 0x110) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) write(r1, &(0x7f00000004c0)="b96abcf5ac7cffa09ea845315c0d853a14", 0xffffff1c) 472.926566ms ago: executing program 2 (id=1497): r0 = socket(0x18, 0x2, 0x0) bind(r0, &(0x7f0000000000)=@in6={0x1c, 0x18, 0x0, 0x9, '\x00', 0x80000001}, 0x1c) setsockopt$sock_int(r0, 0xffff, 0x800, &(0x7f0000000040)=0x3, 0x4) syz_emit_ethernet(0x98, &(0x7f0000000000)={@broadcast, @random="94ea09066dbd", [], {@ipv6={0x86dd, {0x0, 0x6, "db8344", 0x8, 0x11, 0x0, @empty, @mcast2, {[], @udp={{0x0, 0x0, 0x8}}}}}}}) syz_emit_ethernet(0x138, &(0x7f0000000000)=ANY=[@ANYBLOB]) recvmmsg(r0, &(0x7f0000000300)={{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/6, 0x6}, 0x3ae}, 0x38, 0x1000, 0x0) 456.707717ms ago: executing program 2 (id=1498): ioctl$WSMUXIO_LIST_DEVICES(0xffffffffffffff9c, 0xc1045763, &(0x7f0000000040)={0x1, [{0x1, 0xfffffeff}, {0x3, 0x8}, {0x1, 0x2}, {0x1, 0xd}, {}, {0x0, 0x9}, {0x2, 0x1}, {}, {0x0, 0x400}, {0x1, 0x1}, {0x1, 0x10000000}, {0x0, 0x6}, {0x3, 0x2}, {0x3, 0x1}, {0x0, 0x20}, {0x3, 0x5}, {0x0, 0x1}, {0x3, 0x4}, {0x1, 0x1}, {}, {}, {0x2}, {0x0, 0xfffffc00}, {0x0, 0x9}, {0x0, 0x3}, {0x1, 0x800}, {0x1}, {0x1}, {0x2, 0xfffffffd}, {0x1, 0xe00e}, {0x3, 0x8001}, {0x1, 0x200060}]}) r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x10, 0x2, 0x3}, 0x10) listen(r0, 0x5) setsockopt(r0, 0x6, 0x4, &(0x7f0000000040)="d2674561", 0x4) syz_emit_ethernet(0x3a, &(0x7f0000000100)={@local, @empty, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x3d, 0x2c, 0x67, 0x0, 0x0, 0x6, 0x0, @multicast1, @local={0xac, 0x14, 0x0}}, @tcp={{0x3, 0x3, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x8200, 0x0, 0xfffc, {[@sack_perm={0x4, 0x2}]}}}}}}}) 447.881114ms ago: executing program 2 (id=1499): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x62}) r0 = syz_open_pts() close(r0) r1 = syz_open_pts() ioctl$TIOCSETD(r1, 0x8004741b, &(0x7f0000000180)=0x8) writev(r0, &(0x7f0000000080)=[{&(0x7f0000001cc0)="2712b7da3b145a4a6a893e94fd11e2fb2b2103545df3a8f522869c73adc0abab8a25c4a643c2a40dc9362c248fdb992ba4ee722bd0b38bdc3fc40eeedb75e2782081f339838cbaca1ea186a2cef092934842b8dcf0eece5ca0b0241f555945373cefce32065a7f8cf7abd3a7b550f43acc40ece00988c890c497704e03074176821c8889413d1ad90022935bac5559b1387ed7c2707f382231a10905849138872815c8ac97bd890ca11a3200291bd2b981ce52a5028e98f367fa9259cb14ca4135b149ee70b075e16b1e9900256a042dcd77946ec32486a4514d52f285799d36f86f9279de5b0a29ce3ef2a3c23b6e38f948688a4165e17cab617b4b30875662916887f154f9f879134e82ed0ce2b729f96c36e1fbd4b56261034be1bbd787e82ca41e9e03e87609866533ea3aaaf2f7c7e9629a42d6fa0cea5b331cd2e6a03eb68672176468586c637b81ae2d8f894aa43630953c35f07024d4d91335490524033bbf65a1ab121eb7bcac02908f40626d90901fc4dc9ab01080cb09dea5a63210d66bf7fcbd1a7827c6528e7c345c26f4652fe8e781b991385d187e9abf4663c64094df441da79a28623eb1dbf1bfea187f3340704aa5dd765d613dae015ad05014d241d0986477900175053c16f0ad7ba9f0b55bef7640331350efd9d5163963928f15e720f44aa4f1a40aed6414a5d9b5a649bd1d017beb8bda772407a9efd54f415b7c944b52fcfc900fddf7eb43acf915d36c6c9ef210f5caa0938ddf4731843692eacccaa17da45adc1f9588ac29e19478e76383e5fab6b1fd1cc1c97e480200bf423965c5b282b25e56918b71064effa0c3e645fd24d226f12ffdf3b05d5c106ca9965bf96368d62417453045078f1c5949a034a5532f59c33b3bcb883137d4e268ea64e73ca45ae578d14a2182023baa87995a3c36b42e03", 0x29c}], 0x1) 444.822482ms ago: executing program 1 (id=1500): r0 = openat$bpf(0xffffffffffffff9c, &(0x7f0000000100), 0xbe, 0x0) ioctl$BIOCSETIF(r0, 0x8020426c, &(0x7f0000000080)={'tap', 0x0}) ioctl$BIOCSETF(0xffffffffffffffff, 0x80104267, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x44, 0x12, 0x5, 0x1}, {0x48, 0xf0, 0x3, 0x900}, {0x6, 0x24, 0x0, 0xfffff802}]}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$BIOCSETWF(r0, 0x80104277, &(0x7f0000000040)={0x28, 0x0}) write(r0, &(0x7f0000000180)="460cf2c05e3e45fc20107b65d551", 0xe) 388.683183ms ago: executing program 3 (id=1501): ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0x0, 0x0, {0x0, 0x2}}) sysctl$net_inet_tcp(0x0, 0x0, &(0x7f00000000c0)="9b18", 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r0 = socket(0x18, 0x3, 0x0) setsockopt(r0, 0x1000000029, 0x2e, &(0x7f0000000000)="ebffcbff13bbfd812eaa4e713048e69931929648", 0x14) connect$unix(r0, &(0x7f00000000c0)=@abs={0x0, 0x7}, 0x1c) 368.761651ms ago: executing program 3 (id=1502): r0 = socket$inet6(0x18, 0x1, 0x6) r1 = socket$inet6(0x18, 0x1, 0x6) bind$inet6(r1, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x8, "fffffff9000000000000000000000001", 0x7}, 0x1c) connect$inet6(r1, &(0x7f0000000280)={0x1c, 0x18, 0x3, 0x7ff, "000000000000000000000000018000", 0xc}, 0x1c) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) bind$inet6(r0, &(0x7f0000000040)={0x1c, 0x18, 0x1, 0x4, "ffffffffffff00000000000000000001", 0x7}, 0x1c) 366.149392ms ago: executing program 4 (id=1503): setrlimit(0x8, &(0x7f0000000580)={0xa, 0x56}) r0 = syz_open_pts() close(r0) syz_open_pts() ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000000)={0x2, 0x8, 0xffffdf82, 0xffffffd0, "08955c1cfac164e20a070e00000009ffe6000800", 0x4000000, 0x8}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) 363.356162ms ago: executing program 7 (id=1504): ioctl$WSMOUSEIO_SCALIBCOORDS(0xffffffffffffffff, 0x81205724, &(0x7f0000000100)={0x9, 0xb, 0x4, 0x101, 0x4, 0x1001, 0x3, 0x10, [{0x5, 0xfe3, 0xffffff26, 0x71800}, {0x1, 0x10037fe, 0x800002, 0x7}, {0x100006, 0x0, 0x8, 0x3}, {0x2, 0x0, 0x200, 0xfffffffe}, {0x4, 0x3, 0x80000000, 0x7}, {0x5, 0x47fff, 0x14000009, 0xc}, {0x8, 0xbffffff5, 0x7, 0x6d}, {0x2000a, 0x7, 0xfdf0, 0x6}, {0x0, 0x40007, 0x8ceb}, {0xfffffc07, 0xffffffff, 0x401, 0x1}, {0xa44f, 0xfff9, 0xa38c000}, {0x4, 0x6, 0x8, 0x8}, {0x2000df, 0x9, 0x5, 0x4}, {0x10008, 0x20000e2, 0xfffffff5, 0xfffffff8}, {0x5, 0x40000005, 0x24, 0x51d}, {0x81, 0xd654, 0x0, 0x6}]}) ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r0 = socket(0x18, 0x3, 0x0) ioctl$FIONREAD(r0, 0xc0106924, &(0x7f00000001c0)) sendmsg$unix(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x8) ioctl$FIONREAD(r0, 0x8080691a, &(0x7f0000000100)) 347.409981ms ago: executing program 3 (id=1505): ioctl$VMM_IOC_RESETCPU(0xffffffffffffffff, 0x82405605, &(0x7f0000000100)={0x1, 0x0, {[0xfffefbfffffffffa, 0x1, 0x2, 0x1, 0xfffffffffffffffe, 0x0, 0xdf5a, 0xffffffffffffffff, 0x0, 0x2eff, 0x5, 0x3, 0xffffffffffffffff, 0x0, 0x8000000, 0xa8, 0x100000001, 0xce7], [0xfffffffffffffffe, 0x2, 0xfffffffffffffffa, 0x8000ffffffff, 0x100, 0x7b99, 0x1fe, 0xb, 0x1, 0x8], [0x100000001, 0xfffffffffffffffe, 0x40000000, 0x6, 0xffffffffffffffff, 0x4, 0xfffffffffffffffe], [0x100, 0x20000000000, 0x401, 0x100000000, 0xffffffffffefffff, 0x6], [{0x8, 0x5, 0x0, 0x8}, {0xfffc, 0x7, 0x5}, {0x10, 0x2001, 0x5bea, 0x814}, {0xf801, 0x5, 0x7, 0x8000000c}, {0x10, 0x2, 0x4, 0x808}, {0x400b, 0x40, 0x40000, 0x4}, {0xa, 0x20000, 0x4, 0x8}, {0x0, 0x965, 0x3, 0x4}], {0x2000, 0x8, 0x10000}, {0x0, 0x0, 0x3, 0x2}}}) r0 = kqueue() kevent(r0, &(0x7f00000000c0), 0x8, 0x0, 0x15, 0x0) r1 = kqueue() kevent(r1, &(0x7f00000000c0), 0x138, 0x0, 0xffffffff, 0x0) close(r0) 249.72682ms ago: executing program 6 (id=1506): setrlimit(0x1, &(0x7f0000000000)={0xfffffffffffffffd, 0xffffffffffffffff}) r0 = open(&(0x7f0000000080)='./file1\x00', 0x18289, 0x1f0) write(r0, &(0x7f00000004c0)="b96abcf5ac7cffa09ea845315c0d853a14", 0xffffff1c) fchmod(r0, 0x1a3) close(r0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) 249.237703ms ago: executing program 5 (id=1507): setrlimit(0x8, &(0x7f0000000140)={0xa, 0x5a}) r0 = syz_open_pts() close(r0) syz_open_pts() ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000000)={0x541ed90d, 0x20007, 0xffffd781, 0xffffffd0, "08e2fac464e20a070efb5c0009ffe600004dbb00", 0xfffffffd, 0x5}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)="00bce88b2920d6cff35f6889c21088d4018c76bc59e5d516f6c7290b9e636b806ec3614e699f00", 0x27}], 0x1) 247.161046ms ago: executing program 0 (id=1508): setsid() mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x40000802) r0 = open(&(0x7f0000000000)='./file0\x00', 0x100, 0xc2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x3, 0x9010, 0xffffffffffffffff, 0x0) ioctl$TIOCSCTTY(r0, 0x20007461) ioctl$FIOSETOWN(r0, 0x8004667c, &(0x7f0000000400)=0x80000001) 246.810732ms ago: executing program 7 (id=1509): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f00000000c0)=@file={0xe, 0x1, './file0\x00'}, 0xa) chmod(&(0x7f0000000180)='./file0\x00', 0x23f) setuid(0xee01) r1 = socket$unix(0x1, 0x5, 0x0) connect$unix(r1, &(0x7f0000000080)=@file={0x5, 0x1, './file0\x00'}, 0xa) 222.832702ms ago: executing program 7 (id=1510): setgid(0xffffffffffffffff) mknod(&(0x7f0000000280)='./file0\x00', 0x1ffa, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x2, 0x80) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r1, 0xffff, 0x1022, &(0x7f00000001c0), &(0x7f0000000280)=0xc) ioctl$FIONREAD(r0, 0xc0106978, &(0x7f00000001c0)) 217.940958ms ago: executing program 2 (id=1511): readv(0xffffffffffffffff, &(0x7f0000000a40)=[{0x0, 0xfffffe88}, {&(0x7f0000000600)=""/251, 0xfb}], 0x10000000000001e3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r1, &(0x7f0000000880)={{0x0, 0x0, 0x0, 0x0, 0x0}}, 0x38, 0x2042, 0x0) write(r0, &(0x7f00000000c0)="d9781e", 0x3) close(r1) execve(0x0, 0x0, 0x0) 213.091165ms ago: executing program 7 (id=1512): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) r0 = syz_open_pts() close(r0) syz_open_pts() ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f0000000240)={0x5f0, 0xee6f, 0x69ce23c5, 0x7, "cc14d30d2100850d00", 0xa00001, 0x4000009}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) 170.287622ms ago: executing program 1 (id=1513): ioctl$WSMUXIO_REMOVE_DEVICE(0xffffffffffffffff, 0x80085762, &(0x7f0000000040)={0x1}) r0 = socket(0x18, 0xc003, 0x3a) setsockopt(r0, 0x29, 0x6c, &(0x7f0000000040), 0x4) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0x66, &(0x7f00000003c0)={0x3, 0x0, 0x10, 0x1}, 0xc) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0x66, &(0x7f00000003c0)={0x0, 0x1, 0x10, 0x3}, 0xc) setsockopt$inet6_MRT6_ADD_MFC(r0, 0x29, 0x68, &(0x7f0000000140)={{0x1c, 0x18, 0x1, 0x6, "5bde75dd5819802560e83b1654cb44b3", 0x4}, {0x1c, 0x18, 0x0, 0x6, "8369a7fcb416ba26374fe42253619c3f", 0x7}, 0x3, [0x9d5ef3f, 0x3, 0x1, 0x19a1, 0x3, 0x8000, 0x4, 0x6f06]}, 0x5c) 169.90372ms ago: executing program 1 (id=1514): r0 = open$dir(&(0x7f0000000000)='./file0\x00', 0xf02, 0x1c6) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000080)="abe81325ed2aa20ff97536a5914a8d8d0e984b07cb305f8c4772274282b3cbd47699a74356f90c901beb0842b903f842c5499642008f017323950a51ff6d4a7e0f14c3c02370e41581d70a313b2a3180084f5cc4836a301926d7fca5a2a68259993bbb473a4af1cbd1259ac99918613262ba85c588a1234a7a021c15a947165053", 0x81}], 0x1) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x2, 0x2011, r0, 0x0) sysctl$hw(&(0x7f0000000000)={0x6, 0x1d}, 0x2, 0x0, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) sysctl$ddb(&(0x7f0000000000)={0x9, 0x5}, 0x2, 0x0, 0x0, &(0x7f0000001080), 0x4) 157.592402ms ago: executing program 1 (id=1515): ioctl$BIOCSETWF(0xffffffffffffffff, 0x80104277, &(0x7f00000001c0)={0x48, &(0x7f0000000100)}) r0 = socket(0x18, 0x3, 0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x2) ioctl$FIONREAD(r0, 0xc0106924, &(0x7f00000001c0)) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) ioctl$FIONREAD(r0, 0x81206919, &(0x7f0000000100)) 144.397273ms ago: executing program 1 (id=1516): setrlimit(0x8, &(0x7f0000000980)={0x42, 0x65}) r0 = syz_open_pts() close(r0) syz_open_pts() ioctl$TIOCSETA(r0, 0x802c7414, &(0x7f00000001c0)={0xa, 0x9, 0xffffdfc1, 0xffffff88, "25589519000403007fd8f90d6400ffffbfff6aa0", 0x3, 0x4}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000080)='\x00', 0xffaa}], 0x1) 112.298685ms ago: executing program 0 (id=1517): mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) mknod(&(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x0) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2000, 0x1) link(&(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000007c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') rename(&(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000480)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') rename(&(0x7f00000006c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') 93.017059ms ago: executing program 5 (id=1518): close(0xffffffffffffffff) ioctl$DRM_IOCTL_MODE_CURSOR2(0xffffffffffffffff, 0xc02464bb, &(0x7f0000000080)={0x3, 0x7, 0x0, 0x173, 0x800, 0x4, 0x0, 0x5, 0x3}) mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x6381) open(&(0x7f0000000140)='./file0\x00', 0x10686, 0x8) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) poll(&(0x7f0000000000)=[{}], 0x20000000000000fe, 0x0) 54.202077ms ago: executing program 4 (id=1519): mknod(&(0x7f0000000000)='./file0\x00', 0x2000, 0x44000802) r0 = openat$vnd(0xffffffffffffff9c, &(0x7f0000000040), 0x40, 0x0) ioctl$VNDIOCSET(r0, 0xc0384600, &(0x7f0000000140)={&(0x7f0000000180)='./file0\x00', 0x567, 0x0}) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f00000000c0)=@file={0xe, 0x1, './file0\x00'}, 0xa) listen(r1, 0x1) 0s ago: executing program 5 (id=1520): mknod(&(0x7f0000000180)='./bus\x00', 0x2000, 0xd01) ioctl$VMM_IOC_CREATE(0xffffffffffffffff, 0xc5005601, &(0x7f0000000000)={0x10, 0x0, [{&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000663000/0x4000)=nil, 0xfffffffffffff801}, {&(0x7f00006ac000/0x4000)=nil, 0x0, 0x3}, {&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil}, {0x0, &(0x7f0000b1b000/0x2000)=nil}, {&(0x7f000067c000/0x10000)=nil, &(0x7f0000ffb000/0x1000)=nil}, {&(0x7f0000088000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil}, {0x0, 0x0, 0x80000000}, {&(0x7f0000727000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil}, {&(0x7f0000ad4000/0x2000)=nil, &(0x7f0000826000/0x1000)=nil}, {&(0x7f0000110000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil}, {0x0, &(0x7f000065d000/0x2000)=nil, 0xdc9}, {&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0xfffffffffffffffc}, {0x0, &(0x7f0000ffd000/0x3000)=nil}, {&(0x7f00004c1000/0x2000)=nil}, {&(0x7f00001cf000/0x4000)=nil}, {&(0x7f0000355000/0x13000)=nil, &(0x7f0000358000/0x2000)=nil, 0x80}], './file0\x00', 0x7, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1135, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc87, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0xfffffffc, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0xfe7d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff]}) r0 = open(&(0x7f0000000240)='./bus\x00', 0x2, 0x111) ioctl$WSMUXIO_INJECTEVENT(0xffffffffffffffff, 0x80185760, &(0x7f0000000000)={0xffffffff, 0xb, {0x0, 0x1}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$VNDIOCSET(r0, 0x84946467, &(0x7f0000000000)={0x0, 0xffffffffffffffba, 0x0}) kernel console output (not intermixed with test programs): kern.securelevel: 0 -> 1 creating runtime link editor directory cache. preserving editor files. starting network daemons: sshd. starting local daemons:. Sun May 31 00:05:53 PDT 2026 OpenBSD/amd64 (ci-openbsd-main-5.us-central1-c.c.syzkaller.internal) (tty00) Warning: Permanently added '10.128.1.5' (ED25519) to the list of known hosts. login: ¹j¼õ¬|ÿ ž¨E1\…:pckbd_enable: command error pckbd_enable: command error OpenBSD/amd64 (ci-openbsd-main-5.us-central1-c.c.syzkaller.internal) (tty00) login: sd0(vioscsi0:1:0): Check Condition (error 0x70) on opcode 0x1e SENSE KEY: Illegal Request ASC/ASCQ: Invalid Command Operation Code OpenBSD/amd64 (ci-openbsd-main-5.us-central1-c.c.syzkaller.internal) (tty00) login: pckbd_enable: command error Connection to 10.128.1.5 closed by remote host.                cP${×âðàV)»ÏÇRktrace write failed, errno 27, tracing stopped OpenBSD/amd64 (ci-openbsd-main-5.us-central1-c.c.syzkaller.internal) (tty00) login: ktrace write failed, errno 27, tracing stopped ktrace write failed, errno 27, tracing stopped ktrace write failed, errno 27, tracing stopped uvm_fault(0xffffffff83a32b18, 0xffff8000296b2004, 0, 1) -> d kernel: page fault trap, code=0 Stopped at ufs_readdir+0x26e: movzwl 0x4(%r14),%ebx TID PID UID PRFLAGS PFLAGS CPU COMMAND * 11005 15662 0 0x2 0 0 syz-executor ufs_readdir(ffff80002a82b3d0) at ufs_readdir+0x26e VOP_READDIR(fffffd80702671c8,ffff80002a82b458,fffffd8007ffda28,ffff80002a82b49c) at VOP_READDIR+0x125 sys_getdents(ffff80002a736538,ffff80002a82b5e0,ffff80002a82b530) at sys_getdents+0x2dd syscall(ffff80002a82b5e0) at syscall+0x962 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7ad0ba03cb50, count: 10 https://www.openbsd.org/ddb.html describes the minimum info required in bug reports. Insufficient info makes it difficult to find and fix bugs. ddb> ddb> set $lines = 0 ddb> set $maxwidth = 0 ddb> show panic *cpu0: uvm_fault(0xffffffff83a32b18, 0xffff8000296b2004, 0, 1) -> d ddb> trace ufs_readdir(ffff80002a82b3d0) at ufs_readdir+0x26e VOP_READDIR(fffffd80702671c8,ffff80002a82b458,fffffd8007ffda28,ffff80002a82b49c) at VOP_READDIR+0x125 sys_getdents(ffff80002a736538,ffff80002a82b5e0,ffff80002a82b530) at sys_getdents+0x2dd syscall(ffff80002a82b5e0) at syscall+0x962 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7ad0ba03cb50, count: -5 ddb> show registers rdi 0x200 rsi 0x800 rbp 0xffff80002a82b3c0 rbx 0x200 rdx 0 rcx 0xfffffd806dd61590 rax 0xffff8000296b2200 r8 0xffffffffffffffff r9 0x3 r10 0xfce38a6b33774638 r11 0x8b6d3aaddaabf7c7 r12 0 r13 0xffff80002a82b458 r14 0xffff8000296b2000 r15 0xffff8000296b2008 rip 0xffffffff8293174e ufs_readdir+0x26e cs 0x8 rflags 0x10283 __ALIGN_SIZE+0xf283 rsp 0xffff80002a82b210 ss 0x10 ufs_readdir+0x26e: movzwl 0x4(%r14),%ebx ddb> show proc PROC (syz-executor) tid=11005 pid=15662 tcnt=1 stat=onproc flags process=2 proc=0 runpri=50, usrpri=50, slppri=32, nice=20 wchan=0x0, wmesg=, ps_single=0x0 scnt=0 ecnt=0 forw=0xffffffffffffffff, list=0xffff80002a767c98,0xffff80002a736a78 process=0xffff80002a79df90 user=0xffff80002a826000, vmspace=0xfffffd806f9fc738 estcpu=36, cpticks=12, pctcpu=0.0, user=2, sys=9, intr=0 ddb> ps PID TID PPID UID S FLAGS WAIT COMMAND 50818 471633 44774 0 2 0 syz-executor 50818 41269 44774 0 3 0x4000080 fsleep syz-executor 54828 389314 50730 0 3 0x80 nanoslp syz-executor 54828 450605 50730 0 3 0x4000080 ttyin syz-executor 54828 15018 50730 0 3 0x4000000 inode syz-executor 54828 72454 50730 0 3 0x4000080 fsleep syz-executor 53013 485976 60874 0 2 0 syz-executor 53013 95463 60874 0 3 0x4000080 fsleep syz-executor 86852 216170 65165 0 2 0 syz-executor 86852 447597 65165 0 3 0x4000080 fsleep syz-executor 25298 207805 15621 0 3 0x80 nanoslp syz-executor 25298 211782 15621 0 3 0x4000080 ttyout syz-executor 36158 519196 83519 0 2 0 syz-executor 36158 193100 83519 0 3 0x4000080 sbwait syz-executor 68792 334784 98018 0 2 0 syz-executor 68792 439025 98018 0 3 0x4000080 fsleep syz-executor 68792 47439 98018 0 3 0x4000080 fsleep syz-executor 88503 105129 1 0 3 0x100083 ttyin getty 15621 98403 11240 0 3 0x82 nanoslp syz-executor 98018 108597 11240 0 3 0x82 nanoslp syz-executor 44774 272999 11240 0 3 0x82 nanoslp syz-executor 50730 462463 11240 0 3 0x82 nanoslp syz-executor *15662 11005 11240 0 7 0x2 syz-executor 83519 40275 11240 0 3 0x82 nanoslp syz-executor 65165 360655 11240 0 3 0x82 nanoslp syz-executor 60874 102585 11240 0 3 0x82 nanoslp syz-executor 11240 254111 1 0 2 0x2 syz-executor 29930 267581 0 0 3 0x14200 bored smr 657 205696 0 0 2 0x14200 zerothread 37059 213109 0 0 3 0x14200 aiodoned aiodoned 6616 24580 0 0 3 0x14200 syncer update 46529 496396 0 0 3 0x14200 cleaner cleaner 79430 1603 0 0 3 0x14200 reaper reaper 69071 462632 0 0 3 0x14200 pgdaemon pagedaemon 86066 17939 0 0 3 0x14200 bored viomb 54904 193628 0 0 3 0x40014200 acpi0 acpi0 75161 56089 0 0 2 0x14200 softnet0 35057 129418 0 0 3 0x14200 bored systqmp 61368 127381 0 0 3 0x14200 bored systq 45971 69076 0 0 3 0x40014200 tmoslp softclock 72846 97736 0 0 3 0x40014200 idle0 1 349746 0 0 3 0x80082 wait init 0 0 -1 0 3 0x10200 scheduler swapper ddb> show all locks No such command ddb> show malloc Type InUse MemUse HighUse Limit Requests Type Lim devbuf 11032 12099K 12430K 166960K 12911 0 pcb 17 12K 12K 166960K 150 0 rtable 162 4K 7K 166960K 486 0 pf 36 14K 21K 166960K 150 0 ifaddr 32 5K 7K 166960K 78 0 ifgroup 49 2K 2K 166960K 130 0 sysctl 1 1K 9K 166960K 5 0 counters 32 17K 18K 166960K 56 0 ioctlops 0 0K 4K 166960K 166 0 iov 1 4K 16K 166960K 26 0 mount 1 1K 1K 166960K 1 0 log 0 0K 0K 166960K 4 0 vnodes 1289 81K 81K 166960K 1994 0 UFS quota 1 32K 32K 166960K 1 0 UFS mount 5 36K 36K 166960K 5 0 shm 2 20K 24K 166960K 11 0 VM map 2 1K 1K 166960K 2 0 sem 13 2K 3K 166960K 24 0 dirhash 12 2K 2K 166960K 36 0 ACPI 1692 195K 286K 166960K 12470 0 file desc 16 61K 97K 166960K 1650 0 sigio 0 0K 0K 166960K 17 0 proc 21 25K 124K 166960K 605 0 subproc 72 4K 4K 166960K 72 0 NFS srvsock 1 0K 0K 166960K 1 0 NFS daemon 1 16K 16K 166960K 1 0 ip_moptions 0 0K 0K 166960K 80 0 in_multi 61 4K 7K 166960K 152 0 ether_multi 1 0K 0K 166960K 15 0 mrt 2 0K 0K 166960K 38 0 ISOFS mount 1 32K 32K 166960K 1 0 MSDOSFS mount 1 16K 16K 166960K 1 0 ttys 91 413K 413K 166960K 91 0 exec 0 0K 1K 166960K 440 0 fusefs mount 1 32K 32K 166960K 1 0 pfkey data 0 0K 0K 166960K 1 0 tdb 3 0K 0K 166960K 3 0 VM swap 8 62K 64K 166960K 10 0 UVM amap 136 82K 148K 166960K 14948 0 UVM aobj 8 2K 2K 166960K 10 0 pinsyscall 19 38K 96K 166960K 2762 0 memdesc 1 4K 4K 166960K 1 0 crypto data 1 1K 1K 166960K 1 0 ip6_options 0 0K 0K 166960K 38 0 NDP 10 0K 2K 166960K 51 0 temp 61 9113K 9176K 166960K 42167 0 kqueue 1 2K 28K 166960K 231 0 SYN cache 2 16K 16K 166960K 2 0 ddb> show all pools Name Size Requests Fail Releases Pgreq Pgrel Npage Hiwat Minpg Maxpg Idle rtpcb 120 60 0 60 1 0 1 1 0 8 1 rtentry 136 158 0 89 4 0 4 4 0 8 0 unpcb 144 332 0 329 1 0 1 1 0 8 0 syncache 336 12 0 12 1 0 1 1 0 8 1 tcpcb 736 173 0 172 1 0 1 1 0 8 0 arp 96 35 0 19 1 0 1 1 0 8 0 ipq 40 4 0 0 1 0 1 1 0 8 0 ipqe 40 7 0 3 1 0 1 1 0 8 0 inpcb 328 522 0 519 2 0 2 2 0 8 1 ip6q 72 6 0 1 1 0 1 1 0 8 0 ip6af 40 9 0 2 1 0 1 1 0 8 0 nd6 112 29 0 15 1 0 1 1 0 8 0 pkpcb 40 5 0 5 1 0 1 1 0 8 1 kcovpl 48 8 0 0 1 0 1 1 0 8 0 ppxss 1072 12 0 12 1 0 1 1 0 8 1 pfstscr 40 39 0 30 1 0 1 1 0 8 0 pffrag 232 1 0 0 1 0 1 1 0 482 0 pffrnode 88 1 0 0 1 0 1 1 0 8 0 pffrent 40 1 0 0 1 0 1 1 0 8 0 pfrktable 1344 2 0 2 1 0 1 1 0 8 1 pfsrclim 320 1 0 1 1 0 1 1 0 8 1 pfanchor 1288 5 0 0 1 0 1 1 0 8 0 pftag 88 5 0 0 1 0 1 1 0 8 0 pfstitem 24 16 0 3 1 0 1 1 0 8 0 pfstkey 128 44 0 30 1 0 1 1 0 8 0 pfstate 384 23 0 16 1 0 1 1 0 8 0 pfrule 1360 19 0 19 1 0 1 1 0 8 1 rttmr 136 4 0 4 1 0 1 1 0 8 1 art_heap8 4096 1 0 0 1 0 1 1 0 8 0 art_heap4 256 746 0 429 29 0 29 29 0 8 6 art_table 40 747 0 429 5 0 5 5 0 8 0 art_node 32 158 0 97 1 0 1 1 0 8 0 sysvmsgpl 40 21 0 6 1 0 1 1 0 8 0 semupl 112 3 0 3 1 0 1 1 0 8 1 semapl 72 18 0 7 1 0 1 1 0 8 0 shmpl 112 7 0 2 1 0 1 1 0 8 0 dirhash 1024 33 0 16 3 0 3 3 0 8 0 dino2pl 256 3937 0 2483 92 0 92 92 0 8 0 ffsino 256 3937 0 2483 92 0 92 92 0 8 0 nchpl 144 5844 0 4150 64 0 64 64 0 8 0 vnodes 216 4310 0 0 240 0 240 240 0 8 0 namei 1024 15245 0 15244 2 0 2 2 0 8 1 acpiwqpl 32 1 0 1 1 0 1 1 1 8 1 kstatmem 264 69 0 48 2 0 2 2 0 8 0 scsiplug 72 11 0 11 1 0 1 1 0 8 1 scxspl 216 21067 0 21067 8 0 8 8 1 8 8 plimitpl 152 117 0 104 1 0 1 1 0 8 0 sigapl 424 1948 0 1916 6 0 6 6 0 8 2 knotepl 120 64604 0 64587 33 23 10 22 0 8 8 kqueuepl 184 221 0 220 1 0 1 1 0 8 0 pipepl 304 143 0 116 3 0 3 3 0 8 0 fdescpl 448 1935 0 1916 5 0 5 5 0 8 1 filepl 120 5475 0 5315 7 0 7 7 0 8 0 lockfpl 104 367 0 367 1 0 1 1 0 8 1 lockfspl 48 140 0 140 1 0 1 1 0 8 1 sessionpl 144 61 0 58 1 0 1 1 0 8 0 pgrppl 48 73 0 62 1 0 1 1 0 8 0 ucredpl 104 1043 0 1039 1 0 1 1 0 8 0 zombiepl 144 1916 0 1916 1 0 1 1 0 8 1 processpl 1152 1948 0 1916 4 0 4 4 0 8 0 procpl 664 3662 0 3620 6 0 6 6 0 8 2 sockpl 552 931 0 925 3 0 3 3 0 8 2 mcl64k 65536 547 0 545 1 0 1 1 0 8 0 mcl16k 16384 386 0 385 1 0 1 1 0 8 0 mcl12k 12288 285 0 285 1 0 1 1 0 8 1 mcl9k128 9344 124 0 124 1 0 1 1 0 8 1 mcl8k 8192 299 0 298 1 0 1 1 0 8 0 mcl4k 4096 5629 0 5577 15 0 15 15 0 8 8 mcl2k2 2112 2 0 2 1 0 1 1 0 8 1 mcl2k 2048 429 0 425 2 0 2 2 0 8 1 mtagpl 96 6 0 5 1 0 1 1 0 8 0 mbufpl 256 22711 0 22494 21 0 21 21 0 8 5 bufpl 280 6353 0 137 445 0 445 445 0 8 0 anonpl 24 232072 0 230007 46 0 46 46 0 186 24 amapchunkpl 152 51486 0 51123 29 0 29 29 0 158 14 amappl16 200 3647 0 3585 16 1 15 15 0 8 11 amappl15 192 6 0 6 1 0 1 1 0 8 1 amappl14 184 409 0 409 1 0 1 1 0 8 1 amappl13 176 136 0 135 1 0 1 1 0 8 0 amappl12 168 2180 0 2162 2 0 2 2 0 8 0 amappl11 160 60 0 60 1 0 1 1 0 8 1 amappl10 152 57 0 57 1 0 1 1 0 8 1 amappl9 144 341 0 341 1 0 1 1 0 8 1 amappl8 136 98 0 98 1 0 1 1 0 8 1 amappl7 128 146 0 144 1 0 1 1 0 8 0 amappl6 120 156 0 156 1 0 1 1 0 8 1 amappl5 112 108 0 108 1 0 1 1 0 8 1 amappl4 104 280 0 278 1 0 1 1 0 8 0 amappl3 96 11061 0 10980 4 0 4 4 0 8 1 amappl2 88 529 0 522 2 0 2 2 0 8 0 amappl1 80 16544 0 16422 14 0 14 14 0 8 5 amappl 88 14169 0 14047 5 0 5 5 0 92 0 uvmvnodes 80 147 0 0 3 0 3 3 0 8 0 dma65536 65536 1 0 1 1 0 1 1 0 8 1 dma32768 32768 1 0 1 1 0 1 1 0 8 1 dma8192 8192 1 0 1 1 0 1 1 0 8 1 dma4096 4096 1 0 1 1 0 1 1 0 8 1 dma2048 2048 5 0 5 1 0 1 1 0 8 1 dma1024 1024 1 0 0 1 0 1 1 0 8 0 dma256 256 6 0 6 1 0 1 1 0 8 1 dma128 128 259 0 259 1 0 1 1 0 8 1 dma64 64 6 0 6 1 0 1 1 0 8 1 dma32 32 8 0 8 1 0 1 1 0 8 1 dma16 16 21 0 20 1 0 1 1 0 8 0 aobjpl 72 9 0 2 1 0 1 1 0 8 0 uaddrrnd 24 1935 0 1916 1 0 1 1 0 8 0 uaddrbest 32 2 0 0 1 0 1 1 0 8 0 uaddr 24 1935 0 1916 1 0 1 1 0 8 0 vmmpekpl 168 14453 0 14423 2 0 2 2 0 8 0 vmmpepl 168 121605 0 120711 87 0 87 87 0 357 39 vmsppl 368 1934 0 1916 4 0 4 4 0 8 1 rwobjpl 40 29574 0 29064 12 0 12 12 0 8 0 pdppl 4096 3876 0 3832 98 52 46 82 0 8 2 pvpl 32 820626 0 814616 118 0 118 118 0 265 63 pmappl 216 1934 0 1916 3 0 3 3 0 8 0 extentpl 40 45 0 27 1 0 1 1 0 8 0 phpool 112 377 0 52 10 0 10 10 0 8 0 ddb> machine ddbcpu 0 No such command ddb> trace ufs_readdir(ffff80002a82b3d0) at ufs_readdir+0x26e VOP_READDIR(fffffd80702671c8,ffff80002a82b458,fffffd8007ffda28,ffff80002a82b49c) at VOP_READDIR+0x125 sys_getdents(ffff80002a736538,ffff80002a82b5e0,ffff80002a82b530) at sys_getdents+0x2dd syscall(ffff80002a82b5e0) at syscall+0x962 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7ad0ba03cb50, count: -5 ddb> machine ddbcpu 1 No such command ddb> trace ufs_readdir(ffff80002a82b3d0) at ufs_readdir+0x26e VOP_READDIR(fffffd80702671c8,ffff80002a82b458,fffffd8007ffda28,ffff80002a82b49c) at VOP_READDIR+0x125 sys_getdents(ffff80002a736538,ffff80002a82b5e0,ffff80002a82b530) at sys_getdents+0x2dd syscall(ffff80002a82b5e0) at syscall+0x962 Xsyscall() at Xsyscall+0x128 end of kernel end trace frame: 0x7ad0ba03cb50, count: -5 ddb>